{ "Event": { "published": true, "date": "2023-07-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-07-10", "timestamp": 1689033782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "3ec0ec52-428c-44fc-b6b1-38c20a9e77c3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de0075f-1f60-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689020951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020951, "uuid": "e95386fd-ef36-4e91-96a0-229e42905ac5", "comment": "Malware payload (RedLineStealer)", "value": "9e7a7eee071751f3bffdb75aef2f7760", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020951, "uuid": "87efce62-ce01-458c-8ed9-9e5a73d9c9ac", "comment": "Malware payload (RedLineStealer)", "value": "005e021990388ca7a500b209505e747e214a319e0a18d23a1dd659bddafcd2bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020951, "uuid": "3f0033d2-b75d-43a4-9c18-7de88dd70289", "comment": "Malware payload (RedLineStealer)", "value": "4726f7e144be1e52ec6cb20813d1a3a6f8752c2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020951, "uuid": "d9b32e40-b701-4495-8fec-c3e0aa45fe88", "comment": "Malware payload (RedLineStealer)", "value": "17886f4ed2d5fae31d15f8d71a9c2a2ef8087b4516cff1b1ba15123cd7d3d8242d21746febe61cc78be0d00569fc2dbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020951, "uuid": "62bd385f-6b45-4a3f-9816-9d9b9e55d65b", "value": "T1DD152307F3D89036E87227B468F612E30B3ABD94CB718B9767A1551E49733A0963173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020951, "uuid": "7fb8576b-8334-43b3-8b5e-07578a850f8c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020951, "uuid": "2a136678-e186-4165-88d7-5cc45983cf8b", "value": "24576:lyTZy0amS2+iv5hTefSiPFFXHSv6qwBWZUjaEf:Anamv+ivXCfSiPPSblUjaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689020951, "uuid": "33fbcf19-3b3d-4a88-aaae-b5a24145a55a", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689020951, "uuid": "9894a025-63a8-45b8-99e5-0ec55a36ea15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020951, "uuid": "be73825b-b5c3-45a9-b300-545b52b47153", "value": "9e7a7eee071751f3bffdb75aef2f7760.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19238b9a-1f30-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689000193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000193, "uuid": "e7a9bb94-e63f-4479-b507-23ed68632683", "comment": "Malware payload (RedLineStealer)", "value": "7b56108429fe78a7fef46a1f0c5c21f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000193, "uuid": "d124bde8-5b2d-4e34-a13e-3915c0bba88f", "comment": "Malware payload (RedLineStealer)", "value": "014561f5e1b52a96e720c462d57dc4fe2b323183b51ee8488804ffd9afb652ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000193, "uuid": "3f6ed820-6066-4951-b014-654916890bc8", "comment": "Malware payload (RedLineStealer)", "value": "6ca7e828fa2428c32a1e2369b701b6eac774d556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000193, "uuid": "dea37483-0567-47ab-a2fb-09ddff696ad1", "comment": "Malware payload (RedLineStealer)", "value": "d58f1ef75a4eb443d85cf6d7a081049c9259ab96b1c6edc356b27be4308dafa9c4be40a93f1b7897cf86d3b377fcec87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000193, "uuid": "620151fe-f487-44ac-a618-80572b0f656a", "value": "T1CB753392F6D541B6D0F1773548F726C31B31BE026EB89A6F2B58EC994CB2344A4307A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000193, "uuid": "adc506de-b004-4152-9cee-7d504451c08e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000193, "uuid": "6e2a40a7-b721-49e2-82a7-91e4a450a7ff", "value": "24576:fyLXiFftP/dLKfer2dErDWpt7mCnoIvAOuLq4HlA0iz5F760j9dB2eM:qLXkld0ezrDuxBvyLza04FRN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689000193, "uuid": "e983d5cd-d90a-4f23-b4ca-ee876810f5cf", "value": 1585664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689000193, "uuid": "d74ff2eb-4bd8-4cf6-99bd-e97536c850a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000193, "uuid": "b699dd1f-145d-43c2-bd70-6b78ffb7107e", "value": "7b56108429fe78a7fef46a1f0c5c21f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dde7b9a-1f31-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689000604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000604, "uuid": "b6e2c66e-690d-4994-9fd4-96ac74fad2ef", "comment": "Malware payload (Mirai)", "value": "95d55966fd0eb8150c97c3b7e02f2cce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000604, "uuid": "755e8a87-427c-42d3-8f1d-b8b44109f790", "comment": "Malware payload (Mirai)", "value": "02064805c6e69d540e3aa022a86f6ff871e8a9212a21e375c4217e49d8458683", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000604, "uuid": "96adb217-e6df-4f52-a427-9295a3f07aa7", "comment": "Malware payload (Mirai)", "value": "efc76d3feaf7387e0dc099568d7d1feca745ee4d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000604, "uuid": "3f783bb6-2356-4801-80ec-7aba79e8024d", "comment": "Malware payload (Mirai)", "value": "2a855a6836a812aeb0c5ec4d251388bb9d06b809b173e4a0e2af1d3f5aaf62e06efcc1d28fa18f40e14d38dd1b922459", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000604, "uuid": "53cf04bd-49d9-4578-9fa9-e46bb9c42e8a", "value": "T1CE230271840ADEB525303C76EB95E393B6E01AB1C6673023D6290E3C2F75B531D5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000604, "uuid": "cb38a0c7-8942-4344-9fb8-be6f8c253141", "value": "768:5/TYCoIxdEk+AxoTZAZHFeq8b3o9q3UELbUXfi6nVMQHI4vcGpvM:5ECFd+A6YHAxRLRQZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689000604, "uuid": "bd190877-8a2a-4167-9bbd-131bc22861c3", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689000604, "uuid": "aa27c062-6772-425b-b409-b5e4c305e50d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000604, "uuid": "9d1a540a-9a30-4db6-85a4-918b1b8343cf", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61535629-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688985711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985711, "uuid": "1a54d61f-d9ef-43eb-90dd-0155cd344fb3", "comment": "Malware payload", "value": "ce449c6bb0df667ef1c85f20eab8dc1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985711, "uuid": "abf14c65-493d-4588-8a79-a2e6c965e302", "comment": "Malware payload", "value": "02fe96d9fe2050e5eed41f953bb572e0becc07cbfa291907cc40b1ade4062714", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985711, "uuid": "0795107e-9fa3-4af6-b76c-eceb7931f6da", "comment": "Malware payload", "value": "c8531c16267aca9b6f9901ca55c2cd2cc509e2b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985711, "uuid": "9289090b-aa6b-4be0-ad62-80539989aee8", "comment": "Malware payload", "value": "18e16dc1ff4249a1e1dd2543815a5af823ef344096e9370610953d337936fe8014e13930b994cd1ba448d6bf9b315514", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985711, "uuid": "15607b60-f395-4393-a9d1-8f18b3d1283e", "value": "T1D043E84DF990A729D6D122BBFA0D128F73270B6CF3DE72355E305A2533C6A670A3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985711, "uuid": "8466e728-eda5-4be9-99c1-69017263aa65", "value": "1536:H5nF90BXukoDEIzCxgaW0T3Iwif8R52Y5S6qC56Ya:50YkoDEIpaTR52Y5S6qC0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985711, "uuid": "2f9abed5-b6b6-4b34-a115-e60ee6bdc536", "value": 58792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985711, "uuid": "ea75b358-c844-470d-8cd7-b7fdba028e35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985711, "uuid": "78d634a2-8de5-4412-be1f-7d4455c132e1", "value": "SecuriteInfo.com.ELF.Gafgyt-FH.15263.20536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe2644c-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962570, "uuid": "d5396c68-a6c7-43ab-98d3-ddf4597b9f39", "comment": "Malware payload (Mirai)", "value": "39c1baaee70b0eee1ec823ecec2fe35a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962570, "uuid": "73ad544c-5599-4602-903e-64c814642775", "comment": "Malware payload (Mirai)", "value": "033358961f66e9360a9f9ab6d8778ed4c828e8820507083bc1ef21509a321cff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962570, "uuid": "1030a53a-9e6d-46af-8f02-3cd0b4f557a6", "comment": "Malware payload (Mirai)", "value": "f8705b31797ae76cc96da218b8b6894368198d02", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962570, "uuid": "187c57d1-08e2-409a-96e6-60f51ec14675", "comment": "Malware payload (Mirai)", "value": "5d46d483b243b23695a2acb1fbdf2b541f5e62fc244495530f54e2a005e2cbe78e98beacef489e516299ff46a9755399", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962570, "uuid": "445c84ea-b6fa-4a1c-997b-dac0c1b9f3f5", "value": "T17814C716ABA10FFBDCAFDE3706E9070625CCA50722A43B393674D528F54A54B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962570, "uuid": "9b9c19d3-db79-4827-805c-a56bb57a6476", "value": "3072:ymnudUC3dDB6u3ucYOGD5Nrab/coVpAJTdSccve:ymnW3l1ucNGfOjVpQdS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962570, "uuid": "84e2d727-1f8a-444e-ac33-d1eb068998df", "value": 194440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962570, "uuid": "da99178b-f6ed-4b6a-88e5-85629888ddc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962570, "uuid": "d8c94605-255f-4e3a-9e91-0e0e188b3df0", "value": "skyline.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae184709-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968231, "uuid": "fd7b0fc9-c411-44b5-b0b2-e1ef039f1778", "comment": "Malware payload (RedLineStealer)", "value": "0ec528b5b5ef30cd88aa4c09990dd989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968231, "uuid": "79fa6ec6-6ea9-4130-b5d6-fe2ec7df4cf4", "comment": "Malware payload (RedLineStealer)", "value": "03501efa95b4223294677a0d84a0e5f353fa34582eb65655ae44f980fe16f986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968231, "uuid": "d92ae28b-3eff-439d-bcac-903f71443427", "comment": "Malware payload (RedLineStealer)", "value": "e139e6114d939a9e3a9ea36fa18c45585042c5fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968231, "uuid": "1ea27a91-b17b-4b60-8ba8-1a8da7c51517", "comment": "Malware payload (RedLineStealer)", "value": "653470f36fd33545838f236be4d9a084fd46e72db84a76b0d880ae12aa6ea2ecd06c8586a3c7c5923cd4943144f83f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968231, "uuid": "0971a1cb-9e8f-4483-82c9-5f836c68e741", "value": "T189C4126172D29533F572547349A0C31FBE2BDA3249909A4383C57A3E57382D25E3ECEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968231, "uuid": "cbb95a2b-6980-4c30-8089-7d994c18b168", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968231, "uuid": "bcce6b3f-d924-4b02-bffc-3f90e0eed9bc", "value": "12288:ME8V+z47dgCMW6GG2Ut7eoR/DlWrkDQnT7Y:sE47eClozWoMnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968231, "uuid": "d3aa6e4c-e4fa-4889-a6f7-77da7a8ea787", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968231, "uuid": "c01e127d-72b2-4317-819c-6974496226de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968231, "uuid": "241e9e10-f77b-477e-ac5c-ccac55bb5b3d", "value": "0ec528b5b5ef30cd88aa4c09990dd989.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a607e01-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978022, "uuid": "40658067-9f9a-4b27-bb0f-5b9891778a5a", "comment": "Malware payload", "value": "6f1e6d90bf7f9df2d805e57b48cc24a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978022, "uuid": "05f4b983-5ec8-4b0e-a6b3-05d2095a3c2b", "comment": "Malware payload", "value": "047f31337a5e4506be1233742dff490e163fdefd3fba118fcc4cda0e7465e897", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978022, "uuid": "862c555d-69db-4e6e-aab4-1d0d3bcb4832", "comment": "Malware payload", "value": "282bf203c494b2da4f3df6defa7cffe8f13e0ce1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978022, "uuid": "8edbf4b9-af0d-47a9-bffa-411b45cd35d8", "comment": "Malware payload", "value": "3987efbfbbb53a45302e13f8d7bb64fbd065b7c4eea520ad0c3b4469687502a8b187d3a64403e37afa1309cbbafce4be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978022, "uuid": "b372abcc-c9c8-4d0d-aae9-3f0ef239959b", "value": "T17E5345797A21BFEEE67CC2310BF75E709399229126D19284F2ACC30C5EB124D589F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978022, "uuid": "5fccfe00-b4c4-4b9f-bbc0-8768839b66e0", "value": "1536:t+41+w8LamaoQKNhoNi3272AVaphRfBPegGYC:IphRfcYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978022, "uuid": "7c9603cd-830d-48a4-8aaf-625c44fcc6c1", "value": 65340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978022, "uuid": "a9c1f788-cc11-42d7-a843-02787d9ea95a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978022, "uuid": "536a1b22-97aa-4eb0-beb1-120e897e4cd1", "value": "SecuriteInfo.com.ELF.Mirai-AJJ.18834.17640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8908eb-1f1f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1688993250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993250, "uuid": "5939e5e0-8796-450e-a73c-f8ef2c654661", "comment": "Malware payload (zgRAT)", "value": "affde6cd92ad047bfb42554e85709eab", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993250, "uuid": "2676e72f-0330-4b06-9b5f-51df4b429a2a", "comment": "Malware payload (zgRAT)", "value": "055c3b690cfa67978db3760cc7d7ffef3bacb90bda7bf31b8c5e318b575829a0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993250, "uuid": "3e276f56-4124-4324-9047-f46f9d29c4aa", "comment": "Malware payload (zgRAT)", "value": "a599af211bd4aa91a58cfcf3abe10f283f3d493c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993250, "uuid": "176233c2-5a95-443c-aa6f-e18ceb509dda", "comment": "Malware payload (zgRAT)", "value": "62f18e50668258460c55f8269e984790aee23faea7620800e948d8baeb18e386764689ede73f75fff729d01330832bae", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993250, "uuid": "37c969c4-9211-40aa-9591-b5d577a1d895", "value": "T1E10523D89F6B1D46632D01361B5A69EC8B0FE93F7C52B85651E87872E1D2CA08C4A1CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993250, "uuid": "bfea1aa3-d154-4cf0-bb04-8279f8c3a9e7", "value": "12288:oML7nvXmv8+wYsLFormr3LS2UL4QBqwAoXzKwnqsj5lFJGlWMWvM8tPah1XYi8AF:Fmv8TzhaBqixnqsjXFJXtPa/XlCDtdzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688993250, "uuid": "df494841-cd5e-4146-87e1-ec75ab4deff9", "value": 850113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688993250, "uuid": "224284c2-36bf-48a5-816e-5986ff363bb4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993250, "uuid": "6b0f318a-049d-4407-967c-884aa566791c", "value": "PURCHASE ORDER_8936421Y28 .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fbbe6f-1f23-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688994770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994770, "uuid": "b17552b7-e318-4b01-a831-af3603006ecc", "comment": "Malware payload (RedLineStealer)", "value": "6f60ef8396cc568d94d9b086d2a1420c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994770, "uuid": "c049c24e-0a34-4a38-aa70-d9a886b36358", "comment": "Malware payload (RedLineStealer)", "value": "0596323570255924a0af26403e997437363bbd71c29deb36a9aad48b25b9fe1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994770, "uuid": "5b7f8ee1-8471-4468-a284-020e15787ec1", "comment": "Malware payload (RedLineStealer)", "value": "a977134cdef513d72da3a99172aaee20d09a8b3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994770, "uuid": "ea2dad2c-1e45-4f9b-995b-6c052a90233b", "comment": "Malware payload (RedLineStealer)", "value": "8ef34994d10170004d84f844d8de6a28d5f11b93c943c89279290af0e2f17f34e5dc2be3c68971cb4904bcaa94cdb8dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994770, "uuid": "9106db2b-9947-4f5f-9292-e9e850ff756b", "value": "T1FBC4026271D64923F572143719A0D26EBF2BEA310D909B83E3D9293F4B281D15E3EC99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994770, "uuid": "1ea1976f-95d8-4a0b-87f9-121651036277", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994770, "uuid": "13b5416e-9e5a-49e2-90a3-2e8878136598", "value": "12288:Bgk8tnz47kdedMX4fJrbHfF5dywCKOh2s1:Gz47kdf4xP/7dYnks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688994770, "uuid": "a6d12e4d-701e-4722-b52a-55737ce801d0", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688994770, "uuid": "2f9eddbf-e7b2-410e-b5d5-794dd1358652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994770, "uuid": "ad84da1f-6c61-4693-886b-61df724a5187", "value": "0596323570255924a0af26403e997437363bbd71c29de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c7521b-1f41-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1689007865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007865, "uuid": "a2c5fa0f-3f26-474e-9c96-1d4d3312d5ca", "comment": "Malware payload (CoinMiner)", "value": "b3d19d65687560f5c206d0338b7d6601", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007865, "uuid": "668c81bc-d3a3-4c7e-aa8f-4ddd1335beec", "comment": "Malware payload (CoinMiner)", "value": "05c4f71a5caa0ed6809fdfa57b44836f5ee6408d73f6b97cd9a751b696091101", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007865, "uuid": "c9cf330b-6734-4481-be9c-ecb6e52bf099", "comment": "Malware payload (CoinMiner)", "value": "7dc6e5681c33800c6543ecb148d4718e33138ee9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007865, "uuid": "f4407a6a-b12e-482e-969f-2ed1f14472a1", "comment": "Malware payload (CoinMiner)", "value": "0cd5cc23a60d66c494a3c2a041e021c1722a06ed3d5002497542d3dd1ea6962a30b970cf51b2e5d3241d23511f690adb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007865, "uuid": "309a99f7-dd71-4b18-9292-50c150be5c83", "value": "T1BA950102BA455BB5E678D7B7C0D6893007A0EEC1579BD74B38BB7FAD38233A59D81102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007865, "uuid": "b41d9c06-7e93-44ee-881d-ab62b67472fe", "value": "24576:osFKs/vvt1MSC/GoWvyMcUH81mVjIZ/WimspSM8rta7yLp08TM8nch2Cy7v4P+7M:osFKGbNoy9x0VpFm1ZE7yFsC9CiFb6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689007865, "uuid": "b62e8806-de27-4137-9f2a-c48176334062", "value": 1892864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689007865, "uuid": "a306138b-df9c-4b65-bc8a-3ad348d26547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007865, "uuid": "ad0c89d9-0f12-405e-8d62-fa938b92dd54", "value": "b3d19d65687560f5c206d0338b7d6601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec111d8f-1f76-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689030612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030612, "uuid": "9d7606ff-1b61-40da-a3a2-733cd6f53c82", "comment": "Malware payload (Mirai)", "value": "db8d2bdda96a9662a191843ddcc218e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030612, "uuid": "7df21c99-9ce1-4faa-b6a8-259b40af17f4", "comment": "Malware payload (Mirai)", "value": "05ddb3f7a33055b7915c7c14aa71806fc6825de10dc59752769a690e31347128", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030612, "uuid": "e75a6164-a454-4390-ac12-7129d17ff6ab", "comment": "Malware payload (Mirai)", "value": "4e0d7876acb702a2188c3efa3ac50952a67c59ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030612, "uuid": "ed4ee84a-5c20-4bb8-a324-83420ace39fa", "comment": "Malware payload (Mirai)", "value": "c294120c50dc88bf869b4866fe514d745d17f439b4346545ebb0e8120a0248a36080019c4b0fa3e4508cc914b0e0d983", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030612, "uuid": "c2ce376d-44a3-4dd1-8f04-edb428c77df3", "value": "T185B2D0CC61543084C98D7C7C178D4A674FACA1D0BADD9B26E350CD98B3BDA4F3859078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030612, "uuid": "b148a715-8575-428f-903a-d90962166629", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBpknZq8WvA:BQlS07FUXqIYSXQKqucqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689030612, "uuid": "8fd05f87-c19b-4378-b4cd-d589b67eb4bc", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689030612, "uuid": "b2c09cd7-abd6-4bbf-bb6f-34811b142551", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030612, "uuid": "a11e7785-d5a8-47e9-8cdf-b40f7ff56b0a", "value": "db8d2bdda96a9662a191843ddcc218e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47aa9da9-1f2f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688999842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999842, "uuid": "8dc78853-3110-4253-b3e8-e94c9d089c04", "comment": "Malware payload (AgentTesla)", "value": "f3db518ee825c83c36abc91e57fdca15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999842, "uuid": "2293fbde-1a47-4b9c-9ec3-a9b618cf1661", "comment": "Malware payload (AgentTesla)", "value": "06047622f4425a873ae8a551644723ef79c6bf2cd9d75264d15380db35320910", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999842, "uuid": "3c943ca1-20a8-4774-8423-f5fcc5bec50e", "comment": "Malware payload (AgentTesla)", "value": "3020ef50d1d26b0ac4992ff34891665abdc299e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999842, "uuid": "c56dca4d-b727-4df2-a6c4-bedfcd71de9f", "comment": "Malware payload (AgentTesla)", "value": "df41e34d67b9bc0c82b100b3b82b7757c40425704d4c2dcc4b72ab854be8c0a3c7c9964d5c985979aaa7e595fd0c594c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999842, "uuid": "8d43e780-2b38-464e-9e27-48a4ddc17fd4", "value": "T17CC4121750A8E326DC2C1FFE1140904A27E859499C71DB2CDCBBDCD28AB6BB414EDBD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999842, "uuid": "0e79c8eb-dc75-4148-97bf-2d027d1dea44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999842, "uuid": "c0f7eb46-5784-4ea5-b42c-7053170be18a", "value": "12288:iD0cluMI/4UmLNcPUZURMqFH5qJXab+RvmCVr3T:iwczIM2UZURMMHYX5vn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688999842, "uuid": "db48c22f-a3c7-4f4b-9a8c-1de83857865d", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688999842, "uuid": "45f60d0f-55e6-4c47-a318-b6ebc3bdac37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999842, "uuid": "26d1589b-c36f-4d7f-9618-91fc018c3151", "value": "sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b8558f-1edf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688965636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965636, "uuid": "b2f16598-6349-445f-ad13-a17a62ab4191", "comment": "Malware payload", "value": "6582823edceefc21ace452924ab42149", "object_relation": "md5", "Tag": [ { "name": "pyc", "colour": "#DDE479", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965636, "uuid": "dfd84c4a-279c-4501-a7c8-fd9e2169b22d", "comment": "Malware payload", "value": "060882f97ace7cb6238e714fd48b3448939699e9f085418af351c42b401a1227", "object_relation": "sha256", "Tag": [ { "name": "pyc", "colour": "#DDE479", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965636, "uuid": "77d893ac-6c30-4a06-a925-5ba4d9dff1bc", "comment": "Malware payload", "value": "74ac9475d3c8d93b33c3cb234cae5730e42f1d1c", "object_relation": "sha1", "Tag": [ { "name": "pyc", "colour": "#DDE479", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965636, "uuid": "90a182f2-5ba9-4d96-b7a3-321a45e7fb96", "comment": "Malware payload", "value": "002716c567171c20025a5121af39da71c8e2a69db3312d532008778e68a74025480c06d401d6b6f456327b2231ebb6fd", "object_relation": "sha3-384", "Tag": [ { "name": "pyc", "colour": "#DDE479", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965636, "uuid": "f459118d-dfe9-4fcd-a7be-0895e869705c", "value": "T1031123C6F90A40FAC6C45FA4759E0334CEDB7B898BCC90A3E8455BA28E06260599C258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965636, "uuid": "3d8ec701-6d24-40db-860e-be84c5bcbb6c", "value": "24:mx3lZmHzYxP2O6GXBltRRoK4C/pi200Na053Grkn:m0zYxOXGXBfoE/piTumkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965636, "uuid": "5c959232-03d6-41ba-8d20-09bb542a87ca", "value": 877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965636, "uuid": "2e5ba9d3-9d38-4b02-8e0b-260df543b92f", "value": "text/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965636, "uuid": "8dd7a59c-784b-4f14-9440-143776722168", "value": "bootstrap.pyc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ff96bd-1f3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689004703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004703, "uuid": "9cc76c01-ade5-450e-ab92-647ad86d9655", "comment": "Malware payload (RedLineStealer)", "value": "8c94a9c984e26d8f829f1b5475c3ba29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004703, "uuid": "f0575220-a352-4da6-af60-49de9fd2db90", "comment": "Malware payload (RedLineStealer)", "value": "066c4140b360acf1bed9d8d63a8bb5806583680dec12f40788cd94f3cf052bdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004703, "uuid": "d72c5bbd-4d2a-4c55-9984-d126bf82d147", "comment": "Malware payload (RedLineStealer)", "value": "b6791d3b3f5401a502a5859dd437b590ec4c3eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004703, "uuid": "d03e3aea-1b9e-4d8f-8e0b-8090c0394ce4", "comment": "Malware payload (RedLineStealer)", "value": "05d51aa2f8b071c92a732d9a654bd618ec22f1f828e51281f0258d4b1b223a585ca0c328313b81aa3b3297a5783145a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004703, "uuid": "af6d7168-6dda-4548-97ec-68d36a9844c5", "value": "T193E4E03914A144ABC4A9AD39FF4BD4C232162EE4017C950E3EB36E783BD20579DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004703, "uuid": "16dba40a-ee70-4b56-9788-09149de71ddf", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004703, "uuid": "34f037d6-8e4e-4b2f-98bd-7d4a8854f71d", "value": "12288:Mw3zk2E02iICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:MwDkN02BbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689004703, "uuid": "db5dd31d-9c1c-4621-9d2e-b0f4e1c7c325", "value": 708418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689004703, "uuid": "cf5b178f-28f9-458a-8f5e-be47ba554f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004703, "uuid": "4ed6dd30-7cac-44c6-88e5-c71a06d78381", "value": "8c94a9c984e26d8f829f1b5475c3ba29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0a3bbc-1f19-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688990700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990700, "uuid": "ddeb9fad-e945-42d1-bac7-d772f41d182a", "comment": "Malware payload (SnakeKeylogger)", "value": "a67f381cccfc091306827bacdd8b99e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990700, "uuid": "0270daa5-523a-4cee-9094-3d9496580f93", "comment": "Malware payload (SnakeKeylogger)", "value": "067371c60e42b21c7772345cfd18f9990ca2238ad24a221d5f268577eb9f4ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990700, "uuid": "ec6510a1-511e-48f1-a7ac-c81628d61ce9", "comment": "Malware payload (SnakeKeylogger)", "value": "8a300c95218d0d4f067351ba7a1b90da2b5eed6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990700, "uuid": "9143c983-3312-4245-8be8-159e6939d8c2", "comment": "Malware payload (SnakeKeylogger)", "value": "5c50e11878f063e98b1a06aaaf335bd8a95a738f613643e5f005a5822c9c7e5201a139249be7b6cc3033572e68e81d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990700, "uuid": "a5f463f2-d84c-4c02-8b7b-b251a678f332", "value": "T17AE44B3818BD5E22C175C3F59F95C061B26499EB31A6CF2A5BC396C5061EB021AC7E3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990700, "uuid": "78afee13-511b-454f-adfc-cfb92bb83c3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990700, "uuid": "6b73b552-9964-42ec-aea0-21d40b3ce82b", "value": "6144:sJepuKR2VeL6CIVNcCCBxvIM+PBJUWaYh08H+xxPC8ZhG1xVaqyleDO2X+qIpLwg:emKb+qg59DHh6fs0f9r3onFYBzUf9yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990700, "uuid": "f85fc253-b65f-4ead-81ef-3d1de04e73e8", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990700, "uuid": "49117388-8ebd-49c9-9d49-c96b5fe1b460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990700, "uuid": "8439d0be-081a-4e89-824b-6f55649cc4c8", "value": "a67f381cccfc091306827bacdd8b99e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23648f2-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985042, "uuid": "389f1a56-71aa-4187-a728-adbed3c7bc78", "comment": "Malware payload (Mirai)", "value": "ea363eda5ad29d0776fd9a5cffd373da", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985042, "uuid": "eaf3f67c-bee3-4458-bfd8-291ad6fd8b26", "comment": "Malware payload (Mirai)", "value": "068d236f1ed33e2ed3c4e5369df40e11ec0f03e9f333226521b74c6949484c13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985042, "uuid": "694084d6-0d73-411f-8c36-9f82025f0eaf", "comment": "Malware payload (Mirai)", "value": "8507f832cf0ccf592c5a4a287b82050db14088d5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985042, "uuid": "644c9bb6-35e0-4e1a-a910-fe61ae90de68", "comment": "Malware payload (Mirai)", "value": "632464e4e8cab83de7a1cb21890000845e72f425528e86b929cdbc479f2380ab577afb6b079973873de67a79c091a653", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985042, "uuid": "bf43d260-8b07-434b-866f-5d74d6973213", "value": "T19F136D176A8184BCC85DC6701A4FA636E533F13F42B6329E63E4FD206E55DA25B3ADC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985042, "uuid": "980efc24-492e-41e1-a221-ea8d52bfa429", "value": "768:zLL0TQbPhBgw/y4amDEyx0ym3IkPFYphaG/lIY:P9ngoySAO0XdYphaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985042, "uuid": "7c5a1f46-451f-43b7-ac79-7df3466f69a7", "value": 44440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985042, "uuid": "814b87e4-f098-4769-881a-0c4ca65acdf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985042, "uuid": "1fc988a3-afc7-4580-9dc8-6b5d8c374f7b", "value": "condi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d840e9-1f3c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689005628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005628, "uuid": "0064005c-41b1-4a94-bf3e-392af6f160cd", "comment": "Malware payload (RedLineStealer)", "value": "6dc5ee70db01c53dab7883dc925c2661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005628, "uuid": "6340b263-21f0-4b2c-bc41-3bd3d6a05ae5", "comment": "Malware payload (RedLineStealer)", "value": "069a9916e36b0d3d2c6d6d0ecce904b40824b7cca31655d30699e66703ec44e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005628, "uuid": "480b2249-8e04-4fd1-b4a2-b38127c7f828", "comment": "Malware payload (RedLineStealer)", "value": "b5de446e8550170f3cc29dfe74a72ef12188fef6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005628, "uuid": "e51b7762-9c23-4acc-87ce-edb3e531bdcf", "comment": "Malware payload (RedLineStealer)", "value": "224c82fcc478b3fbcd699a96509e3610da34aefda5f8b3225ad2d225796329e06812d67b2b8d71e7ffb75c1b4980ab99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005628, "uuid": "26edff7f-f98e-4ec3-af46-6a32692017f7", "value": "T1AE152343F7E94836E8F51BB858F341831B3ABCA14CB96B7767C1585B09B16C2A13172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005628, "uuid": "efe85ddf-484d-4229-b2ea-ad63103a46f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005628, "uuid": "ebe9b423-05ad-4861-8808-d2c87b97b0c2", "value": "12288:wMrXy90rndQN+Yv3dTIoUWkVsxii82cx/XHbdGrLvNX/pdOTNPGw745uRL7cw8TS:3yEQhPNsLVYii82cRxoJPSX7+ELYw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689005628, "uuid": "aa01a733-4e82-4f1d-a4cb-57cebe1ce64a", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689005628, "uuid": "e2f527ac-2bf6-4d3d-a71d-3ded33856a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005628, "uuid": "72ff3780-dd6e-408d-b711-9b6b78f39115", "value": "069a9916e36b0d3d2c6d6d0ecce904b40824b7cca3165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a94a19-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985725, "uuid": "1c654dc0-3e67-45c8-8e59-4e62e5675640", "comment": "Malware payload (RedLineStealer)", "value": "49ece24126f51e28b5d749fd0a164a52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985725, "uuid": "5a4d0bac-ec7a-476a-8277-c1f2740a7083", "comment": "Malware payload (RedLineStealer)", "value": "06afa0b69dabdd03c151f9e5e4a9a673d840f781e81e7ccce6432d60efabcb6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985725, "uuid": "69bc7a1e-0dab-4806-a7f7-deaf8ee22741", "comment": "Malware payload (RedLineStealer)", "value": "7f408174376831bb00dca89c7f644385a6ab373a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985725, "uuid": "3a342861-43af-4b70-8fb2-fc8fe7c0ba0f", "comment": "Malware payload (RedLineStealer)", "value": "6add40e8a4be2429f6b4ab6d45e906b8f8cd18614bcf8485e020f8904800fa3fd6428c365b5ea14ab34c400c36fb188c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985725, "uuid": "f15513bd-b128-43b9-b8b8-dbaad2dadb06", "value": "T1C844283921E144A7D8BA9E35BE4BC0D17116AEB4017C541F3FB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985725, "uuid": "c84721d6-ada4-4b5f-a761-57205a89cefd", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985725, "uuid": "85c2ae28-1514-4e99-ab97-89815c8f79ec", "value": "3072:ts+iOHMwew7+picM/XsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:tsvOswD7CVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985725, "uuid": "1ad4969e-5848-40f8-ac3c-a6e5f0b7fe73", "value": 272548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985725, "uuid": "d6ce8f4f-555f-41de-9e80-eb490cd0f3c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985725, "uuid": "3baf3787-0173-42b2-868e-6bf151512ea1", "value": "49ece24126f51e28b5d749fd0a164a52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d570e5-1f04-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688981563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981563, "uuid": "01e71198-25d8-43db-b9b3-51338294409f", "comment": "Malware payload (Mirai)", "value": "d68288de752b1eb72a93080a1effe6c1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981563, "uuid": "5b7823e6-a2aa-4e2e-afc2-96b6d4ee5555", "comment": "Malware payload (Mirai)", "value": "06f757d08a6c91c7cb54de0a02560308efe13cc5c4191b77780a917f9fa2f8a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981563, "uuid": "8c953293-f9f8-409a-a628-483a0da204db", "comment": "Malware payload (Mirai)", "value": "55f9859677086d0204f4d8f5352278ad3f0bdaa8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981563, "uuid": "cd9ea5c9-036b-48c8-bb5e-c2051e8d3dd0", "comment": "Malware payload (Mirai)", "value": "f18efab5717d1add00adbe358912a1139445abe680006ac3e909de8289ad7634ef822ce6566050cdc98d6a33e07fbabc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981563, "uuid": "11fc7729-6d50-4fb7-bc71-514403eb43e3", "value": "T14EB3B60E7E229FADF79D823447F74E21A65833C52BE1D541E1ACEA015E6024E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981563, "uuid": "f4974452-a530-4f85-aea6-00d988e8cbfa", "value": "3072:0qutRkeegkKR8L1BDXEJjay6QJZ/2GOHSwbZnwv6:0qutuHR1BDX6OTQJZ/ZTwRwv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981563, "uuid": "0621d244-d733-42ab-9b7b-289fff7d1051", "value": 108908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981563, "uuid": "12942dc9-a33c-434d-bcf4-d2b6592e51f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981563, "uuid": "acc85ccf-739f-4550-81ae-d2ad7fcc4c6b", "value": "skid.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bafdd9-1ef6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mekotio)", "timestamp": 1688975364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975364, "uuid": "70394817-68f2-4c97-9443-580c90fc0be4", "comment": "Malware payload (Mekotio)", "value": "215b1f8778353063d9e427e485eb5fb1", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975364, "uuid": "c138ccb9-2354-49fe-a1f7-de262cee22e2", "comment": "Malware payload (Mekotio)", "value": "07ca0360b267698a9182188c52b457153773f3d9dc3411085714f70d24c4ff10", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975364, "uuid": "65d1e2ac-5cac-4564-8248-a388ca9e3046", "comment": "Malware payload (Mekotio)", "value": "57d00d4e17f2c7bb9d3387f1ee8d8610e36de5f5", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975364, "uuid": "44d428f5-0165-4349-82d5-25926ac217a0", "comment": "Malware payload (Mekotio)", "value": "248eb12040448cb9d0cf38b498d671e416c276175cfd677dcc384d3d4b879ba25f1e7a30b61660bdf2af47bdf41cb1c3", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975364, "uuid": "c7ecc1b8-d6f0-4938-bdc9-2978c1701b40", "value": "T1BD5633C656012B6FB62093E524B0C359B04B2E6C28B2B47D7BEEC64F5513AD26153FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975364, "uuid": "9ef5c5e2-c243-4433-83f4-fcf7d6ab05c1", "value": "196608:JkkOfpCs0U22Wwo/T7h6kATfSwf+Go10XEmBUgufb+U2kCl:JlOfpCs2Zrh6k4fJmG6JgAb+Fk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688975364, "uuid": "f1f9f975-4bb2-4f88-b9b7-ea61af00ce5c", "value": 6397358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688975364, "uuid": "8fe50027-4d70-4fea-99fa-655e0a60948e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975364, "uuid": "ad8951b8-96e2-4a46-9172-dfa02e638c38", "value": "FACTURA_00J23RT50167S56T0rTI4i2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f24651-1f2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688997606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997606, "uuid": "8f35cbae-e8c8-48b9-8373-222a3c288c96", "comment": "Malware payload (Mirai)", "value": "4ffee0031bfc04fea7b5576241b0e2d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997606, "uuid": "0e9f7b11-4c44-4432-a973-7dedb80dd38c", "comment": "Malware payload (Mirai)", "value": "089bf9cf4ecbf0b8cb52c6a5e4bdb2cab797cafedb1ddf4cd1d1d0a65f62cfd5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997606, "uuid": "ea0b1018-9fe2-46f9-85aa-c640d1fa013c", "comment": "Malware payload (Mirai)", "value": "17f8aa9d7d352e3be36051301993b18980145b55", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997606, "uuid": "ebd041d1-96ce-43cd-9aff-0f75495e2802", "comment": "Malware payload (Mirai)", "value": "c9f5a7e7fdf621af0f15f02006f6908b012a11144e1f8648e1a448eba262a02fcf0632431f0733a567ad662229d6acb2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997606, "uuid": "ec13eb08-5536-4224-98f3-f51294e560d9", "value": "T1DFC2E1F67E7B799BDE35103938998E328670A022C7AFA7639141920820071BDB6329DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997606, "uuid": "edbddf17-0472-49a2-87b1-b6fc4762e281", "value": "384:Mw1DMwk8JPyGYhDZREXVZVBz6sIye1iWLRYh4Sw4cGJYeRzOFGBzd8Qu/wsTL8E9:pMwKDZOFbBz6sSHRYfeAxdd8BLTv0Ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997606, "uuid": "84dc554e-d990-4aa0-b92a-32cee9a64599", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997606, "uuid": "abd7495e-9dba-4169-a8a5-7062717eccaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997606, "uuid": "4b7eca57-81fb-4eef-af50-93ce9f5808b6", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de956a7b-1f24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688995370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995370, "uuid": "d5212ec1-2e7c-46b5-aa3d-c7218eb962f6", "comment": "Malware payload (RedLineStealer)", "value": "084e867a390b7dd6c4a8e0d053b66ce7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995370, "uuid": "bd7a1c6c-75af-4557-9e41-6838dc3bed42", "comment": "Malware payload (RedLineStealer)", "value": "08ae25a3e966917c3cbdb72bb699a6ad2535005176078531a221e6629435e1e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995370, "uuid": "eb36fe92-7a08-49f3-8934-96c40a8e87b1", "comment": "Malware payload (RedLineStealer)", "value": "a5d15c1d10acde9fefdbecfb15297bc990675bd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995370, "uuid": "8e007f4b-838e-4b7a-8c66-e287d241e3ec", "comment": "Malware payload (RedLineStealer)", "value": "cbf6f3834479972533b3f70a45c4de49bdc0ade39856a2bf319583624f107c4f4234c28fd0d0a27a3100f5066add11c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995370, "uuid": "d03cd6e7-fda7-4502-a784-8c4f1c31c89f", "value": "T1C06523B938842337E030607E8590E52FFE0709F296A04743EAC77A396B956EE2D7DD54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995370, "uuid": "18834a85-828c-4604-b0d2-07bb2bc514aa", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995370, "uuid": "a7298582-796b-4db5-b2d9-45388265898c", "value": "24576:XE47kOUEfJvETlpqftmHioiS+yvk3RZACBbVTb34k30/8dRi9:XEq5PfJvExMftmHzO0khZAEykji9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688995370, "uuid": "7d8bba8f-6df5-47ae-bbbf-3bdc9dd22738", "value": 1409344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688995370, "uuid": "ee5d09f2-2690-496c-9d05-4d025ee7493e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995370, "uuid": "8417b5ba-fcab-42d2-9b45-79d1deeb5bc1", "value": "084e867a390b7dd6c4a8e0d053b66ce7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76662bc7-1f1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688991760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991760, "uuid": "630ef24a-2e47-43c2-a7db-810b28298593", "comment": "Malware payload (GuLoader)", "value": "38023a81541e14061330ba53a8d067a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991760, "uuid": "8409e61d-118e-4a27-aa90-d70b28bcb16f", "comment": "Malware payload (GuLoader)", "value": "09100dfc7e6587559e7b5912e44a4221bf58f9547e2718c8b8f17583d53e2b92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991760, "uuid": "ed7cc0c2-915c-495f-891c-0bec0c1e6188", "comment": "Malware payload (GuLoader)", "value": "47a40b51193efcd7e94e16b3c85ba2a1f2e1b981", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991760, "uuid": "4ed1df13-0130-4825-ac57-828b7f0775ef", "comment": "Malware payload (GuLoader)", "value": "74dc9937d0274dd20e428cd793e0db5e0e73324a4aee91cd745b98e5b9863c212acee3462d266e3b502dbc98330910a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991760, "uuid": "58d282f5-223a-4cfb-9e11-058e0367eb9a", "value": "T18AF4F2E6C8583476C6B15CB300D05F19A2397D76EB7EA33BA7882B875D27D0B6884347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991760, "uuid": "aabb834b-53e5-445e-be34-5b26d36d9636", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991760, "uuid": "7bd760f9-e376-4433-96ab-671bdd455d29", "value": "12288:7R0UiiHumDYp3khZfPJH9Uaj+MmjjSBEys/erYcyLKEJ6ObeX8u:S1q0UhxRH9Uaj+TjjSEYC6RT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991760, "uuid": "dd0fdf2d-304f-4f31-8c25-c1f9a84d54fd", "value": 723048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991760, "uuid": "43d18abf-d06e-45c3-b327-71c10f7f61ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991760, "uuid": "4e09242e-6434-48bf-b4ae-3d8d49d2cc41", "value": "RFQ 00299288291.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b843ef-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688981877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981877, "uuid": "87558514-01c6-4bba-a7e6-c23c0315b7e2", "comment": "Malware payload (Formbook)", "value": "065cf92b7519116b3cbb416e7d31dfba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981877, "uuid": "d3c724c3-94e5-46ef-b263-1edafa5501f3", "comment": "Malware payload (Formbook)", "value": "091305d3595b7324e7fb674b6120cdb142a6196e796f890fd625e76a014211e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981877, "uuid": "f275e91b-c6b8-46fe-b68b-eb4403a349fa", "comment": "Malware payload (Formbook)", "value": "706b218470e606e34d6605b6ed776f67c35efc94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981877, "uuid": "1b5d4bbf-5e7e-42d0-8f05-318e180e06e4", "comment": "Malware payload (Formbook)", "value": "d67dfe5eb33b74ae9b056bdd37052a3e77c17f03ea1a70d3143f81777b1e90ae9042fd26a908fdfb3ddba8d07e4b452e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981877, "uuid": "4b87ba73-f4c6-4556-978e-8ab6dc770fb3", "value": "T13CF44B3819BD5E22C075C3F58F95C061B26499EF31A5CF2A5BC266D5061EB022AC7E3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981877, "uuid": "d0d29d53-11f0-4448-aef9-dba674c71f29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981877, "uuid": "2d029d34-ddf5-49b6-ba76-b8ed5e204739", "value": "6144:/Jepo8KR2VeL6CIVNcCCBxvIM+PBJUWaYh08H+xxPC8ZhG1xVaqklq5LTyrHsVfm:amZQVtY9GA/4QWM723tlC1tRX0po/9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981877, "uuid": "1bd02418-a55c-4912-8789-b45131106b35", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981877, "uuid": "1a4e703f-1211-4970-a280-7c8aa9437c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981877, "uuid": "6271a103-a627-47da-b7fd-a7fbbaf6d44b", "value": "QUOTE REQUEST 047855273660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d00d296-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688981839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981839, "uuid": "24eb128e-ca14-44f4-9319-ed6556bf207b", "comment": "Malware payload (Loki)", "value": "d59fa54b31f8794c0029a8c6544ed817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981839, "uuid": "34f7f44f-850e-4d4e-9bdb-ba2768a6b299", "comment": "Malware payload (Loki)", "value": "09e7e5ef4bf59c633976810f37649d117523f9e249674b26c2238fe8839a1d18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981839, "uuid": "00cbc659-0456-4734-90dc-1f19b2876d2a", "comment": "Malware payload (Loki)", "value": "26f281b3527203c6d9c47e6abec6c5daebb7ce12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981839, "uuid": "8133a577-5fe6-459f-8d33-0bebb0b4c256", "comment": "Malware payload (Loki)", "value": "6f8814ba1b2fb5206297978baf68302225e1cbc7ae595de5a6da830400341a13dc2fb83ddf8bce632f5ca29c89d67c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981839, "uuid": "f62bf4c0-b518-45cb-bfa6-6424f9f95aaa", "value": "T14BA31A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A18215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981839, "uuid": "30183934-6f44-4aa5-b0c4-fd6891b00504", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981839, "uuid": "f1d3d632-dbe6-4d8d-a867-0e924b69c2e8", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981839, "uuid": "67f4822b-a3b2-408f-9ce3-c7829a25b494", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981839, "uuid": "ddbeb5e9-8b87-4af3-8cd8-d07e27f52ce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981839, "uuid": "12139bda-e3a1-4ee2-973e-9ed61e589291", "value": "09e7e5ef4bf59c633976810f37649d117523f9e249674b26c2238fe8839a1d18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a9a6bf-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688981851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981851, "uuid": "44f98c74-c857-4734-8125-d71f5617b24f", "comment": "Malware payload", "value": "968875f0e4cd6c2aae5f0e8711f3b8e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981851, "uuid": "0044df88-5ae2-4198-a0b1-adc31463e74a", "comment": "Malware payload", "value": "0a14d9458a29f76afc29a106253adaa3d36a7aa73941a1129881117071fd082c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981851, "uuid": "d0890226-8ee1-464c-b92d-e7d386177a87", "comment": "Malware payload", "value": "b41aadd122e5c7bc8829cc701ebfbfa732616157", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981851, "uuid": "e0f2a780-da0a-45d7-b750-b1a426397a4e", "comment": "Malware payload", "value": "60ce1de3eb1e0137f40d9d08f115deb38081adf7241492fc78f3e40aafa58a30ba7b7da189735dea0265b2f1fb33de99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981851, "uuid": "943e5bc3-459c-4ecf-b4bb-15507374d80c", "value": "T12DF26C42A381D4BAF51303B65876D7574232F23A5081EA3EC7996935EE27500D7373AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981851, "uuid": "453c4371-cebc-43b0-9f6c-cd6a156b43ef", "value": "768:s+eI0ygUrKB3kv5Ri7cAFq/Dplo1kLX8GrV+wIl:sr1MY3Qrkq/tl+kLf0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981851, "uuid": "1fb272d4-d00d-4521-8be2-fde72dbcf4ec", "value": 35740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981851, "uuid": "0e286b34-0cc6-4772-923e-a5fb6058b3a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981851, "uuid": "69cffc87-0267-4890-a173-808286cc4921", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.18848.28133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f726ae-1f3b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689005025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005025, "uuid": "f0159431-192c-4096-afab-ba27549a74e8", "comment": "Malware payload (RedLineStealer)", "value": "c86ea9744ea3cca905b7657585568de6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005025, "uuid": "49c27d8a-9398-4f23-adcd-7db4d1c2be7e", "comment": "Malware payload (RedLineStealer)", "value": "0a65c977910ca28680d005dc6473013f3db66862b80fc54be76caaa774022bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005025, "uuid": "e3806612-f778-42ff-83f2-09e20c1d3fac", "comment": "Malware payload (RedLineStealer)", "value": "ba018b2d08a84d2e411b27e314cb8a23a06865f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005025, "uuid": "8b50b3af-e9b0-4c3d-8800-23d304ee14b7", "comment": "Malware payload (RedLineStealer)", "value": "53f6fe9bc8e44c9c0b5ba51f4494f3f28cf7385c4553a41c8bf0156b602560604b154e43ff72a631ab6736cd4ac5e518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005025, "uuid": "1fb75c7d-ed80-43d8-ba3a-cf5ca8f74647", "value": "T191152243A7D958B2D9E06B7069F70B831B35BCB1697857AF1380489A0DB3AC5F43136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005025, "uuid": "82178132-95b5-440b-9997-d7dd60403a59", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005025, "uuid": "2cf478e8-151e-42b3-8b8f-27c19ad06216", "value": "12288:9MrBy90lDtGyHT69dmXPVxG0IYjxSkZiUnt6YdipFOj47Ec0yWLcp6pSa8YmZ41:kyQtGyHh9xV5QFpQj4T0HLc5NtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689005025, "uuid": "236d1ca6-8de6-435b-92f2-a8fd11f67d3f", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689005025, "uuid": "894b4ed1-d8f8-4b09-b032-8daace236571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005025, "uuid": "1b7fb69e-749e-466b-a204-01380cbbf27c", "value": "c86ea9744ea3cca905b7657585568de6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db93e88e-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688969166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969166, "uuid": "f753b2e4-9443-41ce-bda3-3059d42ccf87", "comment": "Malware payload (AgentTesla)", "value": "8621f961f2a8cd9b9fd0a170134f451b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969166, "uuid": "03a94fa4-8b9d-4c9c-905f-c772b54211d9", "comment": "Malware payload (AgentTesla)", "value": "0ad61076e9d17ac248b46062ee4b5db075b98b12c6100bd06dfc3d27756c38f5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969166, "uuid": "ba20e8e9-caf9-4823-860a-dbe9357ea874", "comment": "Malware payload (AgentTesla)", "value": "f700024251f4176ac92a4c863ddfd3514b8dbebf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969166, "uuid": "2194de34-de27-4641-8aef-6aabf55f9eee", "comment": "Malware payload (AgentTesla)", "value": "29df7d578392bb1124c203e5756a4bd219acabe29f3e2fe06958a52fc4e69239b5391d4294bec23b8fe96db17f7a9d72", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969166, "uuid": "cf772f96-7d13-4867-9be2-03b1ca1648ce", "value": "T1E2B4238101B4EA184DC74E9C95D57ED53663FAE80B25B326B307D32D7CA108BFD14AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969166, "uuid": "af32ae0b-48b3-44bd-a356-92107cc36677", "value": "12288:A6FEoH2IzNojASOjOW1muvQfE17jOw1/eMQ1S:A6zHpzCjW1QfERjO9z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969166, "uuid": "f429dd4a-9dd3-48ac-9e78-f086c77c01be", "value": 525581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969166, "uuid": "6b23009e-34a9-42ca-b905-d4df39f43e5d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969166, "uuid": "6b1b5c3f-c698-4789-96f8-0254873e1352", "value": "PO#TY20230428015.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25817320-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968861, "uuid": "8ba4c9c5-a3e6-459d-aab5-22d4fafd2b57", "comment": "Malware payload (RedLineStealer)", "value": "7f08cf7d2cecba48e5231cabfea308ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968861, "uuid": "1b33146f-b29f-4394-8ff0-e61bb37ddbbc", "comment": "Malware payload (RedLineStealer)", "value": "0b260fe82fda22fc7fea57009825ad9e36f0836b84dabefcb49f99a636421e4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968861, "uuid": "b90b4fcb-742b-4282-bfc9-f94440af77f5", "comment": "Malware payload (RedLineStealer)", "value": "384840453afae8adf931c34d163cddf1748db3f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968861, "uuid": "ed0a1042-b627-4058-a6e7-b10f96f21ca6", "comment": "Malware payload (RedLineStealer)", "value": "f64ba4f1589b71608e8fcd1bac930fd4601fe54b055155a2361b9aefdb500c3b26740fb41b7bb39a58c5d9b36b9e3165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968861, "uuid": "b8ccd70d-c811-469e-8dff-1197136fd29c", "value": "T18944283921E144A7D8BA9E35BE4BC0D17116AEB4017C541F3FB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968861, "uuid": "0e14f0d6-89ae-4de5-abac-0b3abfcb6de4", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968861, "uuid": "05f6cd32-76ad-4c83-9f3e-afbdf9f2d7a3", "value": "3072:Vs+iOHMwew7+picM/esVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:VsvOswD73VVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968861, "uuid": "da2a909c-f013-43b9-9928-e7394a2d39a8", "value": 272548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968861, "uuid": "7810b925-54ce-484d-9b7a-2f563d4a5aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968861, "uuid": "1f41c19b-54b2-481d-93e2-17eaccb4eff1", "value": "7f08cf7d2cecba48e5231cabfea308ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e9f65a-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962613, "uuid": "4e0e5b77-aa90-46f1-935c-4dfb06bd56b8", "comment": "Malware payload (Mirai)", "value": "112c9e48e456a890a76453e785379b8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962613, "uuid": "a3b96de2-8f22-4f6c-8da4-c1bfa35bf6bb", "comment": "Malware payload (Mirai)", "value": "0bbb40a14bbc30b7475760532912370ed3b6da7c956ea36630d9e2ea0fa3d8fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962613, "uuid": "b9300e86-0885-4a83-9bcc-db11df7d0f7e", "comment": "Malware payload (Mirai)", "value": "a9d642dee36a58991d2dc3651bbe3e146a483801", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962613, "uuid": "fc8b9860-2b5d-4907-98be-d9a99f6d48c0", "comment": "Malware payload (Mirai)", "value": "1f9b906e74726da47d8f19ead2619a1b02e41e16a09781f81033c75f69597a9bd27ea5388d81715ddfc052aabd707f19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962613, "uuid": "aa23cca2-129f-49d7-800a-e6185794a1fd", "value": "T1A8D2E150C1B5D9B0C331893BF634C7C9BED956BB929A22771A13757C22472038CD97C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962613, "uuid": "97fa3a4f-3e60-446a-8896-c669420f30b3", "value": "768:cyhat7sMRf24niBolSCBVDzRwaNw7s3Uoz1P:cy8tNnFlSCmaZz1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962613, "uuid": "1e91f962-bb42-427c-8884-cadace2f91b2", "value": 30292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962613, "uuid": "9dfab96a-2079-4e95-b26c-46b6c12b18d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962613, "uuid": "d3a6677d-594d-414a-b083-b7883aaad9bc", "value": "112c9e48e456a890a76453e785379b8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b88def9-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688990882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990882, "uuid": "9d18908f-a3f1-44c4-b6b3-880a7f135df6", "comment": "Malware payload (AgentTesla)", "value": "467aa373b20db6d16cd7a3a5d9bab790", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990882, "uuid": "42a61001-8630-4dc2-95d1-17fe6d04e977", "comment": "Malware payload (AgentTesla)", "value": "0bd6d4877e810789e06a275245721bc5c7559a78fa57f2130dda35b4c4a12145", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990882, "uuid": "eeb5b868-9bff-4ef7-b49b-c31f1f894544", "comment": "Malware payload (AgentTesla)", "value": "12a5d3a19ab40e60a2ee2aeb947a64dec2792d2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990882, "uuid": "f0b05a70-b923-4bac-8ddc-38bed824ca5a", "comment": "Malware payload (AgentTesla)", "value": "23a99b5e1ea75f80ce8cbeade7c92929c99d0f5afa241afd3c0c4e3194eb81da23f04d4cd2f034dc193bb8cec30bf899", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990882, "uuid": "0081fb6e-f0af-4cf2-92de-7feec2515dc4", "value": "T15FC402275269E366EC0C0FFC2541458A67E558089DB4EF6C8C7BCCD18B76BB414ACB8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990882, "uuid": "c8e16ba4-37fe-416c-aed6-1d2466c01e58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990882, "uuid": "49e3388d-f27f-4f28-8b91-1e0f02bec791", "value": "12288:WiV0sfEfpNjfPj4H735/VEPcuwS34rnHkkiDJZdu/Heqt:WGcfpNTEb3eCbHNr+qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990882, "uuid": "94b54840-888c-472c-82cd-fb8b43055af7", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990882, "uuid": "84485a23-21c4-4f30-93dd-3d28016a679a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990882, "uuid": "e12e8103-1a37-49a8-8f8b-7fec02bd63a6", "value": "467aa373b20db6d16cd7a3a5d9bab790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ab9b35-1f1f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688993260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993260, "uuid": "d6d0e52c-504e-451f-899d-e502bc68640e", "comment": "Malware payload (Formbook)", "value": "c415c178036686bf3a3fbd8dc296a686", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993260, "uuid": "e9e7c52c-6e31-41e9-a8c4-b62fd83bf5a8", "comment": "Malware payload (Formbook)", "value": "0bdde3cb5bc10aa2aa88e00599e59b6ebfb1ce24fe78dc2871ba3c8118f61c91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993260, "uuid": "f2a290c0-cfdf-48c2-9ab4-5e7dc1d995bb", "comment": "Malware payload (Formbook)", "value": "c1a9c3c79a3c9a9962bd5cfaabe51774b929afd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993260, "uuid": "e3f19e93-70a2-4c86-93a4-f3259d5d92d8", "comment": "Malware payload (Formbook)", "value": "ff6331ab4edcfadac5db6e3fb191cb160f961354191689a3075a96494a9922dfb37ed129f0b59d6334ca9d373a8ff9ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993260, "uuid": "b14ea580-5817-4aab-8ede-14c3ad0a478d", "value": "T190B412473C308063CAFA1E725B58B5B1416AD6721913A27C8755BDB3B0DEF6B9B08C63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993260, "uuid": "83d2919a-e474-408d-8e52-1509da667fad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993260, "uuid": "0b2cdb34-3642-4963-8de4-49f2d4cd4036", "value": "12288:L1I+ZdhnhN/xayCvZPcdDFuP/27MsrfH0tj10YJ:RI+ZDhTikRuP/C/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688993260, "uuid": "12603881-fa79-4053-b712-8cd9c7cef6f5", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688993260, "uuid": "022cda2c-7274-4466-9b9f-8758fdacf7c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993260, "uuid": "4ef2b29f-b7d8-4fd5-b6e2-3f39f59e3fdf", "value": "csrssd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc144fbf-1ede-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688965275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965275, "uuid": "c63c376f-1ef0-49fc-8158-310558577577", "comment": "Malware payload (Mirai)", "value": "a243bb263cc8608fdddeb27a5af68206", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965275, "uuid": "72abc70b-4742-4641-868d-e94972caaa18", "comment": "Malware payload (Mirai)", "value": "0c3ab96cb0a8cc777d3b0af7bf125270d052340bfdf17ecf9d1ff3d45f29dfbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965275, "uuid": "7a7d00dc-f001-4376-b9f1-9fe2fafb40ba", "comment": "Malware payload (Mirai)", "value": "a60b1a2143028463b7c3dcb8352d567e2d822e4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965275, "uuid": "4a0d46f6-1196-4c9a-834b-4a00f4ca0f95", "comment": "Malware payload (Mirai)", "value": "5ca92a1541b3f6405ff84633802ffb7e26dd0354e111f3f3a3ea0c690e1256b8ffa75d169954c3dc4b41d53bad6adbe6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965275, "uuid": "e274b112-3be4-47c1-894a-0f7ecfc65471", "value": "T15EF329C7F900DEFAF80AE33B48530906B131B7A254924B377257796BEC3A1990577E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965275, "uuid": "ee1eeaed-c96c-4428-b2e4-c9cc66008c56", "value": "3072:loXOsYpkUR6jzNFBeFPQOqvkD/X+8ZjVCFoVfjbikLtJFVaXyB3dD:ltzEekvs/7pCFULtJwyBtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965275, "uuid": "7b3083f0-1509-49ee-b410-46f9c0e760fe", "value": 165964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965275, "uuid": "0ad3b97e-9c19-45f1-8e84-15c6d4d76e53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965275, "uuid": "c7b85eb3-3a28-4a02-b946-5de2e58d6658", "value": "a243bb263cc8608fdddeb27a5af68206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9ff25c-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962594, "uuid": "c9254a6a-f5aa-4d0f-8633-2e84eff3dfa1", "comment": "Malware payload (Mirai)", "value": "71da4ab558a6981d853239725b66b26e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962594, "uuid": "e32b65a8-464d-4b5c-acaa-e58b3f112a74", "comment": "Malware payload (Mirai)", "value": "0c53a1495c83e70457fdaaa02c44cd55d09bdb81c1784f17d41c694e7d205405", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962594, "uuid": "99603723-e65b-4b44-a1a7-165d79bd51d3", "comment": "Malware payload (Mirai)", "value": "92ebc8183783cb3355ece7ef46160a5dd2eb12f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962594, "uuid": "3cbdc055-d59f-4089-b305-7600ad21349a", "comment": "Malware payload (Mirai)", "value": "8317fbb7b0447d311813ac88778fa0c62eac6f9268502f0c2fa4ee18f69e9c8389bbf10b646cc881ceb2c07232581dfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962594, "uuid": "f0a57be8-a4e0-455a-ad65-991ed9e2dc0c", "value": "T1A5531B8D54421E2CEAD79CFD50764F099D551320A0A30B1FA6EBFDC33DB32A9EE16648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962594, "uuid": "67d837fb-ee0d-4390-8dc5-badc15c16897", "value": "1536:kooK4nofUO4SQqk4QEqkNjWP7FQPg1pNxLuy:zopqk4QVkNEQipnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962594, "uuid": "98eb65c9-9d65-4732-a9ba-777c7d11b774", "value": 63060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962594, "uuid": "732a473a-3072-41b0-a89c-a04e80dcce2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962594, "uuid": "47b4bbfd-3bac-4a7e-97bc-13cdda0ce39b", "value": "71da4ab558a6981d853239725b66b26e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f31442-1f1f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688992906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688992906, "uuid": "5094f51b-7881-4e9c-962f-cc4a64539fb6", "comment": "Malware payload (RedLineStealer)", "value": "f4da3bf12c10786ba3cdf5a1eef0d386", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688992906, "uuid": "7b48360b-10e6-4650-babe-1ca8b088b8d6", "comment": "Malware payload (RedLineStealer)", "value": "0c5d1c2c1f5bcb910d25419e87349bce28055b67de3ef6bd1e511a6b17290fce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688992906, "uuid": "ff3e901a-e92c-48a1-b0be-31a094dd0aa6", "comment": "Malware payload (RedLineStealer)", "value": "dc3d6daefead81844e1e6a41eb992d3679239196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688992906, "uuid": "5708d935-d926-4076-94fc-f963bfce1d9a", "comment": "Malware payload (RedLineStealer)", "value": "e078eac1785d590d11252f8a7b838cdfa2d1fabd7015252e3edf2d37d49367895401a76c76d89de0d9285f30b16c9737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688992906, "uuid": "2fab1b78-c7a0-42a7-b84d-ae7c96fd9cdd", "value": "T1EE64BF8365E0FC63E4664637CD2ADEE8762EF8614E59775A23186B3F18301E2F663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688992906, "uuid": "e3d72e52-6734-48a8-8d29-62d7e9282526", "value": "89580c01d87da774c9ed352344b8ed4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688992906, "uuid": "981052a0-f749-430f-950b-c5ee057a5a7f", "value": "6144:CAkL3Uvz8l3yh+oAWdCQMt31Nbd7kDmsrO7:9kzOzuyhtCbtldgmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688992906, "uuid": "625e3bbd-a96a-4861-9aaa-e0b8a3d210c2", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688992906, "uuid": "cd86b343-5c51-4571-acaf-c523fd78f15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688992906, "uuid": "e5a47017-c72e-4b06-9912-7087bece1cae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcc11f0-1ebd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StormKitty)", "timestamp": 1688950785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688950785, "uuid": "cd8beb21-967e-4994-9b63-d2785c37eed2", "comment": "Malware payload (StormKitty)", "value": "1134c4fc601715848430812799d0f966", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688950785, "uuid": "dbdde834-d5be-485f-be43-73a2d0cb977b", "comment": "Malware payload (StormKitty)", "value": "0c69a4aceb2d7addb911bb4d1991e01d0f8ced3f40133f99422e1fe924be39fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688950785, "uuid": "00b7a925-201c-405d-9b06-cf2a0b4250dc", "comment": "Malware payload (StormKitty)", "value": "349cb575f63e0880d0eca933bd7e0b602d9a6e03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688950785, "uuid": "837348ec-6f84-40f0-8dff-8cb382a31e01", "comment": "Malware payload (StormKitty)", "value": "c6fd6aa9924523495b2454a2926734fe836d0d05ea14ee359aedf33869d0b176c644e3db57a0abaafb0d870d64b2799c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688950785, "uuid": "6079a4bb-b71b-4418-94a7-ee54c357dddb", "value": "T1F7C38576A5FCF901D96CE230D706E2F5E5D16D61DC202893E066BE5B3A339E3460A873", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688950785, "uuid": "3803f519-22a0-41c1-a1f6-680191322a5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688950785, "uuid": "ee2dd335-25c1-442b-a16b-a4c3844c96bb", "value": "768:Gg9ToOvKw8keZuLslTzQn0zTV6edivTbyISSSSU:h87w8jZuLs5ZPdibyISSSSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688950785, "uuid": "2f75c6e6-247c-428f-9518-0bad76d3766f", "value": 120320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688950785, "uuid": "5a46d364-8369-44b2-882c-f6a980143872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688950785, "uuid": "a3ef5e6b-a696-48a2-a577-24af81b60e3e", "value": "1134c4fc601715848430812799d0f966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c396ebd-1ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688974858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974858, "uuid": "54c312b4-8b91-4b89-9df8-d67d1d15f7a8", "comment": "Malware payload (AgentTesla)", "value": "4624df1a5b317d440c5cc23eb50148b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974858, "uuid": "226e4d31-0443-4411-864d-4a7acc2172ba", "comment": "Malware payload (AgentTesla)", "value": "0caa683c9f3f6bcad952386397eb6a3e70d5c0f4b2b3d8b144f03a620e81ef0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974858, "uuid": "5761890c-e931-459c-a1bb-e0e4b138984c", "comment": "Malware payload (AgentTesla)", "value": "a566f8cba29ac5d8edb788cb2449179a578420ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974858, "uuid": "5f0abc0b-6dfb-4fc1-9f17-cd0ea060c064", "comment": "Malware payload (AgentTesla)", "value": "79ed8448e7da639782ee40c26916a460a78fecb3b0a06a842042afc02117c624e39afd3c535c01972ca85bd73fb6b7d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974858, "uuid": "90808e0d-9c65-476b-8690-347ca6d07393", "value": "T1BBC4022251A4EB36D85C1FFD2048994A37E559499C34DA3C8C7B4CD6CA3BF3410ADBEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974858, "uuid": "89f4563c-b5ec-48a2-84e3-e0dfdb2d1263", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974858, "uuid": "c7fc2565-2616-4ecd-a092-de03ec6cb6cb", "value": "12288:onKdzi1uC9peP6dKdC24GdhDkcJXVIDGJqjqvrXSR:oizi1uypeLX1Scga1vb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688974858, "uuid": "073ae16d-7942-40d6-8683-0b19d3577b7d", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688974858, "uuid": "6d8eea61-dd0f-46a4-a741-bbf039ca7ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974858, "uuid": "c3391694-bb1f-4464-8d88-822c7eec27e0", "value": "SGP191001-000045.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adb695c-1f1e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1688992599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688992599, "uuid": "316840e3-8c88-497c-af6a-9f7adbd1e203", "comment": "Malware payload (GCleaner)", "value": "fd8de020368eea1d1513f2ba42f1d01f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688992599, "uuid": "66fcbfc4-d5a1-40c5-a09f-5463fea0b669", "comment": "Malware payload (GCleaner)", "value": "0cb23c9c198f75221328e8978735e0ec260c4435b7e7e94eb76620ddc020dd84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688992599, "uuid": "48feb8b9-3139-4e70-bca9-ba5a4bc8b6e5", "comment": "Malware payload (GCleaner)", "value": "c7ac149e61846fb5304e6583e6a33eeabe820a23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688992599, "uuid": "e986fdbb-37dd-4ddc-a332-cbccdf9282e0", "comment": "Malware payload (GCleaner)", "value": "68d875ecb3fabb501739b64f9ae2e8026dce7934de5ccb89e67e2bd3c87b0451d0ede25a1193d3a7253c4e7f6c90e2f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688992599, "uuid": "e34b2906-a5a8-4bb7-aad7-ef73d6e357b7", "value": "T1533523A3E9E80178E49156F85E0B5651CFBB3E237A383105F59C6F5E9B2F162C84A370", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688992599, "uuid": "4dad7bb0-af54-4cbd-84d4-41338b93854b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688992599, "uuid": "86cc2ce7-224a-4cc5-9ea5-cbe7f508d0c0", "value": "24576:nfOyH3/nna23zkgJMx4911cYsCvIi5Mm1Ihdl2vSBreuS2w02VnKU:nGM/naCQBqcvzFeuZknn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688992599, "uuid": "4f8b10df-cde9-4d57-b983-2db40e73166f", "value": 1125911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688992599, "uuid": "4040146a-7c6b-4b98-8de9-d813401c9607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688992599, "uuid": "7469f421-fbb8-4c3a-a930-57592174c0dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6099b02c-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985710, "uuid": "5641bc8f-ed4f-4ea6-94e8-aeba8acaeb44", "comment": "Malware payload (Mirai)", "value": "3ed59f52fa737ac088e88179b9e6cd02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985710, "uuid": "7d3f1d1a-41db-434d-a695-e3f8f3ee8bda", "comment": "Malware payload (Mirai)", "value": "0ce6a08c12769bb3f1b1823845db98cea25178b97e3b717979a18fbb11fdfd7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985710, "uuid": "2e04efb8-99b8-4b56-8a0a-724f04a3765b", "comment": "Malware payload (Mirai)", "value": "54148e85299ab195927991ba7ccac6ab467dc429", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985710, "uuid": "1e95d4a1-d958-41c9-b1c2-37540846a46e", "comment": "Malware payload (Mirai)", "value": "1709bbd73cf9e195b76e73bd761932cf754c8fb8fb4691469eedef23e92f0f475260b41f64a507f23b53f5e1f4b4f754", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985710, "uuid": "0fa54d59-4d6c-4c00-aeed-52eaef7f0efd", "value": "T11913E988FD54A22AC7D162BBF61D03CD373B07A8F3DA33225E355B2137C6A615A3A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985710, "uuid": "d42aa0a0-03de-49bb-9106-2a0157a5db0d", "value": "768:x5hRenT/uMfOLjsocsIZ/rDS4wMjmt7trIkG/V6SfwvFI:TPk/HmooEJDTC1ZIkUZIvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985710, "uuid": "27e7d250-2caf-46dc-8e67-dd104396f01d", "value": 43160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985710, "uuid": "142d09c8-6309-4a69-ab94-38b1fcdc7707", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985710, "uuid": "6f7bf8f4-b7ce-483b-8a4c-fe1a974acb00", "value": "SecuriteInfo.com.ELF.Mirai-CE.11965.11630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68606c96-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985723, "uuid": "ea8a579b-450f-426a-8108-7dc401ee17d6", "comment": "Malware payload (RedLineStealer)", "value": "3f9077764c3120108f65fae22c2980ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985723, "uuid": "6e1f63e4-7826-41e7-b241-1564335d13d1", "comment": "Malware payload (RedLineStealer)", "value": "0cff17c6758eecc410176fbe842f7ab1eb5477deb31f07cbc6832a77866f2c67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985723, "uuid": "dc3dcc3d-4d9b-4b01-b9d3-54d63ca9497c", "comment": "Malware payload (RedLineStealer)", "value": "3630d998d22f86cb9219e3e3cf17280f39f75e54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985723, "uuid": "89a36994-8862-49e9-847f-0860af3c3838", "comment": "Malware payload (RedLineStealer)", "value": "d47df2bc10533f3c9c488e7130bfdcd2b358731421a900d9d0262c7f7002cc89e6aaddd07bcca1336a191156671d7600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985723, "uuid": "d5e686e8-d8f1-437f-8e25-0b9b80be142a", "value": "T110C402A471D24533F67204B355E0831EBF2BDE7255919A8393C9B93E4B2A1C04E3ECE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985723, "uuid": "ffcb951f-1d00-45c3-b05d-161176787c04", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985723, "uuid": "a298bc3c-b795-43c0-822a-34d61225779d", "value": "12288:5ugHgnz47QDeGN8wTLK6pUcR2RYyS3U/m+:5Az47QOKWcR2RCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985723, "uuid": "e0a9c63b-bc86-4454-943c-056405255fdb", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985723, "uuid": "9ba9b8b8-77e6-42f3-9356-575567531d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985723, "uuid": "13012df4-bddd-4c0c-9e7d-9c1010aa9bf6", "value": "3f9077764c3120108f65fae22c2980ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1d73ba-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688990862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990862, "uuid": "8d7e5d13-d364-4604-9e34-608743cbecea", "comment": "Malware payload (RedLineStealer)", "value": "9a38ee1a56e4bfb639624abcb8e2f078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990862, "uuid": "9aa476b7-179c-4668-b415-ec20d5ffd837", "comment": "Malware payload (RedLineStealer)", "value": "0d3c13c3388fbab9d002342246aa89105e0a530bcd547ab71ab9e3d3ce93ad94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990862, "uuid": "f2059c3a-36f9-468d-883c-821b6d122ddf", "comment": "Malware payload (RedLineStealer)", "value": "1b7081ad19a94a86fe3365acbbeef1809ffc672f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990862, "uuid": "4f56a533-b84a-4c42-be7c-81f0fdaa37d5", "comment": "Malware payload (RedLineStealer)", "value": "ba161b7247a9ca37570cfeb81f4a8b0f70ee6c6bf335f48c4c208a970fd533d91ee02f11a5c79a87646d3474c96963fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990862, "uuid": "24058b3b-bb35-428d-b607-22748caca3b0", "value": "T1ACB401A5B1D25533F676017714A0822FBE0FEF3519A0968393C97A3E47241C28E7ECB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990862, "uuid": "cf03eb64-3afd-4c51-93fd-0999e385b3a9", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990862, "uuid": "d831f49e-4c59-4abe-8a5a-0df75cf7e025", "value": "12288:IG0UBwz47dhI3iWJZJMa3Qn53NvlCx4m:Imi47IJM6Q539lCx4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990862, "uuid": "62e166f6-b91c-4669-8488-e64a8efd1fee", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990862, "uuid": "39b33343-eb3d-4e17-a2f8-f9c37ba09018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990862, "uuid": "86d3accc-3ed0-47bd-b7f3-c92e8fbf703f", "value": "9a38ee1a56e4bfb639624abcb8e2f078.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e200ef39-1f76-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689030595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030595, "uuid": "489047ec-f9af-4aec-b63a-ebae2f12cb9c", "comment": "Malware payload (Mirai)", "value": "2a55ea8cca2164b6e9ec93bd55ec1115", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030595, "uuid": "76ea12dd-d6cf-4384-aaf1-398b5e6a48d6", "comment": "Malware payload (Mirai)", "value": "0e17347460d19fa7cbc5eb0cb84b5bd9fddd15f2998e0d0b3b62206905f37184", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030595, "uuid": "23cd44e2-da9c-41bd-9ff4-867207c28e9d", "comment": "Malware payload (Mirai)", "value": "15a9bb2f4215a0221c9e0d9e69281f92fd6b0504", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030595, "uuid": "45474e37-d35b-42e8-b2a3-b13ff1cce0cf", "comment": "Malware payload (Mirai)", "value": "77c0451f015415f95863f221fa3ba936aa26a5c513603678b7f4f9958769a0e8c60e2fe5ed247557f76f2cea29219909", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030595, "uuid": "0d7e4eb7-5158-4e74-9b6c-e8220c791114", "value": "T124C2E1E07726F931C420AC3DE53B4C8A3A51063C81FF353664259D398EC265A67F84FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030595, "uuid": "9bdd98a6-c961-47cf-8c95-4df3ef83b1ae", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrwB9q3UELuS:PKy4qfqoeJdXWgNL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689030595, "uuid": "c1211ef9-1bbe-41b4-89af-69b2944d89fa", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689030595, "uuid": "d66b6944-6c91-4e9f-8d19-9e6950c37b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030595, "uuid": "fb2b3b21-5c01-4fbf-b9e7-c01afe1c6146", "value": "2a55ea8cca2164b6e9ec93bd55ec1115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be96406-1ef2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688973676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973676, "uuid": "f5c6e015-b09f-4082-a76a-62d18e1586bc", "comment": "Malware payload (AgentTesla)", "value": "12d73790d00153d79a71c28bb8728c73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973676, "uuid": "298675b0-4d98-4bc0-b99f-c981b5c80904", "comment": "Malware payload (AgentTesla)", "value": "0e86371800fdb96f83f4da3fad66a443d54e52ace5ca428d4489e10c515b65b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973676, "uuid": "a91358b1-c6a5-466a-a4d9-cb8a698c3c50", "comment": "Malware payload (AgentTesla)", "value": "2dee56b08747f19091fdc8d523930919affa019b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973676, "uuid": "7e1984ea-8c81-410c-9471-687943176fc5", "comment": "Malware payload (AgentTesla)", "value": "32e5910f11d0992a6d4b3bf7f71f88539cf0226fb0de474431c2896f02d530e843ed6b07cacf1d9d3dcc433649040f1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973676, "uuid": "e308862c-6854-4d5b-8db5-30eb350032c8", "value": "T125B423F74B244032894CF6DCF6954330E255C4AAC644AD32479AD80E39CA8E6DADFF5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973676, "uuid": "77bedae4-3710-411b-95cb-d0254f4409be", "value": "12288:CYS9n6B7aT3uhUa6YvSs9SwnnkPqu4aNK9WuPfvpF4/58iGb:pW6ueauvfYrf0JOib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688973676, "uuid": "59fe2d52-eab7-41e1-8be4-267d4878fcea", "value": 514838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688973676, "uuid": "58b398fc-f189-46ec-85f5-953819ec0def", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973676, "uuid": "a20aff35-2d12-44b9-8170-9112e69a3a30", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f6b867-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688977884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977884, "uuid": "7bda4218-2849-486e-9819-d4a8b9e2ee3d", "comment": "Malware payload (Amadey)", "value": "44dd85a89c08b9d90eddd05528e291c8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977884, "uuid": "751f3084-dfc8-4975-bf7d-e199bbf66933", "comment": "Malware payload (Amadey)", "value": "0f83772323c355c872b6f4651468c25553e45e34e65af08963b68687254c8de0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977884, "uuid": "b3379102-d5d1-4558-8ab0-7901bebf3c05", "comment": "Malware payload (Amadey)", "value": "e805eacd929679cfc74badf31b842dce114d29c5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977884, "uuid": "0e2dba9b-d16e-4aac-bde6-9ffe359826db", "comment": "Malware payload (Amadey)", "value": "1c7d58e1f6bdb244d53a29a160ea00650adf81a98f49d870904a26ae36691c24af0d4f2fb3bdda3b06d723b5f68a40bd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977884, "uuid": "b3e47804-183c-4674-b233-406f8d8600ad", "value": "T1430512A479D25A33E67245732D70936EFD1BE9330D91458B63C8653E07290C28E3EDAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977884, "uuid": "a095dc7e-a2cb-42b3-848f-e22da1c3d7e8", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977884, "uuid": "7cf99c5c-558b-4102-a0d9-e67ec6f0dcda", "value": "12288:ly1IOCz47VksKxq4OT+r+zz43NhAPKdWbCclzXrEr16i3zpUU6wVYsLcbwz:gA47uZIBT+u09hAytcVe16i3zOU6HsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977884, "uuid": "126e1fbb-24e0-45a6-a660-0b9a96783b13", "value": 826016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977884, "uuid": "f951c302-7eba-4aaf-a79c-f6da3bd3f699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977884, "uuid": "94be955f-ad9e-4db1-bd3f-bd260c70e0bc", "value": "44dd85a89c08b9d90eddd05528e291c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0383a6-1edd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1688964605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964605, "uuid": "cb4e3d7a-82a5-4269-b831-6ca34d459976", "comment": "Malware payload (Gafgyt)", "value": "0c6ef635b112f1604101f1e5f0a8f847", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964605, "uuid": "5faa17d2-3de1-4f4c-a4b5-adc1dd531a91", "comment": "Malware payload (Gafgyt)", "value": "0f8a2b76a6b12159cc006a8594d49e2c75b1cc67e57fd700e1ae0f2d849e821a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964605, "uuid": "15ab8c73-a517-480b-806a-a1748b984d9c", "comment": "Malware payload (Gafgyt)", "value": "8431ee7680d8ac2a6de5580be5fcf05d5a3efa8d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964605, "uuid": "57f07bea-9b55-43c5-8033-e29737f7a144", "comment": "Malware payload (Gafgyt)", "value": "3eaa06499caa082a2c3bec989b28d9534844a7cbb3559122c3df3dcc34eb8ab9ed1a14688a639c5382b30aa86a2c9364", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964605, "uuid": "04de8f7d-1c06-48b2-8dfa-cf103df04148", "value": "T1FDC34A09E7408B57C1E2277AF6DF424A33239B54A7EB33154928BBF43FC27994E22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964605, "uuid": "c97247a5-dae0-48f4-854f-7d8532ae0468", "value": "3072:N8DFUioeZNe7asrwfAR/zfP9xmw/9MTO6scd9M/9XG5dz:N8DFUioeZk7asrwfAR/zfP78O6s8M/9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688964605, "uuid": "abdf1196-bd19-4699-a8a4-cf82c6c3a68f", "value": 128687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688964605, "uuid": "7233a9c8-7354-4cc6-b584-8e69f73c0f4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964605, "uuid": "8d447f09-34eb-49a5-b9d4-a94f5dd56de6", "value": "boat.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1074245-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985040, "uuid": "86295a56-4ce7-42f9-b8ed-6090cb4b85f4", "comment": "Malware payload (Mirai)", "value": "f80da7f717a60e698a68b52e342604f9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985040, "uuid": "85cae011-d06e-4ed6-889a-bf45000e5fce", "comment": "Malware payload (Mirai)", "value": "1096a418a6faf66567825457585aca463ab916fa1e888bcb0bf771e161411935", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985040, "uuid": "28c2a77c-b94b-4f56-925f-cc2c80a88b64", "comment": "Malware payload (Mirai)", "value": "6bf0884a87d4348bcde4c6a1ea1e6c2c7451cc88", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985040, "uuid": "3b63cdd9-85e6-412b-863c-8e5ecffc0594", "comment": "Malware payload (Mirai)", "value": "063ea107fa599ff9418eefeefd9193b4293644be1699eee05a740b71511d83e1ccbddb2e1a54f55392ebc19592e99817", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985040, "uuid": "170853f9-ad84-4cf1-8154-e9c1bed2a42e", "value": "T18E43E507EF514EA7D86FCD3302AD0B0235CD966B22E53B763574C828F56A55B0AE3CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985040, "uuid": "7cca7540-b622-4a3c-9db0-3c6c2bdcafbb", "value": "768:/PPXRHPB++f8cBFFMeSenaeSaVZDOwOuunuUUrlWZlgAXiTaqNqCr9uus5h9IR0:/nLVBcTuaYQGrlWZlgRaqNqADs5h9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985040, "uuid": "b54a665b-a34a-484e-8b10-a3bdd4666efb", "value": 60212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985040, "uuid": "08cc5ae7-70ac-47d2-8d56-a71a41ba194c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985040, "uuid": "a2dcfbaa-6cac-4640-a993-d54b71b228e0", "value": "condi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0f1f81-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688981840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981840, "uuid": "e4bd5b82-5d73-4789-98d4-2423adace35a", "comment": "Malware payload (Loki)", "value": "b87833af2f10087f8ffa48460f1d0f3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981840, "uuid": "e2953d15-463c-423a-976e-9fb0ebd93e54", "comment": "Malware payload (Loki)", "value": "10e0132db7a8417e1f00309d86d7f1ac41cadcd382eafd231cf082e3af532588", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981840, "uuid": "ef2763c1-6bd6-49ea-8f7a-e8747fbbe4e1", "comment": "Malware payload (Loki)", "value": "7cadda2512b34f4337b6851f16a48c93a40ba5d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981840, "uuid": "4df33f78-7e36-49cc-b293-6132d2bea665", "comment": "Malware payload (Loki)", "value": "7ecfb43522f457494500a8c705221d9efbd4572dbe4c56bd8013810a9fed14c3b38f6fc575e09b4d0d879b31134cc099", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981840, "uuid": "2e56318a-85d1-4023-8303-2dafbdad1164", "value": "T149A31A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A18215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981840, "uuid": "2f0e8776-8731-4ad5-afd7-750042d0fa58", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981840, "uuid": "9a7ac8ca-c274-4e30-8e61-c714610a40d7", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981840, "uuid": "8f316eba-a1a1-4d77-a78c-acae60359a90", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981840, "uuid": "f9f4b3dd-4655-4917-ad4b-2e4d65c40a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981840, "uuid": "9b0cb561-25ea-4d9d-a747-0f087cd0a6b9", "value": "10e0132db7a8417e1f00309d86d7f1ac41cadcd382eafd231cf082e3af532588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa5e3f0-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688990854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990854, "uuid": "062c148f-cc48-4ab6-916f-ed5b03d3545f", "comment": "Malware payload (RedLineStealer)", "value": "787567bb89700f1c24d7a1127b152a81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990854, "uuid": "4c26e895-ab3a-43eb-9476-b79660b84191", "comment": "Malware payload (RedLineStealer)", "value": "111028c0cf4fe595f8093917df1edd7671f61bdf354ebaf7e62dafd32c5914b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990854, "uuid": "9f0b3f29-8ed9-4e34-8fec-f0cf225bdbc8", "comment": "Malware payload (RedLineStealer)", "value": "a578d963d77293eb00376fef51f55615b5b9fd83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990854, "uuid": "a0878965-3a70-46f6-ab14-c79db2466423", "comment": "Malware payload (RedLineStealer)", "value": "c6366e3aed5f3cd8bee196007ba9824cd5f560af33b1c5cd7c0bee1551814ae064e03abbe52d119ad26167ef28422d28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990854, "uuid": "b6105435-a390-48a4-b73d-e950d383b9c6", "value": "T1F044283921E144A7D8BA9E35BF4BC0D17116AEB4017C541F3BB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990854, "uuid": "880c0f34-54a5-4d52-821e-581feed61312", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990854, "uuid": "cf83d887-beed-4dd2-a597-3fb880057a39", "value": "3072:rgs+iOHMwew7+picM/csVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:rgsvOswD7xVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990854, "uuid": "4c134cea-c7c2-4f3c-b817-7382a8ac6a1a", "value": 272548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990854, "uuid": "e4607c30-37a7-4c38-9174-c39369c7be6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990854, "uuid": "1036c563-42c9-4899-963d-34de5d574414", "value": "787567bb89700f1c24d7a1127b152a81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30904436-1f61-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689021278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021278, "uuid": "11ab12a6-9403-453b-882b-1cff26edb05b", "comment": "Malware payload (Mirai)", "value": "e8ea00aa1b7301fd3a6f3e2e3fdcd0b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021278, "uuid": "50115cee-e857-4e2b-9ded-2fc49fd73e4f", "comment": "Malware payload (Mirai)", "value": "1152dc2ba65477280c1c36e1de35ee260d6b52a53464c747a2732807a482e470", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021278, "uuid": "ead76a72-9c0d-4d14-9bc8-18de5c35f787", "comment": "Malware payload (Mirai)", "value": "a067cbc3c1945463fed6fd710696e6e7e4dac5ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021278, "uuid": "564dd992-9029-4f3f-937b-57d4f455a547", "comment": "Malware payload (Mirai)", "value": "4608839a60b83327126e9d6a51e2248a5ca6c8ad00a1e671981603c8148d29907c3212b9507cc466052e5b4b6c8aaeca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021278, "uuid": "0ef987dc-d8eb-41a5-8e92-8f00138f9359", "value": "T199041A46EA408B13C0D627BAFA9F424533239B5497EB73059528AFF43F8679E4F23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021278, "uuid": "23673454-041d-45b6-8f6a-a129963575de", "value": "3072:SdTcNYf7LSwbcU6a5l+Viuq2Ws6vVdDOLBwG5oYM/RaT:SdTcsLSyT6a5l+Viu/WDdDOtFeYM/Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689021278, "uuid": "754285ed-9962-4c29-a275-bdedc77ec4f8", "value": 175573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689021278, "uuid": "17babaa2-59c3-45d8-995f-1dd1e10628e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021278, "uuid": "3faa5956-6d8d-437e-834f-a0118b70d142", "value": "most-arm7-20230710-2034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c09038f-1edd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688964603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964603, "uuid": "d7374fde-e9d5-4739-9712-025f354a69ff", "comment": "Malware payload (Mirai)", "value": "8aa70364df4a43b4d9faa3a96009e19a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964603, "uuid": "844b0060-497d-445a-a3fc-85dd67b9c9ca", "comment": "Malware payload (Mirai)", "value": "11c7a5d431896fb0e98dceddacbdca0cfa209983cf77714aa7cd87284b2b077b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964603, "uuid": "e9560e4f-0a57-4957-bc47-5b3d1173c197", "comment": "Malware payload (Mirai)", "value": "d4c230e2235c5694a73d9b70cd40f78544c4eb8b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964603, "uuid": "868e565e-f58c-4f55-8ad4-7de4381fa83b", "comment": "Malware payload (Mirai)", "value": "5dd23ef9df712a2f5e4734243e16a06dc033cbc02d3da25f72d8fc792b80d3d863d64b59d116f0b677145031c7d3d7f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964603, "uuid": "90c16bbc-9499-4219-bca9-aea1d62f38c7", "value": "T1110318132450D1FCD599C5705BBFA62BCA33F03D5235FA8A73A47E2A6D0BE211E1AC49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964603, "uuid": "bec7e636-3088-4336-9682-7ea8f6acfad4", "value": "768:gl18lk3Xvfb2LZtYr9cx7Clb6jrojNC5I:olHnWCo7CF6fB5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688964603, "uuid": "7e01d42e-c0ae-48c3-82c7-12f03aab007e", "value": 38144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688964603, "uuid": "d368227b-51e0-431a-8d05-4a7972413152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964603, "uuid": "1922cfcb-b5fd-4852-9b3a-a8bd10f15277", "value": "miori.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0a9c21-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962588, "uuid": "a3097c2e-0b52-4369-85f9-fbceccb869e2", "comment": "Malware payload (Mirai)", "value": "d2f2a931a890446c50e96d24b663737c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962588, "uuid": "2f217e2c-5dd6-4a81-bf60-f095f646d79b", "comment": "Malware payload (Mirai)", "value": "11cf0af65fb1bd43c92f960ab5e9e2fbc30f52d996e04738f3f1d656dc5161f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962588, "uuid": "60352e45-d7ee-408d-bf31-d052924b270f", "comment": "Malware payload (Mirai)", "value": "6a291f0dd845582efb6d149c54a9f4a17e5244fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962588, "uuid": "63abba83-8b0a-4283-9a82-780e7c09cc25", "comment": "Malware payload (Mirai)", "value": "b01d4494e99ec322e148380de4f61a752a0de5d77de4f7023a60f6627f045324a14bb9501f5690a516e3d90edc2cf591", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962588, "uuid": "f6f76446-f71d-4ced-b709-348ca4b9a488", "value": "T1EC73B079C5AD9DB8C6658B38F64289384B13B00955A33EF5EBC2C2664057AFCF5087F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962588, "uuid": "d9564b77-cc1e-432e-9294-6c97b840831f", "value": "1536:M/ELZ7mNaaJwtdgTrIvodqjcsBX5y7Ngfs3Xy8kUCwRC0Fa:McL4kiFTrIvoYRX5yCf+C+CwRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962588, "uuid": "d627cdd2-556a-47b3-b779-93653fede410", "value": 74720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962588, "uuid": "9af563e7-6e64-4b03-acb8-91252daf6d5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962588, "uuid": "39b6ba67-ea42-4342-be4f-812e65100d57", "value": "d2f2a931a890446c50e96d24b663737c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eebd41e-1ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688974916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974916, "uuid": "2cd400fc-d8b8-414c-9219-a496176dfd8b", "comment": "Malware payload (AgentTesla)", "value": "e9a580c8e3957f2962b2acb4b9a33eee", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974916, "uuid": "ad6b608a-d999-4a2f-9657-db6a099cd113", "comment": "Malware payload (AgentTesla)", "value": "120d50dbc11e93ae0ec4ba3c8a23339972367fbe8883fa027d62629c22372fe8", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974916, "uuid": "00b131b3-6c57-47f2-ba2f-a35b645912ca", "comment": "Malware payload (AgentTesla)", "value": "923fc4c95abaa44801c92131a5c7238a5758b293", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974916, "uuid": "e4ba1713-6a42-40da-ac97-001f87dd7157", "comment": "Malware payload (AgentTesla)", "value": "54d25425d056fc7dbabf4ac977415aa5402bed86e0c65758b582ff9df9679e8897816ecd59eba272c527098d1cb1a0d6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974916, "uuid": "29de1aa0-dbcf-4029-a8b5-824aad10cf0b", "value": "T159D423C38765F0193F993F1DB92B42D75EA9E37B0C9A7B17018D23BB28A745418901BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974916, "uuid": "25bcdc6d-6809-46e5-a8b4-24f645f2d94d", "value": "12288:CgniFhfx2Gy4zuI2LcyGkYjstSmU9/BFHbDUPUidR+Mx:RahftuJYO2/Bt07dRDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688974916, "uuid": "193fa7e2-ef37-4890-b8fd-a8e226938316", "value": 614735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688974916, "uuid": "09c7bcb7-2412-46c8-a447-61bf39b00f4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974916, "uuid": "eafaf4b7-3046-4432-9afb-3c92af6b860e", "value": "OUTSTANDING PAYMENT.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfebce24-1f30-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689000500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000500, "uuid": "e26a967c-06ec-4ee5-80a9-647b38833fc4", "comment": "Malware payload (RedLineStealer)", "value": "35762cd3ccc1574a12f103066ecba520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000500, "uuid": "597e888d-f785-4b7d-84b8-19ef2f03e29f", "comment": "Malware payload (RedLineStealer)", "value": "123830f5adc2114333a361b752e02a6ae770080082ba2b79c984aaf2debf810f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000500, "uuid": "4f385f08-35bf-4e82-8f44-f6c5a5d26b16", "comment": "Malware payload (RedLineStealer)", "value": "c7f02aeefc74ddb4d4134ac09418bbdcb250d192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000500, "uuid": "d6c46af1-e0e4-476e-be4e-4827b94e6ffc", "comment": "Malware payload (RedLineStealer)", "value": "09295e5730f3101f571a1eb9ad17641b0fe4f31350afea1a7e18ad3988926cdbf1a3042bfa7272e611b006c3da7614b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000500, "uuid": "d5b275b8-8ca4-4d85-af5d-fc8bcd46a3ac", "value": "T1D8151213B7E49277D9B56B7094FA16871E327DA18E31831F2A82ED4F0C726D4683172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000500, "uuid": "a98e4cbb-7120-4438-99a0-755ffbba2d75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000500, "uuid": "c455733e-5256-4b57-acc8-a67f10190c34", "value": "12288:1MrRy90zgvdGHHhfom5cyZF5RRvoIlBQpE73i3qnj5/vYkZrSsf1bBvzfS4R:4yDvdMFtZF5xPQmDiMdvYkQU1xSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689000500, "uuid": "44150f68-075f-42a3-9922-f2edb661af42", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689000500, "uuid": "00694d4b-f8da-48f5-86ff-99ddc6245b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000500, "uuid": "a8e4b4a7-a644-4254-9364-06f1a8b18ecf", "value": "35762cd3ccc1574a12f103066ecba520.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdd38f6-1f13-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688987796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987796, "uuid": "23423457-b3cd-42ef-84a9-c72075646c2e", "comment": "Malware payload", "value": "39c47863ba1127bb0f46600ac15e2349", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987796, "uuid": "49c9a7a8-a822-461e-9056-c048c3df706c", "comment": "Malware payload", "value": "12a12b2c2c7f52bac033f9583406472ead553cf92acddfe0009e0a2195e0fcf3", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987796, "uuid": "3c81fbdb-c0cc-404f-bb7d-ef76ecbb9a0c", "comment": "Malware payload", "value": "deade6e26c3c16bbacebe73788337205fd1d982e", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987796, "uuid": "0d30ce1d-5dbf-4ba2-a2a9-8d3c250d37ff", "comment": "Malware payload", "value": "8136bd59183f9932d6bd28f1cb468712ee07bdc88e8cb258c07c1e15d7310f33b138f29029e1ed5591ee8eef394a12a6", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987796, "uuid": "d3e02882-29c2-4eb4-b92d-5207748a9439", "value": "T10813294EE79F02658F410376271B0E8996BDB23DB35150B1386C837433E9C7E46A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987796, "uuid": "8ba54c57-7594-4c7c-a755-234d2da62789", "value": "768:BFx0XaIsnPRIa4fwJMqprSXGUQusSJLz/xs0xUNzkQ/:Bf0Xvx3EMqprS2UQu3JLi0xIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688987796, "uuid": "ad0efbb5-f234-4926-bcff-19ef0001eb4e", "value": 41826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688987796, "uuid": "bfb71173-3fcf-4ded-8f02-1ef5af02eef1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987796, "uuid": "86e74d3d-2fde-4e86-81e7-7660e23e916b", "value": "39c47863ba1127bb0f46600ac15e2349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639fa5d8-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688981850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981850, "uuid": "1ae213ac-aff8-4202-bd24-4d076bc00dc9", "comment": "Malware payload (AgentTesla)", "value": "4de14e43c886242bad473c2346389985", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981850, "uuid": "99298b72-3349-435a-95f0-1d1303c87170", "comment": "Malware payload (AgentTesla)", "value": "13e36dd78efbec69aab73c92a926ee54f892499fbe5174442ef912731352a839", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981850, "uuid": "7bb175cf-8eca-4c4d-af5b-754c0abc8eab", "comment": "Malware payload (AgentTesla)", "value": "9b456876d5598d50184fb499891112257b9c25f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981850, "uuid": "8673e89d-9f39-4f92-9b59-0e704b7fed96", "comment": "Malware payload (AgentTesla)", "value": "7484499a19209eb6bfe98e343034dd4a30c2faf39a649ba3c728c04159635dae26c1fd02747abf57de17b7a069a9c07f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981850, "uuid": "d7bdd380-0790-4e71-af78-fd32d09ef2a8", "value": "T1B615122136C1C172D4A6543442EADB78EF7DB1229BA6C1C7BB4D27B69E103D2A3712CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981850, "uuid": "cf88f78c-a6b0-4a45-9013-187c00790c0e", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981850, "uuid": "b724db50-0493-432b-b5b9-ab40b8ee2e3d", "value": "24576:tk70TrcrgBkhmwXaFEn1pL3nUeax7/ABIzgcaOv:tkQTArrBqS1ypxWI8caK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981850, "uuid": "415bd5ea-3f10-4ab6-b7c0-064a3166814b", "value": 924736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981850, "uuid": "c87996b3-17eb-453a-ad1e-b61e09fcd484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981850, "uuid": "30f6347b-6171-4931-a3f0-14df9e944121", "value": "AC221106.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4858ae6a-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688971066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971066, "uuid": "4bd3ee13-d790-48c1-89ed-7e16988c4166", "comment": "Malware payload (Mirai)", "value": "312990f5b13cb050d3b9c473dd7b99ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971066, "uuid": "cead48c8-bb3c-4ca6-91c6-a2b0eb51732e", "comment": "Malware payload (Mirai)", "value": "13e8da2f3817eeb38d3779a76b4be94e78fabde3fe0cf8c4bb6bb9ef9512d1c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971066, "uuid": "45f05ede-ff75-49dd-a678-8cf6866f8a73", "comment": "Malware payload (Mirai)", "value": "00500a6eaa5a990bde2ac5ef89f764ab3ceea9a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971066, "uuid": "b730cc8a-986d-4303-8fe5-65420b7c233e", "comment": "Malware payload (Mirai)", "value": "28d72e05fa41a69d5dcc98b6bdb333d667eb0944d464d182a4372af07db0509a4536bbd61bbaab5e861621840d9c4b86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971066, "uuid": "a1fb4559-1dc5-4b45-a708-ed10d438cbfe", "value": "T19583534E6E318FBCFFAD823587B75B20924933A627E1C544D19CE9011E7424E742FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971066, "uuid": "189383a8-1eb4-41d3-8a06-abb0f3e4d07b", "value": "1536:MQnOFmg1zaF1xh7hV6cBxImB15DX4q7zjw/lrlAVBbIZ:7OFmg1zkxhP6cVB15DXpzjFLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971066, "uuid": "aa6a3637-91ec-4a31-ad76-9a111c524df7", "value": 84236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971066, "uuid": "f118bda4-0f88-4e67-9afc-2727aa70f04d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971066, "uuid": "30f2c841-6522-48db-8942-0acc7d22bb48", "value": "312990f5b13cb050d3b9c473dd7b99ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecdc718-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688981842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981842, "uuid": "1704c1a9-57ca-4683-af1b-9206a71a3403", "comment": "Malware payload (AgentTesla)", "value": "9cfc7c44a69192df1a21df04e48e8eb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981842, "uuid": "d738bd04-120f-4bba-85ce-78b92c5de226", "comment": "Malware payload (AgentTesla)", "value": "1423a5d778e4db72f847f8841bb1dc04babace000a2ac3047ec1b8403d797db7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981842, "uuid": "fdf2576d-6d39-401f-8f9e-20e5d2fc84b8", "comment": "Malware payload (AgentTesla)", "value": "1d90e31aef69665afbdf8a91234df4d930e731bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981842, "uuid": "66468046-8a16-4305-86ee-59f8b44cca00", "comment": "Malware payload (AgentTesla)", "value": "039437aa3c8ece384f914fa61e147c286ef8598ae65b2ac98c95dd30a0180d0a9c76906c14611c097b41a0f58247098e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981842, "uuid": "a15582fe-d607-4ad1-9c66-7a447be74026", "value": "T195F34A69A2894C12D36D4175C8B611C80BB2D107A657E36E0FA1ECF63E567C33E2F876", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981842, "uuid": "2a6f9499-d6df-40f7-b572-c4477fe805ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981842, "uuid": "7aee8b74-5864-4a20-a8d0-2405c422cc0f", "value": "3072:fc0QpLiaQgY3xR0RI1iMJfIPidwR39xP2kkJOTo7oQx:fcbiqYQK1tJfIBxP2qM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981842, "uuid": "3b752de9-7b8a-4acb-b68c-36eceafface9", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981842, "uuid": "21eecbb9-922b-474e-bf78-bd7fb83d3a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981842, "uuid": "35c8c554-c91e-44e2-87fc-1d9919243694", "value": "1423a5d778e4db72f847f8841bb1dc04babace000a2ac3047ec1b8403d797db7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ef3a95-1ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688974851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974851, "uuid": "4edce8d1-b192-4ec8-bf65-fab40fe44636", "comment": "Malware payload (AgentTesla)", "value": "473dcdde668b44ac917601f5af97a598", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974851, "uuid": "178b1285-86f0-48f2-8e8e-9e96a908c275", "comment": "Malware payload (AgentTesla)", "value": "14bd4f95bb503d8706eef510d1e028cf88d99a6903a585d72d441007c6fb44f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974851, "uuid": "f99eb373-379d-4a6f-9973-5c8816c59420", "comment": "Malware payload (AgentTesla)", "value": "52c086b963cc71368cbdc0a22a48024ebda75c3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974851, "uuid": "439dfb7c-628d-4613-9b4a-391c737f5c5d", "comment": "Malware payload (AgentTesla)", "value": "bfaeda3f39c44b569960ff0d42f79bfb6bcc95293c50b7a08158525af35848582beddabbd46361b1a253d9bb4a05909d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974851, "uuid": "8370e180-a024-456d-928e-bf69d6901ace", "value": "T1D9B4232CAA7CF5D7804865AF1435B0A0640477CEA2F89E9C078F1D64BC49EF7836EE58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974851, "uuid": "cd8f71e5-c726-4cbd-8188-ab59bcd4d154", "value": "12288:4X6110iNLDTfok5gf05SEzSeYP9bdZMkc4/3Mcx1HZplo:4q0itDsNsRe/5dZMkc4P3ZZpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688974851, "uuid": "4edc968d-6d0b-4bee-9905-3883928e8d54", "value": 533155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688974851, "uuid": "c52620e9-77cc-48bc-a8b0-43ad9918c0f0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974851, "uuid": "075d6b02-269e-4c4f-8ad9-c9ab7cc1f1a7", "value": "SGP191001-000045.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85db9d53-1ef2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688973747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973747, "uuid": "d6a3fb41-9df6-4744-9f66-3c29a1d10a43", "comment": "Malware payload (AgentTesla)", "value": "9bc2bceabb2a6074e0198796b4f519b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973747, "uuid": "dacdff5d-59b7-46fe-8930-7e1b8eccd04e", "comment": "Malware payload (AgentTesla)", "value": "14cd4896eaacdfc8b02c8496fc9e589e7252e7a17979993d386247eef8932301", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973747, "uuid": "5e2d9577-7407-4527-8d8e-5c680cced652", "comment": "Malware payload (AgentTesla)", "value": "fc60eeb1532ee104eaac6cdc0ed62e8d8e30646e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973747, "uuid": "6f94e570-1de2-43f3-afe4-9722d2a0eac5", "comment": "Malware payload (AgentTesla)", "value": "83619da3c5d731563983c49d0f84d6356aee63d6222bdcc409e2aebf56dd4d6ace480c104cdc724421d6c5f137c2f4e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973747, "uuid": "727df78a-c478-43ca-b6cf-b201092f1598", "value": "T163D4E051717BEB26DD784FFA0901A50523FC699D6C3AE3288C9BE8CA0271F304599F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973747, "uuid": "0e8c2a55-be5f-4bb6-9e7b-35bd77849dce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973747, "uuid": "d4d36eb6-bf13-43a9-9799-cc270a3fd22e", "value": "12288:rbzNTPyyYFgnYWvYj3+9HjTDFhq/zrXooXtajnK7lzR:dKFgnYWw3+9Hvq/zVtCK7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688973747, "uuid": "f70df2db-cdb0-4ab4-8b53-3e1d27bf5c1b", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688973747, "uuid": "471d0120-390c-4a09-a970-aa652a416b39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973747, "uuid": "4875d5fb-dc3e-4fc6-b02c-1505965f9311", "value": "payments advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424f1142-1f23-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688994679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994679, "uuid": "525503e9-f5b5-46f7-959d-96bb407d41e6", "comment": "Malware payload", "value": "a13bc9402741893b86f976891d803d22", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994679, "uuid": "b1ead5ae-f70d-478a-b864-852122820e85", "comment": "Malware payload", "value": "14f3252f8411a1db60e262f4a5f4fc2cf4bbf704b8a223f12ebdfb1b86521a02", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994679, "uuid": "db72da48-fe90-4423-9488-173c141aa3a2", "comment": "Malware payload", "value": "13f7d2e1b87f8347010923a030d07d2715783141", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994679, "uuid": "885ee6bb-9192-4414-ab33-19a999e1c4d9", "comment": "Malware payload", "value": "814e1052d8d60d8d946a88ab64a1c009feb7d4bdc36fe3108bd638605826c6e04536f76b304837409d3b6a73763238fe", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994679, "uuid": "70afc15e-4e34-40de-a079-e8ce4a0046a0", "value": "T1C255AE223386C233C96E01B01A2ADBAB5579FDB24B3154DBA3C46D2F9DB44C26735F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994679, "uuid": "20bf940c-19e2-4662-8001-217d7e13a2b4", "value": "24576:C/sqx/N9YUVcW7LIJ1MXCOJ05YbswFbB2d7xLZrudqA:C/s69YdqbCOJ05Yb59czLZrudqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688994679, "uuid": "7e47733f-7226-41ab-a978-88c214b55d16", "value": 1364480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688994679, "uuid": "4c9d9e36-d937-4dad-b43b-9cc0f83bc051", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994679, "uuid": "44873ee6-6011-4ed0-80d4-d1804cf8cf17", "value": "Downloa_FIL_3vf5iTDDfg0eAy8jpo9MreZxNTG8ELsdfgsdfgWERK70\u00aexlsk.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6952407d-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688981859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981859, "uuid": "b2b5e59d-81a3-49b7-a603-130d9f24e9f6", "comment": "Malware payload", "value": "7e97f92de5eca43755cd5713741133bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981859, "uuid": "6cdf0d55-a4f0-4a1b-90c3-01e866f8072c", "comment": "Malware payload", "value": "1683074c3aaa2df173665774c449a5076a51f2f9b0481647cece807428642a67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981859, "uuid": "fe085aa8-f331-4b38-ba7b-0e68121552f8", "comment": "Malware payload", "value": "804aaa2540df6beef7a9f1ee5c8d280b8f47e43b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981859, "uuid": "2b401b4a-95c9-42b9-9664-8736ccbc6f40", "comment": "Malware payload", "value": "582a8f665a9c32972d91afb6707e837183d0d11d9c47f9ecd048e4868a4a4ccc85dac60ee1226e195ad0839610ffe47d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981859, "uuid": "af52d73d-d0ac-4dc4-a3e3-e52c43f95ce3", "value": "T186536526AB519EB7DC1ECD3305A9460220CDA09A53D83B6FB6B4C62CF75B90F45E3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981859, "uuid": "ea293a97-e21e-4d26-a356-6cd1f0a30df7", "value": "768:ZugseT2E0r4zIUb2eJQJ/9BEwVuRKwuUNAaj4LiyZ0ZkjiXiTUrewe/uyrAmTFIH:geToZc8ZoDAaj4LiyKZkj7Ur9SJrAKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981859, "uuid": "02499cbb-245b-4f33-a6b9-0e1c7eae723a", "value": 65340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981859, "uuid": "06850a9f-d0da-4f92-8c59-b9985e33da83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981859, "uuid": "61a66160-9f9f-42f9-8caa-f0fe85a00bdd", "value": "SecuriteInfo.com.Backdoor.Linux.Gafgyt.JJ.2293.4782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bb7865-1f65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1689023239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689023239, "uuid": "9e0c202d-a1e7-4447-ac0d-82aa88a7ecb8", "comment": "Malware payload (GuLoader)", "value": "a5f31e5305eb8a70f5c9f669fb5d5943", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689023239, "uuid": "a112ac43-06da-4d98-b11f-749fe1eec522", "comment": "Malware payload (GuLoader)", "value": "1689ce85bde9944b7ac6d570564ed31617e17c4f9cfe8aacb462c20aaa295f12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689023239, "uuid": "6f5c5191-8fa6-4ca7-ab74-a5de01ac8c81", "comment": "Malware payload (GuLoader)", "value": "d5bb56e50f82c5ac6eb2f4b10194c5a7bd7da496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689023239, "uuid": "22a05226-9ca4-4109-bd05-d09161be8c62", "comment": "Malware payload (GuLoader)", "value": "260f387c84982359ed071ee85abb17e78db44474aafa325ac33dfd506822588c14ffa436008a44ac8468bf1da9db65f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689023239, "uuid": "d9abe673-8645-467f-a173-940501f51a88", "value": "T12C84CF80E6889CD6F44313B14C76EA16112FBE5D54374A1A3E2B7A39BD732532326DCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689023239, "uuid": "e04b97eb-5c58-4536-8c3f-b14c4f2e88fc", "value": "17b7d61bda0f7478e36d9ce3d4170680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689023239, "uuid": "520592da-5a17-4c53-8b76-3da7105e73df", "value": "6144:4iucV6ntDwxp9x6+mIn3lBc3rqf5YggRj5ij2Fm+IB5Yoc20OnNrqXtXZlXX:4iuXtDKp9x66vgqf5sREy8d2ocaYLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689023239, "uuid": "517a3dff-9018-49f5-b645-28036c1c9670", "value": 374929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689023239, "uuid": "f71e891a-e2bb-4841-a5ae-b7494f80fe77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689023239, "uuid": "ddb24a4a-c3b5-40d8-88e9-a24a5f257962", "value": "r______________.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d4d681-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688977882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977882, "uuid": "4941a61d-09c5-4ad7-a4dd-4098d824c614", "comment": "Malware payload (RedLineStealer)", "value": "334f540186fcce91f63df7c3bc67f1f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977882, "uuid": "f2e9f202-6f46-479b-b355-d9e2b95e14c8", "comment": "Malware payload (RedLineStealer)", "value": "179762fccdb7abc4291363b29b9ad7759aa4c5d67e39b3f939d88d7d14af53e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977882, "uuid": "283c93f2-db2c-467d-b588-1e28098240e2", "comment": "Malware payload (RedLineStealer)", "value": "cf317370254fcd11d743a8646ef5465414f81cdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977882, "uuid": "d90cef15-9348-4718-96db-ce6cdb493439", "comment": "Malware payload (RedLineStealer)", "value": "b45e03a6c7c810fc139b4cfa137ae739f293cbbc8fac48f9aad59aad553cc95183d098fab16433c18f8dea92c2292af8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977882, "uuid": "8a88e665-f7dc-428f-9454-cf4e3e4945e8", "value": "T1CFC401B071C68A13F57250335990926EBF1FEA7509A48B47D3C57A3E4B381D14E3ECAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977882, "uuid": "f49b3d29-0f6d-429e-9e8d-9b9822a311d4", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977882, "uuid": "9e6dc24d-ed3b-414c-97fa-e30bbfd340c4", "value": "12288:7Ky8Ez47uT+YerNBpnHmIWJw9FP9WdK4wrGF8HXY:8O47ONGPnWqFP9WsG6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977882, "uuid": "a14854d3-68b5-49d0-a293-ed4153313636", "value": 550560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977882, "uuid": "a8267538-67ea-4b5b-895a-2d894096be22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977882, "uuid": "6fcd5d5d-b174-4df6-8768-d8242582f047", "value": "334f540186fcce91f63df7c3bc67f1f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39616bd-1ee4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688967918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967918, "uuid": "07186cff-bd8e-461d-bda6-8bf485575588", "comment": "Malware payload (RedLineStealer)", "value": "a58c39f5524fc05e7337112f83570cf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967918, "uuid": "34584931-c761-4329-9939-ff75a9aa64ab", "comment": "Malware payload (RedLineStealer)", "value": "18058b9f8ee36a67a8180d32e0f3642a2a54cf30b26274517f2cb65dc317137a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967918, "uuid": "1d35dee1-3722-4a42-b861-1c399ba04ff5", "comment": "Malware payload (RedLineStealer)", "value": "3f518989e399bd9d03b88644b2b0404263013e5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967918, "uuid": "7406baa8-82ea-44fa-8d2f-91dcea03934e", "comment": "Malware payload (RedLineStealer)", "value": "ab93619050379484bc548c7aa19d1d5c375b57245a8ca304a68d2e8ccf4905815856c1149412f37a622417d4e59b7213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967918, "uuid": "8092ba12-b946-45a8-ab80-41f77142bf69", "value": "T15AB4026171D29963E57344732890C26FBE1BDE3109618B87A3C57A3E5B2D2C14E3FCA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967918, "uuid": "dddb40e1-09e0-49c5-9aa4-856820b52b62", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967918, "uuid": "03bb3467-b1ca-4988-9158-f502211bfe35", "value": "12288:CGYEsz47zLb3XWXxeL4NF3TmTKGjFLvM:5m47zLbnWkkLaGaLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688967918, "uuid": "90e1f634-a27e-428f-b27c-1ad72e877849", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688967918, "uuid": "b3e62e72-0a96-4744-9da0-fd3ff3affb15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967918, "uuid": "8c313568-f8dc-4d7d-9bd8-365862da1610", "value": "a58c39f5524fc05e7337112f83570cf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7646bd9c-1f69-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689024831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024831, "uuid": "224118b0-29e8-454a-ad1f-8ff225948ba4", "comment": "Malware payload", "value": "b527352bc321f86e89fc5bea087a5922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024831, "uuid": "9693d110-2b10-4d58-a4e7-0e9510eb5250", "comment": "Malware payload", "value": "1929c2fa6b0023ec7d216bccb84b01873c17c80e80b993e8828fb9debad1f57a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024831, "uuid": "6ec8d971-da5d-4718-9d00-2a030daf67f7", "comment": "Malware payload", "value": "741aaa1d5c9806ba351d015c401efa30412114a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024831, "uuid": "0ac8b06f-a6fc-4e5a-acf8-cd8709231174", "comment": "Malware payload", "value": "b03aa95b933b0cc8673b5bb2e266a9f17b091c3491fa27b7c00ea51ef6a8389a24a5aba5538d0e21e0bd7d69271ce7ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024831, "uuid": "770c858c-1197-4912-8be5-3ee0f3b810dc", "value": "T190C412483C80407BC003B07DC666D9A3BA6F55D25B68DB873B598BB13EF139C7E99510", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024831, "uuid": "111f1795-75b0-4c08-bb8e-4c8bd74a8b4d", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024831, "uuid": "e668b202-74e3-4327-9702-ea3fa99f6c65", "value": "12288:/iICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:/BbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689024831, "uuid": "88d55aff-c29c-4668-8a93-b2b24f1fbe51", "value": 543552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689024831, "uuid": "e4a78f78-4473-4e7c-a402-ecfd3cdeb844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024831, "uuid": "a8b687de-9453-4152-8da4-c2ab95fa891a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c1e1a6-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688981880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981880, "uuid": "b833e2c9-643b-4c9b-ba5c-0ead28957795", "comment": "Malware payload (GuLoader)", "value": "117c09138f84dce084e42fcb684e9188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981880, "uuid": "d20005c3-d3d7-4eca-bb0b-73434abd34ff", "comment": "Malware payload (GuLoader)", "value": "192cc32d2b512627692171a834ddc243f4d2eb6402b301c6ce4f495c08720f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981880, "uuid": "473ae626-d606-4299-9bd6-fca43ea7a3dc", "comment": "Malware payload (GuLoader)", "value": "e14276554b5a2a2cdea158d8111170b780e5234e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981880, "uuid": "9393abaa-4986-4e76-a7d2-34bd1e58d394", "comment": "Malware payload (GuLoader)", "value": "754779b2b4aed0b66248f1fa2a3cb0d45f61cc4ac54e5e9ede6d2cc9473949d2c95993ec87f6876d0e7a1fbcc2d76308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981880, "uuid": "0e3de6cd-ff06-4e99-9692-54407bd66db9", "value": "T19F35BF32F2D18437D1721A3C8C5BA3A99829BE512E387A4B3BE51E4C5F3D6813D592D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981880, "uuid": "bdba6dbd-36d0-4f11-97e2-5aed3942e779", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981880, "uuid": "657697de-2779-476e-944d-2557aef14cc9", "value": "24576:EnsJ39LyjbJkQFMhmC+6GD9XgaNVtTxklSHBbqJ+eQA:EnsHyjtk2MYC5GDZgmFhble7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981880, "uuid": "fbe536e2-de1c-4808-a528-7c2d223a9ff0", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981880, "uuid": "28d0eff0-e9aa-4d25-a79c-6fb15ef2b742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981880, "uuid": "a20ae2fe-9d32-421f-af5a-84c3b04e3c46", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4798bb0f-1f29-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688997265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997265, "uuid": "c7e03559-de3e-47c5-b095-8f2286308013", "comment": "Malware payload (AgentTesla)", "value": "717b05e69622a968c0f4fb19a4b0f901", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997265, "uuid": "5bd634b9-a3fa-4601-8ee1-20c491bae605", "comment": "Malware payload (AgentTesla)", "value": "1941a9541ef3429af9504fdf43f6ebc6b1efffbdc70463c9224a24bf973cdd35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997265, "uuid": "6172788c-04da-4378-974a-af661f0b390b", "comment": "Malware payload (AgentTesla)", "value": "fe428a23a13e57587e14529d3f8015fcaeb30c07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997265, "uuid": "5f86d401-a979-4f72-a264-0f3a04ef12f8", "comment": "Malware payload (AgentTesla)", "value": "9c27563889b4de90079785f946936fd82b7fe81243c9434cca29d056445874ad07858ed61afa503045d09367bf4f31cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997265, "uuid": "6c1e7d7c-bc22-4fc2-985f-ea2547425e60", "value": "T1CFE423282D1AC0EB73F517D3C3876B871B79869815A3CD3A5D4967C8683E4EE36060F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997265, "uuid": "e0766db1-40d7-4828-b14e-4928ac9f4d17", "value": "12288:3p9JkMf7l1DbAJArOXyzbePtpT9jam+Wirn5ySevfBa/O3KaqGX:Z9t7l1tXz6pTgOXz64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997265, "uuid": "e21b9ff4-1ce6-410d-bb90-abe0da02ed6f", "value": 660116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997265, "uuid": "32e5cd5e-e91e-4129-8ec7-d6c07feea4e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997265, "uuid": "b4bcbc6f-c066-4ef2-9ecb-f1be450769e5", "value": "Purchase Order.#01222023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37bfbbe1-1f03-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688980917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688980917, "uuid": "809c1855-f2ce-4cdf-ab53-3083158773ce", "comment": "Malware payload (Amadey)", "value": "7cab780a8f24d381d4fa6836237983bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688980917, "uuid": "5612408b-982b-403a-9d17-086d692423d9", "comment": "Malware payload (Amadey)", "value": "19422cd310419c2884cc79a1b6abfcd7816a7decaaad7407ecaf27a209d149f0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688980917, "uuid": "9b5e78ad-1ea2-4954-a568-be54539de435", "comment": "Malware payload (Amadey)", "value": "2e2eb93799eb883593d9d8f910f415d8aa55bb08", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688980917, "uuid": "f2bbc765-a8d3-44ed-8cda-2755f448e7ac", "comment": "Malware payload (Amadey)", "value": "8601ff199851cd49380dc0073d978a39ebf64cfac050b4495610ab00dae6687bd366cbaaf16dbe4ccdea4375e3cabecd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688980917, "uuid": "93469f48-801a-4a5d-8d9c-966a77cf6e8d", "value": "T1B8C40260B1D25A23D472147325E0922BFE2FEA7019904793D3C97A3E873D1D15E3DDAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688980917, "uuid": "73f61aeb-1242-40f6-a85e-bff2b6314baf", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688980917, "uuid": "33b26048-f583-48bf-8e88-c633895e25df", "value": "12288:vegHqsz47HBakwxUW2u9YhfjWP+4bOQHHhif:bKm47H3wxPFTb9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688980917, "uuid": "3b3736b4-f693-492a-abf4-57b46eb362cd", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688980917, "uuid": "74d9357b-c267-4b8c-981c-03b0c9735631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688980917, "uuid": "1d065fbe-d802-47c6-8852-e90fa9645c13", "value": "19422cd310419c2884cc79a1b6abfcd7816a7decaaad7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249aa33d-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688977878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977878, "uuid": "1cfefabe-08ce-490d-b950-12e2fec9c0cb", "comment": "Malware payload (RedLineStealer)", "value": "3758ab013efd20ee26c2157897c1d1ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977878, "uuid": "1397c57e-025a-4f34-8ae5-a168707c5793", "comment": "Malware payload (RedLineStealer)", "value": "19608f0ca6eb8c2f48814f049dc7e692658470d16679abb7b870dc420f24dcff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977878, "uuid": "16ceb962-e5ac-409a-8349-7ee14591c45a", "comment": "Malware payload (RedLineStealer)", "value": "ec9e16ee4ff5f2be67d89a64b167f71f22d3a21e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977878, "uuid": "b0ba3037-0017-4e33-82de-9beb4bb81c98", "comment": "Malware payload (RedLineStealer)", "value": "51030d796e20693755394be3603dee9e3401601b7376b1266720e35b9c5bdadbf2a262b6c8b50d18dd65409ab9a8620b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977878, "uuid": "92513a0e-aff7-4704-87b9-b6503a6df11d", "value": "T11644283921E144A7D8BA9E35BF4BC0D17116AEB4017C541F3BB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977878, "uuid": "7780c5da-b74e-4a70-bbe2-8162f2ba282e", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977878, "uuid": "8fa1ef4a-9e90-4e4a-b4b5-e744be1f2ba7", "value": "3072:ic+iOHMwew7+picM/MsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:icvOswD7BVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977878, "uuid": "8574be60-e9d2-4cc4-930b-c6869333ec13", "value": 272545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977878, "uuid": "bb77823f-f476-4320-bdfe-4a222382689d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977878, "uuid": "a68242ee-3721-41b8-bf19-2104685e90bc", "value": "3758ab013efd20ee26c2157897c1d1ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce21abe-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985033, "uuid": "a7210a7f-18a6-475c-aa59-a30c7a42497f", "comment": "Malware payload (Mirai)", "value": "1b277e2ffcbf749764bd0f1505fc2aea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985033, "uuid": "61ec112b-1b35-4c74-92d1-fa796953487c", "comment": "Malware payload (Mirai)", "value": "19b7a21dca303433a1a26c0c786b08e7aec711dfc9debe3f7327624ca52cd831", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985033, "uuid": "5e92b11b-5971-4080-b513-845a757d8c7c", "comment": "Malware payload (Mirai)", "value": "68838eaf2a873ed9785ae634a969972fc0276a5c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985033, "uuid": "e82a62ef-d978-41b8-a7fa-72ea3dd732e2", "comment": "Malware payload (Mirai)", "value": "6d597150a6226e33c2955f9b0f5d3b18519d0d74b1f46954e60cfd08472d69dbc5ff1fb1cff8e2a78f0393fbce4b49f6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985033, "uuid": "a38f9260-d959-47f6-9660-7e91ca768944", "value": "T1E5532A96FC018A51C6C055B3FA5F038D772A53A8E1EE3207DA295F217B46C6B0E7B9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985033, "uuid": "7adc3317-f133-4b92-b662-9e67e9956357", "value": "1536:V+lEenD5RyYxY/OYeA3SiDn6slrdhs5hu:0TNRyC6DBu5hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985033, "uuid": "4cb04629-4055-4c65-a025-6aad59d61ec7", "value": 63932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985033, "uuid": "162981ec-b0f1-4b26-aed0-fcd606efe505", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985033, "uuid": "fda98829-4d09-4b3d-b673-7a488a7ce62b", "value": "update.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cb65ce-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688978040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978040, "uuid": "10381870-c60d-4561-91dc-ace40e88828d", "comment": "Malware payload (Mirai)", "value": "02727ff7043e535b82459e5fda27e3ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978040, "uuid": "96266c8b-2381-4147-b4f0-9f37a6f25f07", "comment": "Malware payload (Mirai)", "value": "1a0a9e7fecd95a27498dbbaf5bad635f4aaea8f36a3d243454247418fe630fb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978040, "uuid": "79f04755-5f53-48ba-b28d-e4312fed4477", "comment": "Malware payload (Mirai)", "value": "9f2632e4bc933ea756af9530f777e3c06da8d9b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978040, "uuid": "f75dc624-2671-4337-a7fb-98273e4966ec", "comment": "Malware payload (Mirai)", "value": "03a576ee79210af4541129dc084b1acc5c00565f10bb645304c0c7f3f476f47e2768d446767c6b254e23b765c83f0df1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978040, "uuid": "c90538b3-a019-4f45-a539-4c03679de741", "value": "T13143F949F990A729C6D121BBFA0D128F73270B6CF3DE72315E309A7537C6A670A3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978040, "uuid": "b3ce8880-662a-4e8d-a960-f73a6ac1141b", "value": "1536:W4niG6CmooZ9pSkaQjCTXIniUqzu8AUrx45QYRB:D61ooZ9Radzu8AUrx4+uB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978040, "uuid": "079bd6a2-c782-47c6-942d-b1693db3cd3a", "value": 58824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978040, "uuid": "39d5d1f5-dae6-4122-b162-31a9e78d1d62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978040, "uuid": "06683fe0-78fe-4da6-9ac0-9bef4e23d64f", "value": "SecuriteInfo.com.ELF.Gafgyt-FH.15483.4471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1e962d-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688969164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969164, "uuid": "644b550f-2fe6-43fe-b4e7-67d200b46fb3", "comment": "Malware payload (RedLineStealer)", "value": "d47d384444216844d927fb385c7d6e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969164, "uuid": "6df54e8d-3342-4b74-8da4-ed14b5d2f347", "comment": "Malware payload (RedLineStealer)", "value": "1a94e2705b81a2d20d9ae7925bee69b12827201dd5726c17deb1a1887fa18567", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969164, "uuid": "cad4e9a9-2a00-4900-aee5-283dcf1b65fd", "comment": "Malware payload (RedLineStealer)", "value": "9942c5fde0e613f56ef9d20549639c1ceadfa795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969164, "uuid": "1e8c338b-c124-470b-91a5-94786eb22f3d", "comment": "Malware payload (RedLineStealer)", "value": "3b07f20041acb585954104080095e46c39127ca228fb1e7cfa4e5617de4d7005e3a298090bc3a3799425ef409b1d622a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969164, "uuid": "fe8b5aeb-6263-4868-8eb7-84b98635280c", "value": "T1330513B170E29533E93114772AA0866FBE0FEA761A91A64393C4313E57281D15E3ECFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969164, "uuid": "15d09993-67e0-406f-aeb3-a1283a1127d4", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969164, "uuid": "58c5ad5e-32aa-408e-ac68-f407f9c56c91", "value": "12288:TA4bSz47dgVSj1OocWwwPw7alxC61zrzZsl236tyW0JKd0FTTwzld5Y:3w47WM1ODW+GxPzHZ4tL0J60FnKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969164, "uuid": "5c5d4ef3-f5a8-4d5e-b257-91dd561c0205", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969164, "uuid": "81171ef3-3c43-4186-b60f-42723eb597ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969164, "uuid": "1ddf6c72-e371-4cbe-8e20-f96ae53e24ec", "value": "d47d384444216844d927fb385c7d6e79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2bd4634-1f2b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688998384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998384, "uuid": "66cb6f9a-ac24-4b16-a96d-4ea86977641d", "comment": "Malware payload (RedLineStealer)", "value": "06277a03cdeaf29ddaf5419eb7b05b20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998384, "uuid": "22b31a6b-3e8f-4006-a229-361214a857af", "comment": "Malware payload (RedLineStealer)", "value": "1b0729839d14f565e8de6c35f683e4cf6c401cc652ea06fe9d0da0c95e9abadd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998384, "uuid": "7536a2df-1699-413b-bf2e-f989124ff292", "comment": "Malware payload (RedLineStealer)", "value": "96d63bf0038d66d8077141669a1518d99182f7a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998384, "uuid": "a617532d-c642-4f7d-a8ee-2d63f60705ea", "comment": "Malware payload (RedLineStealer)", "value": "e07d8611b0ce3d247b9890949cc178383b0c15e1def54ca2bf855a8544019c02151c9d31a1af9c1034393b3aba6efa1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998384, "uuid": "7b200598-9b0f-4d9d-aaeb-f967d8cd4adc", "value": "T1EA152307BAC90433E9763734A4F202C31B35BDE15CB6826B5359A55D1CB38D8A632B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998384, "uuid": "71f6e89c-148b-45e9-b38b-ece209a23198", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998384, "uuid": "558afbd0-3c60-45b1-a6d0-8722d73ef338", "value": "12288:iMr/y90ORo/UpVjIROE5bDbVA0A/9OcuITijA8yeQbcHO+lLG9L8qwcnmJaqi:lyZOoqkWb/61OcVmS45dGALK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688998384, "uuid": "8511b762-9b6c-45db-b1c1-c8c452aca853", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688998384, "uuid": "20db235f-5187-46ad-98cc-7c4bccd0a131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998384, "uuid": "0070d5c6-b3c6-4bd1-b2e0-6072ec021642", "value": "1b0729839d14f565e8de6c35f683e4cf6c401cc652ea0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7f8827-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688969168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969168, "uuid": "02240be1-abd3-4eb1-b0f4-4ef36fbbadde", "comment": "Malware payload (RedLineStealer)", "value": "e52d4a2008949f9ae53660c59ef1e6cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969168, "uuid": "d5f8f990-7ee1-4a0c-9f8e-43944cace298", "comment": "Malware payload (RedLineStealer)", "value": "1c6b11160053d2f90528cae8f07dfef29fa2c7a6522658c27430eb635c664a7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969168, "uuid": "1ebe8db3-5b69-4733-86d8-3d8fea8eba0b", "comment": "Malware payload (RedLineStealer)", "value": "243da3f9548ec1ff8e42b1b142c0cfc5dc1c6379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969168, "uuid": "a01fef3b-e912-45e6-ab2a-47802271e36a", "comment": "Malware payload (RedLineStealer)", "value": "de021d2e972bb3b5ff7f2efd599545ac63e859f818b8d310034dd8a3902196b7e2285057f65b7985ee5bf7271330625d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969168, "uuid": "8eab6f57-4507-4561-92a0-37d0adf9cb49", "value": "T18605126071D24933EAB1007769A082AFFE0FEFB04AE11A8763D5793E97641C18D7DC66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969168, "uuid": "84705b91-dd36-4963-85fe-4ae6297c664c", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969168, "uuid": "fe0f249b-100b-4633-961a-103be0b28f6d", "value": "12288:R/+Ipe0z47mMTfU+i0IaQH/A1YoZWIYKIUsUsH6o7e+RA/W3:/Ee47PfpKSYoNYKbsxer/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969168, "uuid": "9c2776a2-dc6b-4b29-8397-492bdcd488f0", "value": 824992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969168, "uuid": "aaaef1c5-b7f4-461a-9c8d-96d550d6cf23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969168, "uuid": "c0864426-4bd3-410f-ab9b-dc9473be766c", "value": "e52d4a2008949f9ae53660c59ef1e6cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c13c97-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688990874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990874, "uuid": "1b873ddb-7016-43c9-a0d7-447142becfdb", "comment": "Malware payload (RedLineStealer)", "value": "d60e1cf8c611fc5e1b8886c0a01a8cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990874, "uuid": "16bcfa3e-472d-433f-8766-f2273a1b4bbb", "comment": "Malware payload (RedLineStealer)", "value": "1d47bd41def12d086b2acdbd51023127b45dc0ef3b22f5678f8b0c510f79eba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990874, "uuid": "48445718-e0ba-4b21-8eaf-b385fb3ff9b6", "comment": "Malware payload (RedLineStealer)", "value": "5f11abdec90b2719eaedf5e715033b0cd19d1989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990874, "uuid": "b5409cef-baed-40a1-beee-f96c00b4d130", "comment": "Malware payload (RedLineStealer)", "value": "e2452a071bc6e142e7902646c206a9b813fa569a989fa41028b786b633a56d93dd4aa2bd2a8cbb45afa390eb037054d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990874, "uuid": "bc25b8f1-e497-482d-9448-1660d68c2ccd", "value": "T128B4026171D69623EA72143615A0963FFE1FEE3118A04B8393C87A3D4B281D24E3DDED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990874, "uuid": "28df259f-2c36-416e-aeb7-ad6d6d3588bf", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990874, "uuid": "2de5fd70-f116-41ca-bd38-03c463458d77", "value": "6144:FJGPD0GqXHBJiCWGYLUz247XSy6jRosrd0F0KljcM38lTEKiWcVP0igB/KUQ2KCp:3GY9oz47XSyNliiWc1g1KUQl3oawRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990874, "uuid": "a1633f57-e533-4c79-9002-87be85f7f28d", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990874, "uuid": "1224684f-2d29-4b0d-a23c-b2ee3c73a62c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990874, "uuid": "5cc29cce-eb5c-4cf5-a808-3d635c9195db", "value": "d60e1cf8c611fc5e1b8886c0a01a8cad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9478d450-1edf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688965611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965611, "uuid": "40e41e8d-100a-4280-b7c6-95e3220042b8", "comment": "Malware payload", "value": "e2d748c496edee089549cd9af4b6d5f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965611, "uuid": "987af272-da11-45b6-ab57-113edc7227a5", "comment": "Malware payload", "value": "1e6f67b797749378fc6e5f72520b4127e48221628f60f8f1785090ecb47f51de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965611, "uuid": "3db9ed24-c61c-41b1-a069-69c7b7276c2d", "comment": "Malware payload", "value": "29528a697e8ad8573558cf17fc0b40be97e40178", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965611, "uuid": "1f4cc2c3-d3ca-4e0b-bb9b-b73b1ce6355c", "comment": "Malware payload", "value": "4553a0b7abbdd26ad00cb2032751cc10975adc838221f2f944d3895a982b24644663bbec805676b3579bd51e0ecc548e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965611, "uuid": "c1fb7d28-e016-421d-bd08-04f346d1da4e", "value": "T12F130A88FD55A22AC7D162BBF70D03CE773A0768F3DA33225E355B2137C6A615A3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965611, "uuid": "afbfe82c-e8ee-41c5-9ab8-40a036b7730f", "value": "768:BCl5gS9IYz/yXzDcPzG/GyoYtMt4Ml0POpEEMIi2hx2q1Lew3zqI:VSW8yDDUByWGM0POpE+iGsqF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965611, "uuid": "908b6a91-9524-4a10-ad27-3e1a314c4f00", "value": 42672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965611, "uuid": "7bd42e01-0011-47c9-84e6-d444147b1555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965611, "uuid": "4b6f3b2a-429d-4ec2-8835-042524585dbc", "value": "e2d748c496edee089549cd9af4b6d5f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd04e890-1ef0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DBatLoader)", "timestamp": 1688973034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973034, "uuid": "af07d64f-6696-4612-807e-9412e3172599", "comment": "Malware payload (DBatLoader)", "value": "f6d022437e3ebab46604ace297d22ef6", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973034, "uuid": "653172c4-24b5-4bfe-aa93-9660a8556642", "comment": "Malware payload (DBatLoader)", "value": "1f3550afc182c66a51c5d40bcafd4713f9b8552afbb52347185d98418d8c1549", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973034, "uuid": "0528e27b-e6a3-4c95-8c55-088d59e2d86f", "comment": "Malware payload (DBatLoader)", "value": "e768334e9e09c862f690d97a312e284e0de03cb1", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973034, "uuid": "03e99d7f-4be7-4b98-be63-f4e50cd52e9d", "comment": "Malware payload (DBatLoader)", "value": "2fcb60a3dc56317abeb1cfff5b3001d63b899b240d62354d443d46930250906ebd743da24b4ce0d3f10f66a20c5b04e7", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973034, "uuid": "f12fd6ce-ee46-4d2f-aba6-d6b5258fc118", "value": "T196058D22E2B0CC76E0B739BCCF0667D55C1E7E312E2474062BF77A4C5B362916B66186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973034, "uuid": "d6a23bbd-d68c-4fe8-81a3-3ceb11b59530", "value": "eb409b285a6dd6461b387b8190a8b951", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973034, "uuid": "141fe5d7-df13-411e-97d7-d921e9b421b0", "value": "12288:300zh1YnARzVrGgJoowTfehf/lHG6LbO35QPIwuYmmJ/9zaxmx86:39YARzVpWW7hPfbzaxmx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688973034, "uuid": "0d6a9e6f-a41b-4765-a472-f00d88307795", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688973034, "uuid": "8f21b6d5-dc17-4320-87fc-04eb467a05f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973034, "uuid": "5df063fb-cee1-4338-a274-2d0cf8880370", "value": "f6d022437e3ebab46604ace297d22ef6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3710df1-1eeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688970924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970924, "uuid": "86301589-1059-4dae-88d3-62a570b8bcf4", "comment": "Malware payload (RedLineStealer)", "value": "f7ff4c8a2ab763313cf391376de4d48e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970924, "uuid": "4bdb8f92-a2e1-42e9-aa33-af4cc97f3f91", "comment": "Malware payload (RedLineStealer)", "value": "1f59773b910f3b45efd0eb12f8f2a94087ac05303bdac23046adf791ff55194d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970924, "uuid": "0ef2ba0a-5654-4a50-8133-d89ecf7505ee", "comment": "Malware payload (RedLineStealer)", "value": "912e7908078ee6ffaa420ef4f9cc894ffdf7ce31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970924, "uuid": "bc091c81-cf66-485e-92c4-131098115c3a", "comment": "Malware payload (RedLineStealer)", "value": "6ac00c4102f550c99d19ba334bf6ceed8b9deb091d40e2d0c24eb31657f057200f76e8af7d96b04a4a77e2b2bff5329e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970924, "uuid": "15b10896-d325-40e9-aa83-2ce128cf4554", "value": "T1CEB402B071C28963E97214732890922FBE1FDE311A914B97A3C5773D4B281D25E7ECB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970924, "uuid": "ea6bbb18-bc91-42ac-92bb-8e28e1641c73", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970924, "uuid": "ea5d99f3-b8e8-4237-bea4-19ac8150f3a6", "value": "6144:pk7/YCVFHB1FCWGYLUz247Eqo82oANuS0cv84ViDmQQwrXKxy3HvDnJSmd29EwM5:pkUONz47jt6rjQ7XKxy3HvDvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970924, "uuid": "2fe94c9d-e516-4ef4-b35a-a09ef97cc294", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970924, "uuid": "01e2d6da-6d1f-4c69-9021-35b4ee63dc17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970924, "uuid": "d05b78bb-a154-414c-969e-7ce7fd70a4ce", "value": "SecuriteInfo.com.Variant.Lazy.360290.1544.21787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ed0889-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968881, "uuid": "d57d3612-553f-4bf0-a29c-0673335f92b2", "comment": "Malware payload (RedLineStealer)", "value": "ca8a47e28a226b7fb4223a5a871fc832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968881, "uuid": "fa5dd66d-c2ca-4e8c-bc0c-14fe000645a4", "comment": "Malware payload (RedLineStealer)", "value": "202ad0f7bf52b759aaa2b156f559c6caa7831d834e6e4a05620f44961b65b7d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968881, "uuid": "27b4ed8d-c4c3-4fbc-bf0c-3723fab87cb9", "comment": "Malware payload (RedLineStealer)", "value": "e57f28c00ccaede64d61f3df8db6304a98054651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968881, "uuid": "8a843d70-6e33-4309-8829-df48bd9d2458", "comment": "Malware payload (RedLineStealer)", "value": "67533deba4571142197bbbe15c4c08a1b997cfe0ea534f11dd6c9b5def49c1cf5ba251ac076d9f7cd83598db4dee69f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968881, "uuid": "b611a263-3219-45e0-b641-c9fed4370249", "value": "T110B40261B1D29A33E536043628A0D26FBE1FDF7505A0565393D5753E4B282C24F3ECAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968881, "uuid": "15863427-9dcf-4d6b-9b1c-917f5ac68dfa", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968881, "uuid": "c6cce96f-835f-474a-83c4-8cc9b456ed08", "value": "6144:32PD0GqWHBNuCWGYLUz247o3pbnp9EnV7tsoqXtQvT+7ewbPPsLTFcrHyVE+rT:32YQQz47ob+soqdQvi7ewbP4Jcur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968881, "uuid": "742bcda5-a2f1-4a2b-afe1-b332072c049b", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968881, "uuid": "539b0eb8-edee-43ba-b35b-f011f5bb62be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968881, "uuid": "7c5a2a47-08df-4a3a-a9df-232e43348049", "value": "ca8a47e28a226b7fb4223a5a871fc832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16077375-1f12-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688987303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987303, "uuid": "ecbebc05-258d-4ba3-8955-9d6a1ce3e2e5", "comment": "Malware payload (Formbook)", "value": "38ea2143ea46e291a2185660c875ccbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987303, "uuid": "440c1d8c-18ca-424e-86c0-7bdfd3cfb36b", "comment": "Malware payload (Formbook)", "value": "20fa6136a8a585a8f30110a5dd5fa9d8b2f9a2ee0eff590a721656eb44eceea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987303, "uuid": "289729db-3a11-4424-8be5-8535558bde3c", "comment": "Malware payload (Formbook)", "value": "a554f329380b71e9dd189e00800362bc64f9261c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987303, "uuid": "f6759387-931d-460e-92f3-ffd0a9ab0bd5", "comment": "Malware payload (Formbook)", "value": "2f6e457dbf8425338f98c7784bb2d0fb25fe9034ebb7f7d917a06c30ce32ee8edfffc8ca0185a7022ac3dc9ec5d95e29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987303, "uuid": "5d8e1412-5038-434a-85f3-5e88a71f539e", "value": "T10EE4CF8072BF5F92F6BEC7F54852A5440BF5732F701ED2090DEAA0EB16E5B201A12B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987303, "uuid": "16d544ba-9e69-4921-93ca-686f871f774c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987303, "uuid": "c6a392e1-67a2-4fbb-8c2f-49d8148c6abd", "value": "12288:VdS+Y5cnKmIhKaVlxPo4KRuIu4FwWyEGBCZehfW:VdvY2nKmIhKylxPjKIoyEWbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688987303, "uuid": "3585eabc-02dd-4101-adce-bda05bc4bfff", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688987303, "uuid": "d5f2c6bf-29c2-44df-b97a-eeb99dd6b794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987303, "uuid": "8761560a-7844-428d-ad9a-8a92f669743c", "value": "Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3e698a-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985731, "uuid": "7f472947-84fb-4a3d-bb42-37483fce76de", "comment": "Malware payload (RedLineStealer)", "value": "cf5c11ad3a3ee06df9d7a0a61b0510d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985731, "uuid": "95de778d-d36a-40b8-8170-a61149aedaa6", "comment": "Malware payload (RedLineStealer)", "value": "21fc638f7d43700a0c399ed8ea1636302e373815c2062eb5e36420ff4621aeb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985731, "uuid": "85d4a690-cd72-4a22-8c80-c99f9ab3cb67", "comment": "Malware payload (RedLineStealer)", "value": "5a3cc442a2b65d1bcd4c3852b2dd20aac4eb9601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985731, "uuid": "5235de4b-0ee2-4b84-8ddc-a7ed9112e262", "comment": "Malware payload (RedLineStealer)", "value": "8412b11b88265efd8eff06ae156a77f940aca882db8b303b9c97cd69d331a555835661638bb68f0336245485de94a7ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985731, "uuid": "2446dde9-2641-48a2-872f-a092d13c5ba9", "value": "T158C402B0B1D28623E973547314A0812EBE1FEE3215919B83A3C5753E4F281D25E7EDE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985731, "uuid": "8a253361-6758-4d3c-9fd2-99a19f3a1325", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985731, "uuid": "eabae72d-7eae-42f3-a775-92172c31462b", "value": "6144:XkSoUTLZHBRzCWGYLUz247wwwHrVyIfRnrPxWZZj3iaXxU4MXHJmJ0SzjnjqCNrr:Xk8Zjz47oyI1WSaW4WHJmiqjj/fwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985731, "uuid": "69ff200a-9a88-4269-a4b8-61401a7dca45", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985731, "uuid": "2bef1a5e-551c-4e0c-a1ae-a5338df99d91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985731, "uuid": "bb1f77e0-5d54-4546-82cf-75c8cad0b7d7", "value": "cf5c11ad3a3ee06df9d7a0a61b0510d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b945dd2-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688981863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981863, "uuid": "38ddcf2b-adb9-4638-90ee-d789c1e17d93", "comment": "Malware payload (AgentTesla)", "value": "724a9ef49ca464d6ab626c4580bf8dc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981863, "uuid": "9872b77c-68ef-47ec-bd24-d05ef5bb3ba7", "comment": "Malware payload (AgentTesla)", "value": "221124332bcc9a1796ffa94b00260db30e1774a8114d1ed0b878a28ac1439eda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981863, "uuid": "18890137-e548-45fd-b99a-3ef473d4a480", "comment": "Malware payload (AgentTesla)", "value": "158fa97ffd0077f988f99933270663ea3483ac21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981863, "uuid": "c2b332de-151a-488a-8a3a-2110ed0524f6", "comment": "Malware payload (AgentTesla)", "value": "6710f812fe34d77053c5bf4471483f1ee149a05bb47978753f8b11e136d1214b8124a2f77f98766f67b6e51c0cafa6c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981863, "uuid": "2a7a5823-0aa5-48d4-a011-991e78cefe77", "value": "T1D5C402111165E73AEA6C0FFC2409584923A86A559CB5DB2CCC2BCCD6CFB6F7014ECB96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981863, "uuid": "24ab0eb3-afd7-429c-80d1-2cd2d474d397", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981863, "uuid": "27bbc6b3-3e45-40b8-a095-cfd427a31875", "value": "12288:+gYO9o5nC1qrRUMa3nFFGoh+See7KkDXIwgX8vrwTU:+pn2qrRE3F4owSeMXImrwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981863, "uuid": "7923fed6-d664-4f15-9609-fd5451c9609f", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981863, "uuid": "3100ab61-8a45-4c06-9b74-0dc44dd35732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981863, "uuid": "df406e89-c414-4477-a1d8-b04c4e12c505", "value": "INVOICE NOTIFICATION BATCH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed090f19-1f51-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689014722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689014722, "uuid": "91e15790-3329-43b4-a157-271a6ce9d807", "comment": "Malware payload", "value": "58aee1ea5c8de064a324bc2aa91ed1da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689014722, "uuid": "8ce72243-2a97-49c5-a6df-f6354771336e", "comment": "Malware payload", "value": "225660d3c526a75dae11e0c41afd436480a69015f156c3f5edc4fd65e11b9388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689014722, "uuid": "a16e6bc4-f8bd-4ca6-b58e-31daef55975e", "comment": "Malware payload", "value": "99e6d78bf7fc4f74caf0370c0d4e26f72a8506da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689014722, "uuid": "9eabe25f-03f6-41fa-95ac-b303e3d14a54", "comment": "Malware payload", "value": "2f1c99a468cfff3f45aaf22d56d5018b8eb2642e832f78a56f35a4957f3fe61f2573b8f531d5cacd879eddce4624f1fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689014722, "uuid": "183a61fa-f14c-4a9b-ae5a-2af0aaf88c32", "value": "T1EE756C4AB7B480B9D16BD179C953874BE7B27855072097CB02A09B5F2F337E25A3E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689014722, "uuid": "b0bbb18b-40f6-435a-bdf9-0e05a0742a54", "value": "5355ea42dbe398ebe6cc53e20d228fee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689014722, "uuid": "731fc329-ed2f-4029-8ae8-75ce1284e963", "value": "24576:LUyXeD/70k+LVSaN4uWPjyhP4jZPsx9RssloVJnbJZWzTcf6EnmW/or63:wGejQKaLYja4VP1su7nbJoEnmA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689014722, "uuid": "40fdb851-2655-44d5-aa88-014c43b58410", "value": 1681920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689014722, "uuid": "465333d6-73f8-4047-88c2-abf052741d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689014722, "uuid": "daa5d663-f681-4339-9982-eb3acc27ee63", "value": "daisuki.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a8c1b4-1ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688975055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975055, "uuid": "cd8a53ce-e121-4976-b1dd-0136b9eb546e", "comment": "Malware payload (AgentTesla)", "value": "163956c9fa4350782f7d0344f58c219f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975055, "uuid": "6745186e-f3b0-4bc3-b289-7dd3782e9bae", "comment": "Malware payload (AgentTesla)", "value": "22946068fd1e3e163cd2aa78bd95ac8983fddcbebbd2a7ec07fd2e752caa49d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975055, "uuid": "1304c481-6bef-4de7-8905-40e4194a89ad", "comment": "Malware payload (AgentTesla)", "value": "f7b8d64fde920391ac8ee5d29b468d0acf375b3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975055, "uuid": "97654727-5172-4e00-8ecf-de742f4f47a2", "comment": "Malware payload (AgentTesla)", "value": "0693ae3a1761ec529629156ceda9e859f6b3c4776cd60c5c690351ac8f054a3d014acf63be1e1950479b0da7bde8942a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975055, "uuid": "790e92c6-c5a7-46cd-8f81-4ed56296fcf5", "value": "T13D05633D18CAA567D278EF964424EA59F2C3B38237835BBE75C2C6618102339F6D139D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975055, "uuid": "7e124688-f83d-459c-b491-bb95268e5823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975055, "uuid": "f03112bc-cfd8-4058-8bc4-4155cc4515c3", "value": "12288:UGGbbHMmNdpHsKrfd4Icr9I/yVUC/qu8mw83HXP8pI1Iq3r:oRSI/yaOq83XN1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688975055, "uuid": "b4b1a25a-bdf6-48d3-a40c-d71751b3f849", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688975055, "uuid": "bb8eb7a9-5195-47e1-8454-06f97fcb18dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975055, "uuid": "fea38f81-9cf5-4dae-94ae-67252c8698fa", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc908bf-1ef2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688973683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973683, "uuid": "966d8e84-daba-47e9-a260-b1e70b597264", "comment": "Malware payload (AgentTesla)", "value": "c3a131e33d78b117ee440474136c02b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973683, "uuid": "a035c57a-3be0-4eb5-80fa-fcb65e95a682", "comment": "Malware payload (AgentTesla)", "value": "22a64964f41da02bf763bb8f548a42b3a76835e1b91486b32fa4fa384121d309", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973683, "uuid": "574b2602-da29-4c0f-aff5-33a8359e0123", "comment": "Malware payload (AgentTesla)", "value": "d38d85764a58871558ce43aa891915a0ca298b33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973683, "uuid": "58eaf842-06f1-496a-af0c-62a4fdf02644", "comment": "Malware payload (AgentTesla)", "value": "7f7f5007ae811bf8c0a994d4ba4433aa73100554f08148b0e86efb2a6fcb0a88fc8122c73ab5af1da7358b72ebd69261", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973683, "uuid": "c81f3ab0-b760-481a-b2d2-7a941db8dbb7", "value": "T19BD4E090717AEB26DD785FF90500910427F9599D6C3AE7288C9BE8CB26B1F3005C9F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973683, "uuid": "48987386-7e30-4fa1-bf00-ed6e71c8347c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973683, "uuid": "db9be92e-a555-4c50-87fd-cc987c75e956", "value": "12288:w5x7aTxs7UI6YNe8JRWiNCSu9z9pLEou0QF:p2QMs8HW4L83LY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688973683, "uuid": "ad3effe9-9cb8-40e3-afb1-fb22b8666423", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688973683, "uuid": "3f33f4db-73cf-476b-8407-460a43690c67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973683, "uuid": "e3e04200-29c0-4d0a-86f7-57bab0cf7284", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e60af9c-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985733, "uuid": "a07a6307-ea77-4e88-98ae-de9d8a23de4e", "comment": "Malware payload (RedLineStealer)", "value": "de5c480805eb9b2df8449d507472a6ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985733, "uuid": "e17f54ea-e589-4a85-ae42-c958808af0b5", "comment": "Malware payload (RedLineStealer)", "value": "22a75e2271753251a8ab4a6cc28272fcf1555e8fc9199f79f2f839663d23199c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985733, "uuid": "e4c3ded3-becc-4d3a-9261-b34534adcb47", "comment": "Malware payload (RedLineStealer)", "value": "1702e236a9257b41c600419d40028a86cc062de7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985733, "uuid": "fd37020d-5871-4ca0-a461-770a158f2f5b", "comment": "Malware payload (RedLineStealer)", "value": "ea34e307a604609d8c02935ea4bcfc878a3af43348d84cd491a496962257d260613a4c43ae8e9b008bd4f1b65a70fa7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985733, "uuid": "c831238c-11df-4fbe-b27b-7b9fe6e76986", "value": "T19744283921E144A7D8BA9E35BF4BC0D17116AEB4017C541F3BB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985733, "uuid": "e5380cc6-d9e1-442d-96ea-05a4e1eba84d", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985733, "uuid": "9905b91f-d86e-4629-b3dc-eaa852ac9224", "value": "3072:QM+iOHMwew7+picM/qsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:QMvOswD77VVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985733, "uuid": "0ffc5282-35ff-453c-abfc-71ddd3630386", "value": 272549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985733, "uuid": "fc4cfe92-d7b6-49f9-b5c8-15dbbbb2e150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985733, "uuid": "4c372954-a4ae-4e6f-8218-7c187f2ea439", "value": "de5c480805eb9b2df8449d507472a6ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b561cc8-1f1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688991768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991768, "uuid": "503ca77d-de5d-4e58-9f6a-dea050e03943", "comment": "Malware payload (GuLoader)", "value": "f022d5f21c803c1936e2c6f28f0f9240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991768, "uuid": "c766015e-693e-4d4e-8c9e-023523972362", "comment": "Malware payload (GuLoader)", "value": "22b6816c45f86b303404b94b09b852a910d4ef335c05244c4acf6450ed86572b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991768, "uuid": "57d49ff2-12f0-429f-86f8-af1b597ce4e8", "comment": "Malware payload (GuLoader)", "value": "43e0065a86b944771992db8af0cad4ee86631aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991768, "uuid": "1c8581c1-f76b-4b5f-8697-d430f5914a28", "comment": "Malware payload (GuLoader)", "value": "6e98ef62dba5262bf4dd9c900d1866975adcace77928cd101b33256301baa9abe904dbdcdae64dd7c9a77a4fd0d9950c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991768, "uuid": "6f984754-c4fc-4617-af4a-63562093d001", "value": "T1C78449A239DA356FEC2F4674035FEAB22A795CD07382496E4F40760D0C3694A90EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991768, "uuid": "67800d33-162a-4ad1-8464-96257c34e0e0", "value": "b40f29cd171eb54c01b1dd2683c9c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991768, "uuid": "e41cbb6f-432e-4e7e-a1ed-f5d9aff8d505", "value": "6144:/oShfEPZVheNA+ff03j2NVag8mLWUkCs3dD1A2uwxMf6rbmOuGot:QqCnhe2e4j2627kCsERwGfvdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991768, "uuid": "0e2a096c-bf30-4eef-beb5-5bd1e2a618e7", "value": 371234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991768, "uuid": "eff801c3-0224-4a5a-a3d4-6d702948236b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991768, "uuid": "9c01c261-59cb-4c08-94c8-c9b872665a62", "value": "Factura 1-000816pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61520e1c-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688990865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990865, "uuid": "19bfb757-4875-42a7-8fd8-36d097c860c1", "comment": "Malware payload (Amadey)", "value": "80e075b8685398d745e808f69527be1b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990865, "uuid": "3af2dcd5-e6ab-45d0-b982-bbdb06e64176", "comment": "Malware payload (Amadey)", "value": "22bcbbe977a121233b282714a2bad6eefeb03d1ed6fb14a298a333de878185fa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990865, "uuid": "128f2f8e-e6d9-4b4c-9c7b-330c862e1b0b", "comment": "Malware payload (Amadey)", "value": "360240661067f35234d2029dc1ed5d44e56c4cf5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990865, "uuid": "d41cbbb0-b2cb-4187-836c-9f3d1cba53d8", "comment": "Malware payload (Amadey)", "value": "2f6654d1ca9f64e119bda12680b4657bbd97186ca2f522ee3d6c83abe75c4ef85774506d203b09df6fd1afd74ad107e6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990865, "uuid": "59a3c2fe-965b-485a-bbdc-322eaf7707b6", "value": "T19DC4027171E24523E933447215A0D22FFF2FDE7109A05A87A3D57A3E8B241D14E7ECAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990865, "uuid": "732b4d71-0d29-42f1-a61d-04f10205a366", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990865, "uuid": "a1ee4a78-ec8b-4384-8292-2a1da3d7ceec", "value": "12288:dg08Hbz47gIBAdFy0XwhrYAGAs7lBoSf:dmv47gVq0UrNGBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990865, "uuid": "a7797c52-ed2d-43d5-b9df-7626922653ab", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990865, "uuid": "71cfeb5a-4803-42a0-82f7-90bb1421a07e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990865, "uuid": "620cf155-b6a8-4d32-9ae1-c4a2440487cf", "value": "22bcbbe977a121233b282714a2bad6eefeb03d1ed6fb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8faec22-1f46-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689010018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010018, "uuid": "0dcd3427-d3fb-4b96-bfae-9b5fabf22738", "comment": "Malware payload (Amadey)", "value": "8fffe24a095ff86baacd02f20b2ae01e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010018, "uuid": "3c268ee1-2fd4-4c3d-84df-3fedac2a3292", "comment": "Malware payload (Amadey)", "value": "22f65486ce4ad040f9985202d9306069315f0db3b4c66e630e358d3e8275178c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010018, "uuid": "509765de-4808-4dd8-85c8-70730eecdc3d", "comment": "Malware payload (Amadey)", "value": "66dca64c0e369bb53bf25a13d4f60185a1774dd5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010018, "uuid": "c76cae4b-addb-48b2-8bb6-e3e3a657a590", "comment": "Malware payload (Amadey)", "value": "6e608de547d51a0e53cedc683f3dfca2c1819040fceb122614603e062a8851db0569c470b7b7dddae54a2b3820fd2b4d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010018, "uuid": "1f4ec1f7-9873-4cf2-bd3c-996387bba399", "value": "T1D175331EA3F991B3E9A807F11DF56BD30E34BC906D35175B6784B8982DB2480927232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010018, "uuid": "4f6cff87-deda-465d-a2cc-8466dbba864a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010018, "uuid": "0ac1ae39-a389-4e72-b473-7d18174721b2", "value": "49152:KAhzL8MtOkOiCRahFMaNXg/2f1jlch1Ew6M6:VltNOrahFBXzfdlch2w6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689010018, "uuid": "e2927c4c-e8d8-4625-bd83-85880c27fcd5", "value": 1589248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689010018, "uuid": "862227ab-3af4-4ef8-ac80-86bd5d3524ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010018, "uuid": "ae0226a6-1738-46e3-9833-1aa552359f16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c25cf0-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968240, "uuid": "c797046a-9070-4589-ad5d-62e2cd398d13", "comment": "Malware payload (RedLineStealer)", "value": "0f9a47bc447678e2b68e3748b3390749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968240, "uuid": "1d7d9a26-fccd-467b-8ca7-8e1297f7f083", "comment": "Malware payload (RedLineStealer)", "value": "238cf34068243dfceb3e084a6ac79b8dc96a36e2c6158583f3548f48628df448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968240, "uuid": "8d0f022c-1d8f-41b9-9289-31cafa7dc9ef", "comment": "Malware payload (RedLineStealer)", "value": "3047e55363a67965bc1610c17a61f0160f8e8687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968240, "uuid": "4a5b4ff9-0cf5-4127-9768-429bdb7f3973", "comment": "Malware payload (RedLineStealer)", "value": "8c708f9f77699c013ad3624cef7f2f50f7dc596a0730dfa039afd792df25e4480945d3e64e8c64491f4f39bc504d1e79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968240, "uuid": "f90bb744-248d-4bb8-b037-174d28176091", "value": "T1630512A4B6C29963E23351331DA0C21FFD0BDA7245915A97A3D9753E83381C14E3EDAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968240, "uuid": "887c16ed-97c0-459c-8213-865bc8cb69d6", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968240, "uuid": "786a9fcf-611b-4866-98e5-9e0d7d53fd6c", "value": "24576:Dg47YhuhFi52JyKHeIBFm2gVw7JsMz4U:DgqKg3AKH9Hm/wnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968240, "uuid": "2ef3906d-5a91-4a90-a1f5-1a8f2078cc5e", "value": 824480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968240, "uuid": "6a37856f-9cbd-4219-abe0-703d6f56769f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968240, "uuid": "08ae914c-d987-4fed-9175-9c8157c29dff", "value": "0f9a47bc447678e2b68e3748b3390749.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75091e4b-1f44-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689008937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008937, "uuid": "66e916ae-dcee-4197-8e4a-5b9add886432", "comment": "Malware payload (RedLineStealer)", "value": "0678f5c2a094c232ffe72f8b73479c9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008937, "uuid": "e93b2313-2891-4046-a266-64a4cce15306", "comment": "Malware payload (RedLineStealer)", "value": "246889c39918be278c460d90c72ae6dbfbf94d1b4e88261ad7a75a3aedcbc779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008937, "uuid": "d35644f3-528a-49b5-ad24-c158285be823", "comment": "Malware payload (RedLineStealer)", "value": "a66cccedeb851457c42cab94f75e8c6f39b9a265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008937, "uuid": "8687f554-2408-4ed7-bf63-082e9eede8fc", "comment": "Malware payload (RedLineStealer)", "value": "9679993bbd6c3e60235be15d26a91c307d74fb0f80b201b55a70bd5cae3a361ca2a545b5b2fc22250ba007803e0acb2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008937, "uuid": "12899c77-249a-4f64-9add-a743e2140255", "value": "T167152393A7E89132D8B517702AFB039726B77CE09DA5C75B2A404D990CF32D09672737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008937, "uuid": "ef1867ea-bc0e-4281-baef-b2e4f753c833", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008937, "uuid": "b21309b1-0551-4ffe-8e02-ee2920d0374e", "value": "24576:pyy3llUm7qL2A6H1Vv7WA1WAlLsEZCa15VAVsULMzVtS9c4V:cWmit1F7TYadAVsb5t8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689008937, "uuid": "820cf4ce-eae2-408c-821a-985d946ad0f3", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689008937, "uuid": "3c589fff-4b37-41cb-9f8a-5f7ce5f1d9ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008937, "uuid": "4c1dd0ba-d434-44a6-b706-220a5b2f1b01", "value": "0678f5c2a094c232ffe72f8b73479c9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f73c22-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688991113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991113, "uuid": "b5b3309d-4b57-4e8d-9752-08b3a18cbee3", "comment": "Malware payload (Formbook)", "value": "f70ea388df8d91130be430d51301f8e1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991113, "uuid": "34922e1d-bd72-45f4-9807-e643942cdc48", "comment": "Malware payload (Formbook)", "value": "248c1f8f88ecec7e687789ef11c99db2a74ad89c4e8c691ce35d91798156ef60", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991113, "uuid": "bf7a9d5c-f4bb-4a4b-9845-0ffcebf547ff", "comment": "Malware payload (Formbook)", "value": "2d577d7e8893549691ab2f9fc6163b677825e725", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991113, "uuid": "b4c8b77d-5a38-4b31-981b-2cbecbf05c97", "comment": "Malware payload (Formbook)", "value": "4aef46c23b5825bd2add0c055ac23adf4e96ccda7ae9f2ec436b1f10fbde39f6b0908a09369af0959ff33602398f0cb8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991113, "uuid": "376598c4-8b5f-4f0c-ac9b-cdfb8dab8ab4", "value": "T14F13D45AE39F0265CF5512B3531A0E889ABDB23EB31495B1386C937433EDC3D06666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991113, "uuid": "e50dd55d-a9ed-4bf3-94d2-0267964a47ae", "value": "768:XFx0XaIsnPRIa4fwJMw0GpStroiC1w9cTlV/AtT273Ga:Xf0Xvx3EMw0w8xCmEAxU3Ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991113, "uuid": "e4582f12-a890-4104-a7d8-81b73ac4058d", "value": 41995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991113, "uuid": "245a15be-1f60-4fe4-989e-652e465c0d42", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991113, "uuid": "3ffdbc8f-26bb-4739-be25-ce6b30ecea45", "value": "f70ea388df8d91130be430d51301f8e1.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7518901e-1f60-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689020963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020963, "uuid": "0cee5216-34b4-4ca2-8855-0353dc5de9c0", "comment": "Malware payload (RedLineStealer)", "value": "8e9f2145192479dc19b59b5a249f4796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020963, "uuid": "2bf6db05-c910-436d-8251-9e9d11ea426f", "comment": "Malware payload (RedLineStealer)", "value": "249ff8adcaf0914424769055cc293a3114a071fd260073de2455d6f501971aa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020963, "uuid": "03675561-668f-48af-a09a-58700fa2c3b3", "comment": "Malware payload (RedLineStealer)", "value": "c872d174e9b477d7b398c86845725d9adae1b07b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020963, "uuid": "815fbbc0-a79b-4da9-8073-119eb0292052", "comment": "Malware payload (RedLineStealer)", "value": "9ecf7c39e7a5bcb90dc757010eb3e9fda1ce0f0d3e8a8a6bb45ef0e0365264a027e4d5dd463d56b5ac46d66d66f00a5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020963, "uuid": "2b60ff6b-6283-4333-b57d-a276cc201404", "value": "T19F64BF0371D0EC63E6664631CD3AC6E87A2EB9518E59776B32187F3F28712B1F262351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020963, "uuid": "64d33010-6945-4050-9aa6-50b4b66c9270", "value": "5a013624489e6703ae44eba8e360cecd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020963, "uuid": "e54ebefe-3eb4-4c43-b45f-6477338836a4", "value": "6144:tMSkLLOAG3gvMges35/hw+2gcu3rIS6zLgYRmajD:LkvXG3gvMgXw+2gcup6n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689020963, "uuid": "121f0707-4f6f-483a-a85d-a1b83324fda8", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689020963, "uuid": "7453d015-4b78-4eff-9a63-616845ae55de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020963, "uuid": "71677884-c2d9-4765-858c-87ae69d3f439", "value": "8e9f2145192479dc19b59b5a249f4796.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625e0d73-1f5e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1689020073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020073, "uuid": "5bd70792-2aae-4f66-9eea-c8ca64940ccc", "comment": "Malware payload (RecordBreaker)", "value": "2c456231b6d0745678d27477f46a78ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020073, "uuid": "b995e745-1ab5-4117-982d-19a9ebc99f23", "comment": "Malware payload (RecordBreaker)", "value": "2513cf6aa56a6fb9c84061ac04c8df3e225258638f9f0d40ce898a9096f93e9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020073, "uuid": "d43d4d48-2260-4f18-87d2-058dc993a3ec", "comment": "Malware payload (RecordBreaker)", "value": "13c2ffb4bf48f98ff6ca5f2ea082480a082d6321", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020073, "uuid": "440e596c-92f3-4e00-919c-8cc8e5266448", "comment": "Malware payload (RecordBreaker)", "value": "b7a6d68725ad3b040e2695350921e1eb230a3c3abf84290926c842ec346c25d451cafc136b204c36863053feafa5cccc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020073, "uuid": "ec93e17e-0ad8-45e4-b945-52f35071c05f", "value": "T166346C036691EC63D5668A328D2DD6F8361EF9518F59775A32187F2F38703A2F2A3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020073, "uuid": "ada1b933-79c5-4c09-b39d-9add45c1b7a3", "value": "5a013624489e6703ae44eba8e360cecd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020073, "uuid": "cfdce2d5-225f-4889-b355-3899d4342d99", "value": "3072:/7TLJivCcb1nX/DBQ67rlMQ5kgN0LucGuW0d3WJ4K/:TTLJtgX/d77q5gN0CjRbJ4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689020073, "uuid": "c92d4b61-5395-4b75-b458-266785e5c880", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689020073, "uuid": "ce4f165e-0c58-4b7a-bf74-97ab0caeb7e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020073, "uuid": "04f0860a-f74b-442b-88c9-ed8af1f0efd5", "value": "2c456231b6d0745678d27477f46a78ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cf69f8-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688969160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969160, "uuid": "e3760d23-80ad-4034-9b14-cd151ebfa6e6", "comment": "Malware payload (Amadey)", "value": "c3b8c716ce69ab23f6d71f2ae35a87d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969160, "uuid": "51ec4c06-9ba2-43a4-a67a-77a81027d5b7", "comment": "Malware payload (Amadey)", "value": "253c946fde6de41e296816e78f453577628fcac506a1461f08dab412d03599fc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969160, "uuid": "bf4c74fb-93e7-4fd7-af5a-5fb46581c4f5", "comment": "Malware payload (Amadey)", "value": "0b067dd880dbf7d38e35213a56ca20c6b51b8da4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969160, "uuid": "fb6a212a-e163-48d0-93a1-5e43398b9927", "comment": "Malware payload (Amadey)", "value": "da89dbdacec7610971cac3cd85e73a7a1f6652b63838b3f271a4091a693269dc499c6028e4a71ff2e194fdc6057c63f8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969160, "uuid": "279dccc6-5ef4-47cf-ba77-f35bae62d6de", "value": "T1E4B402B170D69933EA3645371890D16FFE0FDA7119918B87A3C9763E8B281D10D3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969160, "uuid": "231fe37a-9a34-4a30-84d0-0b9103b60814", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969160, "uuid": "750cb2c5-5a77-4872-9d40-b77ef880737a", "value": "6144:cU7/YCVZHBRqCWGYLUz247qdcE0vcLAdkZBeH4tqUFeDQkx0d+NZP5s7WLkIooSd:cUUqIz47A5ukO4tqBDQkx0ih7oIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969160, "uuid": "77486470-85e3-45c3-95ed-05c5d02f983b", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969160, "uuid": "b289e7e6-245f-43d0-b8ab-0277560d7d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969160, "uuid": "231246f8-9560-4e0b-a581-efef82d32fc2", "value": "c3b8c716ce69ab23f6d71f2ae35a87d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfec28d2-1f43-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689008660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008660, "uuid": "f7ecd842-6cff-431b-abc3-33efde00dd40", "comment": "Malware payload (RedLineStealer)", "value": "5461b2ea5f397c9dffba0bf58e4b4a77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008660, "uuid": "9db674bc-0789-449b-9b58-85239f4e274d", "comment": "Malware payload (RedLineStealer)", "value": "26bc3d8b0c6cd099d29f18e481d101c5be5b49db9655a0eb2cc339f9721b77ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008660, "uuid": "bdb0e176-b636-4bbe-8b60-aa3308197c42", "comment": "Malware payload (RedLineStealer)", "value": "4aa5824c71de814f76a2c18f0ebccc0d47d1269f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008660, "uuid": "cc4845e7-3f97-45d1-864e-b568f646a770", "comment": "Malware payload (RedLineStealer)", "value": "2bdde16ff37f6ab2448a8f8dd94b8ee5cf5f558c6b314c752bbf2162792f9689822c204b7a111ee6bd7fb452a27b63c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008660, "uuid": "ba90224b-b197-4300-b07c-551d7c40935f", "value": "T1216523B928802737E030607D8590E52FFE0709F296A44B43EBC77A396B956EE2D7DC54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008660, "uuid": "31738d0c-df73-41c9-8dec-9c43a45ab4ca", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008660, "uuid": "16ba37fa-c3a5-48d4-a8a8-2fdac235cc20", "value": "24576:bE47kOUEfJvETlpqftmHioiS+yvk3RZAdBbVTb34k30/8dRi9:bEq5PfJvExMftmHzO0khZApykji9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689008660, "uuid": "c6ce66ac-212a-4b05-8bec-32463868c22f", "value": 1409856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689008660, "uuid": "1dc897f2-d7c1-484f-b3ed-9c4dc3d75546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008660, "uuid": "6a44b5cc-2d7d-417d-a22c-7fd706a8af3a", "value": "26bc3d8b0c6cd099d29f18e481d101c5be5b49db9655a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6261d796-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688990867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990867, "uuid": "211f0f53-eed7-4e41-9b5f-ccc16a26628f", "comment": "Malware payload (Amadey)", "value": "17c4391eaf5e1346463781abd6e7354d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990867, "uuid": "3341be8f-4b1f-4188-8c07-1c46e2d8d904", "comment": "Malware payload (Amadey)", "value": "26dc4d2dd07dd3d9747ef4a102cd0055dbe107b48cd54c12b1e19b01bc2744b6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990867, "uuid": "dbba04c7-2654-4df1-82b3-510ebfd72723", "comment": "Malware payload (Amadey)", "value": "f3e5cab5e7bebe30175a466eb50d8505de8ab04f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990867, "uuid": "96945ddd-a784-42a3-8cad-1e59c0e964f8", "comment": "Malware payload (Amadey)", "value": "4be4c742198f930808673cd8ad1c090538ce43cae3e4e5335090b1bd6740678892fdd836d6a78ee49b09ad468be66ed1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990867, "uuid": "46bacdf5-2549-4905-aee6-06692c69594a", "value": "T1C7B40151B0E29633E936117725E0925FFE0FDE7149905A8393C9763E4B281D24E3ECBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990867, "uuid": "e071fd61-23f1-4b8b-bfcf-e6287f0371c4", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990867, "uuid": "ba484a87-6ce8-41fe-b949-2c37a214bde1", "value": "12288:jGYOHz47jIkXpzUwV0CcwJ0VYv9GWX680/ke:AT47kwzUw+w0mFvKzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990867, "uuid": "ef8010bd-4b41-465c-82be-f6a025f7bc65", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990867, "uuid": "124427f4-9a51-40e8-b872-1be3a91e9ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990867, "uuid": "f46be15d-3197-4ae3-a7af-082c5c90ec65", "value": "17c4391eaf5e1346463781abd6e7354d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be886479-1f3c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689005625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005625, "uuid": "ebf41ce6-1cf4-42ad-992c-4400c09266e4", "comment": "Malware payload (Amadey)", "value": "42bfe71072750a81fe1d4dcdb2f04dc2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005625, "uuid": "8cfdf48e-8b98-44ef-8dca-9041a65887ba", "comment": "Malware payload (Amadey)", "value": "27054c4ef87730930ab8bbec2331b567a7518f766c3e7f55e066fb7014ae3556", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005625, "uuid": "d4a67bc5-d211-4360-9982-79f06968d8eb", "comment": "Malware payload (Amadey)", "value": "29ac9199d705da60cd8cf27229e8dda3e6188be5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005625, "uuid": "f22855bd-f52a-402d-9441-0f54ee6ff2ff", "comment": "Malware payload (Amadey)", "value": "81f3884bca972ab50292021bc60c487b8aeb8241ab6d5e09489196b146095548822f0b6069e781fff22287d8e9e0dc87", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005625, "uuid": "b4a9de9d-435f-473e-9f27-bd4723695d5f", "value": "T14D15234796D90533E8F56BB024BB01D32D397DA21D3587AE238A5C6E1DB3290297633F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005625, "uuid": "61180898-c928-4e61-a9d9-e010405b122c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005625, "uuid": "24cbdef3-3d34-4c1d-8ee9-67ab7403d112", "value": "12288:BMrSy90bmxzzWSvRTkc64XzHqbv0t3CEfEkkOP3QBXD/n3HPdy2U3RMAManmlbCY:PyRSSZ56gzHqbv0ZCEBcn3VlcG+nm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689005625, "uuid": "2195dc00-b574-4bd9-a2d5-a0c8276ce4d5", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689005625, "uuid": "6359bbb2-d588-4497-9cd1-9de429141afe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005625, "uuid": "02d95c7b-3071-4937-8df8-8a1bd087340c", "value": "27054c4ef87730930ab8bbec2331b567a7518f766c3e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea68f97-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688977895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977895, "uuid": "9e801d57-8bda-4233-9e0b-0d2084eaf747", "comment": "Malware payload (RedLineStealer)", "value": "2a91d3cdaec5e8ccec12cdad0262b67d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977895, "uuid": "94734583-8af0-489e-aa0d-84a4c99170ce", "comment": "Malware payload (RedLineStealer)", "value": "273f3ab708a3c5105ba00e249d695fcd21c9ad1a005a1d636e96212aa73e4ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977895, "uuid": "2b901633-f67b-4337-9658-3cfa08c5bb22", "comment": "Malware payload (RedLineStealer)", "value": "1c3151466b3f5e98e15a11b93be04c82bdad3a18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977895, "uuid": "835ee06e-0a55-49bb-a757-de42372145fa", "comment": "Malware payload (RedLineStealer)", "value": "719d732d9983800f1fbf5ee31013c5d77c18fee61e27c74dbe8d1f7aa87b6a916c84100be46659682463dcc8c7372218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977895, "uuid": "d962aed9-8cdf-4328-998d-9f1bb0376bee", "value": "T138051251B1D29663E233553315B0D28EBE1FCA3149A10BD793D9763E6B281C60D3ECAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977895, "uuid": "cb50abee-9d15-4e02-ab52-5347aec3f7cb", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977895, "uuid": "3661e626-f5ab-4a4e-b3fe-023a33d005f7", "value": "12288:VKqy6Yz47NqXWiWuMJTdr1zGm/bYjiBOPG5DMlgng8WEBV/mp:ba470XWZJ1zGSYjGOPYMp3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977895, "uuid": "137830f4-760a-4c74-8100-a9b9fa114dfd", "value": 819872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977895, "uuid": "057a7588-1f64-4e59-8dd8-61e4ee20d858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977895, "uuid": "09eadb14-30c9-45a7-9e50-4ac929440300", "value": "2a91d3cdaec5e8ccec12cdad0262b67d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ac2b3d-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688991497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991497, "uuid": "adfdbc0a-29e3-47d1-88dd-9e8f954d5f23", "comment": "Malware payload (AgentTesla)", "value": "30e487d84ea2d991860beb0874c38d34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991497, "uuid": "700162ce-81bb-4199-89a6-2de86edc60e0", "comment": "Malware payload (AgentTesla)", "value": "278a198c13e8d5ee3da90771f8d2318801002b8cf61dcb29f651c4fa51a81d3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991497, "uuid": "a9afbd09-342f-493e-ad08-c5a8f814aca5", "comment": "Malware payload (AgentTesla)", "value": "789e6b79a3ec8e9c848022270ac074eaf40eeb60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991497, "uuid": "2a89e801-f692-49e2-b3b0-6f4fd54aef8b", "comment": "Malware payload (AgentTesla)", "value": "2f356fe5900f1def7e1176d3c4eba6ac91f92ab494af3cbd896ab92cab292de3bf520ce698fea18230bb80d4656d81d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991497, "uuid": "4b25cca1-fad2-4d73-bf82-20d32b09b8f0", "value": "T1B26423412EEF101962B3AADF4BE554A44F77B97A5839C15E048F194A0BEFDC0B920F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991497, "uuid": "97da2a1a-b7fa-4ac3-adff-ee8a8436637f", "value": "1536:xIgyZccvQvgpNpaJU+ogsUJW4Wrle/PhG+/kery+bGL9oqOP5tn5j0rV0nbyPuPd:TgpNpV+og0S7BqOPT5Pn2V8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991497, "uuid": "75a34e73-dc60-4360-9818-ec4a43275df5", "value": 324470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991497, "uuid": "d8cf321c-a93d-4e72-8393-7a79fdf97c15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991497, "uuid": "c26c21ab-1c5f-492e-8b6e-5ef3f6fb4c1f", "value": "carta de pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21b9531-1f4f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689013871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689013871, "uuid": "0bf608c0-283f-4f5a-9be3-70ea372e28a0", "comment": "Malware payload", "value": "321e656aa048d51c10d8ce5671a46690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689013871, "uuid": "9f073047-c2a3-4cf8-94d2-e6f110d76e0e", "comment": "Malware payload", "value": "27fc2f1ee3efdc1129be27ab2614c7cfc30a4031aacd10ea02b8efc4c3d568da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689013871, "uuid": "385f62fc-9e83-4473-b7e4-4e3ebc2eb8b5", "comment": "Malware payload", "value": "384727a3cb9c77fdb2cefdd69da5d3ddcf419875", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689013871, "uuid": "f00973f5-244b-40c7-8eaa-05f3e0d7637c", "comment": "Malware payload", "value": "375a86cd4571a070f09386cb5e33af9db3801c057429ae1a5f56011e5f8e5e5bf874ca50f398720ac21bae754170f855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689013871, "uuid": "5567d665-cf30-4540-affc-357c7e68734d", "value": "T1F2750723DA92CFE2D69903F0ECD20C84D3A0D28B872547D5E659DA0959C273F29FD92D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689013871, "uuid": "e8e954ec-874e-4dbf-be35-2f03f3cb3da0", "value": "12288:wDC22F1xagbBvpRDW/k+r95mtwfo9TF60UXT5grtqd7b8eYojwB/ZAjoUd/7Tfiu:UGKXyI7mKVnnQe9iqqFdry6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689013871, "uuid": "19860428-906d-4ffa-b864-de6d0bdb8c0d", "value": 1679447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689013871, "uuid": "1950f2a8-aad8-4d4b-ae35-22f59cfd20d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689013871, "uuid": "2d5bcf87-a5c1-4193-98d9-2946fcf8f3b0", "value": "Jqogbzrswqkiqaqsepjt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6bca85-1f3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689004712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004712, "uuid": "de9c9ca1-b4d7-43b0-91a4-d96f441e13c3", "comment": "Malware payload (RedLineStealer)", "value": "237c39297542fa123e7be74d1eaae4e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004712, "uuid": "3fdde032-bfe7-48fd-bf08-b67dbe31ba24", "comment": "Malware payload (RedLineStealer)", "value": "28627b333375a37a072336a76d858a5b0758fe2abe01c16f17f6acfab4c573c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004712, "uuid": "3866ae62-d60b-4f37-8a19-ad6458cc9c81", "comment": "Malware payload (RedLineStealer)", "value": "e4473b2e8bb53b9fc2b0f7e9c4e31721fcb9f0a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004712, "uuid": "12588a1c-576f-4e1c-b34c-88226e82aede", "comment": "Malware payload (RedLineStealer)", "value": "60611b74f8bd16f8085c76376ada4990eee696ea299b6356b7e51db5b57fd69881b4dd4e7a5895e829bb4116f6871295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004712, "uuid": "af5646a2-6bff-49c1-ad89-9c9e1fdc031c", "value": "T106151202EBD89473DCB1277859F503870F327CA6586A936B36D4AD9E0DB3680A532737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004712, "uuid": "8e7b3953-ad52-4168-bcb1-5678506e6e5f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004712, "uuid": "5700fa70-aa54-42e6-9d81-84a60f2074ed", "value": "24576:lyJLHvLRaQFKWeHcPlaBbI29NLrunu79Tf:AJFKWG2cI29NnuCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689004712, "uuid": "86e1fc11-898e-4161-a422-abb313d4241e", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689004712, "uuid": "e9ce0aec-8d91-4a27-a715-ba0f3dfe0a9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004712, "uuid": "55cec550-def1-48af-943b-4cfb4b0713ee", "value": "237c39297542fa123e7be74d1eaae4e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d4b9ae-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985024, "uuid": "1eb952ed-3d2a-41af-9804-6c24e866e24b", "comment": "Malware payload (Mirai)", "value": "d1075c4a972b7222bf85ea8cb4e9c5ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985024, "uuid": "a93cce74-f3ec-4788-9cf8-a37907d5a84d", "comment": "Malware payload (Mirai)", "value": "2961687f6f9bcf5164f01202a59343ffc75efb47c9c808eec0b7612bc90b4e64", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985024, "uuid": "5baf5f00-f96b-43f5-a7ae-dac2231fc69d", "comment": "Malware payload (Mirai)", "value": "5a30f16311e0359b5c3a445e9efb3cbd0dd3a03e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985024, "uuid": "89368e78-662d-402e-97ef-cb77ac46e215", "comment": "Malware payload (Mirai)", "value": "b266fdf0486d13879b866511ea06d4fb653c22e4c4cf8482fa0460857f5aa9eb5736f326fbcdb6147b55b2b5d129eb0b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985024, "uuid": "6ccc1822-9f5f-46c8-94e8-38fb38b94ff1", "value": "T137536D17658180FCC8ADC1701B9FB236E937B13E427A729EA7D0ED216E19C615F6ED80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985024, "uuid": "7fb2a809-3168-4494-b5c6-284f6d7c91d7", "value": "1536:MN7xOTn/4BDLMu786yZZ+vI39Yphawkg:MNITn0DLM4YZ+v8aphao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985024, "uuid": "2510bdad-e0bf-4a17-94f2-483e2bb439ab", "value": 61584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985024, "uuid": "fa3f25de-80b7-48b7-a290-fe947eda6fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985024, "uuid": "d4582fa8-e21a-499f-8311-4a83988ce4a6", "value": "update.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f746ac-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688978203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978203, "uuid": "d1cd6ea7-0630-419d-9bf2-b61a9701d21e", "comment": "Malware payload (Amadey)", "value": "f43d729a81f30a3315e7d978e2e48055", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978203, "uuid": "48f8a680-b562-409f-867e-add5a98bb90b", "comment": "Malware payload (Amadey)", "value": "29cfe628d226676b02b01edf3cdd95ae579816a28e435f1da0de108a997c626c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978203, "uuid": "7d23e5ba-76e1-4ee2-b7e4-bb6cce1d1820", "comment": "Malware payload (Amadey)", "value": "d515dc02d1a54a11bfb42289a2f92cafb6e53004", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978203, "uuid": "84c72a41-2119-489c-afba-8fbeae9c0e95", "comment": "Malware payload (Amadey)", "value": "ed262d81134e12dd7082b41c92b102ff7fc585375a7060cd26b8cfc575e16eccf48185177b88dcada5b10193d20a44f7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978203, "uuid": "f8970206-b652-4e2e-a70c-a50e2708db1b", "value": "T123C412A0B2D38663E532107729E0D25EBF1FD9310EA0569793C97A3E4B281D15E3ECA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978203, "uuid": "1baa778e-ee83-47bc-bc4a-81479a4bc8e2", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978203, "uuid": "904f22aa-52c5-490a-bd69-fb7c8b8136e9", "value": "12288:jPogDNz47rBMaZVv2uri1DJfcLLJisY6RaQ:X147rBMOk8c0LLcsXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978203, "uuid": "b785fdaa-c519-497d-9840-806b14b86c04", "value": 552096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978203, "uuid": "64b4a6f9-77e5-49b1-be24-dca86e6a68e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978203, "uuid": "6c1fc626-4ac0-4ce8-bc45-5b104a84f79b", "value": "f43d729a81f30a3315e7d978e2e48055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbb4e29-1f22-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688994325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994325, "uuid": "f73b73e9-b6f3-4205-93b2-774771e8b31f", "comment": "Malware payload", "value": "c5f697899764bc6b34991db860088674", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994325, "uuid": "956af581-060e-45bf-9e6c-2aba97430808", "comment": "Malware payload", "value": "29fad700c459ded7179545c78a2d772607f281d40320e36483feccca19c85e12", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994325, "uuid": "46ce311c-414d-401b-8a8b-6a5b65ba1760", "comment": "Malware payload", "value": "d6edf9a691f5d76bae4bf4cc10267c9e39c052c8", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994325, "uuid": "18122836-787f-4749-bbe6-4f841c916f24", "comment": "Malware payload", "value": "f595cbda4ae8d5cc5ec197a042656e0a3f04caf99128df39053ca73986a5657c5c4fd646f266a6dae374bd403abdeb68", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994325, "uuid": "f6724fda-6b1c-4035-8dce-260e95883f87", "value": "T1BE65F103A804DB83D41D83F87E430AE91F0AAF19E9996EDB04577F8B3A716724C9E51D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994325, "uuid": "5852b056-bca5-4d7b-b67c-9a35cfb3cd9b", "value": "24576:cRZyQw6VJZyFw6VSwPXEAg6rZYob7UDjh2IiiwmYDLwEeyiABEN5AboQs0D452AV:cbQ6VTF6VZPXZg61Zb78NT4iyjGEozW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688994325, "uuid": "51be62f6-1270-4b04-b4f9-7fbcd64d746d", "value": 1533440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688994325, "uuid": "7e8611ef-196a-4eaa-8a73-08470ea4ec26", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994325, "uuid": "1d2af29f-cca1-4f68-96f7-63621bdf0c52", "value": "REVISED SHIPMENT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3d9912-1eda-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688963320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688963320, "uuid": "ca4bfb93-986f-402b-9c7c-b4356ed6f591", "comment": "Malware payload (Amadey)", "value": "85a78a7277e6449900265ff0b3bd9f40", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688963320, "uuid": "d3d01bf7-ae68-4f8d-a810-296756ae08dc", "comment": "Malware payload (Amadey)", "value": "2b159ea42120727b28cbad93e8e15f0d2680ff92e60e225e631a462c5a554a5a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688963320, "uuid": "c3e06ba0-4256-4d57-bcb8-16affcf52765", "comment": "Malware payload (Amadey)", "value": "24d8f3765584174118dcea578160c1f90f7c0249", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688963320, "uuid": "b939e36b-f60d-4fe2-a710-334a82d62949", "comment": "Malware payload (Amadey)", "value": "51e9353d5295f2682943de900104ec1233a9489b27c23ed4341b1ddb596953e6505db81417e012ff3016733220658015", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688963320, "uuid": "d5a3e86d-4302-41b4-a36e-995c7ff10586", "value": "T129C40261B0D29923F67510731990C22FBF2FEB715A504A5792C57A3E8B2C2D24D3ECAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688963320, "uuid": "650578d4-2bb8-4525-a1a6-5fba1c0791f8", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688963320, "uuid": "526775cd-5095-4269-a4a9-a04affd1ae03", "value": "12288:G087fz47FAYNOikpdd1XeZp2xXEzutG+/ttrS2Cuv2:Ub47/H2xUzutGmf+2Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688963320, "uuid": "59af0cd4-62c3-49bc-ba1f-0d3cd26cbb0f", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688963320, "uuid": "40f5eb5b-419d-414b-923a-c7ddaea7b4a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688963320, "uuid": "cacbb034-afec-435e-b816-34a1948c8eb9", "value": "SecuriteInfo.com.Variant.Lazy.360290.29599.16013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2097fcbc-1f2e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1688999347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999347, "uuid": "44786603-6740-457c-9aa1-10706bac8fe1", "comment": "Malware payload (QuasarRAT)", "value": "7416ede6924c85117720a8a9d158c67f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999347, "uuid": "1129e6c9-d30b-423b-9717-c2c0585849dc", "comment": "Malware payload (QuasarRAT)", "value": "2b2c926a0d587f409f3c7453d3d9018642cdc51abce1752eb2bf395728619576", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999347, "uuid": "fe24a7fb-df2d-485a-956d-7ac596267e68", "comment": "Malware payload (QuasarRAT)", "value": "238dd66f85677e8f945773a93dd1ffdce0e4f50e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999347, "uuid": "e5756de7-ff25-4618-bead-a8d0be9de3d9", "comment": "Malware payload (QuasarRAT)", "value": "fe2a97d5be49d22d945673f6d53ee88a7ca36766b31b85323021165cdc755862dff3f5cb0aac8777e5e3903e54af9c1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999347, "uuid": "d654033a-ed8f-4e2c-9329-d81d8317b9dc", "value": "T10C442344F8695024DE161F3965B6E6F75732923BAE003A4D7BA0D321F899E8406C3F9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999347, "uuid": "ddec9ab2-04e5-4d22-b8f4-5141f00e7ae9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999347, "uuid": "ee5ba610-7584-4ba2-a896-f645a1eb843c", "value": "6144:sfKS9XQhhREyGp2cCeu6rdBCAOXLSqr8IN:C0Q2cCjnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688999347, "uuid": "abdf8abe-78fb-49b0-a302-27d031199886", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688999347, "uuid": "0e537ebc-1ef1-4117-96cc-64c347eecd38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999347, "uuid": "e49fd251-f697-4c06-9a2e-4b28171a0e5c", "value": "7416ede6924c85117720a8a9d158c67f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a600a5-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962574, "uuid": "462ac565-ec3e-43d7-b639-d9b02f08516d", "comment": "Malware payload (Mirai)", "value": "bcafd0fdabc63c21fcbe86eca8d02d85", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962574, "uuid": "c320513f-b84e-424a-944d-47fa390882e9", "comment": "Malware payload (Mirai)", "value": "2babd84ae969b5886cb55713163c3455a3fe6af1d3913a25a19da9019e184168", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962574, "uuid": "dbb9a564-ae16-4f9b-b7f7-ea518bffbf97", "comment": "Malware payload (Mirai)", "value": "d9d275ca0b2022fe83204cc2669d8690595bdaa0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962574, "uuid": "b39dc142-15a7-4f8e-85ca-e474c755d334", "comment": "Malware payload (Mirai)", "value": "ad788d5d8981547a27c3abd80cfef9f7b1cda024da0b39c0d6ac1f0af923f58ceda14fba3bedb015a962e52284f07daf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962574, "uuid": "a7ad5c48-174a-4406-8539-70230d28d7be", "value": "T147A36CC5F643D8F1E85245B1643BAB769733E43A503EDB82D3689D32EC62910DA1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962574, "uuid": "9de8fe0c-40c6-4eec-be68-bb9de17fd006", "value": "3072:sUjZUxJqL1HnshI74lrnXebWD3p+vCer0mv:92JqY3pAt4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962574, "uuid": "e6751f36-683a-4113-9fa3-95b5b5bf6c3d", "value": 104396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962574, "uuid": "41703ae5-07c5-4a0b-97d6-fae7cbb6f2a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962574, "uuid": "8ee73650-cf77-4822-9923-c2d921fcefae", "value": "skyline.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f86c3cb-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688981870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981870, "uuid": "0fc833a2-dae6-4eea-9c8d-ba2e67c19686", "comment": "Malware payload (Loki)", "value": "f2f97546bca644b3456bcb209c91afb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981870, "uuid": "7c3d5e53-9670-4241-b79a-deccb7883561", "comment": "Malware payload (Loki)", "value": "2c3d16e1c28e192249da7fc79bc4fc2ed1508610627e82ca96c50083f4e0d9ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981870, "uuid": "5923259f-fcfa-4249-a62c-eea7eb8443ce", "comment": "Malware payload (Loki)", "value": "272911f4de0b07a8f65806e5b4370a0f7f8a68fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981870, "uuid": "65e83fe4-16b6-46e5-84d0-177d9a31bbca", "comment": "Malware payload (Loki)", "value": "fe893024c3686aef255a3fef6ae207f3326f0869eb76eb130bdec5c9cde70a8fd723764b19c214eaac2fbc7514b2995f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981870, "uuid": "c299a1f5-ac46-47ce-8e78-cb1fff723795", "value": "T1B8E40126B1BBAB06C57AB3FE0508404837FC9A0C6660F7185C8BA1F7557AF440994FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981870, "uuid": "8f860586-7f39-45bf-81e4-b4f901f0ab72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981870, "uuid": "d25882c0-4fe8-4009-b3b2-a71d4ea225d1", "value": "12288:8J4a6p7tL+NLLTQmnW35MP2po2pi8s3YAZOFbwtsbdCYANPfu17ToE:Lp54TJna5MOwZwwtOAN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981870, "uuid": "bca32395-7229-498d-9122-3f3488e52e68", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981870, "uuid": "dc177584-2771-4466-82c8-a584c5f58a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981870, "uuid": "78b3af61-bf03-48be-b3dc-66982f6a477a", "value": "payment advice for 114,999usd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c190f18-1f23-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688994641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994641, "uuid": "c8d9ee41-f586-4cfd-b433-a83e1f7358c5", "comment": "Malware payload (RedLineStealer)", "value": "95d643f0fcf157eb2e5040335d18a244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994641, "uuid": "4778044f-eea0-46db-8fd0-8a18e9afaae6", "comment": "Malware payload (RedLineStealer)", "value": "2cac970a74cf3c21383ea093fef86dc2628898343935d2eb7be8802a758548ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994641, "uuid": "ee1cc910-75de-45f2-98b1-9fe81472310d", "comment": "Malware payload (RedLineStealer)", "value": "0dfdf2a7b7ee9d99531d4b192d50cfc2f04faf16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994641, "uuid": "a5de522d-569c-4be5-90c6-8ea308af677f", "comment": "Malware payload (RedLineStealer)", "value": "67b5b041e03a25c93b7c72c8488a3c5bb23fed15cc3c5119981245232665aad3a2b32a3a51adb5f963fe3e703284aac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994641, "uuid": "6e41d23a-d211-4f9d-9e67-58bfaa353d47", "value": "T17B259E303981823EEDE220B945ECB527C26DF7B037254DDB56C57BEEC6232D16A32586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994641, "uuid": "ffd66ed8-7266-415c-89f6-2f95d6b3bcfb", "value": "2e7f2667392d8d1bd01896145ab96743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994641, "uuid": "5219dd19-bd7e-4a3a-a28a-6b6ae6d4952b", "value": "24576:00cid6dv1xs2VGi/YrhCTYOs6kaXp0rS6txANDr:iv1xs2AxETpkaXp+SugDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688994641, "uuid": "1a71c630-2db4-46b5-82c7-22c066fe4d5c", "value": 1031680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688994641, "uuid": "7a00ccae-a029-41c2-8e44-0315bb837a30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994641, "uuid": "fbd5a0eb-7acf-4f4a-a7c8-5feb3863ec91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95821497-1f25-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688995677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995677, "uuid": "62f752ac-93cc-4b33-9239-abf1152e1f3f", "comment": "Malware payload (RedLineStealer)", "value": "193878735d171404f704d71e76366baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995677, "uuid": "775d7192-306f-483b-88dd-f889029223b8", "comment": "Malware payload (RedLineStealer)", "value": "2d46ab188cd5589cd3ad6587440919f3d2b592d501cd456f6d0bd4f4fac70a31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995677, "uuid": "21a2d3c1-2f01-49b7-a253-52e7d10aa437", "comment": "Malware payload (RedLineStealer)", "value": "f3271d9a0854615d339cc64567fdb579b145a814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995677, "uuid": "7413c75d-fdbb-4b51-89be-688277218553", "comment": "Malware payload (RedLineStealer)", "value": "8895bc4c32525d3aefe16ee473473a40d4480e8fa717144a774af723bbe47e9c9d3055dd760e9f896e782ae4843a438e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995677, "uuid": "aaf2ea7e-a6f7-4a1f-a0ce-6507c2675ddd", "value": "T1D2750229249740F7C8DA2834FB0BE9D232B25AE10578841D7FE36DB867D3D5698FA1D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995677, "uuid": "5bbc94a4-f8a5-43ba-98cb-e6013f485eb4", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995677, "uuid": "96490f1f-2a8d-43b7-b5eb-5ea4736d8a96", "value": "24576:uwDkNTFT+bvoog7jTPZvDD/SCHzQJ86uJBbVTb34k30/8dRi9:upjEO7nxbGGQqTykji9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688995677, "uuid": "51e5af40-b6b0-404b-9d22-0825e617400b", "value": 1560899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688995677, "uuid": "c5f24c00-fc95-4f4c-a4c5-838a2fa09dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995677, "uuid": "8d5cef39-402c-41c1-a1cb-64a57f538d23", "value": "193878735d171404f704d71e76366baf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65e4532-1f76-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689030602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030602, "uuid": "a9d67054-1fcf-44e2-ac5b-237c00497a42", "comment": "Malware payload (Mirai)", "value": "9c351b0083eac41fe1d7260dbdc79e43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030602, "uuid": "7c032473-db8a-4031-b7cf-67e1bf2b44a4", "comment": "Malware payload (Mirai)", "value": "2d610b757393705875097ccaa9d2d37e969e39bb1e87fc7f5916098a73e77636", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030602, "uuid": "5f664c9e-e4e6-4835-aff9-d2d04ce0c8bc", "comment": "Malware payload (Mirai)", "value": "79d69bbbe21824845de9761f589f4577841c92b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030602, "uuid": "f98edb70-bbdd-4844-94c1-927e836aaacf", "comment": "Malware payload (Mirai)", "value": "2880bd1e8b4fc214d9205dd6201d4713e311172a315989f8b1b344f94bd51ead5b40fe61346ad6786ad7d05c18831005", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030602, "uuid": "9ade9e0f-504a-475b-aab6-d3016128604d", "value": "T184336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030602, "uuid": "65351108-8bbf-4c5b-97af-557b70019df4", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689030602, "uuid": "9cb04a52-8d12-44a6-a984-5ad44f4b9589", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689030602, "uuid": "a884366e-8b03-475f-be2a-1aa234980c29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030602, "uuid": "c26bff2c-1984-4f76-af62-435e34240773", "value": "9c351b0083eac41fe1d7260dbdc79e43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de352277-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978190, "uuid": "a7173cc2-5336-448e-816e-ca7f113ab27f", "comment": "Malware payload (RedLineStealer)", "value": "d259ec6b5d3c3ceeb429cd722f926679", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978190, "uuid": "276d22b6-92c9-42c9-882c-cd24f30611ce", "comment": "Malware payload (RedLineStealer)", "value": "2daa0dd92eb7267023f3db53ed622cd0d979c7e02a1fe003fdc8f4411e7d55ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978190, "uuid": "b8f96c3c-be1b-4e74-b4b5-a3c0fa70363f", "comment": "Malware payload (RedLineStealer)", "value": "ce720f87e313587184e80e196255bebb4bb6626f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978190, "uuid": "3e41168a-0cb4-4cc2-99a1-b69aff6dd8f1", "comment": "Malware payload (RedLineStealer)", "value": "c18acb8293a7fb174a314ec88a986639e738e2be624c9be0e8583b11e6acf3b43ecd2ab73244730caf517df5e1b98fa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978190, "uuid": "f0d88b97-8994-4b60-ae08-4964e2ef3169", "value": "T11744283921E144A7D8BA9E35BE4BC0D17116AEB4017C541F3FB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978190, "uuid": "64884c34-5410-46bc-a373-e6c46ded3a0b", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978190, "uuid": "57d826c6-f425-49b8-becc-d58292035d0a", "value": "3072:cc+iOHMwew7+picM/DsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:ccvOswD76VVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978190, "uuid": "f2d78160-5d4e-4cad-a724-49fccd9b5d9d", "value": 272547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978190, "uuid": "775a7fec-fd1b-4f7a-afdf-05a73ee003fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978190, "uuid": "b3caa067-3567-4b86-8c6f-62733c5beda9", "value": "d259ec6b5d3c3ceeb429cd722f926679.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348171e2-1f27-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1688996374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996374, "uuid": "1bc4f0b2-b514-4219-9941-6fd9c8244b6b", "comment": "Malware payload (GCleaner)", "value": "6ea0a6de9991ffbefb06b9724a34be2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996374, "uuid": "f9fe512a-dc88-4449-a6c1-ea558ba82808", "comment": "Malware payload (GCleaner)", "value": "2e11c816213e73f347fa0045ddb255aca1ff5ecc1ee3df57db0ee8cb5ea43eca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996374, "uuid": "6ce4e5cb-3a69-4ef9-9eba-24fc46637219", "comment": "Malware payload (GCleaner)", "value": "9f18e19da586c1305a5acad5ad854ca480562f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996374, "uuid": "d9e6c366-6c59-417b-b061-1c4fc4bc7734", "comment": "Malware payload (GCleaner)", "value": "e79f69ab9d80685175eb4548d993032039880db2d9a9d097fce6045b97339dc4adcfc6b40827e57d46491efdc4d9125e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996374, "uuid": "872afcb3-c912-40f0-9e36-87596e619676", "value": "T1DB452362618848FCE4E286B10E6693054EBD38277C757199B17CDAFCBF3BA18DC55312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996374, "uuid": "4338eb2a-9a62-4543-86a8-97143e7d8982", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996374, "uuid": "3961f8e1-ab71-4b67-a8ea-c19e482470ee", "value": "24576:nfOyH3/oeATwfarrfjPvH5qxuXpoPkrENwtuhQIU7AncGiazdl2vSBreuS2w02Vn:nGMwnoarrfrRJFrEyC4EMmFeuZknn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688996374, "uuid": "c8cb8bd3-19b1-418b-8677-184ae197bdbd", "value": 1275242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688996374, "uuid": "9db674e3-81e5-45e2-b5e5-7972dfaae2df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996374, "uuid": "8f4ef1cc-28f6-4c25-a0dc-6722155afba5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7654875a-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688985747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985747, "uuid": "3cf92fb5-6d9f-4e81-aa85-6362461fb3f7", "comment": "Malware payload (Amadey)", "value": "86028b8df3e698f2faf2844b0d639e27", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985747, "uuid": "b86d27e8-33e0-4891-96b5-97efeeb876f1", "comment": "Malware payload (Amadey)", "value": "2f2353be0f03dba55a4cb6e97e0da5a3eb077b662a1e6390505bab13a09a64ed", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985747, "uuid": "80309812-c9cb-4722-af69-4932c352d950", "comment": "Malware payload (Amadey)", "value": "93ea5a957ca265eb3e50e492b9590e68b7709dab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985747, "uuid": "b5483fdf-ab58-462e-ba1b-c5b26889cd37", "comment": "Malware payload (Amadey)", "value": "73fda1a0a574330fa524f4cf198cf9fd48cebd29a03ca8f70744fa0815bf3d9ed747c8b7760679bc86ef7e03112d9195", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985747, "uuid": "d633a6bf-e517-4689-a59e-d845ee25f09e", "value": "T13FB40270B0D69623E53255332190926FBF1FDE3105A19A97A3C5793E5B281C24F3ECEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985747, "uuid": "32502c48-b8c5-47d4-89b2-5d81527e06ae", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985747, "uuid": "3dc9ee10-a1e9-4ab7-a029-abd6545521fc", "value": "6144:IWPD0GqWHBhbCWGYLUz247Jl5INI/IqpzThr03vd/Qre/UvNjfTmVAVv5Nqv+sNN:IWYkTz47JlT/aVjcvhfq2Vv5Nqv+s9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985747, "uuid": "3f999ed1-3be5-4597-906f-f637344ff839", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985747, "uuid": "b498a241-3960-4d77-89fd-9ca1126b7798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985747, "uuid": "88693bb7-2ff1-43a7-8639-5fda9d7b6835", "value": "86028b8df3e698f2faf2844b0d639e27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c690090-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688962510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962510, "uuid": "02fb4b97-ca88-47d3-9209-b6e6693b7ee0", "comment": "Malware payload", "value": "34122f00b3e102174e775d47d71a6a5f", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962510, "uuid": "80b683e3-287a-4ea9-a8df-6e0bcb2f436e", "comment": "Malware payload", "value": "30213cacc943b1923d8085f8a9c365a4d256be44eb7aed68665f555d70342c31", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962510, "uuid": "d22587f8-0b5a-438a-93bb-2c291c426110", "comment": "Malware payload", "value": "3dec214aa6ae77d53dc6bfb948bfd5f69a3c1fef", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962510, "uuid": "d427241f-7a17-4cd7-9c81-f7200f08ae6c", "comment": "Malware payload", "value": "252310436da54a1d36812fed18a17ab4c52449a3679a8cd3e26c1c80f1f4aabe2a69ce59213f53aa883d7bd4e9058471", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962510, "uuid": "179b11d6-525e-4a48-900e-e4e66379b494", "value": "T10C24236F7401FE1B810CC5E8BB0869473EA15E7590EC976D5E298E07FC62759BB02F28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962510, "uuid": "7516194b-2fd5-4065-a93e-0ad4b3f1224f", "value": "6144:UEfL9wMG5fiFYdwU6ueTFlI0R209oACLWN5sMBtn1:UE6hiFYCpp0koq7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962510, "uuid": "ca866018-6ff1-449c-af1e-e82d71ca9073", "value": 223546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962510, "uuid": "e758ec9d-53cd-4ae4-afd1-4e87f860939c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962510, "uuid": "3ad9b7a4-b468-40b1-8c6b-0e42bdf5f47f", "value": "cobalt_loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76480377-1f69-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689024831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024831, "uuid": "715829c0-136b-45db-a3c8-948e4aa4ac5d", "comment": "Malware payload", "value": "c4d2cf79f511e2e32babcc981ddf09af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024831, "uuid": "2dee116f-38fb-47ed-ad5d-557e0f776c71", "comment": "Malware payload", "value": "303cfe01cf0a8b0815b0e91080e6cb8d3a1b3e8052a969449bd9008decd8fcd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024831, "uuid": "34a90e6b-22a5-4556-b5f6-1f92d7b8f18d", "comment": "Malware payload", "value": "855bf36cc105f26c996fcb1d70f633b9c87a9363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024831, "uuid": "14ef2ae9-9bdc-4c56-9a5f-f992fa061e9d", "comment": "Malware payload", "value": "b80d3dff0b1834db8397ba62859c4e6ba2a80de4effb0d0990f6eab6d03bc0fa723e4a75f496390ac587c7fc5a88b2c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024831, "uuid": "4b7d2426-ee19-46e5-9768-c793bdf22526", "value": "T17D348E1265D4EF60D5E74A318D2EE2E8365EF971AF09EE5B21186F1F18702A2D272313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024831, "uuid": "9cf3a83c-dfb6-419e-a79a-a96ed0932e5f", "value": "5a013624489e6703ae44eba8e360cecd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024831, "uuid": "e86e36b8-7061-4ed3-a540-b5c31d0127f9", "value": "3072:JJlU/xLw8P57Hew60fWbvXlQ8NSmK8dCANBoRh5lU4ydDBy53WTwV//i:SxLwSiw60+bvXCSCzAyU4ydD1TM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689024831, "uuid": "ad1d9425-20dd-4619-b876-da8d1999b347", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689024831, "uuid": "fd82508b-4c6d-400a-b62c-3f8ec995bc2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024831, "uuid": "1500c93c-d9a9-4731-8299-2ec45a03e5e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8ff3c0-1ee4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1688967938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967938, "uuid": "ebf83d5b-db10-4dc8-9276-68aed68084ca", "comment": "Malware payload (Gafgyt)", "value": "4134bc6d0f48e19aa43ce48665ad6e67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967938, "uuid": "abca2856-82c8-469e-9d35-cca12da2d25f", "comment": "Malware payload (Gafgyt)", "value": "315076be8d90265aaa524aa5562bbcb865899fb42df883f00221d81d22c07df3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967938, "uuid": "d96c055a-89fd-4d2b-adae-90f48f718f60", "comment": "Malware payload (Gafgyt)", "value": "89cf6bf3811d0d2e74d11238acefa07e9377bf37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967938, "uuid": "b8b50e54-2533-4d2a-87f1-fb2e78f36839", "comment": "Malware payload (Gafgyt)", "value": "6d85b267514ab489d7c156343a0097777bef114ebba14a6ab83046f79420c69f34d16141e0ffe725d088573757818e8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967938, "uuid": "777041de-9d8a-432c-85f7-4d7c45a62726", "value": "T1CD035AD2C9B22E78D028D471B4356EB953676400A74F1FDE2039C2A4569F9CDF40EBB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967938, "uuid": "925cee8c-15bf-4f33-847b-4f6b8348a5f2", "value": "768:JLP78RfxGvN9N+Y6duCK2g9QraZos267yFwxJhfU18LACoI:JL4RfMFvF67Kh9QGesnyv18kCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688967938, "uuid": "9545040e-bf47-4b6e-9993-b727f3c6e798", "value": 39740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688967938, "uuid": "c1dc77d6-e00c-4496-a256-647df4d5c09f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967938, "uuid": "49347a2b-04ce-4935-a8df-65b06d2b4855", "value": "4134bc6d0f48e19aa43ce48665ad6e67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14205655-1eea-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688970120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970120, "uuid": "9fa8f0cd-0d2e-48cb-a732-e6dea7bd6063", "comment": "Malware payload", "value": "1b3c1ce0a284d736e8bbdd9780ee8a42", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970120, "uuid": "08553b67-9e20-464f-81e7-6ff21fd71de4", "comment": "Malware payload", "value": "319299772b1a606e9f5dd3b65946fcfcd7693bf41053cebf8ec9d83a4dea0e54", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970120, "uuid": "aa2f18ef-e4ce-407b-8eec-1b7db0cf4515", "comment": "Malware payload", "value": "60d7099ef1a3e6efa86832bcc3e10e9117831685", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970120, "uuid": "4e5754bf-d0f8-431b-84e3-a9a62bc44921", "comment": "Malware payload", "value": "c2732ae7c0f089ca31076d4fceb62dcea6bdd75a35463011958a94fbafaff6274b9fae9270416895dcdb306c222a8fff", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970120, "uuid": "c42fc5b7-2cc0-4d8f-8d32-b73b13311a1e", "value": "T1B5B4235B51D8002087149AB93D46D6F2D1082E4AFDF6F4A743C2BE29D33E5A2A5F52E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970120, "uuid": "f9249f48-3443-43e8-b655-0faab3928d69", "value": "12288:DYwglS4V2nPN+4uWzmFHzz/vvwGpqwYD6SgsWGkwPgGb9Rlg:ca4Il+tWyPvsD6SgsZkSn9RK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970120, "uuid": "a74ecb48-36e0-4e6e-9b66-2ba7c1304875", "value": 528144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970120, "uuid": "a0b4788f-bcdd-4d42-8cbf-1199a4cb907a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970120, "uuid": "293ba0df-4502-44d8-b250-4d951a9daa40", "value": "4501029752.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4472ca51-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688971060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971060, "uuid": "3c04fd9d-ec37-44d6-a3a3-0b2ea0b15e51", "comment": "Malware payload (Mirai)", "value": "a7a64176dcbe13fc894886e995c291e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971060, "uuid": "885e918b-cf41-4ce5-aa21-27755ec9e354", "comment": "Malware payload (Mirai)", "value": "319c295e0e0a26e229b0c3ca54e9f951d23a85f1f81389b6a2457499784c34b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971060, "uuid": "dc68236a-02ee-4ce8-b825-533f90e606b9", "comment": "Malware payload (Mirai)", "value": "d9d0c2a86eafae6b654bc533933f4d07558ecf7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971060, "uuid": "f6ca45b0-dd9d-4f83-b661-440f2ee3a753", "comment": "Malware payload (Mirai)", "value": "26395575d42c6b6f489651bacc0e2246084b1b5670ef1b2dc57c365462d716c17eb8cb107c6afd3c95bff6c4543f0703", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971060, "uuid": "74fe5f5c-1649-46b9-b215-80df7208a80e", "value": "T1B6430682EC81DA1BD6D41379BAAF61EE3310B3D9E0DE3747DD115B103A8990F0DAB652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971060, "uuid": "407a0231-3727-4016-a4fd-4859713f11b7", "value": "768:t8MrQ65Srsn8HBWfZm7dvQbGc1Vm4U0m1GgHMBEIeVpl87TU0o1Nv4ewpobOjGIW:F5RZf4BQb9gTwgHUBeVuUp1N/wVP9p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971060, "uuid": "5e96b5b0-ef65-426b-bb1a-5dcdabdcc63f", "value": 55236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971060, "uuid": "f8e6ae2f-7c44-411f-9c0d-41d3a1813942", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971060, "uuid": "00bbad7b-49a5-445a-a050-809b8d695681", "value": "a7a64176dcbe13fc894886e995c291e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3bcc00-1ec6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (YoungLotus)", "timestamp": 1688954861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688954861, "uuid": "38627054-1424-4c5d-b16d-fe24f34cdeef", "comment": "Malware payload (YoungLotus)", "value": "74d876023652002fc403052229adc44e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688954861, "uuid": "1541317a-1118-4c3b-a457-d05d5031a8c4", "comment": "Malware payload (YoungLotus)", "value": "32178938d52186030a14cbb190325fd4ba35bb4947a1db28bc07e76812b006c0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688954861, "uuid": "c904cfa4-bbce-420a-909b-8554edb0e5ce", "comment": "Malware payload (YoungLotus)", "value": "387429a298df48531a3fc2ebd8b58d2c8fb281cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688954861, "uuid": "df5dc488-140b-4bcc-8f1e-176c387bf9ec", "comment": "Malware payload (YoungLotus)", "value": "9f9ec41d60f3d009897e8094bf9a3829301982131bcbdaea4023e34194a93163ff69d10f336febe17fb511eec9202454", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688954861, "uuid": "c4cf50d7-523d-4207-a353-bcf0874a3715", "value": "T1E0033A0AE55CC0F7E25817707859277F6ABDADAF12691E6A4FA3DD6904B3260F10C307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688954861, "uuid": "6f2574b8-0da6-4a52-b1e8-4b665bf54388", "value": "11e3b80bd10c7bd86bb7e7a9f603d969", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688954861, "uuid": "4784a806-9235-4277-96d2-9bc1ff5c8350", "value": "768:ZesiLUI0PPZrmzsXAUWjNCHmhzoVBvxamBT8TiuKmLHdJqA7PZj:QRUdrm4fWjNxKBhx7ulZ7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688954861, "uuid": "56de877f-99d9-4365-9a4d-2777b4af2fbd", "value": 37910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688954861, "uuid": "ba300081-cf9d-47c7-abb1-e5632a52bacb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688954861, "uuid": "69356960-ccb1-46d9-9e23-d00f2b1ee3c8", "value": "32178938d52186030a14cbb190325fd4ba35bb4947a1db28bc07e76812b006c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10a3300-1f43-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689008662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008662, "uuid": "8c1647f7-4ce5-4e0e-8d0e-4e0106366897", "comment": "Malware payload (Amadey)", "value": "d0e70caa8c287987dd7bde33ee7feb62", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008662, "uuid": "c072914a-f10c-4534-9684-d01285ae8a2e", "comment": "Malware payload (Amadey)", "value": "331d87baea2d774655c8ab932059f2797aca0e5fb21c8a3d3249ed4091f6e814", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008662, "uuid": "0d1faf54-a5bf-4e39-8689-e03c7e0af425", "comment": "Malware payload (Amadey)", "value": "6a633ff05dc6d176f1959e982252c80354f3bb41", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008662, "uuid": "3f880dbd-ea82-4da7-b505-826de7690866", "comment": "Malware payload (Amadey)", "value": "dd13925e7fb147e89b922b5f6b9e7a4998d72958504a0f242ec0bb3d32daaa16f90e3e64a90300a912e3f3ff900b6ccb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008662, "uuid": "3aa321bf-6a62-4742-b4e0-5bdfebef25b5", "value": "T16B75331367EC5423E4B527B108FE03472A3ABDB17D78426A37C2695D58632D8B8B2377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008662, "uuid": "a51d41a1-49ed-4f9c-b9ef-e2cf08d8e388", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008662, "uuid": "4ee5283f-7ab2-4a85-9d19-e48c730ef2a8", "value": "24576:/y7qUlsvEPQh9mMT61KZOelqmulcyQpJgYpAR5OPkJa9v89D/Ns4ILDFGuZ42ARa:K7qU0EPBMT61KZMlcygHO+jAORGuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689008662, "uuid": "0f8c925f-a2da-43c1-aae2-53fb2585dfad", "value": 1586688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689008662, "uuid": "debcfe28-8566-429a-a8b5-0ca91d5a6af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008662, "uuid": "ba532e9c-78f7-45cc-bb9d-6af74836305b", "value": "d0e70caa8c287987dd7bde33ee7feb62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383623a4-1ef7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mekotio)", "timestamp": 1688975764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975764, "uuid": "de891b66-2a5e-4556-91eb-04dcb8e5fc07", "comment": "Malware payload (Mekotio)", "value": "21a1b3e23c9d647da31b974c8bfdb01f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975764, "uuid": "a23b141a-579c-4cb5-880c-456d7478ae5a", "comment": "Malware payload (Mekotio)", "value": "33448acd722b1eda62865788fdc0272eb794dd7f11b9fb6c7926b97d13808f66", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975764, "uuid": "a3452280-c122-434a-9428-02325420d6a6", "comment": "Malware payload (Mekotio)", "value": "b3ba524d31555cca0bc0df2d277c2310a5bb0ab5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975764, "uuid": "80e93fc1-4131-416e-925b-dc7575df06b3", "comment": "Malware payload (Mekotio)", "value": "e5417f47afe3e90ee75b8306352efb84adacee151864bcf03e91f29ddd9381f7501aa1229dc3fd86a971d5a7591c460f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975764, "uuid": "ddcb619b-7634-43c2-8bf2-ce5b890b3f76", "value": "T1CD56239079C21949D9EEC3BD0F52BBAD78A21A1C8DB2001AF8D44BCF78F67D416B2553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975764, "uuid": "e1686a35-20a2-4d46-8c6e-2dc962ec31b9", "value": "36423c9bcf4c5913623c5fea90ae9c50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975764, "uuid": "fe4f0e5f-5aa9-401a-81a4-277578937661", "value": "98304:P+6fvMQq0BNM+TcM50KKNjtkYbCVXIqyqPBabbyJ+KGzAdMPZeSMNJ7QCvT6/tfz:PffvMQqki+YMyfNRl0XWZbOmzAgZeNf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688975764, "uuid": "e6f75c79-48c5-4c04-93cf-4b88ff125c5f", "value": 6145536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688975764, "uuid": "a558d687-bd5f-4d9d-bf0c-cb5b0fa1d682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975764, "uuid": "1c32cb0e-2f1b-4ee6-9ec2-fabba6ced112", "value": "ZsWIlpsW.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22082d59-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688971002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971002, "uuid": "e1c135b2-14c4-4899-85c7-12c1e1f23eca", "comment": "Malware payload (Mirai)", "value": "7f3585c843ad5601d8d1ccfad5e55487", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971002, "uuid": "c757b4ab-824c-40e7-a53b-df88563f88f1", "comment": "Malware payload (Mirai)", "value": "33ed1279d90a96b200b4695690995b4cddbd6483d69b56ebd1c37483ee922eab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971002, "uuid": "3a26c7bd-2c25-431a-a4e7-a24994dafd69", "comment": "Malware payload (Mirai)", "value": "c40f463b29857b4179b92b0bee0964f6fcd2da29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971002, "uuid": "4bbdab46-cd74-4a25-9a4d-ced545f892f3", "comment": "Malware payload (Mirai)", "value": "bb7c4355381a4ce7dd70971ffd36ef54eb6a30b24aaa12ec690e5b71497f3c6c3f62be7dfb5fd328b99582884513e15a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971002, "uuid": "c811b310-cdb9-454b-b36a-56242ec9ffe5", "value": "T13E536C8AE687E5F0DD4609B0207FFB39CA36A8313134CEB7D7C4B957ADE2642905126C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971002, "uuid": "9f4ef5de-9413-437c-97d0-c683bee1f0d5", "value": "1536:tf4f43n7qfp3yAfHOU3lpsRtESpr2HiY:tE43n7iDHAt/pP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971002, "uuid": "7cfdc724-2165-40a8-a035-d7ca02c65430", "value": 62524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971002, "uuid": "4f265bbb-77fe-4a4f-b1ee-26621531b325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971002, "uuid": "d788d81b-9365-43df-8c69-a731b9189d9e", "value": "7f3585c843ad5601d8d1ccfad5e55487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452e4b62-1f41-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1689007568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007568, "uuid": "28349ffc-a3a3-4dde-b7b0-6a48246bd1a6", "comment": "Malware payload (CobaltStrike)", "value": "3ea23755fdb530f1d4733e1c329b6262", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007568, "uuid": "43662573-eb1f-48d7-bb01-bdb1f6cce427", "comment": "Malware payload (CobaltStrike)", "value": "34c1447f2bc18265a71260fd20c773301aab0ff700518ab2da8fe0ce9e55a2eb", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007568, "uuid": "bb75d8b9-20d3-4fc1-8e40-ce64d1aee9be", "comment": "Malware payload (CobaltStrike)", "value": "94178e8c1c34374a17a6d7313ae84c30a21e42b6", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007568, "uuid": "f5a51cbf-b747-43e3-858c-7e757618129b", "comment": "Malware payload (CobaltStrike)", "value": "f1db45827f834925e06e9e55956592e92254b5769207ff824d4241a744785c6e11fe89ad8fe349f3b5fe8bd896aa0f10", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007568, "uuid": "daf85703-b56a-495d-8452-cb8a88fafde7", "value": "T1FFC507A3CB299218CB654FB1DA073474656F1C9D970E894969C0F4FE8EF2B86116323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007568, "uuid": "cff07889-67bb-4a2a-9122-d8397aeaea44", "value": "baaa8b67368fb794e5dfd540198f639b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007568, "uuid": "504422f2-84ee-409d-9185-ca122393a5f3", "value": "24576:ENOhnEd8X+bXTTH4xMBl0R/qK2RLWngE0pHa6ozFnNyr9UEK2Hyn0hy:yS+bjUxMyqK+LWngB7GFM/K2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689007568, "uuid": "f32e5afc-930f-47e4-a21c-e8fad2f61153", "value": 2633728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689007568, "uuid": "5d1c6097-f747-46fd-90e0-722d7a00c7fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007568, "uuid": "7316930b-8096-43d7-884b-ccf31838eb12", "value": "112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8284888f-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688978036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978036, "uuid": "4a304a9b-d148-4197-a157-d094cbcdfd41", "comment": "Malware payload (Amadey)", "value": "8a761f2941f952a57a4a1c78f33901a0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978036, "uuid": "419cb92e-7d65-4955-a347-8b0edc96a4c0", "comment": "Malware payload (Amadey)", "value": "3607a70b3161b86006c2877a74b24a562c59df18bfe43beae744adcbf9598bdd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978036, "uuid": "1663e124-a773-48c8-bcb7-c35335552238", "comment": "Malware payload (Amadey)", "value": "491a347614eb1fedd78fc495c267367f6aa7366e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978036, "uuid": "2f21358d-a642-452a-91c8-c4669aef7e8e", "comment": "Malware payload (Amadey)", "value": "f4d7724d96366dc1e0beb62115a1fdbfb2157cc82aac0925af4bd66aba2dfd23e44e9917c9c50311bf0b5045ad6dfaf2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978036, "uuid": "1bc56003-e15e-47ab-865a-3d9b03acb5bd", "value": "T1A5C40271B6E20933E672447314A0926FBE1FDF7209909A9793C4363D8B2D1C19D3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978036, "uuid": "0e1ffa4c-a7ef-4899-9346-a753faa447f1", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978036, "uuid": "8b6618af-2d0a-4403-a0af-c967b5b25238", "value": "6144:1kSoUTLyHBZTCWGYLUz247cwcRPVULdzbw4oQuYFfovkG0yLoDDFxgfkaY3:1k8yrz47cNpGZzbZFgk+YpOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978036, "uuid": "58bcd27e-16e7-4a03-b6d2-b3a7a907b780", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978036, "uuid": "2b1770cd-2aa6-4537-8dca-80743790b295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978036, "uuid": "2687d3b0-d73e-4297-b5a6-3f97ca5af7d2", "value": "SecuriteInfo.com.Variant.Lazy.360290.27923.15834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2853f3c9-1f61-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689021264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021264, "uuid": "31c7d705-5203-467d-8480-ab3fb36a532a", "comment": "Malware payload", "value": "1b51a933980a53be9325dcad7841b7f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021264, "uuid": "080e9c93-676a-493a-ad2f-775ccb4d9ac1", "comment": "Malware payload", "value": "364e8aa7689089ecb6eb546b76c033b218f40bb669beb0595d711d98c6c4a53d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021264, "uuid": "c46ff2c2-aa83-4fba-b758-861e2ef6b0d8", "comment": "Malware payload", "value": "c27dd2e3564bad9cdb026dacaa87fb6d009cfa25", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021264, "uuid": "d8f2c1a4-a5c7-44c5-9501-a88f87c6f061", "comment": "Malware payload", "value": "8c5322ba118f9a9923b43c1f4a23629e878fd95b127062fe12d691e6fdb87a70d70bd285b82cbe2ee3cbb836883e5a55", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021264, "uuid": "40e2622a-d947-4eeb-97fd-c8ba75679de4", "value": "T107F3885E2F228F7EF668873147B74A25A75823D626E1D684E1ACC1105F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021264, "uuid": "e8d47499-d8f6-4cd8-822d-7a711e5fb542", "value": "1536:4KgFj6sqdW36TNtK6FWJf2/3GnmeBdvmiqodeFBSWyT7e1ATqEskU1eyq8:4KgjMEjff2/3GnmeH7sSWyciskU1eyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689021264, "uuid": "0fb8ae52-fa98-4eef-84cd-fbb940254901", "value": 169440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689021264, "uuid": "38ccc4e2-cf20-4cb6-b518-b658933deb55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021264, "uuid": "f7c1662d-d2a6-414d-ba1b-00cca081fa85", "value": "most-mips-20230710-2034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6c4a15-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688991312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991312, "uuid": "16156f44-46ed-4c07-867d-2ec4fd15b0e5", "comment": "Malware payload (AgentTesla)", "value": "4c6923f74ab77b5ebcd79181f7fccfd1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991312, "uuid": "8f6ef247-21d2-4910-b4ac-c7a4186415a6", "comment": "Malware payload (AgentTesla)", "value": "367fb0e0d122f5eabd8d344d27bd9f3aea9ed0959b5186e54ec18137a2854cc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991312, "uuid": "42514603-c6b5-4ba3-8ed7-903298aa5420", "comment": "Malware payload (AgentTesla)", "value": "f91b56cd77a2579c6451fc5121476d5c849f2824", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991312, "uuid": "32d4aba5-d311-428b-b226-7db83e38cc95", "comment": "Malware payload (AgentTesla)", "value": "fc342e74e8728602c649b729e0be8ecff121f75e20516f3d56c041e1b1f2a0eb2820ccfd231b2e0db6102f8199fbe673", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991312, "uuid": "07d09fa7-473f-4a0b-8216-46cf202e1dda", "value": "T1A9F4F11372BF9B16C9B9B3FD0A58644837F88A1D6A30F3185C8B60F75636F440994ADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991312, "uuid": "0d9859a1-3536-4cc8-8412-7c0ee8306b16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991312, "uuid": "b1be31f0-1274-4011-9f08-50528c07228f", "value": "12288:uJ4ayp7tL+NI9uR4cfRJk17VsFjAg3uODCFwCMpT0/1oOCBzcKGl1+k/0Q7Prd4Y:Fp5H9VH17ehA7ODCFXMp4bYzGl1+k/05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991312, "uuid": "e8c4557c-8160-4b22-92f6-df79a05da907", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991312, "uuid": "28276155-8dde-452f-a63d-ca0577dbecab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991312, "uuid": "51200f9d-2a7b-4220-820e-6d6f2f16fa99", "value": "\u0628\u064a\u0627\u0646 \u062d\u0633\u0627\u0628 DHL - 1300397971.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca00be4-1f34-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689002239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002239, "uuid": "c365fdb2-f8d2-4dbc-8e69-8acaf06348f7", "comment": "Malware payload (Mirai)", "value": "15d2597ac7c8e02a9666a4a61579e683", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002239, "uuid": "f3b2bfb4-76d1-4523-8686-2c5dc314d40a", "comment": "Malware payload (Mirai)", "value": "3696735491700a1adab8ae6b54fe864eb038fbad79bb36ed383d6d694b5d7ce8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002239, "uuid": "2c93a84e-b9fa-4c65-9b3d-65b2ab8f9cee", "comment": "Malware payload (Mirai)", "value": "c5f56b51a0dab4486464c744f908b2e549786d61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002239, "uuid": "597773d9-37fb-43c5-be09-42ef3f503491", "comment": "Malware payload (Mirai)", "value": "6b596a303b27b82192c587aa52f766f6ada3f38118577dd10fe079f3a452b20649fe5bb2e4f8ed6abf592f9f1e8e63cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002239, "uuid": "ddd8eea6-b7d0-4273-b345-ca32c79ad60a", "value": "T1B2330A8EB8029D3CF90BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002239, "uuid": "d3252779-f93d-4b23-99f3-cda304637805", "value": "768:gduPBFnHooqR8qOCKq2cH4Y3e+TK806MMUVjzMfQXOtHud2oG5:r/hqaJM53eqK806MHdMfQXoHuC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689002239, "uuid": "2592ddd6-bc5f-43d9-9bd4-ee32b1b5738f", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689002239, "uuid": "c40d8be2-c555-4b3e-b365-8ad3a6fe672f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002239, "uuid": "7213fb9d-34ed-4354-84fe-c148dd1f9fe3", "value": "15d2597ac7c8e02a9666a4a61579e683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4088435c-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688971053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971053, "uuid": "9cf9f15a-0f69-463e-8089-869eea42ab79", "comment": "Malware payload (Mirai)", "value": "0b94a3afc70a62ff5382629c59b4fb0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971053, "uuid": "9386b34b-4cb0-41a6-9749-bcacbd2f77f9", "comment": "Malware payload (Mirai)", "value": "36b7eb2e50f4aaf134c045a54ff0adb274a9c8603c1f26bf13a1ce38bc8cc09c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971053, "uuid": "aeba46db-60f9-41da-8862-a7c651ed22e5", "comment": "Malware payload (Mirai)", "value": "f5e4a87b562b00833d853dd28b7df9d55c62f844", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971053, "uuid": "1efc6700-157c-45b0-b6af-88847ed40018", "comment": "Malware payload (Mirai)", "value": "c9d3eb07bffb2a2c9d087ee537c43853621591675c8762705e531d40d685bc29b7814180d9b374cc4b5286d4eae7d3fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971053, "uuid": "4f587f38-5c12-4521-996b-0402ab3a949e", "value": "T133434A0137584E07C1665AF8293F27E4C3FEEE9024F8F6845A0FD61A8635E37149AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971053, "uuid": "87cbb6c6-6c70-4e60-b3ab-f1b2d08b535f", "value": "768:vrbqajhCJ9xtROUWcnDrjRdqRaMV8+o1R4EWiUuScp9/+wbGJDmHLGRAkC+FP6Sv:Kc2WzO71cuSczirWkC0uzMe9XwwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971053, "uuid": "bae7134d-1a79-48a7-86d1-b00d547ae331", "value": 60144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971053, "uuid": "b7eb8a3e-610d-47e3-a6a0-2c927c7c0012", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971053, "uuid": "998d9e6c-347a-43dc-9da4-9729a44d5f07", "value": "0b94a3afc70a62ff5382629c59b4fb0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580ae2ed-1ef9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688976676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976676, "uuid": "ca1a2f6b-ccf4-43e3-8afd-6d8f061d3f63", "comment": "Malware payload (Amadey)", "value": "0cdb6440166b0135f7cd4feff60a5351", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976676, "uuid": "3881d6fa-c5b9-4341-8306-aa3f33a54fc4", "comment": "Malware payload (Amadey)", "value": "36cf6ced1c9832ffb8bea522b7683ef40a540eb70a4202c0df752b758d31025b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976676, "uuid": "2b3a8ccd-cfc0-477a-8246-461a8002765a", "comment": "Malware payload (Amadey)", "value": "8c854b7f859cf9301ab7e8ce2a25260ab1f238b8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976676, "uuid": "ef966910-9d3c-4885-ab4f-b83f5041dacb", "comment": "Malware payload (Amadey)", "value": "e110c92e854681b8d440ac2bf604968c3bac183fa915b818778464ce3d62e66d70290c26d70a6d5f88887cf246a4177e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976676, "uuid": "1e67778e-1b3f-495a-bf85-048977905003", "value": "T16866BB20FB801FECD957D1EEC24A99E15C9EC64036130D969F2FB72A23114E9B72647E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976676, "uuid": "17c2dd52-db4a-4584-bf4e-aeeaab5c46e2", "value": "aaaa8913c89c8aa4a5d93f06853894da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976676, "uuid": "41d48ad8-d2ab-4dd6-a105-c33f813e8e2b", "value": "24576:YaHMvGsCzrjbnypQ82C+ij5PAyeUHqrEAn4eUHqr9:Y1vGbjGpQJMj5PzIgA4Ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688976676, "uuid": "c1ca7c10-4ebf-46d9-b454-9b57aca0bd73", "value": 6637328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688976676, "uuid": "aced46b9-fae0-4217-ab2e-daac44726e02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976676, "uuid": "7b65c9e7-3752-43ef-9d0d-36953c205df5", "value": "0cdb6440166b0135f7cd4feff60a5351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e54c2ad-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688985706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985706, "uuid": "596d0ac6-b5df-45aa-b860-e172409a43b3", "comment": "Malware payload", "value": "3d62379f15973974aea3fcf43229dd9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985706, "uuid": "bb770db7-8535-43a9-a2fa-a761a5bbf3fd", "comment": "Malware payload", "value": "378b5de9b4dc3ce86645df7e3328d19079599066b186d2585c60bdd5aae02e94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985706, "uuid": "593a88e9-ebf1-494e-92fd-fcc1465627a4", "comment": "Malware payload", "value": "1f07eccced92ac0f40103b91f8105d2f2a27e7d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985706, "uuid": "dea4829d-fbd4-47ce-907b-c525f9a46d97", "comment": "Malware payload", "value": "dbf9ef1c668fee1ee024a790408e15276a5e34698faaab8833ec4127377c6d5a0d94aea448402a10ae5d9410ea4128ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985706, "uuid": "a2e50a1b-152c-4578-9042-24c94c4b9aae", "value": "T108033B2B5195D0BEC48F81B46AA6E756E93370B90371B15D23D4BD3B6F7AE500E6C203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985706, "uuid": "d0522378-04b3-42f4-967f-82826d75db5f", "value": "768:6qMTGLC7hSI7pxTWkoJuMz3qwfoD4VUvmJLmUs3ekoImP:iGLCtS4rTWkqu8fEtsLaov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985706, "uuid": "db60cdb6-0d35-4ebe-98d7-b720d743f391", "value": 38720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985706, "uuid": "085be3e4-ec93-4398-90b3-b5c0e10a64ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985706, "uuid": "0fc82a7e-b8d9-43df-9acc-149fb8a19095", "value": "SecuriteInfo.com.ELF.Gafgyt-NI.11517.14323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f178f0-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688969162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969162, "uuid": "957978ee-c818-4cb1-9fc1-4f3009e6fa16", "comment": "Malware payload (RedLineStealer)", "value": "e89af0f7c48103594a5def987726be0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969162, "uuid": "51a85113-f7af-4e6f-9524-8636e7e51d67", "comment": "Malware payload (RedLineStealer)", "value": "37a7cd28babef26a4606bfbaf4845eef189501ed8ac5d70cceedd2cfee0673d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969162, "uuid": "6c0b85a1-0535-4ac9-a915-27bea684d979", "comment": "Malware payload (RedLineStealer)", "value": "b032233ad2365b78514df854b51e8002d110286c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969162, "uuid": "79382f2d-5cbb-4633-b55f-e82be355a481", "comment": "Malware payload (RedLineStealer)", "value": "ee6511bb4c708963073bb31499b03cb361007ac79c0add86e537e07e0da27ccdcf1c4ce1c6da98d0a755bdfc8ac23645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969162, "uuid": "e4b471d4-928f-446b-bff6-f7a9a809b20e", "value": "T198C4126575D29533E572187329D0826BBF1FEA300A904A8793C9763E87281D19D3FCBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969162, "uuid": "4e277054-5f56-4a2f-913a-a52ba88027bc", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969162, "uuid": "fa327902-522d-4dc0-a692-38a090d6511f", "value": "6144:A0SoUTLhHBJvCWGYLUz247Mnzy1XSnhCxNPSWEyre6E81S1bF1ZS4qOL7tlO:A08hnz47Mnzzh+TXEdVF1Z7qOFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969162, "uuid": "00904d08-aadc-4def-8530-4b87068d5114", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969162, "uuid": "4f2e51a0-815c-4e4b-93b4-a28b8e42d4a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969162, "uuid": "f5423bbd-5167-4268-ba99-3bdcd0009337", "value": "e89af0f7c48103594a5def987726be0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6176816c-1f2d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1688999026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999026, "uuid": "c9bb5867-70e9-4c0c-8816-e519e4933b77", "comment": "Malware payload (Adware.Neoreklami)", "value": "b2679eaf06b78f671666eb291a2584ff", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999026, "uuid": "d084144a-dfd5-43d1-bd8c-c4abe476ce34", "comment": "Malware payload (Adware.Neoreklami)", "value": "37b3f37a01424c371572ff6c446ceefe2cf6c32072a6fc0c7d052274d7d26e84", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999026, "uuid": "6e41e2d9-66f0-4836-9dad-b5c875710368", "comment": "Malware payload (Adware.Neoreklami)", "value": "e607f631bef4bd61bfa542046dd14998b7d19c49", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999026, "uuid": "edc1cfc7-6d8a-4fdc-afdf-58a82b5e607f", "comment": "Malware payload (Adware.Neoreklami)", "value": "6b22809128098185a530425ae75864dec49529e12dd23ccc9e6516a187b944f0595981c2e01bbd1f203f7e496fb12134", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999026, "uuid": "dac6f5c9-894e-4c36-b90e-fbba089b8199", "value": "T12176331439B722F2E9472231FE495E8933B8FA5A4734526363138E6E2EBC0B15750F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999026, "uuid": "fd2aad45-1f22-45cc-b35d-412b675b96ce", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999026, "uuid": "c52932a0-b29d-4f6b-85c1-1d38f4f4483f", "value": "196608:91Ou+DSoMyM2pZB2nOd9qO9As74phNztod/AHi:3ONRFjhdEszMPSd/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688999026, "uuid": "c25adc83-9758-4004-8d0d-0a91b4648a00", "value": 7613666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688999026, "uuid": "cba9a09f-b2c5-4e74-a0e0-52ab8097e4cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999026, "uuid": "210eba27-a8af-4982-8791-c6e34bd946d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7ff5f2-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968876, "uuid": "09092129-89da-4254-a67f-93f30f6362ab", "comment": "Malware payload (Amadey)", "value": "baf11ebdcd623b20714358bc8a0ac1ca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968876, "uuid": "18486d62-6df5-478a-a8ef-67c237cef79c", "comment": "Malware payload (Amadey)", "value": "37d9567a6f8d980a430dcbb9da4ad2f18f0cd11e91235e670ebfed4d8214e7e3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968876, "uuid": "385d9f82-ef63-4cf0-972f-b48d24167fdc", "comment": "Malware payload (Amadey)", "value": "14f9115f07ea67b80bb15295c141000d32b597a9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968876, "uuid": "a7fcf780-0634-4899-bccd-071faa8f7762", "comment": "Malware payload (Amadey)", "value": "6ba7341e1913012063494a2e2a564f606029549ce65768a4b09a7b33fc846fa839424219331ad9f2b48b19359c2b466a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968876, "uuid": "6fc46b3d-c418-48ad-96ac-7d932e996b27", "value": "T1D205127571E29623F632403624D0A36EFE0FEA720A94564393E9753D97282C34E3DDDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968876, "uuid": "810ca80d-bac6-49c4-a51c-26247149588b", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968876, "uuid": "4c31b479-531d-4392-8288-85b4b7c4f0c9", "value": "12288:fA49+z47Bm7vWdf/krvwsP7TpAdJ/cvUYGHQAvALpT6prZ0LjaBDhR:VE47BmzCUwuTgWvU3HQxLp+pOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968876, "uuid": "c25cfa89-cef9-432f-b833-ed4cdc84566a", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968876, "uuid": "e8caec26-1ec3-44e2-b365-441847904fe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968876, "uuid": "b76b74f6-b5a4-48dc-9fb2-6d109ae3790f", "value": "baf11ebdcd623b20714358bc8a0ac1ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c0635f-1f4a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689011386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011386, "uuid": "7bd72987-3fd8-4084-967c-db5fdfc0e013", "comment": "Malware payload", "value": "67fcce3d5c8e7c4fe18c1180623103bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011386, "uuid": "3cd2b02b-857d-4a4e-8027-3f40c2064576", "comment": "Malware payload", "value": "37f074e704bbad04527d2f14ed764ecdd6e9520ad244ee92747e6ca7e6229e38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011386, "uuid": "34a34891-3d95-4a23-be51-3391526d2136", "comment": "Malware payload", "value": "e92e863bcebef447f56d62393f088e70bda7c9a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011386, "uuid": "95d76bc9-8e47-41f8-bc5c-d6af57a59365", "comment": "Malware payload", "value": "ce66f3aa4914cb9019c61e0ee9972c9d756cf39387ab8255020622ec296620ee9ec2cbdbb53fd3df210348e6584ded27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011386, "uuid": "b84db0e4-b7ad-45cc-8b62-50ce39720282", "value": "T141453342A96C58B0E12283FA0E1F74955FBEFC3AB97C684AB50C2B5D3F77950D902352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011386, "uuid": "cb28f5a8-999e-4db2-a21a-548a08595031", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011386, "uuid": "c1eabab9-f4f7-4857-a4ee-1becf2c4e6c5", "value": "24576:nfOyH3/ld1p409p4gPNDfpD8Lxolkz1DI1YSk2TSPv5dl2vSBreuS2w02VnKU:nGM/Pr4gPh18+lkzdIhk0g5FeuZknn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689011386, "uuid": "da9aa71d-e6f6-4088-86d9-60b467ffc8f7", "value": 1275544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689011386, "uuid": "aa54ecb6-9442-46e9-82ea-3ae8277de50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011386, "uuid": "b0dd0a5a-7e87-4cf2-9b35-f42d534d677d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b15a35-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968863, "uuid": "e0ecfbe8-5a39-4913-9b93-536ac707e186", "comment": "Malware payload (RedLineStealer)", "value": "7bcf7d8431000acb12077e6343e72df1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968863, "uuid": "b281e2d7-d7ca-4db3-8b9f-750287131b6c", "comment": "Malware payload (RedLineStealer)", "value": "3873de97433076d4bd8ec7a0f172785018ae92273a82109114b3097f8f4a9356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968863, "uuid": "f1e1a5cf-ec27-4337-b08e-2c2e7a5ca7f8", "comment": "Malware payload (RedLineStealer)", "value": "1f54704b13d750a5c9ba0f942a6a4db19ee91a41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968863, "uuid": "eecf9ece-fd81-44ac-98b4-3fee05edeeb4", "comment": "Malware payload (RedLineStealer)", "value": "588ca6273d2405361bf51342387a4ae41f44c2ffd8b1c12ecd8cde3c371c9d7943946d47714384b432773963f2ea871b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968863, "uuid": "514c7cbf-410a-495b-83c3-575cd64e8a02", "value": "T12644283921E144A7D8BA9E35BE4BC0D17116AEB4017C541F3FB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968863, "uuid": "3adca490-03e7-450a-b431-42b5e1314d63", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968863, "uuid": "f9a02a0d-01cd-400a-8cca-78ab17d90c14", "value": "3072:R8+iOHMwew7+picM/jsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:R8vOswD7aVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968863, "uuid": "4a9ae91f-ef2f-4391-b007-51a44b364960", "value": 272545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968863, "uuid": "0ac507db-7e56-40b2-aa26-208cab36f59a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968863, "uuid": "744de79c-e66a-4697-94b8-d01f3e252f2a", "value": "7bcf7d8431000acb12077e6343e72df1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f84eb2-1f27-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688996671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996671, "uuid": "fbd176de-af67-440a-be74-9ea11cfa1039", "comment": "Malware payload (GuLoader)", "value": "8d4facbc82e988130375c5a5e7191e4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996671, "uuid": "d0c9a8f7-dd75-4ac2-8fdd-e4fc83a34782", "comment": "Malware payload (GuLoader)", "value": "38b1fa09afda5be40267c84dc88ed1291301a6f031b2de0185d40dd9372b2c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996671, "uuid": "66d9f894-c318-481f-8c4b-8d688a1065de", "comment": "Malware payload (GuLoader)", "value": "c3a0f067c0366b0818cb1a823322607509131916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996671, "uuid": "d86ebd7e-906b-47f3-8fff-19500a51001e", "comment": "Malware payload (GuLoader)", "value": "e05d25e2224dd746b90df47d3d40c641cecd3bd9f54e827c31899daca1ed32d365f5ace3670269fbaacbe1cf71ec7e15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996671, "uuid": "3049bcc3-71fa-4a5d-aa8f-aade8f3c95d9", "value": "T14A844A9239DA356FDC2F4678035FEAB22A795CD0B382486E4F40361E4C3654A90EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996671, "uuid": "85954c9d-3455-49d3-b95e-ad72ac672358", "value": "b40f29cd171eb54c01b1dd2683c9c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996671, "uuid": "5353308a-babc-4e03-a10e-a852f5a714f9", "value": "6144:/oShfEPZVheNA+ff03PJRnEv9Qw7ojvWUqyIMf6rbnf3I:QqCnhe2e47W9Q3DWLsfO/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688996671, "uuid": "7f37586c-9fde-4f4c-bb8f-914ca5eac32f", "value": 374630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688996671, "uuid": "8731bf55-7d55-42b3-af25-c462bd34b586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996671, "uuid": "62098b40-2864-47fa-9aeb-092eb310c05f", "value": "Factura 0104109174pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4ad9f5-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985757, "uuid": "1a681bab-19be-43b6-834c-4a8d4b257756", "comment": "Malware payload (RedLineStealer)", "value": "d63f9da92c02f67858c710afeb9fae7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985757, "uuid": "444669c8-56b3-441d-94d6-80edec549c2e", "comment": "Malware payload (RedLineStealer)", "value": "39011e698918a4909b5e9b33d0931e6ebdd691862734b0bcd12415ba458a4bb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985757, "uuid": "7df54eb3-e6a6-46ed-ab40-f19c4ca924a4", "comment": "Malware payload (RedLineStealer)", "value": "bc3012f3c6d06f064c2ea8e927863aeee749aaee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985757, "uuid": "ae3845a6-036f-4dea-ab12-2331ad2e8804", "comment": "Malware payload (RedLineStealer)", "value": "1424259dd4f584a9221c56fac6f626a1105c2701189b614c11a2fe2060a52dc1b5c8ef01dcc7c8b151db1ec7a6621b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985757, "uuid": "8ef408eb-a160-4a69-a66d-6eb583622ae7", "value": "T184C402A171D38633E8B5557326D4C23E7F1BDA610891478393C97A3E87291C25E3ECAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985757, "uuid": "e921a658-a687-407b-9069-e26b64ad63d6", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985757, "uuid": "96fd3181-9c2b-402d-8052-337d66009f11", "value": "12288:4egHAFz47hHqz6nfVN7w/OZEJFK9b6L6GRU5Q:ug947hKunnRZby6eUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985757, "uuid": "b9fcef44-dd78-4582-bc5d-721e99740f6d", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985757, "uuid": "c2a4a8f2-e4a8-414e-94f6-4494832f3cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985757, "uuid": "e3b6dca0-0cc8-4b01-a287-f07a49ee7553", "value": "d63f9da92c02f67858c710afeb9fae7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c65166-1f27-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688996431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996431, "uuid": "3ac44df3-6921-4067-9e7f-02986b8b9173", "comment": "Malware payload (RedLineStealer)", "value": "65b0eea58cf5e4e8c54180c76cb4edbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996431, "uuid": "9f4c5fa8-0a1a-459c-97ac-de66ce6a27a4", "comment": "Malware payload (RedLineStealer)", "value": "391198d3935b0fc119dcee55c961c929100f0ba262179936193f2cb6a7bff2a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996431, "uuid": "9b376b56-2e32-4f40-8401-b3a3d2723eb5", "comment": "Malware payload (RedLineStealer)", "value": "bd6a96ad956349d40eab66888ee70dfe4e9d08fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996431, "uuid": "b6974266-76aa-4b33-ba48-86e10592ea16", "comment": "Malware payload (RedLineStealer)", "value": "652e00592f308a6fb2c7c68060024f5fd64d155e7fcce1e72870578c34568a1b151c50e7d994c0b8599ab238ddbfc0c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996431, "uuid": "36d5c1f5-2661-46fe-9ab9-0c6eba8d638e", "value": "T1C3752357FBD4E1A3F5BA2B309AE603D31E397D514879175E376DC48A0CA1A80E872327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996431, "uuid": "60bd58e2-6035-42d3-ace0-1bc621295301", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996431, "uuid": "e93db3aa-343e-41f5-9078-f13114307771", "value": "24576:gyY8eoq1QEBuVLNejnsvSn4le0lZI70pXfQcI+gT3ydj4516ur:nECVgWg4lNsYwlCo16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688996431, "uuid": "7edbfa50-d106-44b7-9054-326185f06298", "value": 1587712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688996431, "uuid": "fb9b21c1-9544-4307-ae69-5c357fd3bdea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996431, "uuid": "cb417305-44b2-4fa6-944b-b7a2833d6d36", "value": "65b0eea58cf5e4e8c54180c76cb4edbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e676f0-1f2c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688998686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998686, "uuid": "4aa7f292-da7f-4d1d-a239-9e340ef013c0", "comment": "Malware payload (Amadey)", "value": "b6cc7ea0b0bc196d178dd3a3fb1156a3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998686, "uuid": "5fb31872-834e-45d8-bd67-aa7cfbe91dca", "comment": "Malware payload (Amadey)", "value": "393374fc43175a2055503116eb786caf6e905cc326f158b556657cf1e863b8e5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998686, "uuid": "0881cafb-4242-48f3-86fc-67dd6f7ba12e", "comment": "Malware payload (Amadey)", "value": "3ffa8b451f51bab4fdbdbdfc20a8340b4e4b582e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998686, "uuid": "1d7dfbd6-e472-4a26-b910-e5a09b4582b6", "comment": "Malware payload (Amadey)", "value": "26cbb41cf3e8e53d21e067e807a841f3c4ec051c361d011a225b8538871f69a9e2c80c7de7d201409d910d7aad10ecb2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998686, "uuid": "76d0a3ef-c3cf-47a6-8ccb-c3da11ac2ad6", "value": "T1F315238B9BE94133CCF62BB099FD0B830532BD919978C35B37565D5A8CA3A40A970337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998686, "uuid": "22b45a30-4391-4da1-836e-cd0954b100dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998686, "uuid": "02869a20-d7e2-4901-bef6-b8d781d65537", "value": "24576:WyW10zV9B5aCUXt4+MaxV5EJgU6iglk1NAnrVECW:lWMSCylMaxV5EuU6iiQ+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688998686, "uuid": "c46e20df-275d-4e4e-8d04-46b03380c531", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688998686, "uuid": "ee9f2a54-ce9b-40d0-9898-f9b43c2550ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998686, "uuid": "03d39165-b5a0-4269-bbf6-ec4a7c2b563b", "value": "b6cc7ea0b0bc196d178dd3a3fb1156a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620bed38-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688985713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985713, "uuid": "00d437fa-c4a8-4950-acd3-9831578f78f4", "comment": "Malware payload", "value": "7aa8336e9510f40340cb167ca7c8923f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985713, "uuid": "c03413d5-8c23-4700-9caf-d73f7680e1de", "comment": "Malware payload", "value": "3969b74070699d91e8accf94f47f809249eb5c724cbe301597f920854e9067e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985713, "uuid": "865b10cb-14f9-4fbf-a591-4a19996a2818", "comment": "Malware payload", "value": "31432e5764104fcaeeacb19567d24e6287ae0b91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985713, "uuid": "c3d8eee3-def9-48f1-9b00-60572eb4fee7", "comment": "Malware payload", "value": "85aa103e62b6df024d715e75b9394815a22e4a03cb02d1b35af9502f397bfa996dac3f5485d501118ee5c27d7b875542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985713, "uuid": "b3894d52-b4db-478b-8a72-87f8c8926f4f", "value": "T1D5135C97A71C0A4BD1775FF4393B27D4C3AEBA6012D856C8210EDE819372931A653FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985713, "uuid": "0d7226bc-8a2f-4982-acef-bfd80c004e2e", "value": "768:UO6jZus0mpuPDj29ukaKJhkQiMRQ//Fa2tloXnI5:UO6jZV08uIuJKJbiMRyA2nqn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985713, "uuid": "c7196a35-1270-41b1-9628-d98762f7e4de", "value": 42396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985713, "uuid": "1bdb09eb-7f44-4d69-b5b6-79ad828b43cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985713, "uuid": "91616747-2db5-451b-a698-359aa30dc9e1", "value": "SecuriteInfo.com.Backdoor.Linux.Gyfgyt.BR.MTB.5001.10490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ac9eaf-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985737, "uuid": "b60c61c9-ef2b-4f09-bcf8-fb759e7d4a87", "comment": "Malware payload (RedLineStealer)", "value": "bf4474a7b955075ef14a48e2ba631181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985737, "uuid": "72d66e3d-5c9d-48ed-bbae-f5356c8e1842", "comment": "Malware payload (RedLineStealer)", "value": "39fe03845f04099e7100c0462b899a7846ae32620bdc41599a99a4014bc0d9af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985737, "uuid": "7769c994-434a-4677-abe8-7e9afdc40aaf", "comment": "Malware payload (RedLineStealer)", "value": "ec69cb6eb45a99d4b3d0d6b276912872e56db4d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985737, "uuid": "8bf8b403-4f36-4bd5-b36f-9962084ac5a7", "comment": "Malware payload (RedLineStealer)", "value": "661c28cf68bd1107795c105c87b9ba21869c73c84ab600e4b38cf1d468a2f1f2453482fbf329720d8a42f4a0d1f2bea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985737, "uuid": "962e247d-e0bc-411f-a7b5-8a6b1be57f82", "value": "T187C40270B1D29633D532147729D0C21EFE1FEE311A915A8393C9793E4B291D24DBECAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985737, "uuid": "db2fc647-a0a4-40a8-a86a-8acf1835e2b1", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985737, "uuid": "895d49f9-03dc-4f88-a0ae-602a757a4cc1", "value": "12288:mP+gHY5z479uqXLp1ikYaAKxuGvykXM6ffvVJ:mb45479ugYaA4uGvykcuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985737, "uuid": "00ed4ab7-7e15-44c7-b592-5d9b28bec367", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985737, "uuid": "2997ad9b-0761-4138-9eed-fa97e86d5003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985737, "uuid": "c8ab9848-9c9e-4e46-bae3-1761f5b6240e", "value": "bf4474a7b955075ef14a48e2ba631181.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146b541c-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688991166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991166, "uuid": "67aaaf9e-9021-415b-a032-1f78f7683511", "comment": "Malware payload (Amadey)", "value": "c6e46679205092e6a9e503d31735076b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991166, "uuid": "d2e98e55-7a1f-469d-b5b2-838b1debfde2", "comment": "Malware payload (Amadey)", "value": "3a376e7274190f01e4ccd4c0567d27003fb1faaf3de0e8072930011ac13d2705", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991166, "uuid": "0c97edbf-eea8-4d23-959c-3469e497546d", "comment": "Malware payload (Amadey)", "value": "ac36613f2b8fbd692b463ec14c99471108d28672", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991166, "uuid": "3f8a4a90-4aa1-4e31-92d2-9db26b5db2af", "comment": "Malware payload (Amadey)", "value": "110a870353fb0a70e64832f6facc782672044ec8c9d96940411af92013819dfeedc121ff7355d4caeb42713335639867", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991166, "uuid": "173bf2d5-f82f-497d-a62b-ce41b393d8c9", "value": "T151C4023072D25523E571153754A0C26EFE1BEE710A91AB83E3D9BA3D4B291C14D3ECEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991166, "uuid": "8ecd2b89-e337-445f-9e7d-75be6b7fcabf", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991166, "uuid": "b532742a-959d-4116-9070-579a81690cd6", "value": "6144:sPUSoUTLdHBRfCWGYLUz2474nc7bUyIcIuT0zpCsDiYNIVOo8/KD0LHofLMNLUux:sPU8dfz474n9yMzYsDiLEK9fLUUFqd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991166, "uuid": "f976b7e9-d582-4e8b-bcbf-f28d6948edcb", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991166, "uuid": "44338878-7283-4ab3-be84-033309a03595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991166, "uuid": "a3c308f1-fa93-45f9-88ff-ac9e2e6528e7", "value": "c6e46679205092e6a9e503d31735076b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09280abd-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688991147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991147, "uuid": "ef605741-8382-46f9-b498-c45e31cab72e", "comment": "Malware payload (Formbook)", "value": "1317cd4790b40e8aa19a99af1fe8dadb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991147, "uuid": "681915b4-9653-4b25-b058-0fbedba1ffac", "comment": "Malware payload (Formbook)", "value": "3a455a78fa7b3fc2bbc6432193ad7868e7de7bc53e70c8ad22f83b8d343e664f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991147, "uuid": "6095bd3c-0641-4402-b2d5-f3404d5c0f34", "comment": "Malware payload (Formbook)", "value": "c4923caaa765b41345146a7bc5ef4ea80b715c12", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991147, "uuid": "917c7b55-1245-4e18-9ae7-8973e89fdcb7", "comment": "Malware payload (Formbook)", "value": "20487bb6b359096b824c6b3622357a3a1bb9f50fa2c8082417e60676fc4973e83bb9fdd8bce7f61adf14f50bb3ca3fc5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991147, "uuid": "6ab38338-0518-4832-886c-a0721ffaebf2", "value": "T118139F5EE78F02A48F411277531B4E89AABDB63EB35144B1786C933433EDC3942666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991147, "uuid": "432035fd-e210-4fbc-9bec-901ac019062f", "value": "768:+Fx0XaIsnPRIa4fwJMb9pUh9Bg4TIujaBDux2S3WP9fQUfnv/:+f0Xvx3EMI9Bg4TIUaNux2WWP9fhfv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991147, "uuid": "7606310b-1b20-4398-8206-45ab118934d3", "value": 45510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991147, "uuid": "82ad5b62-15eb-40db-bc7b-ce2c445aa557", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991147, "uuid": "500afbf2-6e8e-479d-af81-9945208cf8c9", "value": "1317cd4790b40e8aa19a99af1fe8dadb.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752ae501-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688985745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985745, "uuid": "573c5ab3-a426-4bbe-ab19-8d0402324ed3", "comment": "Malware payload (Amadey)", "value": "d37689fa5b6406815ec69c24d0e9c97b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985745, "uuid": "e7816250-7846-484e-80da-505685624301", "comment": "Malware payload (Amadey)", "value": "3a50b9ad9a99aab8873c9840096a10f84ee0d45cbb412b136472123357e174fc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985745, "uuid": "ff2f4e09-c147-413d-8ddf-0a9943659633", "comment": "Malware payload (Amadey)", "value": "df2c84ce1fece5c00e792ec59e898b34753d7bbc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985745, "uuid": "94ee2def-a3d9-4521-ac9e-3f6af2ee42a1", "comment": "Malware payload (Amadey)", "value": "0bf927181f90b3e1c826507bc9918d0ed58f0daa88be5c799961358041c748e39a5a9c7ae900e73fd5becbd35ce00ffc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985745, "uuid": "e8e70c18-b5f5-494b-9ee4-667368e09e0a", "value": "T12105129471E25563F2B194332990821EBE0FEA721AA15F0397D9B939472C2C24F3DDF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985745, "uuid": "a2899b6a-beb1-4385-a92b-8230daeaa206", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985745, "uuid": "caa084a7-52e3-4cb9-8b03-47584ad451f3", "value": "12288:nv+Ip64z471F+cvmquSaxL7uYWOqDpsWmY2A26PfVDYY5u9q/176wZAIvWHgrzh:R46477moaBBzqz06HVDtuOmB0zh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985745, "uuid": "f8cd5463-07b1-417d-8fc4-d9e0ca3bb7bd", "value": 824992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985745, "uuid": "577488f8-7cab-46ad-b988-967f4d1b162a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985745, "uuid": "e56375e4-0133-4cac-8560-8bcfe106c6c4", "value": "d37689fa5b6406815ec69c24d0e9c97b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134cfcdd-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688991164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991164, "uuid": "9479c6a3-08a7-4f70-af64-410d0c8957d2", "comment": "Malware payload (Amadey)", "value": "d98b595dafee432862e973a84dc42988", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991164, "uuid": "0e90829d-7eb0-4701-b577-ebb6948d80d3", "comment": "Malware payload (Amadey)", "value": "3a62f6c21b3a163fa31e4a7f21b4165e6f4e93e1457804cf150de4ba29328631", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991164, "uuid": "35e8a61a-4d58-42a5-8de4-1f3fdcd4d63a", "comment": "Malware payload (Amadey)", "value": "a7c9f4bffc038b0c66c8652cbd3221307517c567", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991164, "uuid": "571780d8-2f75-4430-94f7-7d2370ff93f1", "comment": "Malware payload (Amadey)", "value": "cbaa21d383bf12c5f78492797bc903b246aec3ba9b7b8020adcea09856f5ea1477a1d14ee46d0b9b676032f7fd379fa3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991164, "uuid": "fab03daa-c667-4d4e-a8dc-94951ee2a320", "value": "T1F4C402A071F65923E571157218A0966FBF1FDA7109A09783C3C8763E87392C29D3ECE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991164, "uuid": "88c05cfc-2c6b-4e4a-86df-da226089e840", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991164, "uuid": "8a8dac9b-810d-454f-9e06-ad33e048a50a", "value": "12288:Hk8pIz47+slluPvVcfpgrlfvVvikXwGd:5q47RlbIlfIEwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991164, "uuid": "bdf1f1d1-af98-4703-8596-377891d62802", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991164, "uuid": "e9ea3cab-466e-476a-88dc-4a135c8b9480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991164, "uuid": "c669f0b1-8cfd-47ac-b072-92dd06e10d0f", "value": "3a62f6c21b3a163fa31e4a7f21b4165e6f4e93e145780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05be57e2-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688991141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991141, "uuid": "d22544da-0703-4770-807b-72c227eba93b", "comment": "Malware payload (AgentTesla)", "value": "5bc3e77d81966ad07b31088aa6312d05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991141, "uuid": "0ab2d2a0-de71-4446-9aaa-a3dd37e03055", "comment": "Malware payload (AgentTesla)", "value": "3a675b3c98999d8816eee415eb6e28a21f46548fcb0a9faa600b587cf77a7681", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991141, "uuid": "f1ef0c14-9ebf-4805-a1fa-883ee03982a9", "comment": "Malware payload (AgentTesla)", "value": "3618b9c332c94369172628e36cf4762b4da36546", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991141, "uuid": "ee753c6d-fadc-496e-a3ab-9aadc3df85ac", "comment": "Malware payload (AgentTesla)", "value": "21cfc30ddd541a0deaa7c199b413403df575ffedec2ca19b3d707b97ed703493ae1a9fc511384c1605d80e6c7ac66fc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991141, "uuid": "7213309c-0b0a-4443-bbd2-1a7a8281725d", "value": "T18503E44AE79F02688F910276171B1E89A6BDB23EF3515572346C837433DDC3E4266ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991141, "uuid": "bc7b6b5b-b5d0-4144-878b-a33bcaa3ccfa", "value": "768:SFx0XaIsnPRIa4fwJMe9EBCD2bCLiIguH:Sf0Xvx3EMaEBCD2bCLLguH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991141, "uuid": "c6eac29a-4a0d-429d-bcda-1c96d8871b5c", "value": 39949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991141, "uuid": "d3a1a154-a088-4da2-b85f-ed4977c24874", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991141, "uuid": "a453951a-ee79-4f41-809f-a943e4a61cf3", "value": "5bc3e77d81966ad07b31088aa6312d05.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f428bd-1f39-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689004406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004406, "uuid": "b2570d17-ae48-4c11-be9a-d501462a8321", "comment": "Malware payload (RedLineStealer)", "value": "0f0d0b0d1763725ce36c1c1db736fc8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004406, "uuid": "06eac576-7fb4-432b-911d-adc03b643bbb", "comment": "Malware payload (RedLineStealer)", "value": "3ab23a30366cb3cfeded88ccba1999ff26ead2bcde69af9aad7e2ed1fa054cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004406, "uuid": "cd18888d-3fc5-4bc5-adf4-1c8b46cd51e6", "comment": "Malware payload (RedLineStealer)", "value": "3a5d36a40ae2f0aa832b88db12e8080f83b8503d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004406, "uuid": "28d4aee1-0d37-4042-9d24-964e2c1e60ba", "comment": "Malware payload (RedLineStealer)", "value": "541429ec3f5bce2f49a85a61b9192afec96b3dd54ab74a78ca2a0fc9071d9d1bfe1d3c5a4ed730f71c6f39b0e3d2538a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004406, "uuid": "f5af9198-1c80-4d21-a926-f5d1c9c52b69", "value": "T1CD152327A6DD90B2CDB117B015F917C30F3A7CA09838C63915C3999E4DB2684ECB976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004406, "uuid": "0df713fa-1dd8-42f3-81ec-80e604b2c5aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004406, "uuid": "83618a12-fb86-4bac-ac69-3d45d0cbcc60", "value": "24576:nyD97B7U1CjyvR3id1Z0Fr4m5lO5x99+wfCbnBYsVj:yDaCjcipq5lO5X9+wqbGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689004406, "uuid": "0314fced-6b4d-447d-9b93-02b121c960bd", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689004406, "uuid": "5d29ffdd-87a7-467e-b8c5-6107910fe9a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004406, "uuid": "b96005cc-2355-41c9-93c5-f0e3ca8ed2ee", "value": "0f0d0b0d1763725ce36c1c1db736fc8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2adc1cb-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968238, "uuid": "50ce8925-0d54-4aae-818f-d0c9cf417b66", "comment": "Malware payload (RedLineStealer)", "value": "1e87505902570d312c87fc4a557ca146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968238, "uuid": "37ef986a-6b6c-4cdd-8c33-21cc0d5b3ba5", "comment": "Malware payload (RedLineStealer)", "value": "3ae63f1c0c74a869f43afbc240419ea063ca64d41061f069e4fb16d4f303c071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968238, "uuid": "32d82718-2608-4f18-8d2e-49add8ec73e8", "comment": "Malware payload (RedLineStealer)", "value": "bb42bef3fefdd4c6a0ea15b16ab714b31a090e80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968238, "uuid": "3115c241-588a-4633-93d1-399f4f2de7cf", "comment": "Malware payload (RedLineStealer)", "value": "8d9d3ade008e0daae1df4b879200ffcc6d1dce6b386d6f4a58718902ce05dd94d1cdde76a1373a2981f6344e34b81d08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968238, "uuid": "0c216524-7760-45b4-8c56-20afd9f66607", "value": "T14344283921E144A7D87A9E35BF4BC0D17216AEB4017C541F3BB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968238, "uuid": "4ebf9d40-b60e-444a-b1fb-5709bd3f2015", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968238, "uuid": "0dc1338b-1e9b-4a40-bb81-96fd5c92fdd8", "value": "3072:+c+iOHMwew7+picM/KsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:+cvOswD7bVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968238, "uuid": "88aac0ac-caed-4085-82b7-870db0c6b1e4", "value": 272546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968238, "uuid": "964b2d29-c0a9-445b-b6cb-4eaae635bfce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968238, "uuid": "114130b7-6f7b-42d1-9392-220df2c7e552", "value": "1e87505902570d312c87fc4a557ca146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5dfddd5-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985021, "uuid": "fb326324-b600-44b0-98bd-d14d5f161640", "comment": "Malware payload (Mirai)", "value": "477cfb7e5aaa944d7970fc86598c66aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985021, "uuid": "fde015da-0d53-4fb4-90ed-1cfbf9f9093e", "comment": "Malware payload (Mirai)", "value": "3af88b1cde5d53ead4c88412ac41c8918b90804f78d6365b47d8f1bff51ac179", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985021, "uuid": "31a73285-4364-48e3-bc1f-e1b78a505fce", "comment": "Malware payload (Mirai)", "value": "d4c989eab4693eb347b42d36e92901e6be52607c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985021, "uuid": "49f9a6b6-0392-432d-9ff2-612bbf25355a", "comment": "Malware payload (Mirai)", "value": "2cb47919957b7bc438946e12944152be5677db5db02b3d624a6ceb139c31039368bac9ce674e9ff223797f132dba4b0c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985021, "uuid": "9e6a686a-7d62-40a6-b30b-d027167e5004", "value": "T15883C61A6E218FEDF76CC23507B34B31A76963D622E196C5E2ACD5005F6034E186FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985021, "uuid": "7b6735c7-786f-4a72-b606-cbf237cfa957", "value": "1536:mROTgkRtUZK/obPZPCFrXCenw7a/s5hb/y:S6wKw9PCFrpc55hb/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985021, "uuid": "a1cb27a8-8430-4022-a28c-0326e398c17f", "value": 80940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985021, "uuid": "d05d55c7-7d08-49dc-a8ea-3fdad6d6b562", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985021, "uuid": "6236d82a-fe25-49cb-b59a-310579df5d54", "value": "update.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b1f7a7-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985750, "uuid": "6298f310-c978-4253-8d21-dd14ad2e334a", "comment": "Malware payload (RedLineStealer)", "value": "1474ed7aa6522421e834c6aeda79bb0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985750, "uuid": "67247cbf-e3c9-4bb4-99e3-37f36b009a81", "comment": "Malware payload (RedLineStealer)", "value": "3b35b0228a8fa5e9c48d230833c6f4705615b11cdaf0a56b7585ea4b63b372ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985750, "uuid": "920400d4-5d8a-43f3-83c9-29ced85ee512", "comment": "Malware payload (RedLineStealer)", "value": "8be2fba50ad52f9d20522554529d51a97a81f192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985750, "uuid": "cd5de24d-8ebc-4c38-882f-66de08357426", "comment": "Malware payload (RedLineStealer)", "value": "298f745941249dacd7e9e787a18e3703427388b7639f9fdbdfe810837a14e4d4b2b9cbc05c1dd53e6c602d78237ec1de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985750, "uuid": "943719f4-59be-4d00-84a2-e1262e694903", "value": "T1E1C4027071D25523E53104B359A0927EFF2FEE3019914A87A3C5A93E8B3D1D54E3ECAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985750, "uuid": "f01b4527-d9ce-4df7-9ac4-f6120acd5491", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985750, "uuid": "e36dfd6e-1795-4741-be08-44a243e9e4c9", "value": "12288:9+gHDPz470S9m6pfJ2DnV06dGdzud/e5oFmVeX11s:9jr47TU6pxAnGdiwcXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985750, "uuid": "c670a6c7-9f88-4a11-ae34-78b772ad16f9", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985750, "uuid": "d09ef4b2-2dc3-4a49-905d-0a28e6baa2af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985750, "uuid": "2308def4-ac2c-43fe-9025-fac6a1c65661", "value": "1474ed7aa6522421e834c6aeda79bb0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991d3a37-1f2c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688998690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998690, "uuid": "e428eea9-9352-438b-9cd9-00bf4cdb8c69", "comment": "Malware payload (Amadey)", "value": "9511c4874e29166899148a57447587d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998690, "uuid": "5296cdb8-5c0d-4ecd-b566-b8c2ade71963", "comment": "Malware payload (Amadey)", "value": "3b37eca270aabae747ba43e0e5775b697b2fbb5000901cd91f4e75d49c0f39cc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998690, "uuid": "ec5367bc-8051-4cfd-b7ef-5b24dd95ed87", "comment": "Malware payload (Amadey)", "value": "b69517d95c02739469cda784e1ae555e41c13d84", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998690, "uuid": "8f50509f-d3ba-43b3-aadc-6b35b24086b0", "comment": "Malware payload (Amadey)", "value": "933dffc433a8813e6306e254f826ce680dc0a2d27ab68db71ad52f3dcf61aac56eee6b31d18a3276a0a15a5e4a0fc56d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998690, "uuid": "262bde4c-c252-4a23-8127-174dd9634421", "value": "T1AF752316EBCC903BC4B213B244FB43A31F32BC665C704A6A2752692779B3690787577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998690, "uuid": "54128777-657d-409b-9a78-d6cd34bc8147", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998690, "uuid": "b753eb3c-2ae2-4e2e-9119-13d9cbf34432", "value": "24576:GyXNuKHSwZARr4GbfVcu2tDQJVdz8pcwdlUvmm18KrMdkTy275+Lg2pd:V9uyher4y9TJdwpxdlUORCMMw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688998690, "uuid": "628bdac9-27d8-48a0-90f3-cb6870322bbc", "value": 1582592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688998690, "uuid": "c0c5c021-98e7-430c-aac9-aaee8262ee74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998690, "uuid": "3bbe4fff-a0cc-468f-86e0-e1f76882d233", "value": "9511c4874e29166899148a57447587d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e09abca-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688990860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990860, "uuid": "826c0970-24c7-4063-8bdb-11a9f08c1267", "comment": "Malware payload (Amadey)", "value": "03e9b051d199d3e435094d84718658a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990860, "uuid": "3f3dbe7d-6a21-4d8b-9a44-87bb9de9ec8c", "comment": "Malware payload (Amadey)", "value": "3bc5644b67db81204742155e3c069ccd684b8e0f6f34a5d01c5cbcafd7e6b1ca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990860, "uuid": "13bb07de-5cfe-4d13-9fb7-319120050a47", "comment": "Malware payload (Amadey)", "value": "8c8b718b25d64830de02e14c88f2ba0dab17af09", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990860, "uuid": "bc70daf5-6f53-4e7b-920d-aac4a78dff9e", "comment": "Malware payload (Amadey)", "value": "93b0fb185fe9b4baea87716b3f7646592c1e115aac3c8bdfe35dbf699547d2cf3cc9240f435a61480b65395912402476", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990860, "uuid": "70d31948-c10b-43f2-8dd4-e33a50b55a0d", "value": "T157C4026171D28523F277053769A0925AFF2FDF350A905A83D3C92A3E4B290C15E3ECE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990860, "uuid": "c7b99b2c-e0a4-43c1-af53-a0607fd20f69", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990860, "uuid": "10f69e8b-58ca-418d-a527-d685794f8910", "value": "12288:OegH+7z47t3pPChLKb32S6RcXpp6OJ41NqkW791m:oeP47t3JChLKb32S6+ZaWHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990860, "uuid": "e7aa17a6-b86c-4823-a532-b45c39bdc285", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990860, "uuid": "8529d58f-253f-4c24-9478-2644cdc31d87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990860, "uuid": "a3505c08-7a66-416e-9149-e94dff17dfc0", "value": "03e9b051d199d3e435094d84718658a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1fe8a0-1f04-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688981466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981466, "uuid": "0c1ba7b0-1c82-46c6-8b18-67e33c757d2d", "comment": "Malware payload", "value": "3f6978a91be79dd0b4594b056b7713b2", "object_relation": "md5", "Tag": [ { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981466, "uuid": "b323f577-8305-41c8-98cb-ea447d64bdbb", "comment": "Malware payload", "value": "3c35f7163318f296b2f63bae7dfdb1037ac0a383b16d2149a455970a8e139daa", "object_relation": "sha256", "Tag": [ { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981466, "uuid": "024854db-0b22-4278-989c-ba456897a9c2", "comment": "Malware payload", "value": "e0de33e7c2ae717c83cc335e5d0300fc2519d90d", "object_relation": "sha1", "Tag": [ { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981466, "uuid": "ca6ee159-63ea-4679-b4fa-14a79d8bf63b", "comment": "Malware payload", "value": "92e7f41afdbb69ea4712e5f26c3f882a87a8302a054f7a52dc03abbd4cc5fd5928176cfe06a94f0eeaf8149bc847a61c", "object_relation": "sha3-384", "Tag": [ { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981466, "uuid": "115bdab7-3fb7-4b03-84b1-a9a9d2f38117", "value": "T167D34BAC988CD588C979EBF2F752F4CAA14D733B4E8A94B671AF0FD61243D15E943801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981466, "uuid": "6e78fc19-fe97-41eb-8b19-ac18b5c5bbde", "value": "1536:QxUcsSL8csOUpcssqcs+c9csmcsHFb2Aa24ERLYm3RT3MSLVMXLHtSR1GWBZD7px:kvsGGYLrMeVoHtSXGml6niAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981466, "uuid": "c47e42ec-6c2d-4007-8aa5-897f5ee48243", "value": 131707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981466, "uuid": "c48f9f0b-bb42-4144-b534-a60d2ac1b959", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981466, "uuid": "940320eb-53a5-4548-8627-e4d6533514ba", "value": "BSN-1616529490.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339c9f55-1eea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688970173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970173, "uuid": "a3b17bd4-26ca-40da-abb6-b7ff05098892", "comment": "Malware payload (Loki)", "value": "739eede686651682a5c31959c356135f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970173, "uuid": "547867d8-12bd-449e-b608-70783ec35ae4", "comment": "Malware payload (Loki)", "value": "3c98d5b18ecd2aa76a2edf4a25a37e2902c568b1058b8200eb232d71ec48fb39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970173, "uuid": "0adac2df-3232-40b6-ad91-5a92b33c4126", "comment": "Malware payload (Loki)", "value": "c787dca2fb103c1f435f08512452994977ff0514", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970173, "uuid": "8e24743d-8fd8-41ea-b7ca-557b4090c1d0", "comment": "Malware payload (Loki)", "value": "3a63ecfc25979141dd123e048fd033ce932804c722ffbf5947c65c984c47f2c1202504932ab509303552c385dfc26780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970173, "uuid": "5ba66269-4526-4a73-a477-8edaad9a7d3c", "value": "T160B4022710A9E736D81C1FFD2044688A26E859545C74DF2C8C7B8CDA877AB7460FCB9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970173, "uuid": "2b9ebf2a-7ed2-41f1-b9fc-cc6f0e3e8252", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970173, "uuid": "44b17e44-6d46-4d65-9051-85a40c516870", "value": "12288:xCggy6iXQVEqwQPV5T6OoxIybqqYiKa4zzv0tkOaFG:xFWjVlwQP7ThoxneqYiP40tkO8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970173, "uuid": "950bb3ed-763a-4bfe-8324-2743d77f9a7a", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970173, "uuid": "4780573a-0054-412a-a0a3-30dce65c794f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970173, "uuid": "b161fe27-2ff0-4963-bc44-03434b2f23ad", "value": "DHL Receipt_AWB8114770418778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a878b0-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688990873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990873, "uuid": "e4bba666-b5cd-49c6-8948-efbd14c53d3f", "comment": "Malware payload (RedLineStealer)", "value": "0873a9150a1954c8b90bcfecbe801b49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990873, "uuid": "282482ed-3979-4dde-b79b-9dd7be2a1cb8", "comment": "Malware payload (RedLineStealer)", "value": "3cecf7bfd01344832df68fda7f61935c8ba6a11b6a9cc9acab32b0dda22d733e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990873, "uuid": "b5b898ff-e29d-40db-b9f4-be988ba90c5a", "comment": "Malware payload (RedLineStealer)", "value": "9405425954bacab3c83471446a152d512c2f7fb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990873, "uuid": "da9eab1f-1051-43d4-b477-e76cad3e81af", "comment": "Malware payload (RedLineStealer)", "value": "b99250c0042379bbe97b41f7deb775f6641d0995d5499a2e6a9eb4f15461136425bde492b605f15d3d5c719ddd381909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990873, "uuid": "c1285d0b-fed9-4ec7-9a45-57500f537c86", "value": "T1FAC4026171D35A33EAB2507319A0922FBF2FDE3245904A8B93C5753E8B281C15D7ECE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990873, "uuid": "f20d56a5-5d18-4b86-8e54-60778a7c8151", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990873, "uuid": "6d631ad2-9562-4b3e-b5b3-39f23940c492", "value": "12288:2+gHF3z47ag9rI4Gv65ZNEGffiXA+N9CK:Alj47agtIk5sGH+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990873, "uuid": "cce1a043-7911-4915-8836-8939f1c567b0", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990873, "uuid": "309a18a0-7979-423a-9876-754762fcef05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990873, "uuid": "616680d8-866b-4088-a97b-626a0f452e3b", "value": "0873a9150a1954c8b90bcfecbe801b49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa2b3dd-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688969119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969119, "uuid": "b9ced1bc-2ab9-460f-995d-ab71a4a3fa08", "comment": "Malware payload (AgentTesla)", "value": "f0e3dc4422eb52162a55e8d8ffb9f6ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969119, "uuid": "931e96a9-a123-4935-921d-e0ceea5fe91e", "comment": "Malware payload (AgentTesla)", "value": "3cfb4f3c28821b32a5d0904657b78a98ab8ec59d6a3c6230e9e44598cd3d6904", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969119, "uuid": "cea7ebd5-ab32-49d6-a7ff-0c0f5395ab69", "comment": "Malware payload (AgentTesla)", "value": "2b4efdd0093477563a601ff278e6c01f7b78fdca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969119, "uuid": "53fa68cc-9d87-45bd-84ec-2d2b2c619867", "comment": "Malware payload (AgentTesla)", "value": "c707e84c64507a794f26ef7d69e1ebabd78da9ff9cbbaed2d2503f8ad651c3623848599dc432ccbd565542570ad39ae5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969119, "uuid": "ad1d98c7-f73e-4b2a-a9e8-4ee020bf6a1f", "value": "T19225A53F18CAAD27D239E2967424EA5DF242B7C637A74B4EF7C21661943236933D108D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969119, "uuid": "1d80d87b-a757-4ec7-b044-2609c8eaea97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969119, "uuid": "6255cbbe-07fe-47ea-8254-1e928092280e", "value": "12288:e7LnM2Nt53sKrQfLJjbANveJDcuZIBG31db8bwlh2niQjktJghauUj+2PS:bflbAdeJgDKvobJiQiuUj+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969119, "uuid": "9cd31880-e71c-4e94-8cd2-72296a8c2a6f", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969119, "uuid": "ec08fe74-3f00-441a-b8d6-301a9d9c239e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969119, "uuid": "8db09376-12e9-490c-a61f-fa5cf44a0521", "value": "OOJHG6B7cVYv5YX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01924cac-1f35-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689002301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002301, "uuid": "7d42ef93-e5bf-42aa-ab93-572d6b462161", "comment": "Malware payload (Amadey)", "value": "1246f49bd8da1ce1506ea0edc08026ec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002301, "uuid": "67e4e1e4-82d8-479c-8f55-5a0810eee16b", "comment": "Malware payload (Amadey)", "value": "3d4d90071ded35d47dc30a222b6621fce5d38df73aa71c0799bf7d4fdf3e3cb6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002301, "uuid": "3d08fa52-a11a-47cd-9777-4585655f48f5", "comment": "Malware payload (Amadey)", "value": "293be22e4f7cfc40059165eeaec5d82916547a7a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002301, "uuid": "6b1638df-8b46-4adc-809e-b888595c48ed", "comment": "Malware payload (Amadey)", "value": "588c1182ce1e4be81022b64617a23f6f2b429fb62cc3cba5425bd016da840da189afc36bda7d307cc9bcda04cd9f71de", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002301, "uuid": "80d4bcd4-b000-41e0-a882-0f7bbbd51fc6", "value": "T12BC4026175E35633EA72047319A0922EBF1FEB710D508687A3C9793E8B2C1C15D7DCAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002301, "uuid": "b055fc69-0f6e-4dd7-a764-fbdab8176906", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002301, "uuid": "ac4b524b-e854-49d2-8575-764e79caa57e", "value": "12288:3E83nz47C+32djn93rvbkC31MWzIQy1rSeG2:Xz47TYnBvbkC31MfQy1rDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689002301, "uuid": "4180dd05-c194-4248-b407-ca615955e3fd", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689002301, "uuid": "21b1f484-c59a-43c8-84e2-313b585c9ea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002301, "uuid": "76d53e19-2d86-45cc-a51b-addd3cb8383e", "value": "3d4d90071ded35d47dc30a222b6621fce5d38df73aa71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22717afd-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688977875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977875, "uuid": "c9e02505-aa7e-4044-b85a-f61a86389514", "comment": "Malware payload (Amadey)", "value": "076e1fa4c44702f91eb13bbada0c8fa4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977875, "uuid": "a43e30be-04c2-4873-ae20-bba85c1cf7dc", "comment": "Malware payload (Amadey)", "value": "3db845d54f335cb067963c3cba3f8320ea7f1b1f0581a879f47ff4aceaee43bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977875, "uuid": "e0bc8cf7-390d-403d-8755-b56385bde122", "comment": "Malware payload (Amadey)", "value": "d9f0de6bd9ccc64832987751eeca660b21aa6210", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977875, "uuid": "3ff2df42-5c6c-4574-8326-19cb50014ed6", "comment": "Malware payload (Amadey)", "value": "a26e561249a06f69ec38840acec160b0b6a0805b1bb1e9fbea0c5b2f62210883cd742673a63a1cc7b84ce7595a806dc0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977875, "uuid": "ed4aab53-8b5a-436e-9b1f-23fc76e517cb", "value": "T1E3C4022171D78523E6B1057755F0822FBE2BCA360D605A5793C9763E8B391C09E3ECBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977875, "uuid": "c73569e9-cc4f-4367-9c20-460ad4979d5e", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977875, "uuid": "801ee1da-86b4-47e0-b889-e0f437441a25", "value": "6144:Deg7uyH/cHBtzCWGYLUz247JFpjWvIYk0SvWCpx+IngKdxO7mglBRzclwdWOvy:DegHUfz471+W0qpxVngeO7mE1LdFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977875, "uuid": "2895a515-4087-48c0-b9f4-ac3086c91bca", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977875, "uuid": "cc138832-f39d-4e43-8f3c-e9dbefe95088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977875, "uuid": "03f7e482-68bc-4f2e-bd4d-f169d6fabd3f", "value": "076e1fa4c44702f91eb13bbada0c8fa4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7484a06-1ede-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688965267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965267, "uuid": "04f52e83-6c73-40d1-a2d6-2eb3329729e2", "comment": "Malware payload (Mirai)", "value": "21cfceace2bf8cfc29913fec7f42a20a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965267, "uuid": "1b5b5478-15e6-484d-8c3a-c6a9a255fb05", "comment": "Malware payload (Mirai)", "value": "3f353b6261629968950dac3dfcdb6ab95b1386879610396a7e4ba76f7ad65108", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965267, "uuid": "e17620a2-dbae-46ae-92c7-db217063de95", "comment": "Malware payload (Mirai)", "value": "28fff49ba4300176982f49cdc4fcc039637331a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965267, "uuid": "22652937-4746-4198-a975-137b29046f81", "comment": "Malware payload (Mirai)", "value": "85da46d1d997605683d3148d8afcda7f82df48fe46306a735383985092befeb1257c40876c95b613ce6662c6fcec71c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965267, "uuid": "3e3d2e8a-0829-477b-a72c-752213184be4", "value": "T15473A64DEA649B2DC3E272FFF74912CE332B1B98B7DB71259E315A5533C8AA25425020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965267, "uuid": "5ef86932-7ac3-46ac-833d-24e305dba63a", "value": "1536:Ptn+DvPWozQMMr4lj3fvpoN+7Sz9IbiMMX0iGh9PP:EDxzLgwXpo8wX0iGh9PP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965267, "uuid": "3cd53edc-7609-44fb-b53e-e07b1400e57a", "value": 74404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965267, "uuid": "7d23ef18-cb50-4adc-aac2-5ec639db708a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965267, "uuid": "a339ad76-ef54-4183-96e7-363edce3c771", "value": "21cfceace2bf8cfc29913fec7f42a20a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03abead-1f19-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1688990622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990622, "uuid": "71f31df1-9abc-4660-89b5-f0239ce63735", "comment": "Malware payload (Stealc)", "value": "ad4ef85581eae0aabca2114286f90cf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990622, "uuid": "a05ebd4e-3bce-4701-8b72-870c031b63ad", "comment": "Malware payload (Stealc)", "value": "3f76054b9bf791ef9397df1dc505e7cc8dcb87a39a2e238e71693dd0c3c3553b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990622, "uuid": "528d65d1-f274-4795-9d25-9f6f141aa144", "comment": "Malware payload (Stealc)", "value": "2f3586790f44a9287496ce8a8f1ae1ffcc7a1ea9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990622, "uuid": "9fb32f31-dc9e-4050-82c2-e1bdcd1d944a", "comment": "Malware payload (Stealc)", "value": "e3ee22eb9bd08892cb2a37ef6153bc56cb50248f029625919083c6534865bf1b23f85c5828ad03d4429ed13f0c4ca75f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990622, "uuid": "5b09a106-3f72-47d9-9137-8f60b51cbd69", "value": "T1A954E00663F560BAE1BAA33499F341A39A31B8B16B7556FF12C0C5BD0D232C4A535F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990622, "uuid": "c239705d-e095-4a63-975c-9a70549c6912", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990622, "uuid": "08e22539-c652-45a4-b106-4685a107ae92", "value": "3072:PahKyd2n31d5MtpUNPgaGR1aLERyofnUQNkRRLFptSyh/ODpG9aaCXEmWOWFBubc:PahOApUNo1agvnDNkfLtSSWpEbOABm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990622, "uuid": "359741fc-3d27-4f2c-88fa-53c950dddab8", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990622, "uuid": "96bd36e4-aa6c-4842-8610-a23bd1ed9d48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990622, "uuid": "c81d9dea-18e4-46f6-84c4-07664311c8e4", "value": "ad4ef85581eae0aabca2114286f90cf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fb3251-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688981857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981857, "uuid": "ef3cc169-38de-4118-804b-80fee50cc7e9", "comment": "Malware payload (AgentTesla)", "value": "07c74f2eb5d77c5e69c1f7b7d7658d4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981857, "uuid": "b4190a66-c6fe-49b2-8371-978d5bc97b92", "comment": "Malware payload (AgentTesla)", "value": "3fc2adeb47b4f9fdf134587dc79fc696f13852e509b883e9ed7b308b77846016", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981857, "uuid": "0213fff1-85e5-41eb-8466-e50a7ecc0840", "comment": "Malware payload (AgentTesla)", "value": "381458e5883ef4f4be0b5d349b7d7ded8a0c1876", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981857, "uuid": "a3801227-511b-4f0d-8dd8-4baa6e9e24c4", "comment": "Malware payload (AgentTesla)", "value": "41d42fea5ff70946642ee58ad1e1f944518b3fc7806580fd0610909224da424b914e0fc73bd069c2e318f8446e58bfcd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981857, "uuid": "defadad4-a441-4a93-82ea-9d030e2f244b", "value": "T159258AC0EEA7D742ED6893F2E5AD114007B0365A1BBADD1C5D9253EA1863B0CD2D3AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981857, "uuid": "1e3c28a2-26f1-43c5-9b6f-c92080e655a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981857, "uuid": "4eaee83b-0b90-4e59-8e23-fce89cbc8c4e", "value": "6144:sYu/nNw/FlJEd7QCpiAnr3RgRre4Z+54ENKb9ITuIQRSYKJA+CC2BE8UgF69gHJJ:b+ld7QCYSNQe4EKRHIXh+PEzbEqvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981857, "uuid": "774bed28-3772-4226-9f92-7b3b3dec0590", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981857, "uuid": "d073b333-00c6-49b2-afae-a843cf353db5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981857, "uuid": "13633819-9624-4472-8a5a-4a3548100ab5", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88590d52-1f0f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688986206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986206, "uuid": "851b7037-67e4-4920-843a-ec1cd3fdd1b6", "comment": "Malware payload (Mirai)", "value": "0b47c3ebcd067c52b80e983f3ddbee91", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986206, "uuid": "87e9369c-2974-4fee-ae12-4abfc547917d", "comment": "Malware payload (Mirai)", "value": "40065348adf6a16aaac9fd40135258c4087b4e25bf86552c9c1cbd22fe21ea40", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986206, "uuid": "1f788721-723f-474f-977a-502eaa83e3b2", "comment": "Malware payload (Mirai)", "value": "e8eb7be03a10ae2ef5f3c032f4be4daf0dcf4157", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986206, "uuid": "ac441ba1-6ab4-4435-b8d8-e9506f609fe7", "comment": "Malware payload (Mirai)", "value": "2e407545b80db6f44031b7079624a2560417157eea19c8e20a27d3e6cd8888d950cd68d50dfa63246e2b25489ec754e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986206, "uuid": "15c0362e-7bb7-4618-9cf2-e8d02f4109dc", "value": "T19EC2E1A360B5C917C4A3837B5E3D1AA62170A434634DEE2D776A5FC4338A0E0697ECC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986206, "uuid": "9ff810ba-5a18-4d3d-b9f4-8ce954364a7e", "value": "384:Ms79WXUx5+bkbRaliVErjrL9VD9jPwrSaf5CwTvDyLTwfflrTHOBFR0j/y5ZCA+K:X5+Kcrb9VDJee2KTgdTHOBcK5ZCAyly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688986206, "uuid": "8f765b2f-2190-4f1c-a0d8-83e3523422c6", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688986206, "uuid": "8aac3870-bcca-4c71-92dc-e3be54d0c738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986206, "uuid": "154f3a5c-4536-4963-b879-897c02b8b3b5", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19db0f48-1f37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689003201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689003201, "uuid": "74abf617-1adb-49f4-940a-9dae52cdb0c8", "comment": "Malware payload (RedLineStealer)", "value": "827b493d03557b96aaa903309c5fba15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689003201, "uuid": "437b9059-4db8-4502-a393-933482833196", "comment": "Malware payload (RedLineStealer)", "value": "415eb1fd925f853e9042e20a65421e1cbf85617c94e3cea88621d2a9c1d8652c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689003201, "uuid": "a124646a-b03f-4332-b536-f830134da1ca", "comment": "Malware payload (RedLineStealer)", "value": "d40fcaf5346c6eb76759758cd67278857f3dcb1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689003201, "uuid": "7a547145-1292-4347-b617-ba766de0f968", "comment": "Malware payload (RedLineStealer)", "value": "795e5135109062b0c991572f647cb6eed85f3fec1697e0e89e08ff89c4e0a32cddc1f6d4520abd483840d3be0dd182de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689003201, "uuid": "d289eca1-13c4-4eb4-96d5-ea7388f0f18c", "value": "T118152342E7E84573DD7A43705CF507834932BC626CF9866A2785D84E5CF238898B2B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689003201, "uuid": "a8419441-20b6-42a3-8821-47b4635099d2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689003201, "uuid": "a7ce2289-4a25-400b-87ed-96e33e2889fc", "value": "24576:9yr0J91eJ1bmVQ0cb9qjI/HVxp3Awh2kdDD5WLTc:Yr0JrUbmVeBl/Pp3AC2kdHMLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689003201, "uuid": "dd76f44e-ab28-4c6e-a0dc-f362394b595a", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689003201, "uuid": "211f2140-72e4-4afd-a2b4-7c58a46c6c19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689003201, "uuid": "3e7835ee-ae35-462f-a3d3-50de0c09651a", "value": "415eb1fd925f853e9042e20a65421e1cbf85617c94e3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ea1e72-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688981879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981879, "uuid": "7f89decc-f60c-4c93-a960-9f78fffe481b", "comment": "Malware payload (AgentTesla)", "value": "313e0b353d242b3b013f14178e24924a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981879, "uuid": "56299627-0dab-4771-9367-258607ad2654", "comment": "Malware payload (AgentTesla)", "value": "4179cbf147e658854400967be76ca120278fe858fa44cc24cefea7578065b2ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981879, "uuid": "6eba20eb-1c53-45ec-83da-9e31b7e86615", "comment": "Malware payload (AgentTesla)", "value": "7a5f7282680b66513f3775ab470a18c32c67dbea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981879, "uuid": "7b75e04d-b6f2-47bd-8071-57337cb95606", "comment": "Malware payload (AgentTesla)", "value": "faa5ca49529158fabe1497f1dd9f49ca9155cc4fde4f44cc99f2737a2799026bc3229f14c954910ae9b82a545f6c7a2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981879, "uuid": "aac23ffe-f90d-4d4d-a79f-06cbaee9e7a9", "value": "T132D46B3C1CBC7123C174E2B68FADC461F250996B3E618E2B61D7998E471EA0265C7E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981879, "uuid": "b86f8f04-0724-4c41-b9ee-6d8e0d9e209b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981879, "uuid": "207c89cf-6502-44d3-a9c7-d1595d477cf3", "value": "12288:+D6OeWY7RTc0krYm8PyW4e+0hAWrnifyv:yeWmc0ZPxd+0KvfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981879, "uuid": "5e1e0618-baee-4081-82f0-cf9103c355f9", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981879, "uuid": "633df903-aa87-4a5e-94db-bb17beeeb4ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981879, "uuid": "60455823-e686-4c2c-86b5-e63b38931579", "value": "RFQ-Binh Minh Petroleum Services & Energy (BMC).xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b743203a-1f0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985426, "uuid": "026b2cdb-79e8-4ac8-96e3-5e17fe5a9584", "comment": "Malware payload (RedLineStealer)", "value": "5bc9c118b5ed351bda7eae6547375164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985426, "uuid": "ee3f5a14-f6ac-4e9d-bb11-48faa04f7721", "comment": "Malware payload (RedLineStealer)", "value": "41a89cef195c32054e910485a8e6ea1675d2f5e4daefce58ab90abcae047d3ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985426, "uuid": "0cfe7d81-bb9f-4a17-aa27-e288d7602f1b", "comment": "Malware payload (RedLineStealer)", "value": "3b644574ab5399e919cfa015528e198f205c511f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985426, "uuid": "d81ed04d-d602-457e-915f-66678c8ef83f", "comment": "Malware payload (RedLineStealer)", "value": "bc96fb2fe52c0db0b969e92ce8ccdaaae8feca4bb45951cbc4999dfbe6cc2f2b8f4966f21427fda42df722e998f9a0f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985426, "uuid": "3567fca3-dea1-4ff4-a8b1-5b5d8a28de4b", "value": "T133B4026171D25623E932443729A0836EBE1BDE3509909B8393C97E3E8B391D54E3ECF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985426, "uuid": "64bbb8fe-12f6-4ef4-a2ec-52c67807b044", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985426, "uuid": "7a67d69f-5430-4d43-8931-2b8961e641f7", "value": "12288:U0U72z47c6vmOYEnwnV22Fxf1b7xDItLccGLJh:iM47xpwng4ZIFccuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985426, "uuid": "f5cdc3c6-d729-4213-b6fa-4881b8de6085", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985426, "uuid": "d1967736-ad34-4dd0-9d7c-60f4fe69e1e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985426, "uuid": "c27da6bc-9aab-4a60-bea8-ddbfc574bddb", "value": "5bc9c118b5ed351bda7eae6547375164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db5bc67-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688971022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971022, "uuid": "bb2b7158-8d64-4767-8add-6d7dd00a438b", "comment": "Malware payload (Mirai)", "value": "4ea985f46518a77f5b0677fb8817403f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971022, "uuid": "dd376bce-5675-417b-ae59-ca02db56e769", "comment": "Malware payload (Mirai)", "value": "41b3cb52d85cf40be58f38057c10c06c640901eecbf9a75e28fee22d811ec68e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971022, "uuid": "f19a589c-2caf-4326-9564-ef294ac37778", "comment": "Malware payload (Mirai)", "value": "6ab7b87511c576fcd9f0e660c15499cd51bfa070", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971022, "uuid": "6de86815-cd2e-41bf-a4f5-6e8355ea9799", "comment": "Malware payload (Mirai)", "value": "52617e6d66ed6e7f0b4207b8ef6f9c5d4cf18b0cb5e79cf8a4fb01d1fa8318d228f11398a91131ba2cea72f76ca95d92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971022, "uuid": "64df049f-a89f-42bc-b495-6e7dc81e7017", "value": "T16E531999B401AE7CF85FDAFA51264D0DF4217201A1830F2B677BFED36CB20A49E53946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971022, "uuid": "02a5739a-f2b4-4d86-834f-24fee3a0782a", "value": "1536:p41jh2O9KrCCQjQ6kKBNQdjW4S/tuLNE8WE:Wj1KrCFQcNoiRu5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971022, "uuid": "67db387c-a81b-4120-8c3b-dfaf99e7decb", "value": 62476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971022, "uuid": "ea4b595b-58d8-42be-852c-e3d02e647370", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971022, "uuid": "d60ad2bb-8068-47b3-abe1-6f90b57b4620", "value": "4ea985f46518a77f5b0677fb8817403f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ee3080-1eff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688979414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979414, "uuid": "f929ee94-4f9e-4ec1-bf32-393a6a8981cf", "comment": "Malware payload (RedLineStealer)", "value": "e0f45af11968e9c691850585e960ab01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979414, "uuid": "9afc7ea2-ba97-4e58-a3e5-4b16a5e39191", "comment": "Malware payload (RedLineStealer)", "value": "420d620f16a81181687a02b9eb751bc64e84ef6d23cb4b4f67ed117e301a33f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979414, "uuid": "3491b56b-ded8-4525-906a-5e8ec1bb2ec5", "comment": "Malware payload (RedLineStealer)", "value": "c273cb74dde275e13c4c4c9ae95035858cb0e38b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979414, "uuid": "85e00d69-fd66-4620-a639-109834de0170", "comment": "Malware payload (RedLineStealer)", "value": "e7b0491b487a23c6bd9cf1ad5fd2e922e166b64636e1f1cca862a86ec9e194d71c8a94a2e9a694ff18045e937b62a008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979414, "uuid": "9b91fb8b-b803-4b7b-aa8d-656c5eac1180", "value": "T184051265B1E19623F636907619A0C11FBE1FD9311DD21AC793C9393F4A292C28D3ECDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979414, "uuid": "6e46272e-74a1-45f5-a114-97fbcb56ed00", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979414, "uuid": "ff12d9b3-fdee-4fa3-b7a6-1db1fbb8ccdc", "value": "24576:yK4700p6IIiZy95c/lTw3x1kXORaLntFl:yKqR5Zy9GKTALntH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688979414, "uuid": "b00781b5-d19f-43fb-9fee-be71af52df18", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688979414, "uuid": "c3736eb0-61b4-4bdc-b117-bbcd330b7ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979414, "uuid": "f15841f1-b9c9-442a-807b-897e3248336a", "value": "e0f45af11968e9c691850585e960ab01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697556d0-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688981859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981859, "uuid": "0a558557-0c32-4fbb-a1ff-0ec739298537", "comment": "Malware payload", "value": "e93c062d29437707f7740cdbcba11a0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981859, "uuid": "71bf3752-9e94-40b0-8f77-43fd7a3e3be7", "comment": "Malware payload", "value": "42a4626de8646d49df1c5ffa151c05c724b5b7d32d0131d0228189aff81db945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981859, "uuid": "0a1467c2-d3fc-4d8a-a0fe-c090718ec5d2", "comment": "Malware payload", "value": "65f9175623f0c5caeba36d743187f016c3fbb285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981859, "uuid": "0cbcc3d0-3ef5-4600-9ec8-eeafebc20c05", "comment": "Malware payload", "value": "56cde05465284f78390b42b8809ca701cf9982d7e7082f459ecbcce2749ae24f72742042383f13a4d7cd85114ccf6dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981859, "uuid": "ca14ef98-ea4e-41b9-85db-e455e882c7a5", "value": "T138242CC5E98455A0DD59AB706A36CD3592237EFDA874A42C28DE3E273FFB2D31026053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981859, "uuid": "adf9df89-eb4d-4e26-9c8b-84f660888c6a", "value": "6144:mAkzL7r9r/EDppppppppppppppppppppppppppppp0Gi:CP7r9r/+pppppppppppppppppppppppC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981859, "uuid": "046853fc-927c-49c2-a9d5-2a8a7fb63eec", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981859, "uuid": "3448b03c-d1f5-4827-9035-79719023a8d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981859, "uuid": "e38df2c5-b354-4281-bcac-f471f596f1e3", "value": "grjcSvsh1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775a3a62-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688981883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981883, "uuid": "41c74701-d419-4c15-a521-af8d89385243", "comment": "Malware payload (Formbook)", "value": "702f4e94882d765c245b8af2fc1984c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981883, "uuid": "c7877c8f-2e27-4709-9176-3a6bac60aa6d", "comment": "Malware payload (Formbook)", "value": "4339763c2998a0b0a63f0a1e0034decd766d3fc8d3cf35e946a7b12c9e34ab3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981883, "uuid": "136dd6fa-4823-4b38-bd1e-3989012e210d", "comment": "Malware payload (Formbook)", "value": "f96aaa41de354cd1dab448738d639c317e6292d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981883, "uuid": "af392cf2-755b-4c9c-a961-ed14241ad726", "comment": "Malware payload (Formbook)", "value": "f67e09402d2c4e7b5e1dd430a93519dd5d0fa596c508cac0ac72b117bea34da3b83dea9bc91b81fd108d67612a7e95e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981883, "uuid": "863b00ae-85a9-4241-8d55-23c635c5dfdd", "value": "T17C34122CBAE4C0ABE5F146718D36936239EEFE150879970B13505B6F7C31910B26EBE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981883, "uuid": "e24baf92-8062-4252-8a83-d3a804b662eb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981883, "uuid": "fab1fc94-0627-4eda-887f-8c35189daf0c", "value": "6144:PYa6MDEuyPQvYC0Z40foLVNwtqD8wVsxQNWB8q8lXF2:PYiEew4WcyQ9NGF8ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981883, "uuid": "f6ffb7b0-c835-4846-85d7-8f2dccb394e2", "value": 242995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981883, "uuid": "5ff94c4d-0b73-47dc-87c6-92eb5ed8c53b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981883, "uuid": "7c2f0e3b-9ad7-4804-9d15-85037729e38c", "value": "rockkk809543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fc4aba-1f0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688985420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985420, "uuid": "340b3dfe-1c00-4c26-a100-84d855024f36", "comment": "Malware payload (Amadey)", "value": "3e38fc3346016e3361c3cface4238670", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985420, "uuid": "d4b48005-bfea-44c8-baa6-d68e179d9a4e", "comment": "Malware payload (Amadey)", "value": "4371b14d85369b8db7326aaea4126e973ed350e36081ff7b704cee2519622d2b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985420, "uuid": "1a2343ce-c67e-4898-84f4-2ce08b34d9f4", "comment": "Malware payload (Amadey)", "value": "e50ece4e8eb0d7e7d748c7caf9ab5e7bddc685f6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985420, "uuid": "ab3020fc-4b5e-43d9-8120-12cfc15d0e7c", "comment": "Malware payload (Amadey)", "value": "27f4f3b6477f0f18e7887da5e0bc8999cc584779ce72f44753bbf16bdeddecd8b7680f5617ce05708c66512f540b1bc9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985420, "uuid": "bb017560-a6e6-4bf5-8698-6f863d12ae5a", "value": "T1A80512A1B9C75633E43200332990D61EFD1FDB3149909697A3C9353E8B2C1D25E7EDAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985420, "uuid": "977df3e1-d61d-4d09-9fd2-7a8ff6b6bcf9", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985420, "uuid": "ed50a64c-131e-4b97-ba86-da8119b79876", "value": "24576:2e47ONf2LpTDS54ec4JgG1tm2/6JVO0NIIOk:2eqOJ2N2K1aFtZyJVZS1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985420, "uuid": "ad99ec29-933d-4db9-9670-b5260cea874a", "value": 824480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985420, "uuid": "fe3fc07b-6a44-4cc6-808c-d40db98c180e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985420, "uuid": "988f4f1d-1d67-4f48-b321-a0d47854ec8f", "value": "3e38fc3346016e3361c3cface4238670.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67901e2c-1ee6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968542, "uuid": "6eae63ef-f970-4e5c-8b56-7c742cbbb3f1", "comment": "Malware payload (Amadey)", "value": "8270e79f59df93d307ab70c4b86e20b2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968542, "uuid": "7f18b226-f369-48f6-81ff-19f9a65d6f9e", "comment": "Malware payload (Amadey)", "value": "43eac1fc759f31585befe5c04543d45f46006c2fce7818d3d25f57fdd8f4c1e1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968542, "uuid": "ebc955e0-23d2-493f-aec1-6356cd96a5ca", "comment": "Malware payload (Amadey)", "value": "bda89e112b2f7ff2588ef55bb4f0c7a0527ab0ac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968542, "uuid": "962e54db-1f14-44d2-8c83-4b72692b4206", "comment": "Malware payload (Amadey)", "value": "cbcea5ff76ee9a3b5f9ef514b41335c1e2c5764014ce29d0128a75837f5e2420dc8befed3147a3f2f3b324bb7527744b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968542, "uuid": "95079a21-8e8d-4323-bb21-7ee5d6433045", "value": "T1F7C4027175D25923E67106771560932EBE2FEE3119A0968393C5753E8B380D28E3FCBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968542, "uuid": "6ef52337-9c70-47d5-8157-a6e94f8a3c78", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968542, "uuid": "75972f55-9a8d-46b3-9e70-966d3161f786", "value": "12288:K08Vmz47Pi9yW33lu91rIWqgoXUV7QSS:yc47a9V3u1rIvG7QSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968542, "uuid": "251aa658-8a8a-4787-8ccb-0c62c826a063", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968542, "uuid": "926df612-f480-46d3-aae3-6d262506dc7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968542, "uuid": "92025ae8-f020-4485-92fc-f9c62cda8484", "value": "8270e79f59df93d307ab70c4b86e20b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9036cfb1-1f06-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688982354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982354, "uuid": "dc33f55f-0d6b-4a58-b27d-7ac93d0266ab", "comment": "Malware payload", "value": "7c091b77a0f05a1c862e8cee39a6303e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982354, "uuid": "0e232ff6-b951-430f-8a8d-89672e8ff959", "comment": "Malware payload", "value": "442630d8cc7bc7cae0ed9fb63c74fb882090f7f176bacb1afee758b477ab3a11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982354, "uuid": "cb8903dc-a01b-4050-b03a-d20dc9481544", "comment": "Malware payload", "value": "a006b7dcf03526db29070b3a8a3adbc52c880db6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982354, "uuid": "7d59142a-c407-4955-8011-b1e07e94554b", "comment": "Malware payload", "value": "f5ddc0bc46b147e51f0becbbffb86bf5f0ac9ad6427bf31331cc3e91e9b36f9305f43ee3b65ff1e44977aa10f581e97e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982354, "uuid": "2be363e9-f31b-4a54-8c01-26605e35b3bf", "value": "T189E52346F352C0B1E4AA00F4046587B24E766E3283B6D4E76FE07D7E9E713D0E63265A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982354, "uuid": "b96311c9-19a3-4407-aaeb-0f7a04d6e538", "value": "1ff847646487d56f85778df99ff3728a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982354, "uuid": "5f053390-eca0-4ba5-b990-77c999b74bdc", "value": "49152:ON26FOnzGn6LJvqkwnpC+mWd6uIccYf9KMsTvmqScOCO6AjFmP8f8GPGJ3/cLlBF:O06FOznLo0+Dd6uxc16qlOPF7EGPGJ3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688982354, "uuid": "25c95e1d-9676-4668-9a6d-6dc0ea82e2a6", "value": 3110619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688982354, "uuid": "6aa803f2-74dd-41f9-9877-c17d49f46773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982354, "uuid": "f1610e59-e9f5-483b-9ca8-5b5293a7dba1", "value": "7\u670810\u65e5\u5de5\u8d44\u63d0\u6210\u7ed3\u7b97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc088a8-1f20-11ee-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1688993544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993544, "uuid": "1e866cdc-f284-401c-b8fe-3a28a036d7fa", "comment": "Malware payload (TeamBot)", "value": "d1bca6bb0e3ea61daa6a0df5ff5aad3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993544, "uuid": "e39942aa-6cb6-4210-9f2a-a84fbb892496", "comment": "Malware payload (TeamBot)", "value": "44bfc3f58325f4fae45c8d4ccec355c1a52aebcd3cfacfa21637cd9beba05bc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993544, "uuid": "88a91d32-4a8e-474d-9c78-2e859dd62574", "comment": "Malware payload (TeamBot)", "value": "0814b2fe2c02ee41604a63ecba849e7cbbf5bb91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993544, "uuid": "e5ad3412-2492-4c31-b7e1-660d1813c9db", "comment": "Malware payload (TeamBot)", "value": "01cb1800e457f6d43baffc70ce7ccd80443c72e49d27be4a835b2c7feb04b48898afeb272fa156d17ba5642b48109b7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993544, "uuid": "c9c88904-150a-4748-9216-c508152d9687", "value": "T1CF348D1361A1FDA3E7674632BD3AC6E4362EB8D14F58775A22187A3F09701B2F263351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993544, "uuid": "2740fb71-8564-47d6-9fb6-d48bf7e4f181", "value": "41550f6df9df3646fedad1ef75da0863", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993544, "uuid": "64dba294-0c88-426c-abd6-58c1c933a064", "value": "3072:Z+hLpo/s2Hy9BeM9ygoC6yWyYt0AXIHSb0YpUQEdJqXCG41:QhLp9d9n0nC6yNq8SbPiQQCCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688993544, "uuid": "70275920-6670-46ca-b28d-6b81f4a58077", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688993544, "uuid": "ddaa7461-d1b5-47cc-9548-93b8c09bf4cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993544, "uuid": "bc1e046d-cece-4de2-9919-c21b9069d503", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d617a62-1f17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688989436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989436, "uuid": "a0656530-1b1f-4df9-a65f-019de61c2b64", "comment": "Malware payload (Loki)", "value": "90ae609a9e3166ca9d8aa019ed318fa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989436, "uuid": "f506b6ad-05c0-4403-b0bd-9a1a2a4fa810", "comment": "Malware payload (Loki)", "value": "45306a9b72cc0e585f145425f6baf79a22396c76c6cef2f22e0e5e990175ac30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989436, "uuid": "9be6b75d-3141-4b96-b6a1-c583dfac3acc", "comment": "Malware payload (Loki)", "value": "48215099d727687240561893d84a388d3e2db0f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989436, "uuid": "a609c991-3500-4354-b40f-6857e05e6a6f", "comment": "Malware payload (Loki)", "value": "87877aa672179c7328da927eda2645051cc7e68cfc7f71b49d8998e4bd6fe58ede79e071604fee678e831aeeb27f1b1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989436, "uuid": "d04e8943-065b-4396-9126-8de0ee321794", "value": "T15BB4EF4171BAEB26D9B81FF90805910417FC69ADAC39E32C8CDBE8CA1572F3015D9B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989436, "uuid": "3b8cd74f-de3a-4670-bc50-848a2f80c2ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989436, "uuid": "6fb2a2b7-8978-4ebd-9464-de404b9d8370", "value": "6144:wzSSi2GhVRuXATNAZ+dzSp0kZ7jVszJ4L2ZblmC6a7pARwii1VDrQLilMNwIdY30:t5xMACmz9804Lq8Cx7GuiYVDM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688989436, "uuid": "57ce5022-5e75-45b8-b250-62b999ba9358", "value": 530944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688989436, "uuid": "0219c4d9-ef99-4f9a-a185-a44607be4e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989436, "uuid": "64a56079-1d67-45d1-a0da-33b1906941b2", "value": "DRAFT_DOCS_SHIPMENT_BLMCPUBLW230002100.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca44991-1efd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688978509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978509, "uuid": "1891489d-3554-4043-8030-b33f67a86ef3", "comment": "Malware payload (Amadey)", "value": "44158eb9607faf054f89118c78184867", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978509, "uuid": "792f4fc3-94a0-4bf3-9151-3181d83c259e", "comment": "Malware payload (Amadey)", "value": "455b0f3ec606ee1ad7fe8885b170dc695759024d0a521cf3bffb04f4c34818e0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978509, "uuid": "696927ab-4bb0-44ec-a523-d48bf8a3cc32", "comment": "Malware payload (Amadey)", "value": "f796dfa0f80dee7e3a252c7d90b359f6aa689a5a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978509, "uuid": "5bca1529-081a-4045-8eed-715b4e1c4ee9", "comment": "Malware payload (Amadey)", "value": "54d95390b472aa9ac325e398977d0dbd1a860b28dc10ecbafc6924818cf7b8e36756b4a24038b34bc77a6b6e5a584c0b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978509, "uuid": "24c54b33-cc36-4fb5-8a13-04af860e936e", "value": "T1C4B4025571D24A23EA76043319A0926FFE0FDF3118A45A8393C57A3D8B391C29E3EDE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978509, "uuid": "3ce81fe5-2915-4e7f-acbc-1ac0e36eb1e5", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978509, "uuid": "c226b9ef-6852-4fef-8704-cc5c913ba670", "value": "12288:EkUgEz47QGokZ4iE/G3STWcn3+6ayU3FnO:ZO47r14iuTScn3+DyU3FnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978509, "uuid": "fdd9a92a-e352-4f79-8804-c9e6179892f1", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978509, "uuid": "21f22a6d-bc47-416d-afeb-807dc1e17fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978509, "uuid": "f9bdc838-ccc4-43d2-ab61-1d4a28e29293", "value": "455b0f3ec606ee1ad7fe8885b170dc695759024d0a521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0f3152-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688990779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990779, "uuid": "5da57b2e-de11-448e-90e3-f1aad7b0d146", "comment": "Malware payload (GuLoader)", "value": "8a2380f0eb2583f3c8412db6ede3671b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990779, "uuid": "d5597479-8f78-45c4-97b3-d42bf5a37824", "comment": "Malware payload (GuLoader)", "value": "4568871fc80b6972c9c21a5c3fcb54432df137f9d65b70b2fa99681247f7c45f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990779, "uuid": "ecb977c8-8ed2-4fb2-a8c3-16935e82ff1d", "comment": "Malware payload (GuLoader)", "value": "baaa36b808eb8da49943e37bde284ddf3707d689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990779, "uuid": "749a2cbb-3876-4593-809b-48d197afa86b", "comment": "Malware payload (GuLoader)", "value": "f36b45fff19515c26234e45e68da5c6d949a7eb61210e2e33706d20209f072a179a174ee962cc2acd1696a1229adda01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990779, "uuid": "5f05f3e3-d474-4cf8-bff4-233017e1c204", "value": "T14B3412933BEA943FF1534EB24E71B752EBB6E6056025430F27B19F312621AC0CB1A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990779, "uuid": "5dd74a2c-16ce-4825-aebf-fa15c5635bd0", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990779, "uuid": "cedf3942-fdcf-4f61-a382-7609f06eb4c0", "value": "3072:XmpQFx8/qGOnfDjuA9bVXn9T0mM084NwbMFcPF8YZ7bqjSafciZYdQY4p1q33n2M:2Z/qRrpVXnamM0mM8jnuN35IHNREtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990779, "uuid": "72f49d45-0425-47c0-9b69-19da6dc738b8", "value": 242564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990779, "uuid": "0f341c7a-c72e-4288-a8da-1f45cbdccbf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990779, "uuid": "6618cb5b-639f-49e8-ab65-7bcdc9658ff7", "value": "r388379.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85229062-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962579, "uuid": "36366c64-d76b-4109-80af-c85d9f71cd73", "comment": "Malware payload (Mirai)", "value": "2a728492d82d77f7107b94d9f9d48e5d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962579, "uuid": "fb52fc13-0682-4e00-bce1-48660afb8668", "comment": "Malware payload (Mirai)", "value": "458744bb73a1e1d680c79835d1686b4804166c9740d6f190502024dcf5c474c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962579, "uuid": "f3814710-5e24-4767-a20e-bb55a761e583", "comment": "Malware payload (Mirai)", "value": "a043f44576bbecbfc6ca184fc328b4a1b72a693a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962579, "uuid": "5f331c08-4904-4746-b4ac-a4dd2c8db892", "comment": "Malware payload (Mirai)", "value": "30ce5c7bce8e452344db4d8319130fb6c0792b642d07d40098e13f2840a1db028ad8f5853190008849903ca7426ea4d2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962579, "uuid": "4eb3fe5b-2226-4f7a-b8cc-b7177614abcf", "value": "T1F2132985FC829A7BC6D0277AFB2E568C336663E8C2DF3313D81027546A8695F4D27B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962579, "uuid": "a9c70b23-c5f5-453a-9f08-1dd44e47a081", "value": "768:OEeOfU/X8IrkuKMG5uf+I8qTw8Pzh4LP03zyy7NPgLNsossJDkMPR0z7aBsV7c:rZlIrkuFG5ur14L03b72LNBpk8R0qBsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962579, "uuid": "dd4efacb-e4f1-4894-9210-780c6d1cfad1", "value": 42292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962579, "uuid": "30e673d9-72c4-485d-957b-c93d1ef84dd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962579, "uuid": "8f392e40-d236-4c11-b93d-d9a49f81f347", "value": "skyline.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba89c074-1f0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688985431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985431, "uuid": "539539c8-fab1-4b04-b30f-bd5e020b2bb3", "comment": "Malware payload (Amadey)", "value": "1c8e3d8677b910709ade59a79ff7282d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985431, "uuid": "9b0664c4-c05a-4c46-a914-1b62241bf9dd", "comment": "Malware payload (Amadey)", "value": "46ca3840e57c82c7be2a16ee37e85f09bc6d1d49bb6f57281645e0879c550d61", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985431, "uuid": "2b9861e2-ed74-45b1-8711-c44b9407dd2c", "comment": "Malware payload (Amadey)", "value": "19249ba5e66e4223f3dbf4cf7b29edba136277a8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985431, "uuid": "81cf25ee-8993-40a5-83fd-60250b7cf7fb", "comment": "Malware payload (Amadey)", "value": "37fc448fc9c980df33992c2715b1a98b93398431c51ee7645a3b2ee2f8989400c54dbed6169a628353bb528d9b32257a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985431, "uuid": "e55146cc-c415-46bf-8683-ceff4a2e5a13", "value": "T164C402B172D25623F03115771AA0922FBE2FEE311961479393CA723E4B391D15D3ECAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985431, "uuid": "1636c703-c221-4b11-9ac3-a5f4570c0032", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985431, "uuid": "85570456-af71-4be4-a5e4-7d26b3711174", "value": "6144:dOg7uyH/CHBhcCWGYLUz247x8Pq077EBE5zco+hyLNiAssJFqLfbDuf96hrHwPam:dOgH6mz47SPH77jBco1L6siuf969wPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985431, "uuid": "7bf657c5-b404-4233-aff3-953576e621e6", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985431, "uuid": "4ce9a4e4-93fd-428c-a2bd-07ae2cc64c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985431, "uuid": "4d6f71fd-b395-4346-9bc2-bfbfad7d38c7", "value": "1c8e3d8677b910709ade59a79ff7282d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed1055a-1f5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1689018859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018859, "uuid": "b3a627cb-e8fa-4955-b66d-f974eb89cf11", "comment": "Malware payload (DCRat)", "value": "909570c37d5cd3165461458d9cd60c4b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018859, "uuid": "3b1d5fca-e65d-495a-82a2-be6b8497dd3c", "comment": "Malware payload (DCRat)", "value": "4766063b1078d7f10cf8ba01b2a6116ecccd9a617f1ad2e0912a869d0c42772c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018859, "uuid": "8bb52258-f089-4467-8def-0ee910b1e56a", "comment": "Malware payload (DCRat)", "value": "b3f0cf3da5bcf75d15d14c6d9719ace41165338d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018859, "uuid": "535161b6-b39e-4714-af9c-43a377545bf0", "comment": "Malware payload (DCRat)", "value": "7513ab1eb3deaa1ee81d09f3920fb2bd0399cba459f373ffdc3cfba45dfd4f11725c67b492d911409f8f7ba1225a5d46", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018859, "uuid": "cf4f4120-2a64-4cbb-850a-7c97dc8db22f", "value": "T1CBE533853A8DC4F0D4A6653079BA2D603F742D3C8F6022DF6749753A58B73C3A63EA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018859, "uuid": "86c0e0a9-2724-49e7-a77a-a32e5ca45710", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018859, "uuid": "3ca55c03-e960-4dde-9798-4d919363e8d9", "value": "49152:G654FkJ0qNvcnjHssqR+2lL4teY0R9wzbTmPn5RkW5tTSCLW71:G654FknNojHsNR+PD0RCTmPn5S4tT5Lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689018859, "uuid": "f9ad4157-8c9a-486c-9fb9-42e68a7bc438", "value": 3087496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689018859, "uuid": "4448d63f-f036-4af1-8c3c-aea2321018c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018859, "uuid": "645c2ce8-cd1f-45ff-91cd-fb59b25ba3ef", "value": "909570c37d5cd3165461458d9cd60c4b.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6350906-1f0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985424, "uuid": "b0c84c79-cd0d-4e03-88b8-03ef6595111a", "comment": "Malware payload (RedLineStealer)", "value": "4af597ac71483cc4a4435cb99a0fd186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985424, "uuid": "372397aa-fe33-41d8-b0da-86f17ce74e18", "comment": "Malware payload (RedLineStealer)", "value": "47c01c5639bd704d9c36cfb69954210f6d7f3468437cc712d60e045d15cacdac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985424, "uuid": "e33c05c9-f9b1-40bc-ba86-8c387e4b6c62", "comment": "Malware payload (RedLineStealer)", "value": "bc119b7d2d24dcd7d8fb9ca17b2efa56ce46b81a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985424, "uuid": "62d2bb6a-5df1-48c6-9229-c29e1df4e55c", "comment": "Malware payload (RedLineStealer)", "value": "d67778508f897fbb7615cf43956368516a357c1e2e1756cac30e2594ad610e99f75a3f5b987d0c1019826f97858e05b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985424, "uuid": "33b6c961-ad8a-4d1d-9f6d-ee24800e1e5c", "value": "T1BFB40171B1D28923E532147719A0926EFE1FDA7216919787D3C53B3D8B281C14E3ECEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985424, "uuid": "e35f95f3-ef82-46b0-b15d-bb599f22c4b2", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985424, "uuid": "ae1e9e6f-d7c8-42eb-add7-e8b1a80dc7a5", "value": "6144:Rk7/YCVRHBoQOmmkFNxhRBxhRBxhRBx+ueO+ueO+ueAR+ueO/vfP/vfP/vfP/TCu:RkUCFz47m7/Vz8DTDS6vJZVl8cc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985424, "uuid": "469dee36-ef1b-4025-bd71-440b8f5ff61a", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985424, "uuid": "ce604136-7f47-4cb9-9b45-8f44f2530e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985424, "uuid": "5972dbbc-ad73-4c71-b83a-03afbac9a534", "value": "4af597ac71483cc4a4435cb99a0fd186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31493f9e-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688971028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971028, "uuid": "24f4b1ea-5c32-40ff-82c3-dd4d122fd935", "comment": "Malware payload (Mirai)", "value": "5ced7a0c332ec68f58a4815fbf1554a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971028, "uuid": "79966817-1f0b-4ddf-a20d-b2b1e8ebce5f", "comment": "Malware payload (Mirai)", "value": "47c52c771171bfbe9f8f62e868f1044e6d6b5fb0af6c7f1049011b2d414724a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971028, "uuid": "5b23056b-539e-40cb-974a-11dabd324cb2", "comment": "Malware payload (Mirai)", "value": "1b4f70a9964641a8f62552f3f416a3d32b52fbc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971028, "uuid": "f86c5d55-178a-404d-8161-976709173f7b", "comment": "Malware payload (Mirai)", "value": "d2f5a6e40a0d3c5d751af5fcb8421adc489ebe5a075e321b51aae792509f9e7fc875266cda1c3c0f929fbe9c1aded3ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971028, "uuid": "998d8dc6-bdc2-41aa-8b69-506de0fd9bfa", "value": "T162537C16A8391E17C0E4A5BE12FB8B69B2F4364E04A48B9D3E360F8FFF515D4A907174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971028, "uuid": "c597bf13-ba88-4fe4-86c8-666488e316a7", "value": "768:u9s7aZkaQTo4+6sNIaejhjTLGmB46SavbiGSy1B1SeeiuH7DCqyIUOwhQzcgbHXz:7cQTb+6sNIaejhj/GEOGQkeXyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971028, "uuid": "4651cd4d-712b-49f0-815c-357f9b24a6cc", "value": 66568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971028, "uuid": "f0c5b4da-073b-4269-b7c4-78a98ec03bb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971028, "uuid": "d8c624fd-12a4-4729-b32c-0683f530e2f7", "value": "5ced7a0c332ec68f58a4815fbf1554a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29aaf9c2-1f5f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689020407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020407, "uuid": "ccf20ae5-a2ff-4d40-9535-0917a370ab93", "comment": "Malware payload", "value": "c0bf6401549e314977e5b35bc6b42fa2", "object_relation": "md5", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020407, "uuid": "21217015-8a11-4aa7-b3c5-9d1219bc669b", "comment": "Malware payload", "value": "47d752c7a7a95a0227ee0cb2e3224169eaa1b34195825154389665d0f2966bf4", "object_relation": "sha256", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020407, "uuid": "eda4db19-5b14-419f-acee-49393ed175fc", "comment": "Malware payload", "value": "e48511b9c596679afd273f9e6c50ddd1075a5e34", "object_relation": "sha1", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020407, "uuid": "f15182ee-4e2a-4596-8e1f-e03def9154c5", "comment": "Malware payload", "value": "bc88d539a5e3d117c3e0ab65514c3df03c65f9ae71b2f1eca6eabc7998766824b2141ae7034b6d7e836351cb2034239a", "object_relation": "sha3-384", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020407, "uuid": "d2d97928-64f6-4026-bb54-02c9cadc4c13", "value": "T137B6334224861F5C9E6EE78BB84E504CEC6FAD461B73963C9569F0D2049F132F3EA643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020407, "uuid": "68961489-5031-4fb0-8867-761505d6f85b", "value": "196608:OqjTl2/GfGmaSStdXAoU9/nFJAHLmkPr246/+0xz+4GpZy6jXmrrfFEFCwS+:T3lkGfStU/FeHaqye6+4GUsW/9Twl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689020407, "uuid": "073b48a2-c245-48a6-aa71-1fe33884a6a2", "value": 10875182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689020407, "uuid": "fa2e60bd-b4c5-4195-9697-fc182d9d74c5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020407, "uuid": "3ad6d76f-6db6-41c0-bf6c-751885e094d2", "value": "EZL0ad3r.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6e4f84-1ede-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688964953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964953, "uuid": "b7552608-83f7-4ce0-9fdc-ab13f9264844", "comment": "Malware payload", "value": "da03dd16c31667f3eec3520417d366b4", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964953, "uuid": "48b63b60-e879-4fce-8f43-ab4b008424b8", "comment": "Malware payload", "value": "4807bf3418f168f45e7fdf33276f495ebb1039250af979596b78ed86fae890fa", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964953, "uuid": "27d2ef67-0f67-4389-86c1-e8265d7713fa", "comment": "Malware payload", "value": "1dbc28959fdb45bff3605e99d9c30ebd385bf9ff", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964953, "uuid": "136984fd-359e-425f-9712-14fc17fc18a6", "comment": "Malware payload", "value": "5f7bc706282626d621760dc12f71ac2468975ab1ec156dbece4d428c6892f441b6449470066feb05d6fcfc6aaf1f6a7b", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964953, "uuid": "b8c59460-be19-4f40-8338-eb15f8163f56", "value": "T1ADB3D6AB63306CF9C2D4406AE90F77D970ADB02670C84D8535CE4F644736DFAE216E9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964953, "uuid": "883b862f-c0fc-464b-9de6-2e99a8a567f3", "value": "768:urUr/hitHOBsOS7suhLw0TcS576hpiPlPIYogx8rz3xd9BzghrDPEioG9Xk1egP/:f/hitr7sbS+GhVK9CPEioGtk1/PtMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688964953, "uuid": "c537f896-e2e9-4ff3-ac10-229aec8dfda5", "value": 115404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688964953, "uuid": "6171ab74-ff5b-4f02-849f-886db3287dca", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964953, "uuid": "0342add6-7e30-439d-be20-6daa4f342b13", "value": "user195838396.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11ef0bf-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985013, "uuid": "53cac8fb-1efd-466e-92b8-32aae9b7f4a0", "comment": "Malware payload (Mirai)", "value": "3402419991235f00a337f8c15c6076e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985013, "uuid": "15ee5cd5-47ed-4ff5-8c80-9df670592626", "comment": "Malware payload (Mirai)", "value": "4817aa8f681afc6915b19911db70bf806ec8a762ea165149256e0ccbf5d15a80", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985013, "uuid": "309c6070-9503-47aa-a5ae-a85544535657", "comment": "Malware payload (Mirai)", "value": "b68cb9af489d9433a8e3bb1bf838965d861b4cd2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985013, "uuid": "253ab892-cb81-425c-80be-bc209b7ef119", "comment": "Malware payload (Mirai)", "value": "474ad2976665055d2fa11d286eaf20a4ec407faf8a34e4cbbad82e40c48d048571ff598150b7aea3b2080739592d988d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985013, "uuid": "4d3a1e62-0a27-4811-8515-897425dee87e", "value": "T1C2035C039D42D0F4F91148B12127EB32BA71E63B045BE753D7699C33AC71692A72BADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985013, "uuid": "2ca3fa7b-7e2e-497e-9525-88c1996f889d", "value": "768:ZTP0z7cLUwFK4E0MsKm7X6Rk3d1bAqdrbhZCH8LpxY5hCI/:ZY7cZQfyX6OtzNb/CapxY5hC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985013, "uuid": "f735cd4c-9bf2-4e55-99b6-cc53c50c7639", "value": 39076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985013, "uuid": "66460811-9720-4a8d-aeee-c089e12e07ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985013, "uuid": "8115a6c5-6c0e-46a9-9fd9-713d95eb0476", "value": "condi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0b12f5-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985035, "uuid": "4b321bc4-ae80-4f27-a8c7-2b391dbf04c4", "comment": "Malware payload (Mirai)", "value": "b4795ec9aa8486716d3c826996e8d48b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985035, "uuid": "a9f5c244-63e2-42e9-a365-5458b0035cfa", "comment": "Malware payload (Mirai)", "value": "4825c09d607bb23a7662e7d9cf9ed82de1fe3d8be6eed3a7aaa1cd49c0f19fb0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985035, "uuid": "65678d38-2958-4bde-a2f4-066b2b064ca3", "comment": "Malware payload (Mirai)", "value": "e635adb3841c520b9ae41f85819d0b566616e9ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985035, "uuid": "6235099e-2697-4b28-ac21-3036014ba26e", "comment": "Malware payload (Mirai)", "value": "21fd6e3914feb740afd69dca6b48adfaaccdfc08737e9102e3fa3d486f090c3e5fea7cfff9e7e5a255314d83039c9f26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985035, "uuid": "5bd12f35-24ec-42cd-9126-b14cd63017ff", "value": "T18A634B96BC008A52C6C055B3FB5E038D771B13A8E1FA7217D9259F217B86C6B0E7B9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985035, "uuid": "fb7a1e1a-d350-4779-b7fa-9b90e527664a", "value": "1536:wzK+CJjAC6hzOEkY8Oa/AP5VqxWPoIvds5hsB:oKKCoOPWAu65hsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985035, "uuid": "b8a9884e-503e-42ef-8a96-68c753998939", "value": 66940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985035, "uuid": "d4506fc1-5ed2-40ee-8397-e6a521aa391b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985035, "uuid": "1a0f4a52-f60c-4084-8095-688711697286", "value": "update.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9948ba8a-1f29-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688997402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997402, "uuid": "d20aacaa-e9ee-4d46-84d0-5bede3e6718d", "comment": "Malware payload (SnakeKeylogger)", "value": "7b435e58ff40b8362fb54d2babb30fe3", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997402, "uuid": "3f69524a-4cbb-4a6d-b9b4-d86f08655356", "comment": "Malware payload (SnakeKeylogger)", "value": "48461d46bf9ab04630eb75cedbbd556205e4feee8dcbba37fd000a276a207dd4", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997402, "uuid": "4d9eefb3-dcce-4068-b672-72369110dccd", "comment": "Malware payload (SnakeKeylogger)", "value": "438d1e131637a16afe5e720f9b6e9e30ba4c6136", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997402, "uuid": "12aa58f4-3d43-4ab0-9c3d-685509552733", "comment": "Malware payload (SnakeKeylogger)", "value": "2928d4dca5d11571c241e0476d8f4d1ef472373153439057f99b009a911f7b8fee0ae452c9728eb2b03f72ff8c5bef4c", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997402, "uuid": "a7de95da-8e00-48d5-9019-b7d71a27fcf1", "value": "T102E4010670BBAB42CABAB3FD1408544437F8991D6A30F3285C4BA1F39576F4459A4FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997402, "uuid": "0087fba5-6d91-449e-b428-da5908e9d398", "value": "12288:sJ4aHp7tL+NB3Sb1nDTAa0NU9uvft0RSRe7l0Llnq:ep58Spzuict0RivF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997402, "uuid": "52058fd0-da97-41b2-afaa-33a08f80ff53", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997402, "uuid": "6d72edc3-0163-46f5-a98b-8345a5beba3b", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997402, "uuid": "0355db52-ca23-46ee-b6b8-f5984b6feff3", "value": "Transferencia en divisas.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df84b865-1f76-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689030591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030591, "uuid": "7a5798c9-5bd1-4bde-bda0-6fd0e31acda7", "comment": "Malware payload (Mirai)", "value": "e8b23227f6c771cad25618c5232c2206", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030591, "uuid": "889b9761-ef35-4c9e-8fa8-93abcc768ef3", "comment": "Malware payload (Mirai)", "value": "49886b1cd643ddabdefb1b73d7a6689c7a2414d4d62a4ef80617bada52ea85c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030591, "uuid": "d7f7952d-e0f7-4a61-9bff-e21faba21706", "comment": "Malware payload (Mirai)", "value": "71aea5c00ed769bba1db6c9f2f42e9012c3668c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030591, "uuid": "84574809-1f06-4970-8132-d81193bb8bae", "comment": "Malware payload (Mirai)", "value": "cc2ec25663e1055846e5429c9ada61b6701f0f5ce9c5d7e001af9d5aa79df32a168d8e298979dd0a6c687d6030efaca2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030591, "uuid": "5b44a22f-303f-4167-b250-639832c47519", "value": "T13C82DF3051AB74E4DBE14431FEAECEC697160BF8D1FC36931658AB78CA4210651F93C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030591, "uuid": "4acedf1b-b127-432b-a560-e2aecf77b2d0", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa4hymdGUop5h5lX:2dV0P6+kom0tVAoNvm+to14s3UoznlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689030591, "uuid": "4ac52d0d-3b7b-4ec5-ad8c-b58cdb0403b9", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689030591, "uuid": "f624ead3-d837-440d-8401-da0d0afcada1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030591, "uuid": "047e41b8-9f6b-4e9c-9a3f-4318be7764af", "value": "e8b23227f6c771cad25618c5232c2206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a7d959-1f4e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689013367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689013367, "uuid": "e80391a9-4c31-4204-88bc-fb4ef44f646f", "comment": "Malware payload", "value": "5b5fd4b5ce374372b49e7cc0da6f0e4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689013367, "uuid": "9fd17d25-f32b-4697-b522-7e57c716f6e9", "comment": "Malware payload", "value": "4a269414d116334ba8837a573d824a3ff46c3b7d274b7b8e3c3ffd688a2e3729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689013367, "uuid": "643daa85-895b-4e2c-87e1-208a3c561959", "comment": "Malware payload", "value": "66a10c289359189bd9431cd9d0c776ad77ff5d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689013367, "uuid": "95bfe58e-18d5-468d-9da6-4f3e6e5d4dc4", "comment": "Malware payload", "value": "8faacbb551f994009005be604541e29954547666b31bc1e1d77531580e7932d00549b77260d745a60b356e6a1f103419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689013367, "uuid": "57508dd8-efa8-4621-956a-27f48244afc7", "value": "T14E44E00AA6E460F7C9AD833494F34167AA3174B117962AFF16D4DABD5E133D0B038F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689013367, "uuid": "95441040-3776-4a73-b019-36b8c5b31269", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689013367, "uuid": "aece0bea-3bd8-4c08-ad6d-a69dbc0bdadf", "value": "6144:PahOLKPpUNo1agvnDNkfj7wtw+Zm3Jat5ms:PimKPpggvDUwte3hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689013367, "uuid": "92821873-43ed-4d8c-bba3-e7d859f10258", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689013367, "uuid": "7c42d294-aca5-4a09-80fb-b45b824f7c1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689013367, "uuid": "b95280b5-694c-4d4d-a131-249c6362735c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d8e6b9-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688985699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985699, "uuid": "08b5041c-5516-488f-9d7a-bf4a54120724", "comment": "Malware payload", "value": "48b916028e47e72de1c0142b271dbe94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985699, "uuid": "8e8ba63b-40cc-4af3-bdb2-db21346a7c81", "comment": "Malware payload", "value": "4b9f427019199c24572f7e4829c08f7211f9224e41653fc9c6685fa767831e5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985699, "uuid": "6e90c331-8407-4741-a52b-f3ba2e352f3d", "comment": "Malware payload", "value": "635fd1ae1cd5f6747d51ae55ed8edd0b3785794b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985699, "uuid": "6d3f0c15-f421-492b-bffd-f2cb7b3d6091", "comment": "Malware payload", "value": "7a5868c7c3c6d795b12a5f12e7c9b28a441dd0a7bdcd595a057abe7c9376df0ee52694e1eeb65713085f6ac8f12e1f59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985699, "uuid": "0d75c8dd-634d-42b3-973e-3604e6cb9146", "value": "T180E26C029387E0BBF64711B25CBAD747463AF2BE1040DA2AC7986935EE67500E73739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985699, "uuid": "98d0f0c1-b209-43e0-8937-0300463c33ac", "value": "768:PXIeqcC76Qt5585zVz8HVqbrCbS8BsVSXIq:ydd3+1qVqSbD3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985699, "uuid": "0ab74ea3-8e86-4cec-a246-4652d04c2022", "value": 33908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985699, "uuid": "7e1d4b01-620a-4b76-98e1-3ea206e2596a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985699, "uuid": "b86e4da7-58e4-4271-b1ed-9639d1a7fdb9", "value": "SecuriteInfo.com.Heur.20230710103339518953786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a31cbb1-1f04-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1688981485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981485, "uuid": "e8d57513-2edb-4fb5-85a5-9f3c1d972126", "comment": "Malware payload (Quakbot)", "value": "dead32c921c7497854aab28b7003160c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981485, "uuid": "f5870da5-ef02-4be1-929a-5e1c635c2293", "comment": "Malware payload (Quakbot)", "value": "4c7d5ae6fefb8f53e0f557a241f95a677482bc4219c1d91573425ebc0cb44830", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981485, "uuid": "a790f7e5-2594-460e-a2bc-8778cdfcd9c6", "comment": "Malware payload (Quakbot)", "value": "099791366845f5958ff65ecd8e3c8ca733e28163", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981485, "uuid": "93356bc9-a04f-4527-bd6c-e57ddc2205dd", "comment": "Malware payload (Quakbot)", "value": "5f7e07efbdd1e00cfaddbe052b41e1d193245396abdcb0c59c1adb3b5e30504666077632e8fe488d204b9e3124a583ab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981485, "uuid": "ed1b24f7-5216-4051-bdf1-a9840e68f3d9", "value": "T174558E62D947D8F6EC470771A22BF78B56796B70C0218ACFD6C82D64AD238D2F658313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981485, "uuid": "718aff64-ce82-42e1-bb34-f8a5297f3d2f", "value": "efd28f0dcf3f9285f6fdf12beacfdb86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981485, "uuid": "85392366-3e71-4055-8082-c06e13a4201d", "value": "24576:QbynSJg2XBk53xIRcJaELHmfXOSNPSp0ExTqt2AO9GeM4ygQ:QbkS7XB1EsOSNPSp0EAt2bUeM4ygQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981485, "uuid": "c2308db1-813f-414c-8339-fa309a2b963d", "value": 1405439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981485, "uuid": "d45fd582-4801-4a25-8151-2ec2c0ca5072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981485, "uuid": "7fb303fe-e422-4d16-9da9-35a96cecbdb5", "value": "Spote.OCCXX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2be89da-1f4b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689012101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689012101, "uuid": "bb0e9ebc-3659-4c67-b073-67565dabe4e7", "comment": "Malware payload", "value": "178675b9f4ad8376363be395d9a7da79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689012101, "uuid": "1d369d36-62f5-4067-aab0-85ad9011c9af", "comment": "Malware payload", "value": "4c9a045d64f53ce3d313e94456528a5bfb5646f465aae140e120e0dd11b9e1b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689012101, "uuid": "99fa7890-de52-4339-aea1-127a09c8cd50", "comment": "Malware payload", "value": "776a5e6394c1a1638d4baa3deb80c4ffc5fead42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689012101, "uuid": "d267227e-6b5d-41d2-9072-35384d7b5b64", "comment": "Malware payload", "value": "0433f9fb0371ad426b7c2a46c737a739a110324d9eeb2f8d76398de8a4ef6f5013f37e1c9671a939cc57e54e5e0879c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689012101, "uuid": "6f8b4fd3-dc11-4039-b043-bd502ec06221", "value": "T1CD1633F033E1D3F9F2D019B92DD9AB77197EF462931943DB89B146026A200D6DA3E345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689012101, "uuid": "ef5a5b7a-7670-44a8-be51-d2837e3a5523", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689012101, "uuid": "39146689-6ec2-43fa-844e-4b76e6af71d0", "value": "98304:UZ5QPiL0+iEieNSWK1w2Mzd3V18XTHb+V/zE9PqL:UZld8hhUd3C7+V7E9Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689012101, "uuid": "432bf745-d96b-419f-acb8-db4cbce730de", "value": 4024872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689012101, "uuid": "10592867-d1e1-4c6d-897f-190764b81db8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689012101, "uuid": "781b6299-2cea-4974-9e4e-38e943134077", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e3ab2d-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688981875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981875, "uuid": "933b8cc6-8b6f-44aa-bacb-9528451c51a6", "comment": "Malware payload (AgentTesla)", "value": "7f58c033f333ddb5bcd6320116764733", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981875, "uuid": "721be256-1bdd-4d2e-b5a1-4960aaa37f0f", "comment": "Malware payload (AgentTesla)", "value": "4d2b3332bac8fc3295fb6941f27014b6655c4f854ee6efab83b33652cfb463ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981875, "uuid": "4c251859-f331-43ef-ad38-ca26f0be4322", "comment": "Malware payload (AgentTesla)", "value": "f8f40aeb42bddb7dad574fb0515527d0ad9ee224", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981875, "uuid": "268da04d-aa6f-4a90-aea0-2166364803cc", "comment": "Malware payload (AgentTesla)", "value": "95cf0c2e2f13acedc8f1c5c607200b92a805eee41dcceb0dc7c8487167eb543e731f50cf8fdc378b010b64f655b3c840", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981875, "uuid": "271eb2af-2e84-4826-98be-42fbffcfe495", "value": "T16325222265C0C273C4B7697204E5CB358EBA747267A2C5C777AC2B791F523D1A3392CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981875, "uuid": "804480d7-e0a8-4ad1-a7d3-efdf8aac7548", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981875, "uuid": "64d31368-764c-482c-90c5-bae7e4ef7cee", "value": "24576:pk70Trc275prRx5JDhxcBXw9VQlotGrbyDW5:pkQTA8bJBylotGfAW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981875, "uuid": "93979665-643f-4d48-a3e4-179e94602753", "value": 1009216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981875, "uuid": "99375a99-4f65-47ec-8f62-5e82d48ff43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981875, "uuid": "ea4307fb-a357-4b6e-91ad-f3e2a7dc22b6", "value": "Quote 45-6055A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d669b0-1f3d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689005935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005935, "uuid": "8b2b8b10-687a-4b9d-a5f1-209b74abbbbb", "comment": "Malware payload (RedLineStealer)", "value": "12bef1088a0f0b0310aa3bd7748ff848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005935, "uuid": "fa1d6b4f-91e9-4ab7-89bc-18633bd44c8d", "comment": "Malware payload (RedLineStealer)", "value": "4d2c1e7ac0636daa5643a26e6c4ef21ce2318d93bf8700668a5982b01e0f351c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005935, "uuid": "c8fcfb35-67cb-4258-937e-21c3b3a69460", "comment": "Malware payload (RedLineStealer)", "value": "8cfeb9ea01aac0bdb9dbc2cb97b2a40375649d60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005935, "uuid": "7c0ac0fc-cc90-44eb-bc9b-effa23b5563e", "comment": "Malware payload (RedLineStealer)", "value": "9526a269ea6b5003c986ed88775df536411d3c7ead39aba588ed466a80f407e9df06b59901d1964b5ec6a0d28180e59c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005935, "uuid": "409bb065-2e59-418f-9672-7429865300cf", "value": "T1C8152343BBD94133CDB55B7029FA06970A317D905DA8A39F3344895E0CB36DAB0327AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005935, "uuid": "7a01f3d0-ef2e-4c0b-9c4a-0191105cf791", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005935, "uuid": "16095aa4-7856-4439-850c-241bcd45e950", "value": "12288:5Mrpy90jr95C1l+1fxPNBwsS6D9VggIxoxCGiJMYhYmG2gg5QwIu252IJWpqEk:sy4kl+ZxPNVQvhhYmFgg5LIUfpq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689005935, "uuid": "71faa6b7-5578-4bfb-8f19-b84c40966dd8", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689005935, "uuid": "ed1f4768-3235-42b1-8d56-c75ef1ee6036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005935, "uuid": "5599bb14-f4ec-4efc-ad4d-1197ecd06f7d", "value": "4d2c1e7ac0636daa5643a26e6c4ef21ce2318d93bf870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85c653c-1f0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985428, "uuid": "1970a008-2fce-44db-a600-9c6c580353dd", "comment": "Malware payload (RedLineStealer)", "value": "a01209e5cc9739c21b9c848b9f5089f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985428, "uuid": "abf7fef8-b1e8-43e8-82bb-89111c00b584", "comment": "Malware payload (RedLineStealer)", "value": "4d5d39989ba722914fec0275d542f78d28351eb6eea631a9231e23dae1c88c04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985428, "uuid": "a3281c53-48ca-477e-ab92-1e47b09b069b", "comment": "Malware payload (RedLineStealer)", "value": "610d60ddb1b7c0c0ebaf280baffc1dec8217d02f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985428, "uuid": "8ab01fe1-ab0c-46d8-bddc-a8c65a3e42fa", "comment": "Malware payload (RedLineStealer)", "value": "9948906aceb47bf01a403bdd68f00028759bd94e8829aeebed594fea0c5004a5044d62ee564a47601772e5ffa075d6d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985428, "uuid": "4cb41094-76ff-46a9-91cf-64cb5cf18cbe", "value": "T17E44283921E144A7D8BA9E35BE4BC0D17116AEB4017C541F3FB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985428, "uuid": "6f2bfcaf-11de-4127-88b5-d2af097c9971", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985428, "uuid": "6516262c-50f0-419b-a482-673f9d6ef165", "value": "3072:tn8+iOHMwew7+picM/psVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:tn8vOswD7oVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985428, "uuid": "ccbe4c1b-ac40-44a1-a05c-bc81ac0536d6", "value": 272547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985428, "uuid": "7b603bf0-9540-4e12-9f25-5bf428fce4fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985428, "uuid": "7b656cfc-ea36-4cdb-b188-8b574bb32a35", "value": "a01209e5cc9739c21b9c848b9f5089f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26df24f5-1f2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688997639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997639, "uuid": "03fca9dc-ac59-4ed8-bacc-69d9c41aef2d", "comment": "Malware payload (Amadey)", "value": "44c60dfe909f175872acd4d71a3f7247", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997639, "uuid": "f5963904-e647-4b64-8b5c-ab779f751a4a", "comment": "Malware payload (Amadey)", "value": "4d6fb108f72551faa7bab834b1e94b51e20298f23e27924e26caa352db85d0ad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997639, "uuid": "92c7ef0c-602d-480c-93e6-aca6f70e1825", "comment": "Malware payload (Amadey)", "value": "e7f8eb06315330ef9c083e55a45f32578c23ca4d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997639, "uuid": "767d2fb9-705c-43e4-a2eb-dcd4793f92ad", "comment": "Malware payload (Amadey)", "value": "da1b5f33985cfd7f16235f85d99af6c01a297b72d37867740dada75363f6e1e39a4bc7fe24ce52e63bee0f10d5543d9d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997639, "uuid": "27eb5f6a-bebc-4214-8ac6-58ec1ab6c83c", "value": "T14875230369E550F7E8B12BB07CF212C31735BC419EF8A50B6BD5888A58F29C5A531B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997639, "uuid": "8d99429b-991a-4452-b32b-75d8ddd1be77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997639, "uuid": "8b9a120a-eb89-4ab2-9bbc-c4c26aeb8c54", "value": "24576:0y/eC7P4G+4P5CWhl+/x1JDwuZJqIxtbVH6jE/FFv3k4Lu:D2C7P4A5rhl+/fJsuGIxtbIQd24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997639, "uuid": "f8048751-f8e5-4e32-8b97-02806ab4cb40", "value": 1586688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997639, "uuid": "d690fbc9-cc5a-4211-8828-19f5e3e0382d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997639, "uuid": "2a124a36-bbc6-4f5c-819f-19eee4ceda97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a11df3-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968237, "uuid": "cb307440-14d7-4391-b25e-79f5c8fa1f86", "comment": "Malware payload (Amadey)", "value": "00451fa6d543d1ecc4a863c1a99c1e65", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968237, "uuid": "992100fe-5afc-40ee-82e8-6cec8398026d", "comment": "Malware payload (Amadey)", "value": "4ea6d64ab4fcb5ffb06e1f8ef5db4290be3a535c0ca256bc922e9708ca6191a6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968237, "uuid": "f72c8d1a-b852-404e-8e2a-0fe5e9e2fd95", "comment": "Malware payload (Amadey)", "value": "b5401045d48b24cf0e9fcb1bc62c05ddce21af06", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968237, "uuid": "8d5bfe62-bb4b-4a59-92dc-dcc1b7e98168", "comment": "Malware payload (Amadey)", "value": "2da2275b63a2cecdb8c4c1164da7b76b7b1d2277531deb6608ac7b05fe7b78e8eed23b33c467abee38ae8b629adaff48", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968237, "uuid": "5b495f7b-cf70-4605-b63c-b6c49a8e7b4b", "value": "T17AB4026071D2A623E67714361590922FFF1FEE3109A0878793C8793D8B291D18E7ECAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968237, "uuid": "299fdcbe-e75f-4c6d-b4b7-803ee59caa1d", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968237, "uuid": "744710b8-781a-4dfb-a286-8e2cc1cabfb1", "value": "6144:xmPD0GqyHBBDCWGYLUz247rT2+PsCd0ukjIormfdVKMNR8jl4D46JdrOE1LULXJj:xmYAbz47H2+RYtKfPKheECp1wLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968237, "uuid": "01076a79-e1c9-4eb3-8ff2-6b221330c921", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968237, "uuid": "85be5352-6063-407e-a72a-e65c800f3455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968237, "uuid": "dd67b11d-250c-4610-93fd-78419468702d", "value": "00451fa6d543d1ecc4a863c1a99c1e65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c76ce4d-1f13-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688987851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987851, "uuid": "86020606-e0f4-40fc-b9a9-6c5f8bc91593", "comment": "Malware payload (RedLineStealer)", "value": "e50c0d182419bd73f1e01bdb91ede767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987851, "uuid": "a0b80cc5-0856-463a-8c6e-07a60535c851", "comment": "Malware payload (RedLineStealer)", "value": "4ef736afc6458c82a681ee567e1dc32b377346ef9f2cac38ba11cff3bc1f2fd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987851, "uuid": "5ee026b1-b9df-4efd-868b-028ec7a7254d", "comment": "Malware payload (RedLineStealer)", "value": "ccc8e42972df4b7a6ff4f4f6dd15a266e2854ba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987851, "uuid": "9bb77db4-43df-4d2e-a820-64e7a1298929", "comment": "Malware payload (RedLineStealer)", "value": "0b9cdcfd3cb44573e61682b542db84781d4fe8a73c4599a4ec0d1405027a89005de3bfb3da067e66c58e1ede372f5f54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987851, "uuid": "51a0d73f-3249-46c3-bae7-3d0d2da1180d", "value": "T19CB4026171D69623F57200722950D22EFE1BDE721D605A8393C9B93D8B3D1C15E3ECEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987851, "uuid": "9469aa3b-38db-4bf7-bb6d-1fcccf3d0087", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987851, "uuid": "b94e0b08-c543-4756-be6e-2137086fc3cb", "value": "6144:z2PD0GqjHB9pCWGYLUz247+SZ380HXPuHUiXp4n6ensi09rSMJmCGcuHLe8+p2zU:z2YFBz47+1ePOVXWNnsior9mHnIUKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688987851, "uuid": "0ea1276f-4a41-453f-955d-477e3e694eb4", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688987851, "uuid": "77907c6b-f8f4-4b34-9d2f-03f8890e3a88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987851, "uuid": "3403f1f5-c456-487a-8267-94644fdcd527", "value": "4ef736afc6458c82a681ee567e1dc32b377346ef9f2ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6ead3a-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962562, "uuid": "dfd7c778-c266-4bcd-b07c-daecb5c0d4a3", "comment": "Malware payload (Mirai)", "value": "3111657a27cc1c628047278486990168", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962562, "uuid": "bde2b420-b92c-4d91-ae4f-178e78e5d5e6", "comment": "Malware payload (Mirai)", "value": "4f02b807d0c6c0d8b5db03ed843cc2716b6263e5dbcdcce55e556c8c610e2dda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962562, "uuid": "f3e9a750-d21e-4355-b884-e9eaff0adbd9", "comment": "Malware payload (Mirai)", "value": "d4997f59826a2ec558c72f8b5cbde74b0afc2862", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962562, "uuid": "e5df6636-caf4-4ecb-82a2-381d70b41674", "comment": "Malware payload (Mirai)", "value": "0f5140d730b5755592927aec248940abb38dc08303af6a74203df61b48c272d1d03459f468a11cd67b243f9ba78223d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962562, "uuid": "27ba4bb8-1833-46dc-8e5a-a56075cb01aa", "value": "T17A835C24A93D2F26C1D0B07E22FB8755F2E5260E25B49A9D7C760F4FFF2464064472B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962562, "uuid": "45b45910-bcf1-45c5-8f61-cd77823a04e7", "value": "1536:9WGrXN9SALJ3PF/HJ7OqIx7iejcGxTNbUwUWZ6v34RKRIdlPRrBFx0+K:Zsc2q3ejcSTHUBv3AKRIdRxB0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962562, "uuid": "5cde4204-f3b8-4563-96c5-b55339c86757", "value": 84724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962562, "uuid": "6db62b39-8e0e-4d53-8e46-2ed56f8ada49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962562, "uuid": "90aa6f1d-b6c0-41b9-a973-201b789c627d", "value": "3111657a27cc1c628047278486990168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b93a3f2-1ef7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688975716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975716, "uuid": "d89b2655-fdfc-4fbd-bb34-cfe36b341d5a", "comment": "Malware payload (GuLoader)", "value": "8a9c7a9580d153a0f9c938b50f7aad3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975716, "uuid": "849f9b84-40ab-4101-95b9-9bcb35152484", "comment": "Malware payload (GuLoader)", "value": "4f836a2654cceccebabea728ed2d43426153053660a7fbdab3c86b8cd28ef31d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975716, "uuid": "e8752fca-86f0-4d48-a18b-18b76103d927", "comment": "Malware payload (GuLoader)", "value": "171106c00aa7c75792c26f9717ef5ba94beaa88c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975716, "uuid": "929b87cf-e4c4-443e-8bb6-727b25e88f15", "comment": "Malware payload (GuLoader)", "value": "06b7ff8ac8f349670883c78111524b9e573264d877c854ded318c7f9eaf6ce82b8600e976b5128dba4d5e9b2e69c0d64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975716, "uuid": "1ef4efe5-4d39-4dd1-b60c-990862fc34f3", "value": "T10B74BE2B6B3B9921EE7C7032F2D6D5B357384CB15528B42131D0FE13287767A6A0E18E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975716, "uuid": "0300c483-28ed-4538-8999-5f2ec88b6df6", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975716, "uuid": "feeee664-ceea-426a-ae86-ac97460f566f", "value": "6144:qhgqhwXoAoVHX2B5lb5Y3/czJa0YXBldsDe8ugrN+KWTSqaq6lpg59GAfd2cm:pqvVHX8l1Y3n0KBcq+Ner2U9xocm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688975716, "uuid": "3caa627f-4c99-4f2d-aeee-c14137bb174d", "value": 345180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688975716, "uuid": "30524355-42c9-452b-a297-be3797ce135d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975716, "uuid": "1397caa4-2493-4517-b685-2d508f6224c5", "value": "RFQ001.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1566a922-1f35-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1689002334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002334, "uuid": "ca5a0ba2-3a09-4ca1-a552-2dceb2ac2143", "comment": "Malware payload (GCleaner)", "value": "dfaa62fdeb2886c2d748be5ba7db2c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002334, "uuid": "a4a1c2d1-f01e-4478-9b33-7b1acfdc9471", "comment": "Malware payload (GCleaner)", "value": "503988563f5b5bdd109fa1fb955e526fc118d8aa337ad5c97a96c1606f9259ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002334, "uuid": "b6fbf889-082e-4d1e-8e98-f2f06a1df4c2", "comment": "Malware payload (GCleaner)", "value": "2f2e3fe4dc6596401ddd2b3d90d1309cf03671e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002334, "uuid": "643aafd4-7da9-4ee1-9978-6b2f5bb11018", "comment": "Malware payload (GCleaner)", "value": "03ab56ddd413488b8b4add5835c3439c628fdd707083a99b06c55f40280bb5646c73deb899e44058a18fd38fc6223073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002334, "uuid": "367479c9-873b-4449-b103-b7e1e8498a10", "value": "T18E55334BA26004FDF0D146F42E69A5504D7E3E61BC7C19283D6C6B0DEB2B2E4AB64376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002334, "uuid": "0c7e5655-a341-40ed-a1ed-6cc5c09cd7f6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002334, "uuid": "8cf715cc-1093-46e9-be80-d6602efa8184", "value": "24576:nfOyH3/pZLtCFCaKiKJYuTMWUNAAU1vkJFqdArUZ1K5kh33APlsu0dKBdl2vSBrE:nGMhZW5KiK6KMWUrUH652gPeWBFeuZkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689002334, "uuid": "d75b09c3-0770-46ce-9a36-1abaca9a9749", "value": 1292930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689002334, "uuid": "9274a6c1-a895-4de1-a364-94a8dd8305b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002334, "uuid": "6a416f22-d18c-4270-a4f5-440bb724c823", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c879fc1-1f30-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689000199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000199, "uuid": "a08cd042-5c69-4d71-bc1b-a53f1271cd16", "comment": "Malware payload (Amadey)", "value": "1c355c32e9b42647c0e21e65b78f6064", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000199, "uuid": "49ca3d9f-7cfe-4e61-84e8-a271cb2c4a2a", "comment": "Malware payload (Amadey)", "value": "504b4cf90293bbdcd6af53d4c950798e711bacab47ba6856dc31a397570ea6ca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000199, "uuid": "0db95da8-f9f7-45c3-9912-e500bb237295", "comment": "Malware payload (Amadey)", "value": "e60b519da98990309d3416add560cacf95c28b23", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000199, "uuid": "c91d0098-9388-4c51-af2e-bfd67f323a6a", "comment": "Malware payload (Amadey)", "value": "b712c31b61c3a66ee9dbcc6f3fb44ef9aa4d66dc4f3f6d659da9f155aeead013e08e7ef185d7a952bad9494d1309a12c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000199, "uuid": "bb6a7533-f74f-4ea5-93e9-e9a7aa961b65", "value": "T18D6523B928842337E030607D8590E52FFE0709F296A04743EBC77A396B956EE2D7DD94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000199, "uuid": "0f8a7390-cce7-4ef5-869b-8fe90b112efa", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000199, "uuid": "e1d26920-bbd6-40c3-b7d8-3aed495aeaed", "value": "24576:xE47kOUEfJvETlpqftmHioiS+yvk3RZAyBbVTb34k30/8dRi9:xEq5PfJvExMftmHzO0khZAUykji9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689000199, "uuid": "5983da37-2d65-4724-9d61-40acd1410481", "value": 1409344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689000199, "uuid": "08637904-27cb-46ff-a7c2-c07763a41d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000199, "uuid": "91ec4909-8b62-48ca-82a4-2f85df023449", "value": "1c355c32e9b42647c0e21e65b78f6064.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c8b224-1eff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688979412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979412, "uuid": "003ab821-27ce-441f-afe9-a54a101c54f6", "comment": "Malware payload (Amadey)", "value": "8a84c7ecec6fb6e8921b6b23d2bf9f6f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979412, "uuid": "8d80cd4e-acf7-428b-911d-9978b05fda7d", "comment": "Malware payload (Amadey)", "value": "5072ac92c9730b00a9e78be93a9ce6277d6a334b362848a0af81e20dcd17b3e1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979412, "uuid": "f8a64e6c-ceb6-45ca-8fd9-eee6bd1e14ed", "comment": "Malware payload (Amadey)", "value": "b5e8f7feab8dd5a5c028180fa4af1db35f6f3edf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979412, "uuid": "2552850b-3f96-413f-b950-05dbdaad0dd0", "comment": "Malware payload (Amadey)", "value": "3c1fa36640f4f3ac20e2b65842464b57fb07fcc57c71c3c0e48028f91124e3ccc3b0f6bfb464cffba293a74c471418c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979412, "uuid": "76a1bb24-db19-4b89-804c-55b6c67a4c67", "value": "T1020512B071D26623E63624736460936EBD0FDE3518E19A87A3D6263E077C1D28E3DC9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979412, "uuid": "28566f51-8cd8-42f9-af53-c29683cdcc40", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979412, "uuid": "72d47fcc-e7f5-4361-9d24-c68599699985", "value": "12288:cMi1IFdz47i+cVjhRULSH3p4Q7EtbMS0qXW4xOUEU5HWxW3vaxPzfCR8q:Vl47EzULu54QE1MSvX9xOUEU5HsWSx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688979412, "uuid": "1db7932a-d8d0-4cc3-b60a-9793441c0dbe", "value": 826016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688979412, "uuid": "49903857-6889-4ce3-adfa-3ba00e7c1460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979412, "uuid": "5c3749d0-018a-477c-8aeb-181feb1797d8", "value": "8a84c7ecec6fb6e8921b6b23d2bf9f6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f726327b-1f51-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689014739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689014739, "uuid": "a22c54f7-4f8b-4553-b727-3497f7385efb", "comment": "Malware payload", "value": "297fc2e60624db58736354b634843083", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689014739, "uuid": "bbf7f172-1ccb-4cbf-ace2-aa998e3ff15b", "comment": "Malware payload", "value": "50d49dad644a276790c9f81885e3c88355a48ba528c9f628cb8b1d6f4bd5af8c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689014739, "uuid": "ddc1d9c4-1bff-4a18-af00-e51525a15c8d", "comment": "Malware payload", "value": "b2a61691dddf87405bc49ddc2575fd74ce669b53", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689014739, "uuid": "3dc02c9d-a9c5-46d8-982f-aa4a45cfa497", "comment": "Malware payload", "value": "f5469e4d52960409c15bcc50c9efd04f0dfdb80cd303fd9352037179e878cf492176b8ef321ed55e04fc39490f58e45f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689014739, "uuid": "89867d8b-ebb1-41b6-863f-717681ea3ea2", "value": "T176B49D007495C433DBA9053174E19AE5DD79BC6C0BA088DBAF877EAF5E30380D6F5A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689014739, "uuid": "6db3c80b-b381-4a7f-ac12-d14974c0b1f5", "value": "f6305eab1881785ff9938470cff3cc23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689014739, "uuid": "84220151-8fb6-4c5d-a887-8974171e3eec", "value": "6144:h6Qn6S9gWvSAX5eDgAOGpniw6gkWKu0PMlFX7pookTwLVCU:h7n6S9VxE0wEWKu0P8LFVCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689014739, "uuid": "0f4be20b-4e34-4682-93ab-d80f19c1c163", "value": 513960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689014739, "uuid": "10883175-59e2-4684-a7e0-901e45001c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689014739, "uuid": "3b9c2c97-301b-4622-ba1c-a0eb7268aef6", "value": "libcef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4005e02d-1ef7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1688975777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975777, "uuid": "b3b13f45-2eac-441f-9920-3b3f66982d4d", "comment": "Malware payload (DCRat)", "value": "17cf957ffd91adda08bd927147a990e6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975777, "uuid": "f4d63f95-0ba9-4676-816e-3aceffb128c2", "comment": "Malware payload (DCRat)", "value": "50d79420fb05f65b91ab1096a6d1601feb1bcdf98afa3d98398c228296675c0e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975777, "uuid": "05261417-d0be-4062-a22b-d9721ee6f1e8", "comment": "Malware payload (DCRat)", "value": "e3befbc980679542d2fc342416199523bbc59ad4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975777, "uuid": "3961c1fd-eff1-4876-8cf9-91f0c6fc2cbb", "comment": "Malware payload (DCRat)", "value": "2c8bd353a2ee0916c6716d2eafb03a9d7cfd6181926749333be47a5ceb294b0d65ed3d9771642d66f12c28cff7215251", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975777, "uuid": "bbb17e3c-76e5-4b9b-b758-a5fae5165f02", "value": "T1C5B5CE067B44DE02D46A173BC5EF822547BCBA417A62DB1A7E5F335C22613AB1D0E1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975777, "uuid": "925c96f5-c0d2-4f9c-b3e7-d97471cf61fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975777, "uuid": "337f3024-30c0-44ef-a4c5-d5a96cd48a48", "value": "49152:evnlMAJuwoZ2EMo6/AtVIq6WOko8BwtPhCVG6PP1IyYY6W4ke:evnlM/G54tVykoNPCP1Fz67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688975777, "uuid": "caca1dff-daa6-4f97-b4ff-46a2bf294b34", "value": 2358272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688975777, "uuid": "c9c9ea09-462e-4b32-8e52-8825800b4f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975777, "uuid": "44eed8b5-ba5c-4057-a2e2-fdc60611e39a", "value": "17cf957ffd91adda08bd927147a990e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8368bdb2-1f5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689018840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018840, "uuid": "07fcd055-20e0-4208-ab31-b96c6852a23f", "comment": "Malware payload (Amadey)", "value": "5775ad6817c6149e36aa9a5aa8e8d7fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018840, "uuid": "9d7329f2-2d1e-49a9-abdb-9ccc5cbbcc5f", "comment": "Malware payload (Amadey)", "value": "51026f35b528d59a5c092d4d7f91265a343694f66561cb2d40be5c2f5786647f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018840, "uuid": "643c7e3b-e847-4199-b7ee-28b52037c7f9", "comment": "Malware payload (Amadey)", "value": "25d74c34ed4c23eba2c414dc2d13f0c1ec1940e1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018840, "uuid": "127b3434-0fe3-4a64-9d38-80a15b654ba0", "comment": "Malware payload (Amadey)", "value": "de16a082c84552fedc98a3500cbdc2cd7f26e35673eb4d98d3376355f8cce515ba716eb59e2eaffadc986c1be5b57e87", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018840, "uuid": "f316acf0-3586-4a6d-96e8-c6a416fab4be", "value": "T1C6752352ABE99072DDF52F7108FA01E3063DBD741D78CB2B3B56A45A1CB20C06A3577A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018840, "uuid": "35be4147-65a9-4042-b4a5-5a0fde45dd05", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018840, "uuid": "918cc949-5736-4d9f-9480-23a083818f73", "value": "49152:io5x6u0lQel+4yPAO3TIK7ITduFaO+1o:1047B3Tvkh31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689018840, "uuid": "dcb1d53e-d7ba-4d11-8a44-e7cb131522b2", "value": 1582592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689018840, "uuid": "7bd35b9d-5b10-4dce-a012-80b96abbacd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018840, "uuid": "c82029d6-2eb3-48d3-8f0e-a3868d760f2e", "value": "5775ad6817c6149e36aa9a5aa8e8d7fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43a3755-1f34-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689002225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002225, "uuid": "f8aad3b1-960a-4863-b5d7-13d9bedeb2ae", "comment": "Malware payload (Mirai)", "value": "613e7e5a3977cd21d4963b850cc00820", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002225, "uuid": "315e466a-8412-42c9-aa8d-1d1c10866341", "comment": "Malware payload (Mirai)", "value": "5175d5554e8711fa081e8c33fdf0de2c1c4b3bf3d7094fd90b26f52d50f82b25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002225, "uuid": "51c5a6ce-8c25-4ab0-b331-c481691668ef", "comment": "Malware payload (Mirai)", "value": "29c25329f1c9a0b72ce1bc977e61d1923255dde0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002225, "uuid": "744d209e-6404-4b6f-a601-33c2507e41aa", "comment": "Malware payload (Mirai)", "value": "c1e155836e137b7c7d4050891281b0ca8de4322ab17873883e068ed3b00af71d98a6f4b900b9898137fe152ca8955558", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002225, "uuid": "62120446-c7d2-466e-915d-ee004e1734b3", "value": "T12AC2D0E07726EA31C420AC7DE52A4D8A3A51063C91FF393764258D398FC169B67F48F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002225, "uuid": "0172d62c-9879-4080-87d1-00b305696f1e", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwria9q3UELuk:PKy4qfqoeJdXWgiPL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689002225, "uuid": "85aa1452-4de1-4a9f-85d8-5a9f3821aa83", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689002225, "uuid": "af99c5fb-e186-4be0-a4a9-313f546eabe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002225, "uuid": "d6db88c3-5c5e-4083-876b-192af9f4f803", "value": "613e7e5a3977cd21d4963b850cc00820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94720719-1f25-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688995675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995675, "uuid": "92540320-36fd-40e8-9e3a-cd516b4ff277", "comment": "Malware payload (Amadey)", "value": "e0be34e3d52026df5230b01429147a20", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995675, "uuid": "95fe3bd7-02fb-47e3-9949-a52384210a30", "comment": "Malware payload (Amadey)", "value": "51db8473f2706e8989d364c73ff1ae2d28b9949c7343c0bdf29949a5f449a9fd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995675, "uuid": "9b1b75fa-cff9-45bd-a949-ea4d57241e98", "comment": "Malware payload (Amadey)", "value": "1db21d7923d43bc40ab73275fb3454830759642a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995675, "uuid": "c7e8984a-ed3a-416b-8195-99da6bd21f56", "comment": "Malware payload (Amadey)", "value": "0f5d88dc57c3a5e57c789eea2d09418875cd37bd91fcf306e9dc905fd3db0179ef2f005185907206756976a0b402cc2a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995675, "uuid": "9e6783ec-0c71-437d-b7b8-e666ad338e7e", "value": "T1ACA53316B7C84126C8A673B109FB03AB09347DB09DB5A31E73879A7A4F72015D87D74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995675, "uuid": "8e591870-bb3e-4e01-bd7e-6c34a23f8c48", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995675, "uuid": "73111ce7-489d-4b58-93de-af964055f1a3", "value": "49152:BAqNMgdmnt2pDv+8bYsnlQSkVugC0jjat:K0MImtQv5Rlnzg72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688995675, "uuid": "0cf20b0a-b3d9-486c-b081-28860e6bd396", "value": 2231296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688995675, "uuid": "07c3cff8-2356-4ad2-a518-dfd366b1fa60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995675, "uuid": "bde955af-e2bd-4a3b-bc84-d2a9c37a8636", "value": "e0be34e3d52026df5230b01429147a20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6177576-1f2b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688998309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998309, "uuid": "cc69d921-8d5a-4956-8cdf-4f946745726c", "comment": "Malware payload (RedLineStealer)", "value": "76dfa6c35390e0feaa9b3b8c5c9ab967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998309, "uuid": "b207f049-eb00-4b82-8d16-2ad2c8d5a9db", "comment": "Malware payload (RedLineStealer)", "value": "523563334517ca2addf839752117f30fb0f741ca996e2a1dea48ef719ef2c4ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998309, "uuid": "93e47bd4-0560-4089-8855-d39898047085", "comment": "Malware payload (RedLineStealer)", "value": "5a08222692b10590db9dfddade3813b5a291ebf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998309, "uuid": "a4f7c5a2-e094-4a1e-864f-c90683be3b66", "comment": "Malware payload (RedLineStealer)", "value": "e709c4dde9bfe5a2cee0b9d750f243cfc606e01c058e62a96bb37124a3c2a6b3bfe6f8893e58727c113dded6694ffca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998309, "uuid": "8437410f-f1b2-47e3-b232-9b52332f6ee9", "value": "T11E04B558364BA5BEC96F887D9C700CE46A7CBC661246A7078C8EF0E43D3B7919B151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998309, "uuid": "d7ecc820-6c9a-4380-8f94-91009ed9a90f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998309, "uuid": "4ffb3851-8647-4eaa-8264-7b09ad466e4a", "value": "3072:82ow3Pqod+zfzrfS1xN1WGnEPUEaC98e8hd:2Sds/SLGPUEaC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688998309, "uuid": "fd0c96f4-093e-4d6f-a966-c3e7fdfc9489", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688998309, "uuid": "ecf30a21-a3df-4a5e-a4f2-f00d1f3f7189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998309, "uuid": "9e63f0c3-7fd9-4f8a-8353-03dcdba81d27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b297c290-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688991431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991431, "uuid": "7a0388bd-c25d-4a4c-a083-9c211adbd610", "comment": "Malware payload (GuLoader)", "value": "2d13b27364f587fcd18c7b0efb36deb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991431, "uuid": "4f360b7d-9d4c-41fb-96ad-514ee40d02a6", "comment": "Malware payload (GuLoader)", "value": "52d9132242c3eb71c38d9f1703fb3a62b559432b76ae9a68ca203526ab222819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991431, "uuid": "e97d9fd1-64fa-4351-94cc-9a09a9354bf7", "comment": "Malware payload (GuLoader)", "value": "f40189e18c2c7b2fdb2562de0ec5f048af6ed715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991431, "uuid": "ba27af8b-42b3-40dd-9fe4-7c80a339e564", "comment": "Malware payload (GuLoader)", "value": "933f9ae94c759b3b39721e26feb71479b743d11f08654898298f3cc39645c1181e91fc9f72db59ed2414b3891b2324a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991431, "uuid": "c4f28ea8-e7c3-4c29-a04e-5500f38d928d", "value": "T10764AD2B6B3A9921FE7C6031F5D795B36B384CB25528B42232D0FE13287757B690E18D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991431, "uuid": "ce8e3c24-d6ce-48bc-8c42-5d4a6875f72c", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991431, "uuid": "0447f2e4-d5d5-4292-9c1e-9188e072c410", "value": "6144:qhgqhwXoAoVHX2B5lb5mxtKfIcCfK8AbN7vecuH7vTWpP4+O:pqvVHX8l1mxZc9j70d+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991431, "uuid": "6ec0dd63-4103-4212-8dd7-b11ec168d41b", "value": 331338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991431, "uuid": "9640dbea-2879-477b-bebb-e2fc3224d327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991431, "uuid": "a166dfa3-b03c-46d7-a82b-b6133c3087ad", "value": "Halkbank.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6438294f-1ee6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968536, "uuid": "821dfaad-9447-42ac-ac10-ad442021ba36", "comment": "Malware payload (RedLineStealer)", "value": "843efedf2eaf392d9e4c32af6c5a06be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968536, "uuid": "3718ce8f-81f1-46e5-92b8-eef505776f46", "comment": "Malware payload (RedLineStealer)", "value": "5339db49221a69b2723c19804390ed986019b07b064f370bf5317962c235cccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968536, "uuid": "86cb4062-7095-4295-986d-fa381850b073", "comment": "Malware payload (RedLineStealer)", "value": "4069f2eb0373db3d70ea582baa0d412b7247143e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968536, "uuid": "d28b81cb-4b56-488b-86ed-04462e881189", "comment": "Malware payload (RedLineStealer)", "value": "52a66e25009454c7c7facce7b8f5f4a9a65e2f495d9ac226d09e0cb4e9e4b81b0d375405dd9a38b8524eaae2adcf53be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968536, "uuid": "901dc15e-4813-4585-bc68-4e0654c91c5a", "value": "T1B9B40250B1D29923F53255331990432EBE2FDF3409A0969793C97A3E9B291C58F3ECE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968536, "uuid": "4e30998f-f8d3-4e52-ae95-fe553729cb2a", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968536, "uuid": "f24d0d3f-acfd-4d36-8e99-36b08b5eec94", "value": "6144:0U7/YCVnHBh4CWGYLUz247AdrpZfNFlxudsJtCgteO8GSN14ADIJtz4n9qTNs:0UU4iz47AdFbdJtCgteO8lNTDIbc9qT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968536, "uuid": "c5b83577-d927-4180-be9f-cf215b85d86e", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968536, "uuid": "616a02f9-f11e-4f1b-ba86-3f1ede48ef3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968536, "uuid": "acd5fc9f-d4ae-4851-9628-93fc7ad302f0", "value": "843efedf2eaf392d9e4c32af6c5a06be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de8093f-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688981867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981867, "uuid": "757b867e-aa29-40d3-8a35-67fc4f0d254e", "comment": "Malware payload (AgentTesla)", "value": "015178199238da40758768ae286839e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981867, "uuid": "d2c16811-0c86-44b2-aa08-98fe997b8be7", "comment": "Malware payload (AgentTesla)", "value": "53d099cc9a333e7f872a8630ee7521ef5ff738fb537577fd46ae486ea2f6895f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981867, "uuid": "456bedfb-955d-4532-91c0-c3afb008ce03", "comment": "Malware payload (AgentTesla)", "value": "259d04bceec6c36e1d00f5cee32cc0e71c849d4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981867, "uuid": "7c1f8e51-d51d-4b78-98d2-5c89abbafab1", "comment": "Malware payload (AgentTesla)", "value": "dd8778a4755fb1966797dc94d0353a9c8d5e1718fd6d3754f355da0ac2b2e139d4fcec7f324d432304877c7cd8de280a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981867, "uuid": "1c4becd5-d77b-425d-8c60-e13d9544efba", "value": "T151C4593C0CBC5E23C070D6B68F95C461F558C5EB32A28F7667C79A91461EA0229CBE7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981867, "uuid": "67c91d3b-58b3-4146-a3a6-c470f58a6995", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981867, "uuid": "e30c9d31-856b-4efe-a58b-8165605104bb", "value": "12288:cmxjOdKLoRJ7EktMLDEoNHgSN4f0Ktzce0/O9fz:udWWJntMLOLjCW9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981867, "uuid": "6da73748-0b7b-4c01-aff9-5874e7b91ddb", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981867, "uuid": "d6e4b8fc-f419-46de-8ed1-d1fa6da6e648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981867, "uuid": "a9268f5a-5faa-44ac-b263-ef99c13692cf", "value": "ORDER REF8O0579790-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badd1378-1f6b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689025805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025805, "uuid": "baecabb0-1679-4fd0-92fa-128e48f4ee24", "comment": "Malware payload (Mirai)", "value": "891ca0f35a22b732ec556b952489d7e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025805, "uuid": "430d742a-61a0-415d-99f4-7dc7e12a65db", "comment": "Malware payload (Mirai)", "value": "54640febddf8abd56cb1a01398600a3756b721d0e8a5b1516be23865dc7072b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025805, "uuid": "3abf9f91-0d25-469f-8d27-567cca37e0b3", "comment": "Malware payload (Mirai)", "value": "6a14d59544bd9ce10551682911fcd8349a5a26c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025805, "uuid": "ce17088e-6e16-42be-bda6-58ddfcad3a19", "comment": "Malware payload (Mirai)", "value": "a28a52577b7af8f0cf1c407f84594adac10eadc1413ee96ee5e4dd6ab194448ec8abae3aa6bcfc0914d4098f12a005e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025805, "uuid": "f6f8269a-f8b5-4645-b4c8-a5b8407801f5", "value": "T1CC230231490E9EB125303C76DA95D393BAE12AB1C6673023D62D0B3C2FB56131E57E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025805, "uuid": "c7bcaf5e-93e4-4687-a0fe-c3229889a90c", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3Q9q3UELbUXfi6nVMQHI4vcGpvI:DECFd+A6YHAxZLRQZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689025805, "uuid": "2146d522-1fb0-4b34-a67b-96caac2d4ed2", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689025805, "uuid": "3e3bb62f-3596-47d7-b2f3-170e540e2dae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025805, "uuid": "94e987da-4efe-472d-b94d-821e01add32c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3789c46-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985017, "uuid": "34168f87-9011-44eb-85b3-3db3203348f7", "comment": "Malware payload (Mirai)", "value": "dfd5a7c3aa062e02aa685e4edff11753", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985017, "uuid": "eeb22d7c-f559-4cf7-8bc4-6c68db35ca5a", "comment": "Malware payload (Mirai)", "value": "54a7a60808b2ebbceb4ef38c33e602b8e34ea555990182e0ae0f1281c9e6bea8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985017, "uuid": "048b2740-03a5-4c08-9955-64f96193e925", "comment": "Malware payload (Mirai)", "value": "7223fab05c85c0967d28d383654099fe72a0f96f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985017, "uuid": "900d7a3b-3521-4653-b3e1-9aa916e0876c", "comment": "Malware payload (Mirai)", "value": "0caf687da42b0d325ebda47ee1b7ea450154491b3053008685d38639336fffb7610e2d2d42c1001444f781ddc2d96f2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985017, "uuid": "88156192-657a-414e-a731-5839b8cf17fa", "value": "T13B333A56BC01C911C9C099B7FB5E038C772653A8E5EA3203DA295F226B46D6B0F7BDD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985017, "uuid": "737e666b-d0a5-4b95-a3ee-38769a4a300d", "value": "768:UjDPYXdb2jmlJX+hn9MkUmWeMG3POtOm/euG64yR1gcwSXK3s5hXI:UYdbyUX+XmG/OtOm/eb6nRBXis5hX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985017, "uuid": "9c1cc2cf-8498-4315-b4ec-34c0c6600070", "value": 50264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985017, "uuid": "a4f99cb2-475a-44bb-9810-5a52ac4fdd7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985017, "uuid": "149f49d8-81e4-4ef6-91bd-5532210fe51c", "value": "condi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed9a399-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978030, "uuid": "ac884aef-748f-454a-8bc4-48fa963d618f", "comment": "Malware payload", "value": "5b48a065080f74456059263587b9d929", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978030, "uuid": "f9a02259-e38e-4479-be6e-4c84ec31c7bc", "comment": "Malware payload", "value": "557e8e453738fc34ad80b81fd205c2ddfdf4503cecfc80d940643923f3ab1212", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978030, "uuid": "b0f237c3-2d74-4088-a51b-d8dd90e824ca", "comment": "Malware payload", "value": "8865add7337dcf4f19d3654a2271bf35c72fb15a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978030, "uuid": "5fb0bf0d-ac44-4a43-8afd-87279ccbad44", "comment": "Malware payload", "value": "eed31e18b44ad17a395e900b6ff4281311eef8288dff2113877dcab928cb5b9772a4b0a78b01c0d4876b6c29887e497b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978030, "uuid": "75ba7946-13f3-4eff-ad17-47b7a38f7f4d", "value": "T1E4135C2B129190BECCAFC1746A5AEA6BED33703913B1B11923D4BD366F79E600D5D702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978030, "uuid": "42fcc57d-5ba9-4ad1-b97b-363a500e99c5", "value": "768:u1Q7GmCjTBEyhbsa3HoHZuBrzl6xu9oGGV3/93F7k01I6dHHrHZO:DGmCnBEuAa3HUqEx+GV34e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978030, "uuid": "173df8b1-99f7-46c8-ab74-1386e2f397b6", "value": 42832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978030, "uuid": "3980f0df-f933-4bcb-9220-896734faf24d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978030, "uuid": "6c0f6f65-c027-4217-99e9-7babfdbf94b1", "value": "SecuriteInfo.com.ELF.Gafgyt-NI.27732.9873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6dce202-1f39-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689004404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004404, "uuid": "958fa743-72e2-4b2d-800c-af65a3a27925", "comment": "Malware payload (RedLineStealer)", "value": "1c8fc14d422af937677324c6d9a163f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004404, "uuid": "b456243a-97a5-454f-bff8-25f9a30b4759", "comment": "Malware payload (RedLineStealer)", "value": "55c06ba8dc9fb792c52ed9ed716cf4f5500da9f73bb66c9ba720a9cb2b666648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004404, "uuid": "be17703b-fc2e-45c2-bd60-865deaedd466", "comment": "Malware payload (RedLineStealer)", "value": "7e8e44f96dd39e0bac0438b3b09222822f8d6f57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004404, "uuid": "00f1a101-cb34-45b5-90a7-667ae6390e1c", "comment": "Malware payload (RedLineStealer)", "value": "d76e699321057755e773485c9b9903d372f838e5cdbf38d9148afab53c3875c0d0ea061cae1e3648b25c20d74e5d8d8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004404, "uuid": "5aff33b0-8632-441d-8a12-62cd165a66da", "value": "T150152212ABD8A873DCB517B15CF5428B1F327CB059B8422B2749699B0DB32C4967237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004404, "uuid": "1d6bc788-6be2-4b9e-af76-c92acb8ed8d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004404, "uuid": "4e65dfb6-2b42-4bec-ab50-7898a6aa3c8c", "value": "24576:byBt5t8kWf4AJRSH+aZsv/tClEZkijZ9KA+:OBPKkWf4kSH+aZsXtCGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689004404, "uuid": "c226125a-1094-479b-bcd3-d98a6fbd9686", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689004404, "uuid": "c02dcb58-8e5d-4869-9e4a-3ac70d8fb719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004404, "uuid": "f84c2798-926a-4324-aa85-cdbd018efd6c", "value": "1c8fc14d422af937677324c6d9a163f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55222308-1f1f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688992992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688992992, "uuid": "9d2feefd-3e97-4adc-850c-985bcc7a4afc", "comment": "Malware payload", "value": "617371d1f40192b8f872fd2294c64abb", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688992992, "uuid": "f7ef2b4b-acb5-445d-bb20-f23a8bfbe77e", "comment": "Malware payload", "value": "55ccd52ba0b2a2c593c5043c9650d1d350d08cdea16fa719122f8238c67f8661", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688992992, "uuid": "8d094e1a-70de-42da-bf05-b2c288870775", "comment": "Malware payload", "value": "6ce91c1762600a5e6d40bd4e82702a71d52f3502", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688992992, "uuid": "2f70c892-4d2f-4d33-8a6c-a0ccc828c628", "comment": "Malware payload", "value": "1b4e862ed6eb8e881893556931daa8145c46bacc04da2a8e5923ee50cf99fb1f590b4a7aefc7a620bc18bb7d878a8120", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688992992, "uuid": "8980ad8d-d9c6-4050-aea0-53325e4fbb3f", "value": "T19644E012012733A3A5AB1E4D758377F9427E323095FA3278B49FDF9D4BC39646882A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688992992, "uuid": "b7b01ae6-d210-45c4-b087-4a5733689e95", "value": "6144:97F3DTL7SURdMYR06qx7nDAVzaT7syh5Zxcq4/tdyWn888888888888888uq:LDT3SgdMYR0dNB7sYF4HPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688992992, "uuid": "38ae0b17-3c62-4124-8d8e-846434c021e4", "value": 265807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688992992, "uuid": "0f6a8173-e9a4-4b37-95f5-c49bd53d9b5c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688992992, "uuid": "17f2a59a-292c-4ecd-bdc5-6b58c70aee9d", "value": "RELEASE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d694551-1ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688974994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974994, "uuid": "111d55f9-b2e8-4b4e-890e-fa8df59bc603", "comment": "Malware payload (AgentTesla)", "value": "cf016f1de21091ce5d4c06d3b36018d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974994, "uuid": "877cf8d5-be94-4bc5-a2e1-ded5e9612dd6", "comment": "Malware payload (AgentTesla)", "value": "573899e6efeb930ac1e1b656e30c92b8ddd3dc402a86c46ad5cab46c6ec611ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974994, "uuid": "7d673b45-9588-4518-b8ea-c9521e2c5afb", "comment": "Malware payload (AgentTesla)", "value": "158ea909a1e6c81c8eb88ae5238b6ec68b20a628", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974994, "uuid": "bad1ced1-7400-4f33-85d8-ff7530295d86", "comment": "Malware payload (AgentTesla)", "value": "405f1d528d6b66a66a6ee58ab2dda3a4f9dcbb61ab654d2bb33b284cfcf93bb406437d741e6fac5673385c24e3fcb46c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974994, "uuid": "934c8290-bfcf-43b5-a611-0a62e4a375df", "value": "T1D8C402231176F731ECAC1FFC2444884923946D449CA4EF28DD2BCCD69A7AB7494EC79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974994, "uuid": "c4f90c62-a73b-4f83-a8f9-5ce4165fb511", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974994, "uuid": "2fa05d5e-d5c6-4fa4-a50c-7fa31f0dbbfc", "value": "12288:+M6hs+RBWu9OeIcUBoW8qnrkCsH1DA1CcmZHJRX8foYrVJ:+9fWwip2WR0c1CcSH78fF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688974994, "uuid": "0e11efb7-d18c-42ec-a95b-e91d21b1dcd2", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688974994, "uuid": "2b24a852-46be-46b8-a7dc-7ce5baf2fe27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974994, "uuid": "974c3980-b170-48eb-99c9-ebdc00570fd1", "value": "132000032.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3072ff-1f6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689026716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689026716, "uuid": "cce235bf-c5c8-43b3-bee2-f111bb6d6eb4", "comment": "Malware payload", "value": "c0e88be9b83acf26d8269f07fe927f5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689026716, "uuid": "a2ef5f56-7960-434f-be56-e3e90c45628d", "comment": "Malware payload", "value": "576ef869c72f3afe6f4f5101f27aeb0d479cae8e5d348eea4e43e8af8252dfd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689026716, "uuid": "ec167c37-0e49-4f3b-8c5c-6409fe296881", "comment": "Malware payload", "value": "6f35b6b10fbf777d61df5c195fa6bf79251683e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689026716, "uuid": "05cdb2a2-a89f-4991-bf06-e7324146ab0a", "comment": "Malware payload", "value": "b0f8136df6a70c9d04ecc6415aab11afd8481c6e458593d49e5872896e086af4d1430b49f60620fdaf906adf25ed8e37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689026716, "uuid": "0df6f0f7-d808-489b-a6c7-2fda565d2005", "value": "T103247B8035611F57C37D69FB818F2891A3F2526A60D5E7C19FE1EEE820E1F84F50BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689026716, "uuid": "3741cf34-8ea9-4f0b-93b7-faf641fa3c50", "value": "6144:t9oWWDUY7ddgXEDnSKiGw4HjYUduMkIdDSKf+m7AJ0H7:t9oWg7d+XEDnSKin4UAuHIdDVf9vH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689026716, "uuid": "bbd60590-704f-4566-b49e-e5aa28480acd", "value": 218112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689026716, "uuid": "bf6378df-e3c2-41fb-ad0b-e8374c1cf511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689026716, "uuid": "dcbf6225-9036-4340-a36a-1fe9b920ecf1", "value": "win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ddbabf-1f0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688985419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985419, "uuid": "f1961fac-14d6-4cfd-bdf1-2ee16ae7a076", "comment": "Malware payload (Amadey)", "value": "2415dbdd83d587bd33b25678273cb84a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985419, "uuid": "07eedee2-9acf-421e-ba41-ce31c9387214", "comment": "Malware payload (Amadey)", "value": "589598f28559e972e9cfe2b17798a77c91d90dfc4c6abcbec2ce2f84cd972216", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985419, "uuid": "ee13af19-ab06-4d29-bb8d-6eb591442a0a", "comment": "Malware payload (Amadey)", "value": "ed4ece3526da299f671519a5dec27ec57c54ef85", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985419, "uuid": "ea148c44-697a-4f44-9014-49e7cfd4fba7", "comment": "Malware payload (Amadey)", "value": "322620273a5ed899381866bcce3996f7f4470b78735ecd4106be6fd5125522f953bb54fbbc20f42b158ba08a43428d05", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985419, "uuid": "5c7c350b-b9f3-43e6-8c56-2ba142a32dbc", "value": "T197B4126130D65933FA32143719A0926F7E1FEE3115909A9753C27A3F8B391C18E3EDA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985419, "uuid": "35035ed4-7c19-4d8f-a20d-052d6902ec82", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985419, "uuid": "404919e6-423b-4734-ab55-ac77f4c821f3", "value": "12288:K0U2Oz47NdoGV45u3SeBz/0qgoG0//f1x:B047voGVjpgGf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985419, "uuid": "ee0a530d-3997-4b3f-9ca9-34ca7d44bb83", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985419, "uuid": "d5fec5e4-b74a-4f30-bb50-3b138866ee64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985419, "uuid": "d9cb57d4-ed8b-468b-9b33-319e020affc6", "value": "2415dbdd83d587bd33b25678273cb84a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39233445-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688971041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971041, "uuid": "297e162b-e3e7-49e8-8800-97b5207c5e19", "comment": "Malware payload (Mirai)", "value": "0186e3df1272d7baea0ae2f8a3b61f68", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971041, "uuid": "86fcc4e9-9b41-4b7a-ad70-ab8ef8a23d0f", "comment": "Malware payload (Mirai)", "value": "58e2a24cd2fe97798c467d87c625fc1ceb0461e55255053424735f51e2efa953", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971041, "uuid": "0134b75f-e750-43c9-8855-1dd86148f660", "comment": "Malware payload (Mirai)", "value": "ea23694c247d0df3b72d475682b91c9e15c2a823", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971041, "uuid": "137ecbf2-0640-4594-a3c9-584fb44ce19a", "comment": "Malware payload (Mirai)", "value": "7e2d18c057f8fd25657b612e509cae65b75da7dbf547e059aed3d9bc4cfa3c30f4dd83219690bc86b1c3d2c0233147bc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971041, "uuid": "7ce8050d-35aa-4df2-a361-f8a508f94a6f", "value": "T1B9532907BD4489EDC149D138437BB63AC52631BD1238B2DB6BE4FE275C46EB11A2C889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971041, "uuid": "24359116-aa42-4427-8d14-94d3cccf8208", "value": "1536:ESEKY4Jzjw+Qld5UIqZEZtY+fq+ldHNxZRe0Hcl2k:m+s+Qj5UIqZEZtjfqwtxZRexl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971041, "uuid": "9954e3b9-8995-4b12-b5e9-5826f8903175", "value": 62304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971041, "uuid": "9b3abef6-f641-46ed-b50e-ca0f8bf2126a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971041, "uuid": "c37a5a07-4cc8-429b-96b5-9d1d2d8e996a", "value": "0186e3df1272d7baea0ae2f8a3b61f68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cc0005-1ee6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968546, "uuid": "beb203f8-6bfa-44ee-beb2-1ee36e54356d", "comment": "Malware payload (Amadey)", "value": "842be9b67f30279301f1485675598fc2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968546, "uuid": "c46d0d7e-f5c4-4221-9188-9d8596b99487", "comment": "Malware payload (Amadey)", "value": "59656336eb925a4dd42c1fb4de4005384e4a810b0b2c4b2cdd6bfc46385d6e97", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968546, "uuid": "12364695-5a4e-4530-83d0-2bf8eb548b60", "comment": "Malware payload (Amadey)", "value": "24b6be81c4f7a24af2af9f88ad558f32252cf202", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968546, "uuid": "4fb1e7d0-398d-470d-a02f-384cd9d23413", "comment": "Malware payload (Amadey)", "value": "bbcb4e05f9e42968136a319ca0fa1c9173b7684af75791f7fc27171e9e1fb98ac41d672f01a2fbf48218ca9ee099d10e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968546, "uuid": "bcd54fbc-0898-47cc-bd19-7076502fb73d", "value": "T1C9B4023171E29663E97101732990C22EBF1FDF325DA0964393C97A3E4B291C54E3EDA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968546, "uuid": "1ffc8db3-37e0-4e6e-9a65-d3abee7ff067", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968546, "uuid": "ebdfbc4e-0317-4b4b-bf7d-7639a039c3dd", "value": "12288:5kURJz47V3pZWNFAcQp/nhRrlvHyDxlcAP:Dp47PZeqtVj0vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968546, "uuid": "31344d78-cba0-4184-b5ee-1bfff5710e7a", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968546, "uuid": "35e0e254-0a50-4413-8980-990d817c3fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968546, "uuid": "0ed3ee63-67c6-49dc-b85c-0fa43fb470a6", "value": "842be9b67f30279301f1485675598fc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a19ae95-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688981861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981861, "uuid": "36f99d97-36ae-45a1-bc7e-537924b1c006", "comment": "Malware payload", "value": "48d852ed3dd0fb9156e7eb0cb32e9bac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981861, "uuid": "8301b762-75c4-420a-b87a-dc96eee2ee78", "comment": "Malware payload", "value": "5a7669317682b599c4de30b06426ea1b8f7ce2396140353fc146b8afcfb759d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981861, "uuid": "7a6618c3-200b-4c2f-97cc-eaa4746b0e26", "comment": "Malware payload", "value": "83786168460fea00a8ccc1664c55eb9bac12fd3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981861, "uuid": "d9f20f3a-14b3-47aa-bc06-766dc40d5233", "comment": "Malware payload", "value": "440cc2efaa651d42823720048397d20278c80dd094f4aa5684a835b77b8c83fbe3b85b942041fa9894d4a73158331854", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981861, "uuid": "c0c2614b-2b6a-414c-bccd-84c76a323fe7", "value": "T1A05345797A21BFEEE67CC2310BF75E709399229126D19284F2ACC30C5EB124D589F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981861, "uuid": "8ef5459e-27d8-4f57-abbb-ca34286b419e", "value": "1536:t+41+u8LamaoQKNhoNi3272AVaphRfBPegGYC:ephRfcYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981861, "uuid": "b8a4f269-9236-4c2e-891c-b209735e2c90", "value": 65340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981861, "uuid": "cf5cd526-1bc5-4109-a340-347d0982dd16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981861, "uuid": "cfc65a19-134b-4efd-9949-860bd11d943d", "value": "SecuriteInfo.com.ELF.Mirai-AJJ.597.26616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c019fc0-1edd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688964603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964603, "uuid": "6d60a19d-5a08-42c4-8bff-ddbab8df3e3f", "comment": "Malware payload", "value": "7f5daa5e9dad9035e3ce446a2aab3a08", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964603, "uuid": "7b3a3aa7-a7b5-46b2-a8f7-d5ef94c670be", "comment": "Malware payload", "value": "5b08ff6cdc7d1a22acdfa9fb15ea2aafa85b6649fdfd2995c896768bf9c22df2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964603, "uuid": "ba159698-8134-4879-ac77-ba26b005b080", "comment": "Malware payload", "value": "12f59b6c271ebd4f7cb3161f2e344fc1f1d00025", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964603, "uuid": "7000fd57-7223-4fad-b14b-f84225398246", "comment": "Malware payload", "value": "613e0440eead9fc644e3027fa7504005c2d291e4ac910e7c8ec8e1f3cca532f082c6068418944d5e75527bc55c485026", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964603, "uuid": "f5fd6fe9-df2a-494d-86e1-147ab16f94bc", "value": "T12FF26C42A381D4BAF51303B65876D7574232F23A5081EA3EC7996935EE27500D7373AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964603, "uuid": "d0574359-d45e-41ab-a124-b24bc1f26025", "value": "768:s+eI0igUrKB3kv5Ri7cAFq/Dplo1kLX8GrV+wIl:srlMY3Qrkq/tl+kLf0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688964603, "uuid": "a6947d7e-fdf8-4e5f-aec3-03626d33a5f8", "value": 35740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688964603, "uuid": "dac9a6c1-ce47-43ed-85aa-7dcd2a15965f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964603, "uuid": "42130fc9-2fe7-4c65-9b7d-506e4d70f1d8", "value": "boat.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a365700-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688977888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977888, "uuid": "5860e433-e7e1-45cd-a8d7-84abe9e85de6", "comment": "Malware payload (Amadey)", "value": "2f652108bf5cb1eaca52fcf8c47e0bd2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977888, "uuid": "9c415cea-cace-43ab-b6ae-da803ee7488c", "comment": "Malware payload (Amadey)", "value": "5b53dfaf3ea076fc97a1624502ffcde5485dd481b4f9e9bceb10483d759f499c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977888, "uuid": "2a89fb9d-1586-4561-bb53-5bf8d176fcb3", "comment": "Malware payload (Amadey)", "value": "bb4b7d9fac2cdc8914db2fbe62c6c07e4b02ec98", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977888, "uuid": "bd2fa00f-dd21-440e-bb39-a3d44fc7b81d", "comment": "Malware payload (Amadey)", "value": "7e5b987c2d2e193cd5b1bb2673580d3df85432b9d25ecc9f45ae74bf40ec454c792c8264a0ad39634f84458fbeb7f6cc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977888, "uuid": "5eb2c5d3-2b41-40e7-85c7-1000e45e005b", "value": "T156051265B1E29663E43941362990C13FBF0FEA7119E0878793C9793E47392D14E3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977888, "uuid": "db711308-2638-4536-bc20-054e0c9ad28d", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977888, "uuid": "97956ecd-56da-4540-8843-797d296d2a09", "value": "12288:FQ47Wz47f8K9PX02wcV7ZwPQADfMV957bZzY7OoemrRZGszpUU0:1s47frdE2wcV7kAP7b9Y7Wmr+7U0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977888, "uuid": "e3c81e03-61de-4dce-9363-77cda37818b5", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977888, "uuid": "f9124ae0-ac18-42f7-9711-2a4a298e31da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977888, "uuid": "616f2f64-aa0e-4135-90d6-da8e09053674", "value": "2f652108bf5cb1eaca52fcf8c47e0bd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa150952-1f17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1688989833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989833, "uuid": "7382ccc8-39d6-4c03-b467-78826b7132a1", "comment": "Malware payload (zgRAT)", "value": "b7bd74867dd4f141daab18d01533c7d6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989833, "uuid": "5158956f-3c93-40ef-a1ea-75601a8c867d", "comment": "Malware payload (zgRAT)", "value": "5b86ed5f163e7cd26260c46a2e7159062033b7d414c3ff6fada3ffcacd975dc1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989833, "uuid": "a637a13c-a41c-4494-88e5-6c8b41d1a687", "comment": "Malware payload (zgRAT)", "value": "3a899dc368067aefacfb62fd39b5209c02f5dacb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989833, "uuid": "50a8af64-9ad0-4dab-9ca1-949d4cc19472", "comment": "Malware payload (zgRAT)", "value": "3cc9111058f23a31194c5f5d4c96e6b7c0b14ecea44b64a44283e40de6b974e00a5f03826cc70b73bf398d096c1df10b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989833, "uuid": "d7847096-3fea-492e-8671-e83a83282c48", "value": "T14324AEE4778498D2DA9E9BA7E5595D8C1336217BEECB20CC0046FBCA39773458E0CC96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989833, "uuid": "c0009390-02b9-4055-a673-4c5de79fc032", "value": "3072:c1ifZbU/NhbCQzXMPKdrxL8/rii10i1NDRNugDIf52VzduPZAc:SaONn9ojiSLNlIR2vuPZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688989833, "uuid": "8eb9d1f9-105a-449f-b8c0-6de8780b1631", "value": 228021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688989833, "uuid": "96d1f270-c451-436a-b549-7f81ab55292d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989833, "uuid": "76795c56-a193-4521-8b89-8ef0c148505c", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.24527.5174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f029bde-1f31-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689000606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000606, "uuid": "7232b4c3-786b-408b-b11e-ff938fdd9a06", "comment": "Malware payload (Mirai)", "value": "6184837e04535564569f2b607c0566cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000606, "uuid": "0d21d7b0-8e3b-4968-b30a-4629da8a8b68", "comment": "Malware payload (Mirai)", "value": "5c363b01db15de5c79c38661ddf962fd57db4b31a33e9a4fcd3d0173fb399c5f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000606, "uuid": "b74c4b76-d93f-4a37-a5f9-057abfb63761", "comment": "Malware payload (Mirai)", "value": "1b26228dcdf2d9fc690dbab09b17c20189e2a0b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000606, "uuid": "0d1eb6df-c619-45f2-8501-249ac7796d00", "comment": "Malware payload (Mirai)", "value": "964005bfbfa93562a16f2862160ac5fa9c6774f8e30942594a5df3ccd985480f0bccfcf06c7d82a0ad285c2218b1daae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000606, "uuid": "5c7a9fc6-756b-40fe-bba9-8b3ed02f9473", "value": "T17FA2E014BF28928FC832697895D9E5D21293FC72F2ADCC096550C16FF5733A96834F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000606, "uuid": "d6109f3e-66e6-4230-bbf4-d702d85296cb", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTE:798o08kxofBE+ZkXaEbp2F2TWul0c5QR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689000606, "uuid": "f5433f95-ede4-4c81-bcaf-91aba08e8cc5", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689000606, "uuid": "908b0294-a900-45da-b355-c1b5719ea508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000606, "uuid": "176b6c3f-ad14-4745-8d85-225cb6dbea0e", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871296e5-1f0f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688986204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986204, "uuid": "52a3efd6-ff35-462b-b010-8367656f955f", "comment": "Malware payload (Mirai)", "value": "3a7ea675f5aee774526b267995fc3e5e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986204, "uuid": "71d18a8c-c916-4078-96d9-f8ce8fc8b9bf", "comment": "Malware payload (Mirai)", "value": "5c6175dc7458d53540c9730d515a3e61ccfb239b08fee70fde805401c5da40ad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986204, "uuid": "b3ef4c2f-72f8-42aa-b26a-5d57147a940b", "comment": "Malware payload (Mirai)", "value": "28849e0d5271322dc644c543bf9117f1d8cff02a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986204, "uuid": "c0c34cc9-cca2-4335-b3e7-a66cf4c11292", "comment": "Malware payload (Mirai)", "value": "345408d854d4d31c55dc47057d951c17e363ab9c6f4a99c685904ca726a9977c73b2fa5143dce1358a8675c165ed156a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986204, "uuid": "3dc9e126-240f-4f8a-b620-4adc8528a5f1", "value": "T1613301137715BD62DE751D3566F98C8A3148426ED0ECAC2239C4A9A172D310BFBE14E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986204, "uuid": "394d0b07-a7e9-4796-a36c-48c84d0db5ab", "value": "768:JfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbMbG9q3UEL2qEK5J6OAsNTGjf2tl8XOM:KPtQjiZVcykHRDMbrL15J6RN2tAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688986204, "uuid": "233d5eeb-8a6d-4520-8527-fd73793cfbb2", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688986204, "uuid": "28221793-29c0-479b-91eb-eb0af92d6fc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986204, "uuid": "9886dd8d-0145-4356-9272-1c6193c186ae", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b528c9c-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985701, "uuid": "d28a41a2-5eb7-4edd-843d-1c58360bca08", "comment": "Malware payload (Mirai)", "value": "eec824655c7936635ddb58d0383e9558", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985701, "uuid": "02246331-684d-43a4-a81f-c01015bc92ad", "comment": "Malware payload (Mirai)", "value": "5dca72b5525c2aca06bb6c77af2ffdd27c8ef6d7879117463cb31416d776f8c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985701, "uuid": "af855420-b37d-4e25-bebe-af52d4e71192", "comment": "Malware payload (Mirai)", "value": "949ad50c857f1b212455f0744a08ef8969ba6ab0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985701, "uuid": "21608dc8-f039-43bb-a7a8-d8e33ef188f7", "comment": "Malware payload (Mirai)", "value": "0c9a1bdd020719edf4325007695b722537193c9bf824e4f3d71bfa119218a110d1f7c590d7f9c447625d07fbbe45dec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985701, "uuid": "c709a77a-2aea-4b07-8cbf-47e287ff7861", "value": "T1DAD2E19353045D61CD3204349B944762AFB7F7BCB47672B2215CE794AC4B20B3EAE78A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985701, "uuid": "9067a211-2f23-442a-888c-c7d595e605bb", "value": "768:IGidaYIxeYgIUJUxoR4hU2V0yguESlvPs3Uoz1b:IGidaxeYgIIUxoRuUc0fgkz1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985701, "uuid": "8ff00401-3a5e-4d7e-905f-f6130c461662", "value": 30292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985701, "uuid": "e458f671-679d-4ecd-a974-631c202a8671", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985701, "uuid": "69044453-871e-4589-9c7a-33ab0d4459ee", "value": "SecuriteInfo.com.Linux.Siggen.9999.11482.14937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59822a07-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688990852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990852, "uuid": "ad361c3c-d6af-4b01-b613-6a319c842478", "comment": "Malware payload (RedLineStealer)", "value": "65544b4ad360910bfef16971134ee63b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990852, "uuid": "ccdcc1b5-888b-4187-90fe-07dbcbf8f4dc", "comment": "Malware payload (RedLineStealer)", "value": "5e2174c83284d10086febeec23b82a563f9d71af425677c575594681a04e20fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990852, "uuid": "fab62ccc-539c-4b18-a713-45554552997e", "comment": "Malware payload (RedLineStealer)", "value": "2943b0b79745e98210e7ddd68270494bf1fb52db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990852, "uuid": "7b38942a-dcaf-44dc-8559-463ee1c59d6d", "comment": "Malware payload (RedLineStealer)", "value": "27d0ee4334ffdba8fe5f771b0031d6f8162e4ec35149565bcfec6f655e36f5285861a43e6515897bcbe798c2a05d23e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990852, "uuid": "bb456f6c-75bc-4ab1-8653-dbf403e1cd64", "value": "T15444283921E144A7D8BA9E35BE4BC0D17116AEB4017C541F3FB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990852, "uuid": "82f78a3d-7f65-4e11-93d8-e44d438fd6c4", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990852, "uuid": "3f758c44-ac8f-4bea-a954-cba34ad821e9", "value": "3072:qM+iOHMwew7+picM/2sVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:qMvOswD7bVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990852, "uuid": "68a5136f-d919-4d09-ac43-abc4dffcb981", "value": 272547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990852, "uuid": "7c761831-3d03-4fd5-ab74-952fe3a9091b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990852, "uuid": "2f0abf40-0fbd-47fe-9db4-f627829f965f", "value": "65544b4ad360910bfef16971134ee63b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847ac55e-1f5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689018842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018842, "uuid": "e49208b3-ffb9-4e50-b6d1-1a4f001ca706", "comment": "Malware payload (RedLineStealer)", "value": "669d338b6588bdca08e5065931644861", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018842, "uuid": "5f27e52c-2773-43c9-9295-b67d7b8edea0", "comment": "Malware payload (RedLineStealer)", "value": "5f484f9066f67c91d035d32ea6e2ab94074e4b49b4562d94bf090d08b905d5c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018842, "uuid": "2563a204-dcaf-4bfb-81ad-7150fd70636c", "comment": "Malware payload (RedLineStealer)", "value": "3b3cbd260b1144505426cec45c3cc540375c57dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018842, "uuid": "dc6359d7-4ade-498d-ba8c-81843fc08ef1", "comment": "Malware payload (RedLineStealer)", "value": "07d23410d5e6c2895d821b76e245c0e712b46238e07651ee4a2486fee32dd63df11866e3b1b44c2fffe72454c59788f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018842, "uuid": "0d537bd0-0732-421e-8f26-702db51d906b", "value": "T1D1E4D03914A144ABC4A9AE39FF4BD4C132162EE5017C950E3EB36E783BD24578DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018842, "uuid": "5d6903d8-3341-4cf4-aa70-3166ca9ca206", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018842, "uuid": "7564a40f-beaa-4c34-84fe-c825b23555d6", "value": "12288:Iw3zk2EQiICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:IwDkNQBbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689018842, "uuid": "ce4c7b42-0a4f-479a-8dbd-eed2c847ecdd", "value": 708419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689018842, "uuid": "739ec8e9-b3fe-4c26-a97a-8445b4ec1c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018842, "uuid": "00024d32-83b3-48a1-b00a-c3cb78d63737", "value": "669d338b6588bdca08e5065931644861.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07627d9-1f2b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688998380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998380, "uuid": "8c132646-1436-4f2f-b9f2-e18439c317f1", "comment": "Malware payload (RedLineStealer)", "value": "a2bf672228aaeac149e0f23f1dae00f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998380, "uuid": "52867255-f42d-4584-936f-ecbd0774048e", "comment": "Malware payload (RedLineStealer)", "value": "5f71aba9eb6491696ac286fe5e0b24d421015fb20ea1a3c514dc8d9b2f538d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998380, "uuid": "f3253a8d-a0ac-4393-a24c-26b4a23d87aa", "comment": "Malware payload (RedLineStealer)", "value": "e92a132028112155a5ebfcaab5d7a3bc4fae2996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998380, "uuid": "d09eecb6-1d0f-4bc1-91d9-152a966f42ec", "comment": "Malware payload (RedLineStealer)", "value": "ecf4bcedd70db84525b3a9e66514cc9c52f065b17b64bf5afbb12273ae8647d52bbae597db9cb71291c2869d76d5d08a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998380, "uuid": "02937951-833d-4b15-8118-689ddcaf65c1", "value": "T198E4D03914A144ABC4A9AE39FF0BD4C132162EE5017C950E3EB36E783BD24579DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998380, "uuid": "4b60f907-4ddf-4335-9018-270bf722e0bf", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998380, "uuid": "9c396916-2b9e-48bb-8ee4-b0e226d8d4e2", "value": "12288:HRw3zk2EtaiICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:HRwDkNYBbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688998380, "uuid": "a5ae32e3-909f-4492-83c9-f037d4151f06", "value": 708420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688998380, "uuid": "267de40a-b4f5-4753-8ab5-fdc22525252f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998380, "uuid": "cc030f4c-3d6e-4454-9a19-c60383a7adb6", "value": "a2bf672228aaeac149e0f23f1dae00f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d9ac4f-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985752, "uuid": "15803d8a-78ab-4af5-a93e-2a7590a80618", "comment": "Malware payload (RedLineStealer)", "value": "dd523e0e8987e03bedd33550ec6a5227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985752, "uuid": "ef86a650-553f-42a7-879a-46bb8c2325d9", "comment": "Malware payload (RedLineStealer)", "value": "5f7c26c699d8cbe8a2d1cd681e6cf26bd67fa4534954d8191340c2bfc67eeb1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985752, "uuid": "9d1813c1-02a5-4e5d-b231-a6f6d38c9064", "comment": "Malware payload (RedLineStealer)", "value": "4b4d333dd1d9f0b39f1cc27b7b9021f5f64c26cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985752, "uuid": "b0b78a12-6f96-4bed-bb53-7a125ea73cc7", "comment": "Malware payload (RedLineStealer)", "value": "0dee4bef125501279e26fff2d00cac3fca3dad581addd63426f92f36a59919919a3193252d4cb4f30b4fff899837b885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985752, "uuid": "c657da53-785b-4f44-a1ae-73afe00e390a", "value": "T1F205126070E26933F63A14722590962EBE0FDA7219A0978763D9753E533C2C54D3ECEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985752, "uuid": "75a0ab54-c31c-4499-9cc6-e1f95d4a363a", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985752, "uuid": "18bbc0e7-f304-46e4-a902-119bbf2fb27f", "value": "24576:tM47z1abem4TWhJRNN96+zbNem5cTfQUXL/a:tMqzGem4TW/RNNU+zpeC4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985752, "uuid": "5a50f499-cc7d-4c02-bed4-056a46b3bbb9", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985752, "uuid": "e274b7d3-e6d8-4cf9-abac-45dcfbc5f255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985752, "uuid": "29c6cf16-1f59-405f-b77f-95f5ff5e8c66", "value": "dd523e0e8987e03bedd33550ec6a5227.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74023ef0-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985743, "uuid": "f1f24f32-1500-434c-9474-afa67006c6db", "comment": "Malware payload (RedLineStealer)", "value": "d1127a46cd86cf0cb7ec5c55d8d8c78c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985743, "uuid": "c641c763-c21d-4e70-9232-e02f9427205b", "comment": "Malware payload (RedLineStealer)", "value": "604cfb2edfefb9d34707f62ef612c35b44a71a6b989c31a56e783103ddd361d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985743, "uuid": "d21b8468-29d4-4047-a14e-dd915a5f9c76", "comment": "Malware payload (RedLineStealer)", "value": "ec9e9adf54a6bf7f8ddb75dec8e90aceab8589a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985743, "uuid": "eddcfcf7-ee6f-4f6f-af19-69a81c4db3d8", "comment": "Malware payload (RedLineStealer)", "value": "50549aed24f8ed71599fc01282eaf5c29eab62f8e83c4f58702e9c7a9f6b61386be49f04a677d8c74d5842cfed129f2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985743, "uuid": "cf6e8e2e-2a9d-44bc-b89a-9d90f37ea71c", "value": "T17AB402B571E29523F57210731860856EFF0FDE765A90468793C8BA3D8B291C14E3ECBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985743, "uuid": "af7719ef-3f73-4329-83c4-ed099f57280b", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985743, "uuid": "25ad815a-ae8f-4917-af44-0763bd14b767", "value": "6144:zE7/YCVmHBNNCWGYLUz247t8lUA6iN+GvUWJpffElgE47yhLTOZmeCYNcaF7emXe:zEUt9z47+T+Gv7tpa2oe/caEmkOfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985743, "uuid": "8d101d02-f1d6-4389-869d-86121be32e61", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985743, "uuid": "e48c0fe0-2a81-4a72-be58-5e35baaaf280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985743, "uuid": "316e82b8-271c-48d1-9cf5-c097e023f903", "value": "d1127a46cd86cf0cb7ec5c55d8d8c78c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c4fab5-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978199, "uuid": "957b049c-e750-461e-bc11-4f33c5c9adef", "comment": "Malware payload (RedLineStealer)", "value": "db3b1bf2cb57770d7c58e1d6aa9072c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978199, "uuid": "377e3a78-acd3-4109-bdcb-a0c5f48f2a07", "comment": "Malware payload (RedLineStealer)", "value": "61a1e548fc343b5cf377df47b22206cb008973b453d194064ebff937ea185a57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978199, "uuid": "f5530bfb-c386-412d-bf22-1b042f29d570", "comment": "Malware payload (RedLineStealer)", "value": "4dcfeeb65d4b276e4ccc7db1a30047331ccbb362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978199, "uuid": "d3d009fe-a131-458d-8eb2-2edce3e4c1e6", "comment": "Malware payload (RedLineStealer)", "value": "be0b43cbe9cbbaf57b020855c87e0dc51c2a4a46226fd52fcb252dd0f2be65961a36c7c49bfc94e2fafa0f360c9f22d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978199, "uuid": "5175fde8-acbe-4906-834a-01b0db43d08d", "value": "T1A4C40272B1D25573F472103265D0926EBF2FDA7155A09A4393C6793E8B3A1C30E3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978199, "uuid": "22d10946-0030-47fb-9a0f-d70da7404d8e", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978199, "uuid": "46d3ae84-f594-4e84-9957-de6184a6fecb", "value": "12288:OegH0Dz47kpWKsLQl4mzMVguj3Zvy25dXxrCSVXt:oUH47RKCo4+ML3ZvygxrBVXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978199, "uuid": "fbc7fc2f-c28b-4324-8427-5ab67e209829", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978199, "uuid": "86e9d0b0-4d52-4abb-b151-cb056ec93dce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978199, "uuid": "c0f2d264-775e-4202-9d5b-f9a0a1267d36", "value": "db3b1bf2cb57770d7c58e1d6aa9072c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a9f05b-1f3c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689005640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005640, "uuid": "5ddb3a6d-d37c-4013-b099-b97cbcb2469f", "comment": "Malware payload (RedLineStealer)", "value": "d1b2ff3ebad519f66ac22ca094f330b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005640, "uuid": "b3e36ccb-60b8-4579-9c6e-db147fd1ea2d", "comment": "Malware payload (RedLineStealer)", "value": "61b5dc04ec8d88a18260a3dfe42344ec5630c6af7204246429ccf48b0dedaf5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005640, "uuid": "96b11dc2-9629-4a81-b0df-f5a4501b0b13", "comment": "Malware payload (RedLineStealer)", "value": "04c01cde76efc135619342141a5d75ca5b939e20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005640, "uuid": "462fd0e5-3c46-4a19-b6cb-7b865c160a69", "comment": "Malware payload (RedLineStealer)", "value": "ef78b3478f3f041325653fab92a5c0212429d760ecf8d4bb1e16b4b6ecf3a6e4dfe3e91c1e32d261f4a5dfba5519e68a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005640, "uuid": "f26dc1dd-0007-4ef8-8ab4-aa032d441bcc", "value": "T19664BF1372E0AC63D56B4B318D3AC6E8762FB8514E197B5A22287E7F18701B1F673352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005640, "uuid": "dbffe4f4-d605-4554-8333-9a89f3fb9a72", "value": "5a013624489e6703ae44eba8e360cecd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005640, "uuid": "d9d3b11f-2560-4280-9ee9-3bc4ca1fc29a", "value": "6144:aa1LZthEAk5U+gVD7aQ49H6fz+DviCQ5xnv6ky:j19/Eh5U+gN7aQ49H6b+DhQ5h6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689005640, "uuid": "963dbcc7-4e35-4ed1-b3ee-7a6cb20ff3a0", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689005640, "uuid": "403c8421-00ef-4f43-8f07-073ea8409d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005640, "uuid": "653dfaa9-9188-45c3-be6d-c76df169de50", "value": "d1b2ff3ebad519f66ac22ca094f330b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf12cd01-1ed1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688959669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959669, "uuid": "4d250bd7-ad3b-4548-a73f-09a662e450c0", "comment": "Malware payload (Amadey)", "value": "6679b277af96a200fefe80f242cc40d3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959669, "uuid": "e26da030-d12e-4be7-9bfa-149a04be280e", "comment": "Malware payload (Amadey)", "value": "61dfe33d71fbbb14a14a47989270adaab1a4091179c83583c50f3a0efdaac5fe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959669, "uuid": "681fcc39-0c98-4f55-ae41-055ed970417b", "comment": "Malware payload (Amadey)", "value": "521598d16c4ad3022469f95c0a412148d1fdab0b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959669, "uuid": "a64efd89-26a0-422d-84b9-d3998f381a09", "comment": "Malware payload (Amadey)", "value": "4fd38c7ff732b32c9e71f50fc6e6935342f391e07eb0c40e2bb7215ce943392520602c43fefd74e177e087062b54b709", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959669, "uuid": "6c0000e5-1d1e-4715-8e44-9124ffb8158c", "value": "T110B402A0B1D65933E932153714E0A21EBE1FDE315990978393DA393E47391D28E3FCA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959669, "uuid": "6fa9e054-1c1a-48fa-8fd2-c39d950531b7", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959669, "uuid": "7e17376c-3cfe-42c7-bad3-e4bfddeb9457", "value": "6144:R07/YCVrHBpuCWGYLUz247WeuI7CCviK4EnvlnBwKaIjcqqRMqg8MBYoq0PybWG:R0UsUz47CI7CCviREnvln7B7UMbqcyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688959669, "uuid": "a176ebe7-5b42-4745-8c33-764766097962", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688959669, "uuid": "c60e97de-1b3c-4e4b-9d12-5cbc62b96c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959669, "uuid": "aac42c83-69c8-4ce3-84e1-c46befebc3ff", "value": "SecuriteInfo.com.Variant.Lazy.360290.24105.30165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2913e0f0-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688977886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977886, "uuid": "73ee3165-0653-473b-ac81-68305a7752a9", "comment": "Malware payload (RedLineStealer)", "value": "10bc0ac6c8650252bd41a2f9029e121d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977886, "uuid": "a8f3e81e-b69f-45f6-92de-452222fe2bd6", "comment": "Malware payload (RedLineStealer)", "value": "626a7e96a2e66f8d5f79c8a907f059fcf6ff0d34110e2d9986ae6b6e660339b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977886, "uuid": "62bd6ab1-c002-41c8-91fc-7d2667e24d7a", "comment": "Malware payload (RedLineStealer)", "value": "9caa89e63a7e8088685f2083cc80173faa27b9dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977886, "uuid": "8900acd0-ce18-46d1-bb9a-db1b6ddd851e", "comment": "Malware payload (RedLineStealer)", "value": "2cbd4c160a77196fac4f009a8aab6cd583a6514c0de17c0d3c34b26ee75e3763c5539104e0f678c7ab62b2148ae3471a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977886, "uuid": "ff096991-c801-4e74-b763-f24b73214256", "value": "T15CC4027171D35623F57211370960D22FBE2BD73119905B47A3C9763E8B292D28D3ECAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977886, "uuid": "439e64f3-bcc7-4391-bd5d-c11dfc519b36", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977886, "uuid": "49dbbc77-453b-42bf-8f1c-08b1bc499ce6", "value": "6144:YESoUTL/HBluCWGYLUz24755VUKjEh04/uwVejd/GBkJvLiqdX7qLZOxhD0pTkOl:YE8/4z47/VUKAzUjz/wwbWkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977886, "uuid": "217aa6c1-03c1-4423-9979-848e983dcd75", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977886, "uuid": "dc37506c-4a6e-4807-8efb-49c61c9beb33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977886, "uuid": "dedf5fe3-94cf-47cb-a5ba-d322a0ddac21", "value": "10bc0ac6c8650252bd41a2f9029e121d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da489ae-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962620, "uuid": "929616be-17bf-4a91-9d53-d6edaffc2af9", "comment": "Malware payload (Mirai)", "value": "5c6329541c365205fb9e95067dd1d8d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962620, "uuid": "b6ac5eab-9763-4bbe-8eec-2b602fa37386", "comment": "Malware payload (Mirai)", "value": "63208f1c33904ad7f9d22fa9670f1b568e2e8308cdd7c3a52436f4ddeb632d04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962620, "uuid": "d22eff4c-2139-4039-9365-218b55ad4c32", "comment": "Malware payload (Mirai)", "value": "e451cf18af4cf9bcbfd2a818d313007500b73042", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962620, "uuid": "623a05bf-fe83-4e99-b7d5-3527a5cd2e9e", "comment": "Malware payload (Mirai)", "value": "b236ca67a55c5251b87780e3059e3455fc6f5793fc35ccfea9a2060d148f2742ef31d19832bbd5860c5c412248ed8817", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962620, "uuid": "a026c48b-eec9-437d-961b-151346e9e1cb", "value": "T171D2E1496EE6CB94ED1D60302A9E3A6F3011DA3EC1B09632C1CC35A9ACF57556F38392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962620, "uuid": "b2dfdef5-0538-42e9-9549-cb954b00cfda", "value": "768:5Pvg/cqbvSpjejDkK9mHO7PFjRenbcuyD7URQRjH:hvgkqrKjej/9mHOZjEnouy8RyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962620, "uuid": "ee129798-becf-4274-afee-1da457f63647", "value": 30740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962620, "uuid": "da659975-a306-45ca-bb5a-be30637b404d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962620, "uuid": "46e93240-9868-4632-98bb-564511192b59", "value": "5c6329541c365205fb9e95067dd1d8d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd860f82-1f24-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688995369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995369, "uuid": "df837c22-7bbb-4f86-a5fb-e483ba8ed8f1", "comment": "Malware payload (Amadey)", "value": "dd3aabb0d0cfbe82308f399714f8ffb2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995369, "uuid": "1ad034a1-204f-4f2e-a73d-8b363ed4a3b2", "comment": "Malware payload (Amadey)", "value": "634704da54dcfff222f8e06cb4a32761171e33cc5746fb135631c32d56d17ee8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995369, "uuid": "f37e8218-9043-4fce-b8ca-c942de913550", "comment": "Malware payload (Amadey)", "value": "17bc09da3a7ec2c4d06b43eb4e0f1ef7d1ff5882", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995369, "uuid": "90161bd7-54db-40e0-b925-b678c7c7081f", "comment": "Malware payload (Amadey)", "value": "9984fffcb1d72642757b0209737fa4330e64daeb319cc436dccde63541ba75a3225a3b4ab30efc177baa0812c7404f72", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995369, "uuid": "73cde535-e86d-4854-9b48-b3087b4e0bbb", "value": "T1B0B402A074D29973E53650725890D22EBF1FDB720AA09AD793C8793E4F390D24E3DC99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995369, "uuid": "8ba57058-912c-4036-ba49-cf67649ca247", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995369, "uuid": "9bfedd86-b3a1-46cd-909f-cb022cc0d1fb", "value": "6144:o07/YCVGHBVKCWGYLUz247llaQLxX9NJwvildt0gkwkQkzgdf4UMufsZK7hT5qG:o0UxUz47llb59NJwWGQ0/ukw7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688995369, "uuid": "d0076d81-8320-476d-98c1-8aff8faef8eb", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688995369, "uuid": "cd951b29-004c-4038-b84d-eca26530b390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995369, "uuid": "a7f22a7b-41f0-4559-a0e2-c223749f0d05", "value": "634704da54dcfff222f8e06cb4a32761171e33cc5746f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bd0bfe-1f03-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688981016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981016, "uuid": "8b63d3ae-e6ef-4be8-8928-9c904c588c14", "comment": "Malware payload", "value": "9f1c1e45b292299818c7fe64c865e67a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981016, "uuid": "dd8bd49e-f8ee-4d21-bd79-ef7df51f0b4f", "comment": "Malware payload", "value": "637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981016, "uuid": "cd1c3edd-09ae-41a9-bcc4-0bcb7f18a8f3", "comment": "Malware payload", "value": "1cce67a2b76d3bcd85f158f533e55296b8aea592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981016, "uuid": "d100e1cc-5fac-4466-b6b2-84afbcf536d6", "comment": "Malware payload", "value": "55a5412914ce761fcfc1e040a946f5e0fefcc2ff2b7dbce4a6b42076acfa66333383e685f9c96198eeed3d924c682417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981016, "uuid": "25536916-de7f-45f6-b791-0031f4806452", "value": "T18BC47D09B6AC47F4D0A7C23CC9128506FAB6789913618BEF079087762F176E15F3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981016, "uuid": "ae251fcf-0d86-46e3-a61a-7ad661c0f71c", "value": "9d12b8a738fa9d477edc73ce72663075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981016, "uuid": "963b98bf-ac55-4ee6-bd50-bf22f2c0e725", "value": "6144:8KIpz8gbJnHlZB1wYvPgwi/YkVlWGGv5wVRU/rCPED3xTfuRkbjaRVepohAYHdGZ:BGz7JHsYKN2v5/G+TfuR1VioyYHjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981016, "uuid": "6fe9a781-db6d-49ec-95ae-c57c6f00a878", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981016, "uuid": "db680de6-e702-484a-a021-c1ee504a3064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981016, "uuid": "92aa69f5-015f-4f9f-821c-631f33cde027", "value": "637e28b38086ff9efd1606805ff57aaf6cdec4537378f019d6070a5efdc9c983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d54688-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688977899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977899, "uuid": "8e97f9de-577f-4672-9758-126d8ba468b1", "comment": "Malware payload (Amadey)", "value": "7d4b59865015921ae8bfb1948f759be0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977899, "uuid": "79753a15-a68e-445f-b379-c91eb4f84ded", "comment": "Malware payload (Amadey)", "value": "64a0edbeb0c9594e47e78043f744f47248967a04b5b46ed68c8f3797a257b8da", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977899, "uuid": "ffe81533-d116-44b6-bd1a-eccd0a2a24b9", "comment": "Malware payload (Amadey)", "value": "dba8f6f2392ead69a9856e1c00760cacf27eec85", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977899, "uuid": "acf29464-a498-430a-a6d7-400c563c5b62", "comment": "Malware payload (Amadey)", "value": "96a1c676da92eb41e7e20d55c498eb6f1dbd9d905702c6e91a92098221bb5b1e3d45d06a867e53d98b28c1842487eaa9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977899, "uuid": "0d5dfec5-610c-4211-897f-5245043fa9e8", "value": "T1C9B402A175C38623E572153325E0C22EFE1FEA3155614687A3C9763E473D1C28E3EDAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977899, "uuid": "0d00ee8e-f5c8-4117-b485-64bd10efbd6b", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977899, "uuid": "9bcdb5bf-1098-4280-a470-45d0f522053f", "value": "12288:iUUCmz47E//h3mT/JahqoycIyxdkho66:Jc47E//h3Iexvdkho6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977899, "uuid": "7259da35-ea2f-4bb7-8c71-992619d077cd", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977899, "uuid": "dda97276-edd5-4490-a2d1-06dc5dfb7403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977899, "uuid": "44c0edb1-dd91-4582-a2b2-fa3510222aad", "value": "7d4b59865015921ae8bfb1948f759be0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ff1e0c-1f28-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1688997024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997024, "uuid": "fe3dc88e-befa-4289-8540-2d07404b0e05", "comment": "Malware payload (Fabookie)", "value": "1ba71aaeba6e97e0b4101eae85cb6fd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997024, "uuid": "8a558cc6-9e80-48f4-afbb-85c131a64c09", "comment": "Malware payload (Fabookie)", "value": "659284e5615e553baeceb72ed2f226fda246e40ce0dd0e300514b9afee6d41ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997024, "uuid": "cc5a5456-e150-42e6-be21-04762d627c5c", "comment": "Malware payload (Fabookie)", "value": "800c305125444909bf5bd0f87aaa9bdf3948fecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997024, "uuid": "78190e05-acb7-456e-a82b-6692a2207a79", "comment": "Malware payload (Fabookie)", "value": "9d0627c07b8edfbb3c9141dd7010f4af90893cd40f1f26d3ddf7518b0b3e5ed0594e624de573f3194cf7900cbe790c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997024, "uuid": "8b8e33b9-463b-48c0-8243-df4a37bfb5c0", "value": "T156F42B56FBBD4272E051C135C9A6E7B5E6B27C855D30970B2346EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997024, "uuid": "59e1b326-32c1-44d7-b614-1be8daca5738", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997024, "uuid": "bf415d6a-8aa3-4d9d-b841-a8bf9e6a2fe9", "value": "6144:XA01NdzQ/xQWQvYYaE57i1bdRxQ7cUBmCUiJbc77ZvfuYuEdGxTC28Wf7xLUnw+V:XdEJQWQG1bIShtdGxTC2M5JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997024, "uuid": "f62c8bb7-5369-4d95-b5a2-a024a91633e7", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997024, "uuid": "d56ab216-3844-4fb8-993a-738cd029b5f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997024, "uuid": "1f1da77b-2d00-49c2-9333-62c37a1c7b19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bc6dc5-1f16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688989348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989348, "uuid": "587c445b-47bf-44c4-925f-7977b8d7b4f3", "comment": "Malware payload (Loki)", "value": "aa3160f77c0d83e7aa1f37fe0af3d739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989348, "uuid": "ffa41307-1f94-4c91-8711-e1504fc64fa8", "comment": "Malware payload (Loki)", "value": "65acc93f4a502f7efbe10313ed41bc436425ebe172f3974883f0ecb6d2ecbf3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989348, "uuid": "2034d2b0-f4e8-40d6-a5b8-c2ee5303dcfa", "comment": "Malware payload (Loki)", "value": "f312f90b4c2b7fe44711c3ae9d16a79c1528c218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989348, "uuid": "a16e02b2-639d-4f2c-8a38-beda92046ffa", "comment": "Malware payload (Loki)", "value": "f7f1eef9a2481c9af43c61f8cc25a508928b0eb9afd7f6263d897bc206e09aeee0528c7252451f7b19087850039ded66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989348, "uuid": "b9dc5ddc-53b6-4d18-8043-e9a815563db7", "value": "T16FE40122B1BFAB52C9B9B3FE150855483BFC591C5974F3085C8B61F71A3AB440990EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989348, "uuid": "6982e099-a5db-4401-a9ce-88443ea42e00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989348, "uuid": "7990ef00-1700-4af9-bfa2-4a322a6162d5", "value": "12288:jJ4a5p7tL+NBegud+kAP0yVB7RfrGvmzffFKoQNv3GQZti+0:hp5+eJkjVB7Zum0Hvbtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688989348, "uuid": "c8106399-6282-46b6-bb52-352b5ad88ff6", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688989348, "uuid": "ef241285-c035-4763-86ff-5e15f7feee10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989348, "uuid": "1acae9f4-62c6-4fda-b776-40448c1966cb", "value": "MAESTRO_BANKSLIP_BWE0623.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ee1e1f-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688985741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985741, "uuid": "f3674fd9-26b3-4edd-b54f-d06c83476599", "comment": "Malware payload (Amadey)", "value": "cd6fbbf1eacd22ac0c02e1159406cf53", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985741, "uuid": "3aad9f80-97d2-4cd5-9a27-0563f2dcdea5", "comment": "Malware payload (Amadey)", "value": "65be873f58f99ab721d4660060d8266d30727e94c4986d24602d5dba2d7cc540", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985741, "uuid": "1bc9a1c9-351f-426c-9e64-bb6670749c3e", "comment": "Malware payload (Amadey)", "value": "a1028f571cd6b593bba89e130ba25f37a22b7fc6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985741, "uuid": "f8de95cc-76f0-4c52-98f2-4652f6c4c356", "comment": "Malware payload (Amadey)", "value": "b98b2494d5c40f000eba13bc9f98cb0bea8638bafdbad04f9abe649396eac85d642fe71d4c6afd34728ae5cc5c1589a5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985741, "uuid": "7aececc7-8289-4428-ac82-5434cf80ea31", "value": "T1B2C40120B1E35623F6B2053319D0926EBD1FEE7509614A4793C5B63E8B390D15E3ECB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985741, "uuid": "454e93cb-7214-45fc-8bf6-ec649d0e9376", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985741, "uuid": "795d1673-8282-44b4-87c5-96489ee40f29", "value": "12288:M6+gHxTz47cmvEIFBIh0jJvHuXpotEicYX0OY:TR347cm8sBDjJO8cYX0OY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985741, "uuid": "4af8a758-742e-49d3-8dd9-7a25897ad9b2", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985741, "uuid": "a99d27b4-4c9f-4ba7-b77f-9e51be473d6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985741, "uuid": "35cb88a3-73d5-48a4-96bc-5e73a169e10a", "value": "cd6fbbf1eacd22ac0c02e1159406cf53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adeed86-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688985727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985727, "uuid": "e6e0bbe8-7563-4f72-b692-451f973fd9bf", "comment": "Malware payload (Amadey)", "value": "9e468f18bf3465058470d3d35c559e8d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985727, "uuid": "836668b0-7070-4f36-8efe-2d927def0f51", "comment": "Malware payload (Amadey)", "value": "65d2f8603fd6b0b57eef0c044e529e9427ab8cf1bfb376126801602dd930e6d8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985727, "uuid": "569e375b-eef9-46e1-a513-860dc1d170b5", "comment": "Malware payload (Amadey)", "value": "1f35cc6ce9d75b2e840804304fd30d4d66168b78", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985727, "uuid": "59a39f96-d1f5-427e-87e5-751e449a9a40", "comment": "Malware payload (Amadey)", "value": "e459608ed06b8a84dc4d3edb1364e081164579858b626596efad015ed8aa2fc6f2d1dfcc0c476bc795aec11da2f41706", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985727, "uuid": "3c3a3123-b2be-4f18-9e68-78c295027650", "value": "T1DE051270B1E28633E67215765460426EFE0FDA321DA18A5747C9363E8B2D2C50E7ECF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985727, "uuid": "f79e9c95-7855-4999-b2b2-aecaba2e2d9b", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985727, "uuid": "05636d8c-02b5-4e1b-8472-788873e3d65e", "value": "12288:BA42bz47tgqwv/LhGe3IW4vMi0HI/gQiSBrm2abOvsQnVDXYLJ8TdSxCj2:Ev47tBGIWpiqI/gyBzaFgBYLCExCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985727, "uuid": "adb876c7-236e-446b-acb3-9fdff30b1234", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985727, "uuid": "78601f79-e27a-4346-ab76-25a6f4d8045f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985727, "uuid": "a57bee19-cc7e-454d-812f-5c311a71e987", "value": "9e468f18bf3465058470d3d35c559e8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4d837e-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688977890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977890, "uuid": "2f0f479b-968b-4f6e-bfae-7a2e21977f50", "comment": "Malware payload (RedLineStealer)", "value": "2876a7025bb25cb0ad697b94b51795ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977890, "uuid": "ecb569b6-3856-4e89-98bb-9102afb382e5", "comment": "Malware payload (RedLineStealer)", "value": "66771da792b31752c32b12a8c69236a2188ebb858bb3172d7cbe1b1252c6f6cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977890, "uuid": "9ff19299-4df9-48fb-9a23-786cefd82897", "comment": "Malware payload (RedLineStealer)", "value": "f283a686d08ba3628b7da00f48ed9023588a5b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977890, "uuid": "8ecd6ca1-f47e-4cc5-861c-5db8561507e7", "comment": "Malware payload (RedLineStealer)", "value": "a9a92e45c466a781d708586bbe6bb2ab118b1e87968f17d9016a680aefe6e2fc10da1f3df22694a713d9d7444fc26264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977890, "uuid": "2923a6a6-c142-48cf-8d36-25143498a7c1", "value": "T137B402A172D28923E67611371590931FBE1FDB3259D0879793CA763D8B391C08E3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977890, "uuid": "ea18e34c-c104-4387-a782-a56d184a83df", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977890, "uuid": "d1a50043-6574-4c6b-875f-d10744b6a1cf", "value": "12288:rK0dKCz47RLPnF5n4E31S1EM8Zc3p8a/8D:3KA47DJ4E31k8I6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977890, "uuid": "3fee701e-c71a-47e2-9de2-1a64159884cc", "value": 525472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977890, "uuid": "badb463d-604a-4f9f-8c38-148ad3b02b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977890, "uuid": "66f13b2b-6c0e-4c83-88d7-7a2d743a0118", "value": "2876a7025bb25cb0ad697b94b51795ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e156002-1f49-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689011046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011046, "uuid": "ac790d24-de70-478f-af82-856954a2abbc", "comment": "Malware payload (Amadey)", "value": "59e6f696196b9b101f8f3f6cfa061cfb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011046, "uuid": "17b773be-161d-404d-93ca-b92d0c794d15", "comment": "Malware payload (Amadey)", "value": "66c75ea2b79268b20feb4fe49237bd678f8d4699b1262a72fbdd998e93cf78f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011046, "uuid": "45bd80f7-c2d7-4cef-b6d6-4340ec9c4543", "comment": "Malware payload (Amadey)", "value": "f303adc1f26f6f02ecd57491b4c1f96713f98300", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011046, "uuid": "dadc4d28-1669-4395-a845-8ff564c948c7", "comment": "Malware payload (Amadey)", "value": "ba74076b17a48e4aaf684b35510e148857a4e1888d7713da552594bd2ddcd15972844d4d23fc8cad7c982876b28a45dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011046, "uuid": "ca692290-0774-4d53-ac61-015b3c50873d", "value": "T116752302F6DCC0A6E4B1277448FA06931E35BCA1CDF42797175B9AAF2D33988527076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011046, "uuid": "c05cc09b-922f-47ea-8e86-9166a30eba1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011046, "uuid": "a49d5b3f-6dd6-40e3-b485-64721bb48d6d", "value": "49152:KDTUYcpa3ApL6NuDrjXnPzVY/4wY2e69JCKZ1:dYJuLVDrjXnPBa4wk699D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689011046, "uuid": "b32bc912-18c8-48c8-938e-5ec70d322de2", "value": 1587712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689011046, "uuid": "dfe9af1c-1bfa-4510-b1c5-0e7186d2c24f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011046, "uuid": "a81e0336-048d-4ce5-9c6a-6ddf1aa12f4a", "value": "59e6f696196b9b101f8f3f6cfa061cfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fec268-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688981854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981854, "uuid": "792a7ee4-ceb6-4954-acf9-0fdb36caf04c", "comment": "Malware payload (Formbook)", "value": "f42a59bb38dc7cf293f80232eb129cf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981854, "uuid": "b9c5f76d-223e-4905-a0c2-74e8abbe041c", "comment": "Malware payload (Formbook)", "value": "66e61b3996bf7efd0024f9dc73bd4e9d180b1347dd10e2b9a985eefde8cbb250", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981854, "uuid": "21e7bcf7-962a-406b-9c4c-74b8fbc9747f", "comment": "Malware payload (Formbook)", "value": "15fab3498f32606fd1010031ae24b96e0031e394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981854, "uuid": "21a7649b-d767-4432-9212-944dfb9334b0", "comment": "Malware payload (Formbook)", "value": "c7b4ec00d25f5ea6aa4094b371afe645887e85412badf46d243edd61f7ad395546cc22d08c36f9ae9a0967849472388f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981854, "uuid": "b23135a9-c9bc-44b0-99e6-76471820319d", "value": "T16F05BF1992648757F0391FF9C6682E0903702CBC74A1E7D8BDA679DB99F2FB10832617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981854, "uuid": "46318250-ef74-4460-9b13-4d0c2fb92fc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981854, "uuid": "5052728e-5981-49ee-8435-dfce97588ba3", "value": "12288:J6v2iNmIiKlPoOTy2xy80d1WfOG6uJTJwpWBohN/Ylwc0mN1:J6v1rlPLTy2Q8AMmfhoK3gl/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981854, "uuid": "921a5510-903a-48e9-a71f-cd5d505d3e49", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981854, "uuid": "fc34a130-b9bf-4e01-b13c-44a1c53ebc8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981854, "uuid": "f22ef8fd-9435-4085-aa30-dbe212a64355", "value": "Confirm bookings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7e97d4-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688977893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977893, "uuid": "9735cdf7-8b83-4ac4-8910-ae9107e2d9d2", "comment": "Malware payload (RedLineStealer)", "value": "7251e8bd18c0e945a764fc2d7f789baa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977893, "uuid": "4966f8fe-ba8a-448a-abd4-085ca883b3b8", "comment": "Malware payload (RedLineStealer)", "value": "673082fa1699badd490624af402626d0e3eaa18e8d357f74325c27d9f3cdf204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977893, "uuid": "3c05f4b7-cfd4-49f9-8edf-4cd0bfc98434", "comment": "Malware payload (RedLineStealer)", "value": "a5316b56f1d4251474d7e2b1342168a9b1f38fca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977893, "uuid": "2c7532c0-895e-4f9e-8ff9-fb3e93cad4c0", "comment": "Malware payload (RedLineStealer)", "value": "b62a5470bfeb0720672a22f0f1424c54eaa65f0ba5b529b9adbd30114593dd06b8d7ecfd230c515f9cf40b3d19e4abd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977893, "uuid": "0fb54a02-0271-4fdc-bb2e-ea027013c9b3", "value": "T1D9C4026070D25633E97210730590912FFE2BDE315EA05B8793CA7A3E8B2A1D55E3DCB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977893, "uuid": "889eddeb-1417-4000-a1ef-b40b5a7a33b6", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977893, "uuid": "2790dd83-ca09-4ef3-b321-31a776963d54", "value": "12288:xugH57z47PykEyUircCY2+h9HFKmjJUfD09a:BZP47AypQC7fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977893, "uuid": "8f6205cc-1e79-4b3b-91ec-a3b75af26575", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977893, "uuid": "4dec9505-d292-4ba5-ab6a-60fc67ffc75c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977893, "uuid": "09462969-63e1-45cf-87ed-527df8688465", "value": "7251e8bd18c0e945a764fc2d7f789baa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0ab949-1f2f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689000008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000008, "uuid": "8e60ca3b-fcea-4aee-ab79-168fbaf110df", "comment": "Malware payload (Amadey)", "value": "634f345e2fb17bc841ce205beeda286f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000008, "uuid": "7b30d162-b93b-4dbb-aab9-7c32a6ae608a", "comment": "Malware payload (Amadey)", "value": "67a45559c67180bac6f740ec616b9c74df65b1cb4a48219d705f41d667e2b233", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000008, "uuid": "9e791114-670e-49b9-b440-59c939772490", "comment": "Malware payload (Amadey)", "value": "d9f43cf541bbd64156c36193206c96db42f47674", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000008, "uuid": "11b69ca3-504f-402b-a039-842f6d21b168", "comment": "Malware payload (Amadey)", "value": "4360146849973e23fa9b3eeb0336ad072a9b3e20901c40056000ef2fb727e04770cf6b3cc1680333b734fbf49716d40e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000008, "uuid": "3b04ef62-8516-47b3-80ed-1133f4b12cd6", "value": "T17975230B7BD4457AD4B047B148F303932231FCA29970376EA6C9A9D90EB36C4B63577A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000008, "uuid": "27d0ac5c-b95d-4e1f-9755-c0ddb072c0f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000008, "uuid": "428129d5-5efe-4a8e-84e2-ac456ad155fc", "value": "49152:wux1UO1LsM5vIzSyx8jYRogsQ+aV4Qmsad:T5LsMWzSQRogsDaVYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689000008, "uuid": "4218fcf7-2319-4764-b39f-4241348a8bed", "value": 1587712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689000008, "uuid": "f44a9889-3c87-4c6c-85d8-bfacd8edf3a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000008, "uuid": "1ecfaa1a-e5fe-462b-bdb2-ef5931da050a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8eb3e7d-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1688991415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991415, "uuid": "81b9228c-b15e-4f84-a8ee-237a75555984", "comment": "Malware payload (DarkCloud)", "value": "3820b33681d72c01c4527a1bd9481687", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991415, "uuid": "7e345621-c065-490e-8b83-72b833dea49f", "comment": "Malware payload (DarkCloud)", "value": "6804e2dfb2c8a05219d1e9b447bbfc16ca73e06bbc6bc35e8d79c78d29ec65cc", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991415, "uuid": "0d5e25e7-4da5-4cc0-89d3-3368014106fc", "comment": "Malware payload (DarkCloud)", "value": "5d5778a07cdc2e42d28f68e2584d82adb1b0d91e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991415, "uuid": "689cf06b-7fb5-4f8f-83a3-e71fe0bf0c89", "comment": "Malware payload (DarkCloud)", "value": "db1d6f1be6ea2d440dde2040316bdb8b429af07e5418072fd8cab00bb8934ea3a10c5c5a25a6bb0b423ec0b39eacf441", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991415, "uuid": "37f4ed9a-730e-4f7e-8f21-47d14a051646", "value": "T1B6050150707AE76ACE392FF90911950417F929D92C39E31D8C8BE8CB4A31F3055D8BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991415, "uuid": "12b5c1e3-0455-4815-8f89-17f977755829", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991415, "uuid": "acb5a560-8ba5-4df1-b459-7dc5345c5a53", "value": "24576:r5ULUwluMNn1fRNCnvyGo32NWdRkll/djSp:rNMNn1fRNCqI7V2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991415, "uuid": "6ce1ce51-42b6-4efd-81d3-9ee90c970bc5", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991415, "uuid": "0b6bca17-eed3-46cc-b2e4-a9de754ee4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991415, "uuid": "d21742c5-edc8-4e40-b248-f24b4af06494", "value": "DHL STATEMENT OF ACCOUNT - 1300397971.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc845ef-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688990856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990856, "uuid": "0b58357f-267c-4888-b662-ef2ef7c95f11", "comment": "Malware payload (Amadey)", "value": "1c2d0c5d2b4194928bf82f3b97cde955", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990856, "uuid": "823195a3-3736-45e7-988c-e334e36b9ee4", "comment": "Malware payload (Amadey)", "value": "68688db931cda715cf0191a7eb0c1d9e1b847a3f365051de9d7515f870c9579e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990856, "uuid": "b5ecb73d-72c8-445a-9f0d-e151865fc40d", "comment": "Malware payload (Amadey)", "value": "ef2299cb5ddef30eb6f12c891849c1a10003ef42", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990856, "uuid": "ec88481a-b884-4680-a65e-30defbd4c2ba", "comment": "Malware payload (Amadey)", "value": "8e214c84bc1cbb5e91dc65b0fd4cdf41f4062bfbeae6f65908e97688875b737222dd51a30f0be0c6bf646491757f9473", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990856, "uuid": "62de6d97-c3d4-4a1e-b946-0b64e43ce4c6", "value": "T1D3C40265B1D34523E47244332990926EBF2FDE221AA157C793C9763E4B291D20E3ECBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990856, "uuid": "396c54f5-c42d-4e90-88cf-8bb167b41935", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990856, "uuid": "ecba4b2e-7c13-4300-b4a9-5bdcd45f55a4", "value": "6144:zOg7uyH/aHBF1CWGYLUz247ew9ppWMl7Ziaxm7Va+zae3p4FOcmPWp51iHhJzeW9:zOgHydz47BUEeaeaJfpchJSmLQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990856, "uuid": "5cb0112f-98c7-48e7-8edb-b9b9885c51c0", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990856, "uuid": "14add16e-3ccc-4254-aba1-d45b1cbf0b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990856, "uuid": "150e3fd6-8d06-49e2-bebe-c28d097b34a9", "value": "1c2d0c5d2b4194928bf82f3b97cde955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23879338-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688977877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977877, "uuid": "40b8adbc-3b3d-421d-a53a-f2d6a27a4eed", "comment": "Malware payload (RedLineStealer)", "value": "127bf48a08b8dcbf4a36c3d3924bda6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977877, "uuid": "d008dba8-b8e9-47e5-a8f0-1c2a759c978b", "comment": "Malware payload (RedLineStealer)", "value": "687132a7c72a4c78ae24e9c7662b11230823b1641d2a2f04f4b0d5a23b16c519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977877, "uuid": "1e2978a3-7022-4d50-8b66-43751dd8bf8c", "comment": "Malware payload (RedLineStealer)", "value": "8201883e6108ca704cc53d4ffa1bf455a4abdaef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977877, "uuid": "6f114a19-7da3-4905-8ae3-23a51d567b8a", "comment": "Malware payload (RedLineStealer)", "value": "afc2a9075ed8f41574a997fdf02465b0ebcee1aaee1d7c1db00c51cc96af19000b233d4606ee37165c03b80a4d594e09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977877, "uuid": "5e2801ab-456a-4067-871d-d94d0234e948", "value": "T1B0C402A171D39923F57215772490932EBF2FEE351990868793C4393E8B3A1D14E3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977877, "uuid": "c96da482-cfdb-4241-ae0a-13bd2c177503", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977877, "uuid": "aa108653-caa8-490f-af6d-bac80a2043b7", "value": "6144:OOg7uyH/IHBFQCWGYLUz247GDmf++cDtbN6DGM2DewrR916vhBHe/xXJ/qAy8i:OOgHwGz47G6fFcD/6DGNdrzkenqAy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977877, "uuid": "7aa4e8aa-4ed2-4885-bd8f-b4de66613350", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977877, "uuid": "adce6638-52e8-4f20-a71d-1eb61a575185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977877, "uuid": "0022d9f2-6155-4b84-8b83-e286600d9be7", "value": "127bf48a08b8dcbf4a36c3d3924bda6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fd3c6e-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688981845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981845, "uuid": "2ee20602-24be-4681-86f7-419808b05000", "comment": "Malware payload (AgentTesla)", "value": "8856e78406d497ec262c9a082cc5e95f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981845, "uuid": "e09d40db-246c-4488-abbf-2660b23de3df", "comment": "Malware payload (AgentTesla)", "value": "68cab573aabc49f6164dbf01e2bcdcb9707839ba7b567e8bd6f45911baba9b2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981845, "uuid": "29ad3fe6-4bf2-4b5b-b000-2c3991ccd267", "comment": "Malware payload (AgentTesla)", "value": "9b175f79f3625ba503b795f0f6525d080f54d8f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981845, "uuid": "54f53693-3d1e-4672-af6a-d5df30c4345b", "comment": "Malware payload (AgentTesla)", "value": "eb81f8c5a0b3f3cc9949f9f8504ce89ce5fa3c08d9e832911eb96721a1fc1bd343b2b3f4ea68660c34bb7102f44c94f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981845, "uuid": "b8338802-a0c1-4447-97d3-2f0168d59bbf", "value": "T1F7F3296893855D71FF2D4478C8BC31483A72B1469A16E75C0DA098F7BE4638736AECE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981845, "uuid": "21629bd1-3f97-4e90-8685-bdc34a6314ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981845, "uuid": "e14b2c76-ee7d-441b-8127-6d191d45fd67", "value": "3072:WP9cT9SJj1RJE/SZ/DLk3//2R80hpe6COJ7feD7HfNWba5sB:TZS77CSZ/DLk3P0hpFC77HEO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981845, "uuid": "61a24ca4-16de-4f5d-aebf-0ece4883ae13", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981845, "uuid": "41864e20-7651-4c45-81e5-e892d25c6501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981845, "uuid": "bcfeb727-7598-4d66-81c9-ab5be68fe527", "value": "68cab573aabc49f6164dbf01e2bcdcb9707839ba7b567e8bd6f45911baba9b2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3142ead-1f16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688989338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989338, "uuid": "36f9b339-c10c-48c2-ad57-e28b7f5fa33e", "comment": "Malware payload (GuLoader)", "value": "8b659a21de4ab804803b132238948fc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989338, "uuid": "7f81a894-f596-48ec-91fa-9c580dc5a077", "comment": "Malware payload (GuLoader)", "value": "68cf967f38f44205a0d7996e4b06956241c1c340844d22012de2605f6680c736", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989338, "uuid": "cd96fffa-8a77-4180-9b5c-fa67b87a8da0", "comment": "Malware payload (GuLoader)", "value": "465877da2e637cfd453b0ff0eb93c5ce1025b55e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989338, "uuid": "ffc8077d-df93-4901-9b1b-30fbd357f6f9", "comment": "Malware payload (GuLoader)", "value": "c6a0d0bfa37a3c8ca62361eef3c9236d7d236583051725c82ecc1a9d20455ede4a770ad6382e6ec9031dece6ff25d1e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989338, "uuid": "e7c70f43-012d-4be4-b9fc-14b49ef02591", "value": "T196D401257AE8D423E348523085BAE37A8B75DF642EDAC6035BF93DDF3615B519C38600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989338, "uuid": "c4ebcd6f-2059-4e62-aede-7d58efa72049", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989338, "uuid": "b5213142-581b-4798-9b61-db0827436e3d", "value": "12288:jRbeidoEmJ1XlznfV4/Xw+3ItiKjV4hBjTdb4U2gbzQ:xIEm/Xlznt4/h3ItiK54hVTPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688989338, "uuid": "780f2947-e3cd-47a0-87b9-0ae7b9febff5", "value": 613400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688989338, "uuid": "d4d63b55-c0af-4f5d-b2ac-065b73b93eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989338, "uuid": "f5911512-2f56-40ad-8048-79d7453eedb1", "value": "Facturas Pagadas al Vencimiento.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99441ddd-1f06-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688982369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982369, "uuid": "bd765833-5d3d-4aae-bb17-bdd7a6046b32", "comment": "Malware payload", "value": "cbf4a64e3ac80ffc592c0a5a109d6cb2", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982369, "uuid": "17726b3d-a072-4429-863b-b07f432aa18c", "comment": "Malware payload", "value": "68f2127ca5e808474139b66d145a3cc539c81b98d199e66e40e2d8ebc539fb6f", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982369, "uuid": "34d49aaa-09fc-47a1-89d6-c1f51ba4f589", "comment": "Malware payload", "value": "63d3ce3fe2e5a54a37bbb5059ec9884212ca6240", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982369, "uuid": "a3382b8c-4d44-4b7e-be71-dd21f8b79120", "comment": "Malware payload", "value": "6e5143ef648f326aa47b84e94605b6627b1d3cef36de816c591d0186b2fff178927f1ee9c3305c6b529fcbbea3fb4905", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982369, "uuid": "05cc86b9-a13b-4627-8cf9-60802c1c60e6", "value": "T19F326C74E3046730F10BC7B8AFDAD0893B3A7882AAB459A7215D931E4F52C093BB55B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982369, "uuid": "a872ceee-c46a-4e11-8e01-0d7d926fe243", "value": "96:Mg14WHmLKd7Kw7GK6Q46bvuY3VKdmq83hWw3IOqdEy:MgPGLSKc6lsxVKdp83hWw3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688982369, "uuid": "e85b1c0d-b27b-4688-8132-44782021ba1c", "value": 11938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688982369, "uuid": "7b3ccca4-743a-4f7a-934c-ac24a63d343e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982369, "uuid": "b2ed0124-41ad-48ea-97f5-b1f1cbb445f0", "value": "\u7b80\u5386.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e0b503-1f38-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689003619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689003619, "uuid": "84277813-9f90-47a7-a609-32318d011d3d", "comment": "Malware payload", "value": "9a74b4be9425a3d3b5b40d55d21601c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689003619, "uuid": "ff1a1302-a80b-4657-84cf-3e8c2b10bdf9", "comment": "Malware payload", "value": "6a0df27f8a774bbe0b19414be601e977c25c36e501e74dab9d21c3158034052f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689003619, "uuid": "de739c18-adbf-42f7-bfda-76cf4f15524b", "comment": "Malware payload", "value": "f29046f9c4096fea340c488d36307f581f899ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689003619, "uuid": "240091b5-c5a4-486c-899d-38263e6dbb5c", "comment": "Malware payload", "value": "65ff7cdd0da0d355e830863fcf4e8a7687cf13a958931b23ebdc7fc128cfcf87e64f44469428d3dbe7a34111da01482a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689003619, "uuid": "618c3cf4-77d8-44af-8698-0a8c380aa265", "value": "T1C195E07E180DACDCDEC12B762B903510A36C6EED0D606E830921A7D7786195DEEDE31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689003619, "uuid": "930ac0ff-8e8f-466e-a48c-9e8c19552b04", "value": "6c637586c8988f74d649e5d5735d090f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689003619, "uuid": "278715d3-3ed8-4d3d-adfd-9daf5f0d9e22", "value": "49152:SdGPUmiLrPw/IyJyWN95PUi88iOYHFR9k67CYkSYkp:SYEnYrRb4FRDC7S7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689003619, "uuid": "6936dedf-fa4f-4e08-9845-a632e0cd7a14", "value": 1878528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689003619, "uuid": "d418b69d-80dc-4e7a-884a-903e5682c2d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689003619, "uuid": "6f25e6e6-c1de-4f93-bd4f-f6c20ce51ed5", "value": "6a0df27f8a774bbe0b19414be601e977c25c36e501e74dab9d21c3158034052f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b0c8e3-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978021, "uuid": "dfbb643f-004e-4050-960b-555d08c6037c", "comment": "Malware payload", "value": "7f3e8b8b4a4e8ed79e755a7a12496f0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978021, "uuid": "3f06dd01-498a-447d-8ba6-8c7f1b0a4073", "comment": "Malware payload", "value": "6a1593fc70984b7dcd96669af53e6e5e8fc406426fe720b94449f0223f150d9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978021, "uuid": "2e6efcdf-da06-4775-ae05-0893f7994549", "comment": "Malware payload", "value": "35bad0babac88b3e0e1be2473c2a4a3bb4df7b2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978021, "uuid": "e2ed6aad-702b-42d9-8077-b24ed19ed441", "comment": "Malware payload", "value": "e146ee24e42838b8bbc2b89977339b2f78cf2383500167845ff6040ea19c482e2c2d3ee746506d0c999f344ddbb6d7b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978021, "uuid": "7f24d7a0-ebf5-4b1c-be97-2b1f4ce0a3ba", "value": "T1FE536526AB519EB7DC1ECD3305A9460220CDA09A53D83B6FB6B4C62CF75B90F45E3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978021, "uuid": "968d43c2-1e14-4762-a9bc-1932cdcf3a7e", "value": "768:ZugseT2y0r4zIUb2eJQJ/9BEwVuRKwuUNAaj4LiyZ0ZkjiXiTUrewe/uyrAmTFIH:geTWZc8ZoDAaj4LiyKZkj7Ur9SJrAKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978021, "uuid": "eb85ca64-9c41-4ec6-a886-2d6bd002ee49", "value": 65340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978021, "uuid": "2edd2411-9a06-4dd2-9f87-90bc11a0e580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978021, "uuid": "56a405de-ec22-4632-9c82-6efb51d1ad2a", "value": "SecuriteInfo.com.Backdoor.Linux.Gafgyt.JJ.25055.3652", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c755e66f-1ef7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688976004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976004, "uuid": "0c7a459d-33d7-4b12-a072-017d4898ebbe", "comment": "Malware payload (Mirai)", "value": "27b5bb047b22478deb7b512b15bcdfe6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976004, "uuid": "559bdfd4-d257-4fb4-b606-ef36bf36575b", "comment": "Malware payload (Mirai)", "value": "6a4c394c89deef34cd2f472ddd78a83055068f0ea20cc2f75927634e59fe496b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976004, "uuid": "459f0ae4-9a8f-43d7-aee3-b0d1e412d234", "comment": "Malware payload (Mirai)", "value": "8ed458a140c4d4f78c15bd8ca92bb2310f1f227a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976004, "uuid": "10c24343-c3ff-40cf-a22f-d4f553f7c844", "comment": "Malware payload (Mirai)", "value": "cecc336677c87cb52efe8b54653e545f9b0a54bc3f050b17ad4d871c0106e71c5ee4114063dd8f39e614f0c19b67b0fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976004, "uuid": "1bdf191f-df08-4785-9988-86fc04ee02d8", "value": "T123044D46FA814F13C0D7177AB6EF42453322A7A4D3EB730699246FB43F8665E0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976004, "uuid": "150d449d-85ed-44a8-9cab-3583427860e7", "value": "3072:RKfsrdDqBbs/Q5Hna0mc3ogzrWif8EATXfzJwbZnJ+MyHQ3M/9xozUO:Ys2bYmna0mc3oguif8PdwRJ5yHcM/9xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688976004, "uuid": "bbcd0dea-ff95-4851-b68d-ea136b16516e", "value": 175684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688976004, "uuid": "50fb3923-ea8b-460b-9c48-7cb86e1160ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976004, "uuid": "d56cff0b-805c-4f77-b79c-502f6cba8f7a", "value": "skid.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de189bc-1f61-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689021273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021273, "uuid": "fc0f8f0d-6bb3-4c74-bf32-1c3c13803206", "comment": "Malware payload", "value": "4938f238afbaa3519c9fe8a135c97ed8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021273, "uuid": "6d1cfca9-6ac4-42c2-b070-3c2790c4a2ee", "comment": "Malware payload", "value": "6a528ce7472519de8ba52c959e894131c0d1847afa28fcfa8a0206878097f3ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021273, "uuid": "66f09946-ef77-4e2b-8342-2d650d94eb3b", "comment": "Malware payload", "value": "90cd2048788ab90f8803701138ce3c3aa24b800a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021273, "uuid": "e8779556-b073-42a1-914a-65a8be38d196", "comment": "Malware payload", "value": "575d30407c552996ce5daaea7fa05ceafc3d1f00f63b7ada60820d81eb1d91e1d5d902af7dd9b20d9cf7b462c9dabbfa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021273, "uuid": "a7702688-0489-499d-b8b1-42e009b95921", "value": "T188D30956F8819B12D5C111BAFE1E024E37231B78E2DE73029D246F747B8A9BB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021273, "uuid": "bea4fd63-6a5f-4c25-a6eb-76f123716a09", "value": "3072:eESUvUDzv/zXQ6Jd7da9HjKrQPMB+Sg0:eESioLzXDJdxal7MB+Sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689021273, "uuid": "c5634f0d-abb1-4a23-a00b-02581cfcf62d", "value": 141776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689021273, "uuid": "66bbe3a5-7703-4002-9504-52048448c9c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021273, "uuid": "7dc6fae4-0d6a-4f1d-bd79-8f11ed0df526", "value": "most-arm6-20230710-2034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfd6b6b-1edd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688964605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964605, "uuid": "fc6accda-c156-4362-956f-c9eb6fbff4af", "comment": "Malware payload (Mirai)", "value": "f419ed60c3a9ca50e209c732d2d25743", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964605, "uuid": "b947ae8a-efef-4610-99f0-daeb2ab74120", "comment": "Malware payload (Mirai)", "value": "6a73ded42567a60475a7d25e5b33d6e8e0b1719c1cc23df0320a2baef9fdaac2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964605, "uuid": "f8407631-c9e9-4171-b165-c1694b7c5dde", "comment": "Malware payload (Mirai)", "value": "6f6df85745087d94e9ef6b8fb1a9b2be07ad2a52", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964605, "uuid": "a5497b43-6924-48ae-81e8-b3bb602da2ca", "comment": "Malware payload (Mirai)", "value": "f0dc13bae050d5ed3bea0a9f51eea00be371dc1a4908286867315940dc5c021a5554120174e4dd1bbb85917bce4fbf25", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964605, "uuid": "614690f5-0e2a-43d7-90f1-95bcc78fb0cd", "value": "T1E983B54DFA64AB29C7E232FEFB4D028E332B1B9CB7E670148E315B5533C9A964535121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964605, "uuid": "23d01b29-e3d3-41f6-95fb-62c8619c2f96", "value": "1536:yGncExSd/RA2QYzJBStBeO1Pc68jLnBuel9yQhiOwe0Haji:UBd/S2LjStQO1Pc68jL5Vw36ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688964605, "uuid": "618aea1b-fb6e-4315-a7de-7bc41fe7fae4", "value": 87712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688964605, "uuid": "5138c556-664a-406c-b360-a44e72599c5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964605, "uuid": "bb92e33b-24c4-4f35-bca4-5e7601f6bb7f", "value": "miori.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af84bd72-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968233, "uuid": "7c6539ca-ff8b-443b-bd9e-75b9213ccd66", "comment": "Malware payload (RedLineStealer)", "value": "0931e8aa8bddc4f9563cedf8ebcd56b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968233, "uuid": "865942d1-d5c0-4f5d-b2cb-812b3de8a689", "comment": "Malware payload (RedLineStealer)", "value": "6ad1b4e778c0cebc1dbedb5c7158dd636d4de0c22699c58dc9e7a35fe7f99478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968233, "uuid": "1b019ba6-f5da-411a-a9ef-536e5f182be1", "comment": "Malware payload (RedLineStealer)", "value": "bdd7327230adfb882c0a9eb5819dca17b2729103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968233, "uuid": "d3a19be1-6a7d-48d5-9b7a-bcd8b1e9031a", "comment": "Malware payload (RedLineStealer)", "value": "49b3783a09bc8ca194259c595134bda4742bf1acedc8f57c63fe8d4aa15cd44aa94400e2833781be2b953f3515d9e61d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968233, "uuid": "7d517d69-bd6f-4cf6-907e-4f3b5fb99acc", "value": "T1AD05122072C38523E476083614E0926BBE2BDF3251B556D783DA623E47293C25D3ECEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968233, "uuid": "267dd97b-b2d8-4304-8970-d4f4c66158bb", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968233, "uuid": "5ec8c884-d21f-4ef5-bc2b-a8a42e1526b4", "value": "12288:Ly1IaZz47RJ8rGqCpo+rSb4v6raT1dyNhj/NUOkrNSs8U7uagyXNBOunK:SZ47Lje+rSb4gaT1W5/NaSu3hXnOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968233, "uuid": "08a4cc6e-0fa1-4243-88bb-ce6bc2d947ff", "value": 826016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968233, "uuid": "6dcecd09-e892-47d0-b673-131ecd3cbcb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968233, "uuid": "8b42766c-6ac5-4c2a-a8e2-a578dce971ea", "value": "0931e8aa8bddc4f9563cedf8ebcd56b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2906c60a-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968866, "uuid": "256e7786-9b32-42f3-9d05-ae08660e05dc", "comment": "Malware payload (RedLineStealer)", "value": "a04f9b1b105cb2951a2803414792f32d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968866, "uuid": "4860e422-1a81-4387-87c6-8560afe7935e", "comment": "Malware payload (RedLineStealer)", "value": "6ae3bfc1446a926d3c4fcf94666d8b23f2adb4cdc424cb649bed061d3c570c6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968866, "uuid": "26d1d733-144e-41ff-9664-9d1aa4b6d32e", "comment": "Malware payload (RedLineStealer)", "value": "ff826b44e819c634923205eb3544a91925916101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968866, "uuid": "c08b275d-8f87-4909-b131-e03cd50f6f81", "comment": "Malware payload (RedLineStealer)", "value": "a0548549ca89d7989664de772d9a49dbed9ef5f85e1ece4871986e52ea847e9e544fef9d52574b7f2263dd464c7eeade", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968866, "uuid": "1cce0a1c-cd09-48d4-8e86-eeaade0b0e04", "value": "T16E44283921E144A7D8BA9E35BF4BC0D17116AEB4017C541F3BB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968866, "uuid": "f9bc72c4-a30c-45ff-bb5e-0a8be6c2367f", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968866, "uuid": "9d9830ee-b2a9-4ef8-a837-1f4d62ccf67a", "value": "3072:rLg8+iOHMwew7+picM/NsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:rLg8vOswD7UVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968866, "uuid": "c6d07dc6-a6a2-4637-affb-9115446a0995", "value": 272547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968866, "uuid": "fee56eb0-7d35-43a3-ad91-0073aaae9557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968866, "uuid": "40702864-589b-4e78-8ea8-18fb76b5f015", "value": "a04f9b1b105cb2951a2803414792f32d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9650eca9-1f46-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689009852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689009852, "uuid": "3507166b-ef08-4592-88bb-d93fd5b131ad", "comment": "Malware payload (Amadey)", "value": "2a6e1fb8b08aaa808c7fb58476b6e43a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689009852, "uuid": "47e8ca5f-d0b2-474b-824f-89238663a732", "comment": "Malware payload (Amadey)", "value": "6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689009852, "uuid": "d0efbd4e-8b50-43c5-a474-47e44eb1af41", "comment": "Malware payload (Amadey)", "value": "7ad750caf7fae9d5a84a40ceaa6b717687c8f8c0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689009852, "uuid": "2569b506-76fe-4c4e-bc7a-65717b7583fd", "comment": "Malware payload (Amadey)", "value": "797b640e7aba76882858449b8c71657f937710f62e49dd02046074b7a5a5026889de4b763b01b32ab0b1ae4b534798d7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689009852, "uuid": "381ccd5f-31f4-441d-bb4e-115c936c4fec", "value": "T1341523269BE89172E9B5277058FB02970F36FDB65C38832B23166D1D0C33685A9B1737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689009852, "uuid": "77c1f305-5afb-45ec-a817-8abffbbaf2cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689009852, "uuid": "582a0842-b22f-445f-8bfa-f6cadb76f2da", "value": "24576:zybHwr+znBAxCLaz/qplMPNYrlWCn+QCh2:GbQr+jBQL+M2R+Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689009852, "uuid": "03d0a53a-dbc4-4945-84f8-d04df6a4ed15", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689009852, "uuid": "164ae535-c759-4a39-9e48-80c30563ed66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689009852, "uuid": "ab1c341b-cba9-413f-b584-9e1459827718", "value": "6b061fa4768c28530459442828163e1c4cf33aa058cd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4444d2f-1f66-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689023673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689023673, "uuid": "ae99f098-fd4e-4148-bd0d-ebf6a6e88515", "comment": "Malware payload (RedLineStealer)", "value": "90f38c6c576ed2e1d5d68af5b2b39b23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689023673, "uuid": "f02795cb-8b10-40c2-9457-ba0df990cf73", "comment": "Malware payload (RedLineStealer)", "value": "6b78dfce3fe9f54b8af722e912304dc97b681ff6d9ff3d77e3007b446443ba26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689023673, "uuid": "052a9579-c50c-4db9-84ce-b09ae615e166", "comment": "Malware payload (RedLineStealer)", "value": "690a3b9b1c9ce20a0425e0f45f82b3709e9a22bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689023673, "uuid": "651da8bb-adcb-43c0-9f42-2858076566d6", "comment": "Malware payload (RedLineStealer)", "value": "fcacc4bd1d510293ca8e123caa79b14666a5155ddae7f0736768e36528e2c9d4a7351c7a37616ef1572ff5d731b84277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689023673, "uuid": "e1df5381-7822-46a3-bf05-216ebc46e537", "value": "T16D64C002A1E4EE61D9E64631DE3DF6E8762EF8B18D57675B32142F1F28701A2D2B3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689023673, "uuid": "bedb27c8-8c8b-4524-b832-34dec358f32e", "value": "5a013624489e6703ae44eba8e360cecd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689023673, "uuid": "54e7a998-5d14-4923-8f5a-d6fb3d270fe0", "value": "6144:1PY2LMXKvhJs4cuF6YF6VxEzAMeso+o0Zw7LBk0j/e/:FVA6vh6LuF6YFXEMm+o0ZG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689023673, "uuid": "3986d7a5-13a2-4c7f-911a-dfa365b0d22c", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689023673, "uuid": "093e19dc-d42f-4af8-b38b-01d1b8114187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689023673, "uuid": "59a939e3-47a5-4d02-a438-ab742093117f", "value": "90f38c6c576ed2e1d5d68af5b2b39b23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde33bdf-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968257, "uuid": "bbf57354-b4c2-4e48-9189-90ae7772ce46", "comment": "Malware payload (RedLineStealer)", "value": "5f487f40c9cb438fb8dce7f335bfe8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968257, "uuid": "638294dd-805f-4b39-bdc5-6874decb6b08", "comment": "Malware payload (RedLineStealer)", "value": "6b93892da2d1b0a1a4851c15d8caf7b936148bc5d8c09b133769a07eb9e93067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968257, "uuid": "a2431ed7-163a-4acb-ba55-9b0cac8e9014", "comment": "Malware payload (RedLineStealer)", "value": "03bbae8e6a190cfb45c3801c12d6f7dc952c0f91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968257, "uuid": "e36d4c3c-d714-4210-9ab4-a506bb6577ce", "comment": "Malware payload (RedLineStealer)", "value": "f3cdce5ecf68a73c7777be119930f06e3a12b1dc83fa6ae658829dde06eeb97956935cb159782b2e4727957bf53aa204", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968257, "uuid": "b12311f1-6e4c-462b-831f-8e1c4c86f52b", "value": "T19744283921E144A7D8BA9E35BE4BC0D17116AEB4017C541F3FB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968257, "uuid": "7f0eac4f-216b-41ba-819a-e0083781c378", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968257, "uuid": "8a8dee00-d111-45b3-ac53-81a48e3ec2d3", "value": "3072:f8+iOHMwew7+picM/csVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:f8vOswD7VVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968257, "uuid": "e86a5dca-6750-4d6f-8c42-a120e58cadf8", "value": 272547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968257, "uuid": "a3ff3304-94fa-44d1-b4e3-48aff17e2dfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968257, "uuid": "97c966ab-0705-40ea-be1c-919ebbe17f5b", "value": "5f487f40c9cb438fb8dce7f335bfe8ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5676dd24-1f1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688991706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991706, "uuid": "fc66714e-bb47-4dc0-b87a-b26f336b05b1", "comment": "Malware payload", "value": "fef3a5dd1d5026ee69685d15830d8052", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991706, "uuid": "f2896e2f-4788-4e3a-bb98-9850c946337d", "comment": "Malware payload", "value": "6bbea28a057cd3e4d91b9ace161bd87534c3fb46e680fdbd35d387a27eabbce4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991706, "uuid": "7c118277-d896-4049-aaba-a9b5cb0ae6bd", "comment": "Malware payload", "value": "d770bfaeaaeee381039e4e96e330c958aaf72ed9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991706, "uuid": "ac61daaf-51e5-4436-a822-e05688e10a5e", "comment": "Malware payload", "value": "25d5be942319be4360d6b69f8b1c344236cb25c4e26e5a56856f666298f7640181f734546e5ae58dc153e3ad906d63ae", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991706, "uuid": "2e0814b9-e83a-44d2-95e0-e8bcbc428369", "value": "T1E2510D1417F51319C2778A399836F2418932B956FA02DFEE51D0A2991C20628ED7AFBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991706, "uuid": "6cb82ecb-a9be-4de0-89f1-fc3171314299", "value": "48:8bFUXc6jyDJ2RF9R69fMI6qXv3Seo+/aFnu8:8bFUXc/Ja+9kOvSeVaFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991706, "uuid": "055007d0-1b34-4256-b2ce-460ae4a2a87c", "value": 2620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991706, "uuid": "b485d9be-f08f-4f9a-bdb2-431a36680e72", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991706, "uuid": "efe80204-fef1-44f4-b7d4-a4e2b9dc2270", "value": "Passwords.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97faf96a-1f2c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688998688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998688, "uuid": "fabae67d-d37a-42ae-9754-a7e3b6c38b49", "comment": "Malware payload (Amadey)", "value": "e390eb2626cb37bb31a11b6e977a8d29", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998688, "uuid": "a90ec0de-3108-4369-9a7a-46a2ba46a5b0", "comment": "Malware payload (Amadey)", "value": "6beb10342d08ea98c385a6a98617aa0d5734a06730ba12d2a191b1f6e3bfb16f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998688, "uuid": "8ec9de6d-635f-440d-a334-9f677da4fde4", "comment": "Malware payload (Amadey)", "value": "eb8c5f2beddcffc378355c4e73cc2818b358aaae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998688, "uuid": "c6b2095a-00f9-4241-987d-3495baff187d", "comment": "Malware payload (Amadey)", "value": "0657fdb9134348609933d448596df4b336a73ec38d3d17645c9b706c82023ba2020434e920e7462f0a952460af726b00", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998688, "uuid": "b13eb888-95e3-4688-b520-72d139e01246", "value": "T125152303E7D49032E5712BB05CF102D70F35BE9259B9829B1784BD2F08B39A19A7277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998688, "uuid": "0c652d1e-271a-4034-af30-14a4fa3d99ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998688, "uuid": "59e293fe-60f2-4ebd-af6e-895a74a13f09", "value": "24576:VyoFOYKC3WgkT2FgjS1GUUoBVEn03G8h:woFOLCGhT2W+1NVo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688998688, "uuid": "ca629b09-58c0-47c7-8bfb-ec48be8693e7", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688998688, "uuid": "78c98414-af3d-499a-9780-0dd8392d6911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998688, "uuid": "4275c156-41de-4122-89a8-6cac6dbe5f32", "value": "e390eb2626cb37bb31a11b6e977a8d29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f4b373-1f41-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689007731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007731, "uuid": "b44b130e-a827-43a9-9cbd-2e82aa87a970", "comment": "Malware payload (Amadey)", "value": "fd814badf14c594fd49511d96bfb2c97", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007731, "uuid": "c55f77c0-0cf3-44c0-aed1-076c3302ab1f", "comment": "Malware payload (Amadey)", "value": "6cbac601759f7a1c49b5957708444d7a40fc1435003fec4f352a6f26f3fc794a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007731, "uuid": "fbf960d4-2d89-4570-a489-4144cfc0bc14", "comment": "Malware payload (Amadey)", "value": "0f41dcfcf72b04ff949046a967ac29c8aaaa9350", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007731, "uuid": "adc54ed6-824f-4021-b4ae-a1e557627af5", "comment": "Malware payload (Amadey)", "value": "e2efdc3bc5089bd0a7c468cc0a302c335c8516d9ab01f6e9d5dcc785fb612ce36410915e54e5ead680d02e53539d99ab", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007731, "uuid": "1e890511-275b-4a75-a3d5-c164a3035d86", "value": "T184152246BBD88533E979477168FA12C31F37BCD01E7C836B1689695A0CB2A40B57237E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007731, "uuid": "3f80fb2c-ddbe-4c08-ac5d-0dcd1457c988", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007731, "uuid": "b7236c8c-ad5c-46d8-839c-05f122f39721", "value": "24576:TyS4kNuSk1jcUmo8HDi5Pk/OOpTV5kNHn:m/Xh1jcK8HaM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689007731, "uuid": "5c30c8f9-5233-43d0-a650-cb189bb65954", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689007731, "uuid": "9aaeaa82-a4b4-4104-b351-7d6596df7fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007731, "uuid": "2e6ebba1-d57e-464b-9e2b-c58e6407b926", "value": "fd814badf14c594fd49511d96bfb2c97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5eb153-1efd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978507, "uuid": "10005307-8072-4d65-96af-39023a670b1c", "comment": "Malware payload (RedLineStealer)", "value": "e112c981b39c18c2a88b208014259dfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978507, "uuid": "424a55ed-78bb-4494-94dd-1b96e68cfa41", "comment": "Malware payload (RedLineStealer)", "value": "6cd7d9864a981336a0c1622c117edb43220b1918aa2e14379c0cd285f64fa41a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978507, "uuid": "d56e7bef-c883-49d0-8adb-1eede857f191", "comment": "Malware payload (RedLineStealer)", "value": "1b7e8f3a31487100a6996db356e78b3284d4db3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978507, "uuid": "5e7fd83f-f1e4-4c01-b076-2ac7a9bff78c", "comment": "Malware payload (RedLineStealer)", "value": "f7c5400d2e78780d524ade54cc0e0206c172a9d577a18f5f4fa741a96444b3ab3c2631ca595e9564f406d10b676acc6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978507, "uuid": "474b4e85-7d95-442e-b59f-28173dc9fdb8", "value": "T1AD05126071E35933E137543324E0866EBE2BEA7156A14A8B53C93A3C5B7C1C24E3DDAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978507, "uuid": "0461c2d0-8a09-4e89-8f17-236876d37d26", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978507, "uuid": "c6d481be-c3c0-4d17-8500-6b4290dc9128", "value": "12288:kg44oz472Bc98oq/uqOPOaheiPPOff8KnNp4HeiIiwETZYuNkyMFl+:ZK47scSTyPDhrOMKnP4+FiwETZYM3K+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978507, "uuid": "b3cc2447-5753-4368-bf6a-076be775bf85", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978507, "uuid": "542d3ff2-43b2-4313-bb30-a5ffb18e9e16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978507, "uuid": "931edc04-eb57-49c6-9853-78a18079ad7f", "value": "e112c981b39c18c2a88b208014259dfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af75ae81-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688991426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991426, "uuid": "51ffe8e1-2a7d-4e2d-9cf4-779d009a0c6a", "comment": "Malware payload (RedLineStealer)", "value": "591477fe516fc900c9d23bb75c3337c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991426, "uuid": "d73ffb1c-652c-4521-9d76-ea98a5e49b0e", "comment": "Malware payload (RedLineStealer)", "value": "6d6a1f154c6ae1d70ede87fb06b8588807f50b33315fe4dbfbef9126b18f3bc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991426, "uuid": "b8885900-206b-4b1a-95b1-dc4aa9e05c46", "comment": "Malware payload (RedLineStealer)", "value": "a660be215df39546ed53dda7f836a0f2a522d8de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991426, "uuid": "986894d5-80b4-4b2e-828b-cc5b5790bf65", "comment": "Malware payload (RedLineStealer)", "value": "41047ea8195e1c607269c65678b6fd0bb8a84135a64069e84505a3fc8aba578b79677002c710e554e864ac2001e49fb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991426, "uuid": "aa2f1895-eb8f-43ac-8753-0ea45b1ec4c3", "value": "T1132522203590C1B2D4732A708AC686656E7A30B747B9D5D7BBDC0BAA5F023D5A3361CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991426, "uuid": "667b4bbf-768c-45b6-aab8-012d2750c7a3", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991426, "uuid": "0c5053eb-93ad-4641-9dd3-2188ac7b67c7", "value": "24576:b5k70TrcBhfEkPAaSqTDrpIXFgVOFazJuNlbk6/ZaCTTNAT:NkQTAYaXDNG+MFaIy6/ZpvNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991426, "uuid": "b245c60c-4ff0-4f92-99eb-dbb03b2a8c75", "value": 1013824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991426, "uuid": "cbffe47d-ed2a-4b12-844f-db68a9de857d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991426, "uuid": "97094e27-b798-4fda-a42f-e52a9e338242", "value": "30307_230710_odeme talimat_453747683648987643456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b59f4e5-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968870, "uuid": "47f26a6e-8743-4c1a-ad02-9e39f3af4bf5", "comment": "Malware payload (Amadey)", "value": "b18bf5dc78206806b4e42e9094ab17b6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968870, "uuid": "a4e1d4ed-4781-43c7-9d4b-98bd0121ed10", "comment": "Malware payload (Amadey)", "value": "6e3c26f45c203ac93007a02f040b1504c51afd35eca1fc821a823ab36edf6821", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968870, "uuid": "bd2f249f-319f-4098-ab44-9093a37f05e4", "comment": "Malware payload (Amadey)", "value": "a50d7d63b6e32645cae6eb6a9ee6581fa48daa6b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968870, "uuid": "0fc8a14c-ff4d-4e3d-a70c-653522c62b94", "comment": "Malware payload (Amadey)", "value": "788ba7b785d5a20987e98be8eae75232c8b5b544e41b026c85a87f3e4d75da7bf4e526ccc8846bd2d33957a37bf07ec3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968870, "uuid": "3a34c7ad-d512-4345-8bb6-311bdc704e5a", "value": "T101C4027170D69A23F532143325A0926FFE2FDA3219919B4793C57E3E4B251C24D3ECAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968870, "uuid": "6b862188-1562-473a-9b0b-4346a3abb309", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968870, "uuid": "2480f368-ab61-469b-9afc-c515704c2b2e", "value": "12288:/k8t5z47ofSqwCYW4kwY0hUL2w1GkNFO+3Rw:F547qSfCYS8hUL2ANFO+Bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968870, "uuid": "d98c3618-af51-4a18-b4dd-9b8d1c423f5a", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968870, "uuid": "16d37875-5257-426f-96d6-7590016efa75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968870, "uuid": "27b8ce07-0135-4ad2-9c99-d217f008fa1f", "value": "b18bf5dc78206806b4e42e9094ab17b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1583d2fe-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688991168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991168, "uuid": "749119ec-db33-40cb-9d27-a4c41367d49c", "comment": "Malware payload (Amadey)", "value": "f75b0ec8632cd6f2e9b00857d6eb0455", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991168, "uuid": "51f201d4-3ae0-47c3-a4c6-6317378cdb0d", "comment": "Malware payload (Amadey)", "value": "6e9856822068b2fdcaab4cd9f9c247066344c4bbfac31b5d5de03b7313fea73b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991168, "uuid": "4df6a14c-0b60-41f4-aa44-7e341260d2aa", "comment": "Malware payload (Amadey)", "value": "cec89d81586e15dc029c3b368d33b4c70a1b9dc9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991168, "uuid": "a6a607b3-2624-4f97-8ee4-cd4fbbcb3482", "comment": "Malware payload (Amadey)", "value": "5841ce186a16841dcf37e62cd0483b9155c1bd1839f95ccb7d042ee337165adb5390291bf73b95612c4eeb3bdfdcaf3b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991168, "uuid": "7463e67d-ab97-4d6f-ac00-e6bad6554c60", "value": "T17FB402A175C28523E672543329A0831EFE1BEF325D909B9793C5753E8B281C15F3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991168, "uuid": "46012b97-31bc-44f4-816d-73878bf692f2", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991168, "uuid": "8039e471-193d-425f-aa85-a43c865aabfc", "value": "12288:nekUCbz47t9juQtaq2iJ/tWlfQLU/7oL:nVv47t9aQtaqv/CKu7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991168, "uuid": "c6b1e6af-fc67-4e4c-a6b5-f57c801e5886", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991168, "uuid": "cb604548-f74d-4c00-bd20-3ab8ef94246b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991168, "uuid": "50761f25-641a-47ed-8104-ec9ba266bcd9", "value": "f75b0ec8632cd6f2e9b00857d6eb0455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cab230-1f17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688989448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989448, "uuid": "831d7643-aee4-4192-814b-9a858e8b5ad6", "comment": "Malware payload (AgentTesla)", "value": "36ba4cdfd03acf39f8f3c139a4937f6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989448, "uuid": "14c5ff85-f8ac-4f4c-b746-90502b150a64", "comment": "Malware payload (AgentTesla)", "value": "6ef04512273f3fc29d990c7e022ce5338384b161ab3314a96e2c5cac75df794e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989448, "uuid": "b6d7a959-870d-4196-a045-24cc2f32ec71", "comment": "Malware payload (AgentTesla)", "value": "f4f9e71b8440892fd8ac84e12c2300491c2a55f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989448, "uuid": "f52f0e0a-0098-40fd-8517-ee1d1dfd5136", "comment": "Malware payload (AgentTesla)", "value": "4ac3c1a90abfda65385773e5daf54197613aa3f6fcc9eaf0325357c02112b5098f1d27c36af07edd76562f6359ee2915", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989448, "uuid": "d47fa78e-7013-46b6-a1b4-8d51777510f5", "value": "T120842403719ADCD8A1E27A53038FF9B91BFBB6E50A2F519861CC430A46D5D5CCD886E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989448, "uuid": "edab610e-e894-48ce-b197-50acac2c10ec", "value": "3072:IVNfoo5zootopvXp6ARe3thFYI5TF1Hooooe5ibwF1WgVXT5C:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688989448, "uuid": "2e6ce499-068f-4e94-bf12-864d709f7bcf", "value": 381758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688989448, "uuid": "37c11b1b-df2d-4fe9-a31c-5862a2650e23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989448, "uuid": "d54b4257-e776-4923-8014-45610ce98f46", "value": "Vbs Online.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2deb51c8-1ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688974888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974888, "uuid": "cb4c1fda-5324-49ab-a5e6-b7acf0b9bc32", "comment": "Malware payload (AgentTesla)", "value": "dfe6163e0f6e74a9ece706b64f2b76b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974888, "uuid": "91bf5b14-a2dc-41c9-a423-1a5e3ae4ca06", "comment": "Malware payload (AgentTesla)", "value": "6faa1af3229879738ddd419469ac7d668aa1c223254b552f40fbaeb8b2dc5ffa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974888, "uuid": "0a3e7087-e017-4221-a0e0-e4e46021ce46", "comment": "Malware payload (AgentTesla)", "value": "f0a5b92cb6142ee46c0403339fb73c47d23e1e9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974888, "uuid": "cf04a94a-344f-40e0-b131-384f5b225dcb", "comment": "Malware payload (AgentTesla)", "value": "37664158370c95063c0046fcdfd8ad2077860a1cdd69ec001856350407fbfe5ebc70c55dd6a93bf193a4f1b54421d13f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974888, "uuid": "306e4171-9c25-471b-ab35-40e7af47f294", "value": "T1DEB423587C1E9B52C14F90D4987924AE9F113B89DC3A259E07B2F90B63DACBC16D13DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974888, "uuid": "b60e3d42-a135-4b1f-84b3-6e43b64a4940", "value": "12288:taGHnZyo0uz5TrjYAVv5avLSW3j3KeL+Ggn3jVthfVsAmHIpYNqmmhu:ta0Mo0sPYWW3j3KQgn3pVmopXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688974888, "uuid": "ee7eecd7-836f-404a-9581-55e94771f1f7", "value": 529446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688974888, "uuid": "4ee56b8b-13c1-4b46-b1a4-f05aeb7975fe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974888, "uuid": "f8e3d552-1dd9-4aca-9a80-545736220b61", "value": "shipping documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e03797-1f69-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689024827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024827, "uuid": "d043f53f-498b-4810-bc5b-882092f83f59", "comment": "Malware payload", "value": "fc0c34a3e96105cf9b27b0228f981b1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024827, "uuid": "d73ecb25-71b2-49a1-a860-820b82811b46", "comment": "Malware payload", "value": "70244e155a95744792bbf13f8eaab830c3d4a8529cce439cffdc4172b14fcd80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024827, "uuid": "d17ebf5f-5852-4708-b272-a8c3e0ffe672", "comment": "Malware payload", "value": "6c7b3b8eb923cd7b9b0b3455461cbe52b3e4ce62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024827, "uuid": "271deb06-e12f-4dbd-9c4f-f7d15658374f", "comment": "Malware payload", "value": "0954d7580d7bbdc2b64d5fea307825aaec6d840e47bdf683d9c9641dfe74db1efcf1c75b8d61fdbfd51fbf24a1b46d63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024827, "uuid": "aad07e71-4f50-412c-b946-e9446e46fedb", "value": "T13FF42B56FBBD4272E051C135C9A6E7B5E6B27C855D30970B2346EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024827, "uuid": "3226acf9-649a-4ec6-859c-c0f523d345a7", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024827, "uuid": "0bb8359c-5962-406d-9289-2e911bacc43d", "value": "6144:XA01NdzQ/xQWQvYYaE57i1bdRxQ7cUBmCUiJbc77ZvfuYuEdGxTC2sWf7xLUnw+V:XdEJQWQG1bIShtdGxTC2c5JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689024827, "uuid": "cf481167-8c9a-415f-93a6-aed1b1d30036", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689024827, "uuid": "c624188c-6d1b-457e-9d3b-63a848d9aad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024827, "uuid": "72306b94-90db-43ab-ae36-5eae5ad6f382", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f2a225-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688977901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977901, "uuid": "de137ddc-14e4-496e-af4e-39e880074f61", "comment": "Malware payload (RedLineStealer)", "value": "5134cadabb93050a87cc9fdc142d834f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977901, "uuid": "0c214ba4-f6a0-4a50-be4e-22096d96f97e", "comment": "Malware payload (RedLineStealer)", "value": "71c686d2bcd2347221c301756987b5c9157c09dbd03f7075ff5072b096f33844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977901, "uuid": "c7a11f9e-bd21-4453-b24e-6dfaa9b05ca0", "comment": "Malware payload (RedLineStealer)", "value": "d36e7f0b27010ada125d33e6bd0e21d707cd4172", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977901, "uuid": "1d07502a-fd27-431b-9b09-9582300dbe4a", "comment": "Malware payload (RedLineStealer)", "value": "ad25189d0e6981ae45756c23bd2c9ec7ca7ca9fd93e32a65f436e4d03c30e8d8a4841c5a88ffaede22336358b7217ecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977901, "uuid": "4bbb6941-2dd8-4d5b-b82f-b369df09f026", "value": "T14505126074E68933E53250336960925FBE0BEF715A90969793C53A3E472D1C28E3ECDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977901, "uuid": "ff7523f7-82aa-4178-aa0c-3ed39a8bc65f", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977901, "uuid": "8b4b46d3-5813-4899-a2c3-1312c59d248a", "value": "12288:kQ4OYz47C1/R4v7JqSzgcCekyT1vDDzlBUi9F1ZkRj6P1WebLbqzZXznB:3a4724jJV5Dzsi9dpb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977901, "uuid": "5486fc64-596b-42f3-80ca-1ebbdf92d94f", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977901, "uuid": "545fae68-e7b9-44f8-a48d-54cfb79c14c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977901, "uuid": "01d42ed8-2394-4474-9439-064a809d67ab", "value": "5134cadabb93050a87cc9fdc142d834f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c57c627-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688990884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990884, "uuid": "78357384-8801-4373-aedf-928ab267e44a", "comment": "Malware payload (Loki)", "value": "39f88f3c5e3bc6eb013f81b577a32645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990884, "uuid": "c21f7ac6-a44c-4bb5-ba4b-74fcdab8e014", "comment": "Malware payload (Loki)", "value": "71c93b4b1cef4f5c4f562ea58850fc63f945c4f7932f0d78d7912fbbf1fa1cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990884, "uuid": "15281a52-ecff-4675-bede-ffe52a436256", "comment": "Malware payload (Loki)", "value": "5eadaf5bdbde3aeb48114dd8c458ca326aa8b59e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990884, "uuid": "a9e595f5-04c3-4cb1-b2c9-8e0b999135e9", "comment": "Malware payload (Loki)", "value": "4cfaa900ad7af50c1ee25bd1a4dadecaf71897093827b71ae9e4a0a4dca5c17c55374d5c8d0207ce97bfd5bcd781fac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990884, "uuid": "12cc23b0-f43f-46ba-b1f9-fe1a516789c2", "value": "T1AEE40116B1BF9B12C9BAB3FE050494443BF8891D5965F3180C8B91FB4A76F440A94FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990884, "uuid": "e0689246-660b-44a2-a147-95d3f1a20e49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990884, "uuid": "32f9f244-8505-4362-bf50-02c9c6ca8148", "value": "12288:5J4adp7tL+NO8nQdQkJbh0IbiN/YK8b4mBwowrTeMIvx9:jp5r8qth7z9Ikvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990884, "uuid": "2acd0fad-6993-4b0c-a0b5-93d7b7893830", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990884, "uuid": "47028918-8cde-4937-b7ee-b0086edff4de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990884, "uuid": "7b0833a9-d456-414d-94e5-30ae228ca577", "value": "K81195 - Remittance Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554c6f89-1ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688974954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974954, "uuid": "5b5e0050-696d-4e94-9b18-af4dc41c2f66", "comment": "Malware payload (AgentTesla)", "value": "cc4b5436e2c0b900cb41a8b4d3770674", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974954, "uuid": "8b9cee70-a84c-4256-84ba-f0bccf4b101f", "comment": "Malware payload (AgentTesla)", "value": "71f89701ea665ab429c5fabb91f89053ca165bfc489b54d963e7c4cfbb3338f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974954, "uuid": "e7a9ab0e-412c-4396-b59e-2aa46df4d3bc", "comment": "Malware payload (AgentTesla)", "value": "6c3bcd2f65a1c1f57501a28a956d7030bcfa7c29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974954, "uuid": "e4dc174c-17d1-4c3f-9bf3-259f6a9b5141", "comment": "Malware payload (AgentTesla)", "value": "a7585d0cd65449422b91f0dbd9f0ecefba3627f12a659a89aad5ba46dde223df7a1d993d03a0d4509ae49f12ed9285cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974954, "uuid": "bf510c95-21a2-4c7d-925a-b89580a81ed2", "value": "T13BC40212656AF773CC1C0EFC1045948523E89A59AC78EB5C8CA38CDA8AB5FF504EC6D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974954, "uuid": "bf5f6be1-2a1e-4e16-96e7-1620768dbc29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974954, "uuid": "5996c269-8f02-4b9b-9bb8-80c68526f7e1", "value": "12288:4reLLTw/BCPytOH2PWpAaMYtdHfA41iaWWPAmpIKSiInYgQL7:zT+A2epAaMYvIaW3mi5RQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688974954, "uuid": "cd259e39-e291-4910-b432-3ab335985a34", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688974954, "uuid": "50d71b5c-77f8-437a-affd-241a752b6865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974954, "uuid": "1fca8071-96fb-4575-86b9-7f8ddd899872", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37df483e-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688971039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971039, "uuid": "ce613fc6-e9c5-497e-8066-417c691eb73b", "comment": "Malware payload (AgentTesla)", "value": "89f0d858c9dfe4c6020af9e318b84817", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971039, "uuid": "a6276078-68f2-4304-9fd6-11adde2e8a2f", "comment": "Malware payload (AgentTesla)", "value": "72377a1023075ac814e170afb8a15d720f6f62f26311ad910c91ead8f4459cc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971039, "uuid": "2230a05f-114d-4f7b-a2ea-2a1e73698588", "comment": "Malware payload (AgentTesla)", "value": "2ee25574897f6baa4fa564b8624e2b90ea3f416f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971039, "uuid": "33171ed6-05c3-4082-a839-ea237be9b850", "comment": "Malware payload (AgentTesla)", "value": "ba867b32dc208628c1907b765b372ef02b0fb22ab0f19a7f7219afb36e4b169b2304bc87ea7fadaf9fc09a1c033be7b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971039, "uuid": "78663510-fa81-4221-bd7f-2654822d7a68", "value": "T136C4F002763BDF17D4B8A7F30531014453F9667634BAF11A5CCBA0F64ABAF1018ABA97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971039, "uuid": "f0898068-7faa-4afd-9b60-99ba2bd861ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971039, "uuid": "46ee11c8-62b7-4b4a-b0ec-32b10469e837", "value": "12288:7KqB+jwVN8ValKRICLtcBpP4BsPEZjU/1jRTtKiBvUd:7KqB+YNoRIutopP4BsPn/13DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971039, "uuid": "353fa9a3-0451-4d90-aaeb-eeb39ee6aed0", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971039, "uuid": "5c506ac7-6e5b-41b0-aea9-a84d25d7b4b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971039, "uuid": "d04d74d6-ca25-410b-ac1b-52a42b0259ee", "value": "PI pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea8e3f9-1f2b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688998377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998377, "uuid": "cecafde5-fd6d-4e4a-aa65-505f929f9c6a", "comment": "Malware payload (RedLineStealer)", "value": "39285f80b332880483fc1645936cb6fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998377, "uuid": "89c57b5d-2200-4d72-b76a-335ea795f13c", "comment": "Malware payload (RedLineStealer)", "value": "7264cad994bae7303486b901f6231a199fb105c5599be228f8e354e4e86f66c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998377, "uuid": "ab443982-3c72-4fc3-b3f9-60c70c9ad03b", "comment": "Malware payload (RedLineStealer)", "value": "221f3ca161006529b220af94962044f7d6491ce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998377, "uuid": "fa363905-4365-45c9-a7ad-9441b9b16d82", "comment": "Malware payload (RedLineStealer)", "value": "e589d3df1c92fc9b65aedb9482d44105f88a51db6fd06383b88e2839f555c7e5ae63a5688b6694b5d1901672cefae6d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998377, "uuid": "e81d3638-c310-4f88-8b05-5cd25f323b1f", "value": "T128E4DF3914A144ABC4A9AE39FF4BD4C231162EE5017C954E3EB36E783BD20578DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998377, "uuid": "6edaf240-d689-46f9-bd80-022bb8716aab", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998377, "uuid": "c7441f6f-a777-4cf4-9582-491a27f1a85b", "value": "12288:YVw3zk2EeiICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:qwDkNeBbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688998377, "uuid": "dfa000df-f8f4-4f83-9ecc-2d3d860f5e23", "value": 708420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688998377, "uuid": "51d74bf9-efd9-42ce-97b5-25988b924be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998377, "uuid": "7eaf0b04-6582-4b7c-bee4-faddbc019dd9", "value": "39285f80b332880483fc1645936cb6fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046066a2-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688967946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967946, "uuid": "3f6cf5a0-b1a8-4a7f-b9b3-61fd622db238", "comment": "Malware payload (Mirai)", "value": "30dd5eb391f9ff5391c11124cf1be845", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967946, "uuid": "9805508e-a636-4397-8e1a-95795b396062", "comment": "Malware payload (Mirai)", "value": "7271554b0f1b1053ad97d2493f59c21b8686d3ad40e3bbb6152fa8806e00281d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967946, "uuid": "5875f971-8aa6-4c24-b3be-9abe101a74ef", "comment": "Malware payload (Mirai)", "value": "8688c216a62c5f4046d61f3cbb21373c53b30ecf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967946, "uuid": "002f86df-4726-4b0f-9b2e-33af03770b1d", "comment": "Malware payload (Mirai)", "value": "187f0df00ab2ce301ca9f6d42df913d920a01cca7ed892b1cf740d8c40e29169117d758db4b105a63aaf782204f4de2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967946, "uuid": "87b38e0d-4821-4ab8-b454-d2a4638acfe6", "value": "T10543F949F990A729C6D121BBFA0D128F73270B6CF3DE72315E309A7537C6A670A3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967946, "uuid": "03a33a88-4262-4075-a0a3-aaf4440e2881", "value": "1536:W4niG6CmooI9pSkaQjCTXIniUqzu8AUrx45QYRB:D61ooI9Radzu8AUrx4+uB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688967946, "uuid": "82c9c31c-fce2-42c8-8fe7-4d7dc7e41838", "value": 58824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688967946, "uuid": "a6b3c6ee-5a01-4886-87a9-3bee04bc43e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967946, "uuid": "92e7672d-1853-4d78-85a9-96d623de6505", "value": "30dd5eb391f9ff5391c11124cf1be845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8d86cb-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688985700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985700, "uuid": "1e02dc4a-c853-4aed-8cf2-c4abb67e9bf9", "comment": "Malware payload", "value": "9dd60d877b82358125316af8f53be2f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985700, "uuid": "78c81f7e-fb8d-4bce-9284-69eab586bdd0", "comment": "Malware payload", "value": "72d087b8d5bfa7242e1dd5cf5ee0904b3bfa85f151fa5b2482f1b9092f786f86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985700, "uuid": "18ddbced-35c4-4c16-bd86-13b0d3abd408", "comment": "Malware payload", "value": "3a4532d32e72ba91b9593313ee6c35a5ceb71806", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985700, "uuid": "bd6e62ad-ed2d-4398-af9c-4c22e309a825", "comment": "Malware payload", "value": "b3a32dd328a74750257f6a01e9c958f5dbe20a6c80a19c3333480de5005324ebd4772b35fc984826718f050abc4126a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985700, "uuid": "74b16d80-d6cd-4f9e-bc70-5e0b3ae8ee4d", "value": "T1F9534426AB519EB7DC5ECD3305A8460221CDA09A53D82B2F76B4C62CF75BD0F45E3C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985700, "uuid": "122df7b3-1c38-4582-827d-ac6793ad3f52", "value": "1536:VeTb9Ki+QrM6DrxhIZZ3ZcfatYz7jT3s:GgNQGZOXT3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985700, "uuid": "09f4dd67-bcad-4181-9c32-a99d9020e23e", "value": 61504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985700, "uuid": "c545393a-3712-4aa3-81ae-7e5513c6caf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985700, "uuid": "a515eeeb-aa24-452b-9f21-2b3535fb8a81", "value": "SecuriteInfo.com.Backdoor.Linux.Gafgyt.JJ.28641.27412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e27b4d0-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978029, "uuid": "92370d6d-6180-4198-90eb-2fd962aa8a35", "comment": "Malware payload", "value": "e19f2f5dd6e56420bb4fd898dfc2d700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978029, "uuid": "b1e0f229-9f5c-455f-b445-0084ee867b92", "comment": "Malware payload", "value": "73747a3ba1f89f7515989b4aa2eccb1700302d8e601e03dad6c3b49ddd687e38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978029, "uuid": "17fdd2b9-a373-4929-8bb1-86f4e1848ddf", "comment": "Malware payload", "value": "68ea1fd0c33aa20d6e1766d0333300fc3190703e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978029, "uuid": "3ca8394f-14d8-4541-abde-ffedef249ea3", "comment": "Malware payload", "value": "55bc3a6da87aae06143913b29f23bf01442b23f29826c615f2cadf5cc57ac77dcfdfe563cf170604fd7da75b44ef2e4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978029, "uuid": "fa90bb5f-c662-4d1b-97df-832b49ac3b7a", "value": "T1DD536526AB519EB7DC1ECD3305A9460220CDA09A53D83B6FB6B4C62CF75B90F45E3C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978029, "uuid": "6ff2e30a-48a9-44da-999c-a7bbfe3acbd1", "value": "768:ZugseT2l0r4zIUb2eJQJ/9BEwVuRKwuUNAaj4LiyZ0ZkjiXiTUrewe/uyrAmTFIH:geTFZc8ZoDAaj4LiyKZkj7Ur9SJrAKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978029, "uuid": "5c589da6-375d-4ac3-b22b-7bbc3ed3181d", "value": 65340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978029, "uuid": "c2146652-2ab0-4a6c-b31c-c2e543c57133", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978029, "uuid": "fe30d23f-37ab-467c-bd5d-bc61b798a6fd", "value": "SecuriteInfo.com.Backdoor.Linux.Gafgyt.JJ.1177.21823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc2136d-1f19-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688990697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990697, "uuid": "be8dd6b9-b6d1-48f6-81e4-767f08bc228a", "comment": "Malware payload (SnakeKeylogger)", "value": "70449edc2945b6283a2afdb179714d8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990697, "uuid": "362c6087-4a3a-4cef-b50c-57357f825a83", "comment": "Malware payload (SnakeKeylogger)", "value": "73e288b96b3f5a85046fc0ad2d5864b65c01d1f673943f0b35179af4ce39eff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990697, "uuid": "c2c23fd4-f6df-4d73-8f79-9a584d739c15", "comment": "Malware payload (SnakeKeylogger)", "value": "1e18a4e993eebbd2b2437db4d57f786bc9951a23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990697, "uuid": "b08e92d3-52c4-4021-a98c-9d4d4975929f", "comment": "Malware payload (SnakeKeylogger)", "value": "abc0d718ead59c7ecc5f89553cff1f19723ae5395e228352d3c8f272c5855fccf812b699c46ba4350cd60a113adf840e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990697, "uuid": "d42d0fb8-0a30-4f95-aea2-b9f5b09540da", "value": "T1EB434C43B69F93A1C2D95B7AC49795840732EA83A513CA0E398F131928C3FEED95135B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990697, "uuid": "03d854be-c516-45c0-8736-39e54d2a18ce", "value": "1536:/MphjqEpmN8kbjIa8NKUjHJOOQhBUDlzyc4F9nY++ceDs:qjqEpmN8kjIa8NwOQvUD5mFpJeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990697, "uuid": "4d7313a0-3dfa-40f2-bdec-e54775f51588", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990697, "uuid": "20bcd827-add3-41c2-a207-24491fd6e747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990697, "uuid": "9b35b957-278b-4727-8511-68148a1ae561", "value": "Qfwadvlt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621566c8-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (HawkEye)", "timestamp": 1688981847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981847, "uuid": "295c3405-9227-413a-803d-d5a4e53dfa3d", "comment": "Malware payload (HawkEye)", "value": "42975e59f70448efb621c1f9c4bca01b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981847, "uuid": "2e6d449d-c3c2-4788-bfaa-4284cc1c5225", "comment": "Malware payload (HawkEye)", "value": "746d8f96f8153a4e45bb998ec885c82ffa1b4aaa18eb1381db2a2ed851e876cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981847, "uuid": "a464bcea-9997-4ff8-8399-880a5db3cce3", "comment": "Malware payload (HawkEye)", "value": "acd00215d93e8e81d32e10d0a88127da4133c1da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981847, "uuid": "15eafd89-a5e3-454a-94d0-0f0616cf1c8a", "comment": "Malware payload (HawkEye)", "value": "9298a253b23e985589382d9935663588a700c395d78b507506633bf2cff227159c60ce6883d6f0e6051cc45956e6ca27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981847, "uuid": "2fc60bf5-88d9-4aae-80e5-633ff736b53b", "value": "T10DB49D03B3D14436D4BF0530677757729BBABE301632C91B87E818896EB6291BA37387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981847, "uuid": "ba137f3f-1433-406d-afd6-b424c58fae27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981847, "uuid": "2b741afc-5214-4776-aa59-187f95fc3132", "value": "6144:uuaqLk33bS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9v:y33QtqB5urTIoYWBQk1E+VF9mOx9Vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981847, "uuid": "19860e49-3a09-40c6-ac45-7a1892857d60", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981847, "uuid": "a6be56b2-6f2c-4277-bf84-8e697dde060a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981847, "uuid": "84bfb739-c2a8-4238-89f7-6f5f3e22730f", "value": "746d8f96f8153a4e45bb998ec885c82ffa1b4aaa18eb1381db2a2ed851e876cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f598fb-1f04-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1688981471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981471, "uuid": "cd317656-3bd4-42c5-a1a2-6f929332b10c", "comment": "Malware payload (Quakbot)", "value": "e55119cac7088b78dec6150fd44fc91c", "object_relation": "md5", "Tag": [ { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981471, "uuid": "8d64ae9a-41aa-4244-b4ee-7f81ae7ebfcd", "comment": "Malware payload (Quakbot)", "value": "749699a9a6198e917dd0b9dbb3769324cffe1f7bb570a8540c06b229ec0909c6", "object_relation": "sha256", "Tag": [ { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981471, "uuid": "96c91094-b249-42d5-a64e-cace0d0ad247", "comment": "Malware payload (Quakbot)", "value": "eb2fa6ee837042442886552e24ec643b9f652b9b", "object_relation": "sha1", "Tag": [ { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981471, "uuid": "bdb5d20f-f9f9-4a71-a88a-62d490e85aec", "comment": "Malware payload (Quakbot)", "value": "edd8a92c54fcd025cb90bafa71146cd607a04a4e1fd57fc4060e119160fffcc04efcb0b0b907f09b9edbf68c6ea443fd", "object_relation": "sha3-384", "Tag": [ { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981471, "uuid": "0ee3261f-f369-4b61-9796-61ec7dad9537", "value": "T17D7302878EB374202D6C510BE9ED4892117DB4B9781E3FE299C3C7B296DCA83C553A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981471, "uuid": "7ac06f91-4d84-49b0-bc86-c65d872a697a", "value": "1536:/v1E0cLynEjJgccYJ4GpTx4+ANlriysNCncKnmaD7N1yVtDTYDku:/yCnEjJgX8xx4XTKNcmaD7/y3DTYQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981471, "uuid": "decbe41c-12c7-4709-8835-46dacd0646be", "value": 79479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981471, "uuid": "7f21d862-a489-4fe7-8626-fdc34645027f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981471, "uuid": "5c40ab50-26ba-454e-b4a1-0232c3cfeca5", "value": "BSN-1525063912.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ceb87ac-1ee8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688969437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969437, "uuid": "4dd8ed3c-8bff-4964-89cd-edf1f9c078ff", "comment": "Malware payload (AgentTesla)", "value": "c274d1781e37da1fba8f2aa66555c8d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969437, "uuid": "f81fa0cd-0abb-4422-bc43-de493c4e5219", "comment": "Malware payload (AgentTesla)", "value": "74a7d1dc8afbb04d57a56e4fe989823680523ed0dcfcc145551b3b5ecd6d7d2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969437, "uuid": "dc473f3d-02d3-4ca8-b65f-06e5be641aee", "comment": "Malware payload (AgentTesla)", "value": "c6f2c470c4ab0d161c2e64b7d04655f373d5ced7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969437, "uuid": "696f4c3d-a325-4243-9767-3bec2c400635", "comment": "Malware payload (AgentTesla)", "value": "98569681cdb6cf22e8badf1986a3f3df3b4ff5754ea672b8888a20a9cef87299995ba1b78584d1c796411b66ad55ec73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969437, "uuid": "30dde37f-7b3f-4148-88bf-867eb4b521fb", "value": "T1DBC402167E77C366D128A7F2347914C0636813A124FCE6291CDB91F95D3FF0868ABA87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969437, "uuid": "e3bde5fe-2b36-49b1-802b-fc52c80afc26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969437, "uuid": "354f33ff-8919-492e-ade2-deecf1d843f3", "value": "12288:uSu0Ol/Jf0BPIHSteE4p5wRxv4qxYpLFqRROMokPYT:uB0OtJf0BPIH8efr8v42YpZqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969437, "uuid": "f38a5fb4-23c9-4700-9948-85df7bd3f2e4", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969437, "uuid": "2760c94c-acb6-4f55-b417-8d8078ae9aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969437, "uuid": "52b22db8-13f9-43ac-890c-ef293ed0fe12", "value": "QUOTE_RE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a48798-1ee6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968530, "uuid": "b2f384e8-72ea-4c93-b181-4bf5b8bf90ce", "comment": "Malware payload (Amadey)", "value": "22cf18f611dfcf9951cadddc4d609d9b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968530, "uuid": "426b991d-3d0f-418a-bce1-58f17914a472", "comment": "Malware payload (Amadey)", "value": "74c20ef0ec0d69282b22f078004c985d3dfa116fc184d3a363ab19b665d72128", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968530, "uuid": "43cd054d-dc99-4fe5-bd93-0cbb6fcf14d2", "comment": "Malware payload (Amadey)", "value": "1501527c03fcddc217d7cff9916a376c6cc9f760", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968530, "uuid": "40af7abf-bc4f-4dd7-a67b-bc401a7781af", "comment": "Malware payload (Amadey)", "value": "5486041aab8260cffd70c506a4503a06647ac1d8778db6e07591dc212b041b6a0d165513ff3c2cf99e1eb4cb74886cd7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968530, "uuid": "12e112da-4668-4a96-a274-ca917afa0406", "value": "T186C40261B0E29573F63214332990D22FBE2FEE2549A05683A3C9763D97281D15D3FCE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968530, "uuid": "bcbe9551-ce45-4f61-97d8-41caf9ad4bda", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968530, "uuid": "d901669a-8b1f-4a0c-adf7-74387bfccdc5", "value": "6144:6USoUTLdHBJ7CWGYLUz247a/en91UnEbTR8PCRId2oD1J1XWcydfiueR/oY6wxDV:6U8drz477+Ebl8PC+df1fEfJUmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968530, "uuid": "133022a0-f059-4a8c-92f8-30013bef656a", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968530, "uuid": "5dac54fc-29ee-4f26-a178-d704a56099d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968530, "uuid": "ecfc2852-b778-4ad0-aeec-62feef753c96", "value": "22cf18f611dfcf9951cadddc4d609d9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243af3e1-1eea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1688970147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970147, "uuid": "b2feb55c-93b2-4263-a40d-25523940c02b", "comment": "Malware payload (ModiLoader)", "value": "ce90c2be58bcfd1466c1098151f95401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970147, "uuid": "32dbbf90-a3ea-43f5-a389-195424ea7135", "comment": "Malware payload (ModiLoader)", "value": "74f3991c2f65f8bfa4e39a908f8d4d73d8b502fed1d9910a9ed66773c0674c99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970147, "uuid": "c6cfb8ce-ad2e-40fd-83af-fd4f6c6b91f3", "comment": "Malware payload (ModiLoader)", "value": "f2b10e394ef72c5324c2df0fba0e2bdb2bda6651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970147, "uuid": "30c8695e-00b5-4592-aff8-6f1435259eaf", "comment": "Malware payload (ModiLoader)", "value": "79f92e7da4f94c15b6b1611c3483e0089a03077564231d4c7a7ebd4670b7ca73e3fcab3e92e28d347397b7cc01e48124", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970147, "uuid": "e1002584-624f-47ad-8ea8-af8f959104cf", "value": "T15515AE32A3924437C3621779DC17B7E6593D7E302D14984A27E12E4CBF79E82782729B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970147, "uuid": "f8fdd155-2b6f-44c1-95e6-5e4f1265bebd", "value": "8466179c03d61f9be09e96306c739027", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970147, "uuid": "5e88522d-e50f-44cd-9e3b-dd6740506643", "value": "12288:VDQy2c+bp9/95hiFFCt2AvQBPNIkry/wNQZqLfLYUj2MsT2AWwog:Vcnbp9mIzvQBa1/wNQULfLYUyVTHjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970147, "uuid": "7d5236f0-3ff4-40b7-b15c-1cd46bbbbe9c", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970147, "uuid": "e20b33e4-18dc-4c10-a102-ae93450cc2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970147, "uuid": "6b71fb31-4d65-4271-9f7d-669192b969b7", "value": "SKL_100614800C_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701a289a-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962543, "uuid": "819772aa-0dba-4b1c-af83-4cf29f641aa7", "comment": "Malware payload (Mirai)", "value": "af97182dd966bb997b6a2e939bc49c1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962543, "uuid": "c57109ec-ee17-40fe-8d5d-2d53d469f478", "comment": "Malware payload (Mirai)", "value": "753394daa882cf0323b330caeed5d431069381b0f182f6b2e0d2e94cf65e645d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962543, "uuid": "39a88539-e4d5-48a8-a22e-209a886c1eae", "comment": "Malware payload (Mirai)", "value": "1881667f44c739750fc4b60f230217bda095f4de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962543, "uuid": "a43aa316-41c7-4c5d-9a42-6f7f71298741", "comment": "Malware payload (Mirai)", "value": "6e0d8c1d9ff4a85c1f4e3e09e8007ed9677c4816d8b87d7348e0ab75cec98a872976ac0814b686119f3ae1200f29bd78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962543, "uuid": "3f7f8d12-b83f-41e5-bf72-8bdcd11484c1", "value": "T169535C02B3684E07FAE61AF5343F1BD483AEED8025E4B585A90FD7464235F33459AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962543, "uuid": "dcc15ad2-77ef-4ca5-b661-819816ece837", "value": "768:zipbi/131WUsTETbl1T9Q9n5pY5eEgGsllk5MDZH0a26lBHW2tdFsDMUQSDAYTVJ:zT93Egl1wYAzk5a+8NbK1DVBug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962543, "uuid": "230cf708-b535-41ed-af8e-f8f7a6846de9", "value": 64188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962543, "uuid": "e772009a-bee7-4be1-a3ac-b84bedec8c8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962543, "uuid": "edf27ce2-0c60-4c1d-b20f-aff5ae2275b2", "value": "af97182dd966bb997b6a2e939bc49c1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330f2a6d-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688977903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977903, "uuid": "1c6de55b-7405-4bb5-a676-ec4cd31f09a3", "comment": "Malware payload (RedLineStealer)", "value": "664a99ec0bc1cf444e54fdd6dc39bb97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977903, "uuid": "74f73b59-c2d5-4c07-89b6-9cff83a2f310", "comment": "Malware payload (RedLineStealer)", "value": "75802f71a55cf0863677d4f011873341a2886caed1ad2a4a906a07d77e02e3f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977903, "uuid": "66654bc8-72ca-43c2-8be9-d1e78b4fca22", "comment": "Malware payload (RedLineStealer)", "value": "a3929ba5d9d8c8169a310fce30517606acea5dfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977903, "uuid": "4a609f69-4702-49ab-97d9-d933a1a7876b", "comment": "Malware payload (RedLineStealer)", "value": "e8b4de6ef7ec441e7fd9c50c50089f1e3ef1e646034fd4daa96ee9631e51c30ad99b0160a09024e943f1641a1009360d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977903, "uuid": "1e883271-7438-480c-a4c5-ca4496dd4ba8", "value": "T15CB40260B1D64A33F571553316A0D22FFE1FDA3216A19A8793C97A3E47281C14E3ECE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977903, "uuid": "faf034c0-65d2-49cc-b086-a144c9da8c97", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977903, "uuid": "c60973a7-f643-4c0c-871e-8c30e1362a0b", "value": "6144:+E7/YCVeHBtGCWGYLUz247HEelddIvIIWwloJnW0rM8wnHkXhwvj3YhwDotR3Poh:+EUZAz47xYv2Y8wEXQcecn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977903, "uuid": "fd95f16d-cdbf-45c6-942d-5a62c61d42cb", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977903, "uuid": "3d468397-6751-40ed-a1cc-2366cd4b390a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977903, "uuid": "2a527ded-b37d-4fa6-846a-f19097b670d9", "value": "664a99ec0bc1cf444e54fdd6dc39bb97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98513166-1ee9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688969912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969912, "uuid": "7fbce7f3-7972-4a35-a245-a8840e4f6313", "comment": "Malware payload (RedLineStealer)", "value": "251cc9c3455844f3eaa98b0fc2c1ded4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969912, "uuid": "73b23364-41a3-468e-8f2f-6ff6115b41b0", "comment": "Malware payload (RedLineStealer)", "value": "75a5cf0475460c31e228bd47cfb22b11300156aced58a14c6d6faba407fe2c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969912, "uuid": "37aeba95-73df-4b68-a6fe-4504311f212b", "comment": "Malware payload (RedLineStealer)", "value": "5199e0bb9c9bce61b2b80a2ccc09bfc1c2b6da05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969912, "uuid": "13bbfb4c-e5cd-4abc-9080-f24f2f97725f", "comment": "Malware payload (RedLineStealer)", "value": "d89fb4e4799780eb961861a219002186907c25832814c9612a12ad4d1438fd2329996bec98a9cf35c6465e3725aca100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969912, "uuid": "7d00a3d0-f1aa-4d0b-bdcf-439efa4bd3e1", "value": "T1B795D01175E1C473D57312330CE4EB7E5A7DF8300AA19AAF67E40F6F8F60681D622A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969912, "uuid": "bf7ef4e7-894e-4c11-9ad9-5c48e4e645ca", "value": "6a76ee7eee4043c503cafe261bc1f071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969912, "uuid": "dfbe8d85-0afe-4599-bcb1-bb8636d9fe47", "value": "6144:p9WOZZrGrsSFB+ekKM1V3XAOP9krrXwLbbtCfi3bEDNLgXsNxqUO2IaO9w+Pk+uE:zrZZrGrsSu3X19k3KQi3bqNLqF2Nj2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969912, "uuid": "6aa02678-77b6-49ba-bd1a-be21c9d0aaaf", "value": 1946624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969912, "uuid": "40764af8-b649-48c7-a453-10c8656494e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969912, "uuid": "38060627-c188-46e9-b84d-e82e53166ecf", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2538c4-1f01-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688980039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688980039, "uuid": "a6ed70d1-82f4-4ff5-b924-58497191c417", "comment": "Malware payload (AgentTesla)", "value": "6fb32173703c59c46d9c33409d0ddffb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688980039, "uuid": "f6aa0910-9403-4d82-a1d2-ecc9faf54e74", "comment": "Malware payload (AgentTesla)", "value": "75a834a3db2e98e4531c20659aec62ccac592e36d42295fdda5ab2b8937c2c41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688980039, "uuid": "74e9c4d4-5d5c-4f13-9bdd-47faa8b962b2", "comment": "Malware payload (AgentTesla)", "value": "5ddf9acfb3883961dafb7202a129e2c94aa85f26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688980039, "uuid": "ca39a9c0-b78f-4b9b-949a-36248af8f2d6", "comment": "Malware payload (AgentTesla)", "value": "4e0044f0511d2283a70274433176178482d908caf3b5240b8ff700eec1d16a19622d76b7ef5bab4385fe3c38f7f7bd2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688980039, "uuid": "52faa3c3-70b7-4d5f-add8-7848e621cf85", "value": "T19C452CC5E98455A0DD59AB706A36CD3582237EFDA874A42D38DE3E273FFB2931025063", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688980039, "uuid": "74cf51ea-7a19-441a-951c-e5798efa4dcf", "value": "12288:KBP7r9r/+ppppppppppppppppppppppppppppp0G:u1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688980039, "uuid": "015dd84e-dd82-4d27-a151-071f7412358e", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688980039, "uuid": "0d6fa881-dea8-4f49-b735-622a1bde46f6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688980039, "uuid": "a30fc5ba-323d-4af1-9d99-eef4fde8f79d", "value": "ASMT-AR00-AST00.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c630300-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688981864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981864, "uuid": "259335f2-b1c8-4c99-a299-10871a23c9aa", "comment": "Malware payload (AgentTesla)", "value": "f929f60cee998d8e729999a568ed26b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981864, "uuid": "1bdfe347-28cb-4374-bf7b-5789ee0ea763", "comment": "Malware payload (AgentTesla)", "value": "762486e96e54ff18ca1f24be9c149b563117564cb3d1836db4262d8306e55b7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981864, "uuid": "febe08ac-995d-40ba-b012-15269eddee20", "comment": "Malware payload (AgentTesla)", "value": "8ffd6fc1fdaacafec4c7a0c2d7b319d079b2fdeb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981864, "uuid": "5c92c3de-7d46-4356-b0e9-95f1c70cf023", "comment": "Malware payload (AgentTesla)", "value": "411cf5abf2a3c5ccb992940d8ab9984a2df63feb063f0f79b33cb5fcb5987cfcc55ee7a098f13dbbb826ab56ee66aa7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981864, "uuid": "5520576a-16d2-4620-905e-2e3569e8e009", "value": "T1AFD46A3C1CBC3222C174E6B68FADC421F550996B3E658E2761D7999D071EE0229CBD3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981864, "uuid": "1ef93d4f-521f-4a21-b89b-1015a1717660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981864, "uuid": "5ba7c97f-4d47-4b4d-b2d1-96ed733f068b", "value": "12288:C9X63vlVxbLETFGkPik7SrTm2AedXMm7TKXm+:KX6fhIT8kFaf8mi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981864, "uuid": "b249ec95-93f9-40ce-8f62-b6987b67b72e", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981864, "uuid": "bb16d069-791e-4954-ac57-e3ad0f4cce83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981864, "uuid": "642b0a30-decf-42b4-b8e3-391e82250703", "value": "Invoice & Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d15a7b-1ef2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688973738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973738, "uuid": "4406c537-27b1-4b63-a8c3-7d2100ef548c", "comment": "Malware payload (AgentTesla)", "value": "2e3f35b89b6f0a5b853999cc5486d8c3", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973738, "uuid": "6b2d401c-326f-4ab7-be94-848972eb376f", "comment": "Malware payload (AgentTesla)", "value": "7663778faa4a995bba1a306df22a3fd6b1b58929673ee733f900f3780ab4d4fb", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973738, "uuid": "3039c42e-a3e8-48d2-b3b2-a02b3177417b", "comment": "Malware payload (AgentTesla)", "value": "6e7e28da58cf5243412b9a8fd673ff4f4c298d2d", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973738, "uuid": "947eba5b-68ce-481d-a586-3bb0db461f73", "comment": "Malware payload (AgentTesla)", "value": "0b181d651b96a2ae018f698e2494cd818f49036cfcd12b961f858057a476f3ba903b5f5c1806e3827a6307e988814e16", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973738, "uuid": "aeef8efa-cfe5-4c81-8b56-8ee0491d6706", "value": "T13CB4237CF60F496A0C035A9A062AF33561F5D51E900BA295F830E9B433E947CDF6BE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973738, "uuid": "94745564-b554-4b78-b67c-42e1b47b52f9", "value": "12288:EX8wcJYxYHenYdpWhd93q3H5zJFJw/N5lZCfNqpZhrP:EX8JxHenYfyf3q3Hlm/N5lZhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688973738, "uuid": "f2315933-6e3e-4fe6-a638-2996eb60f425", "value": 511927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688973738, "uuid": "ac85a58d-4a41-428e-9827-febd26b8173a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973738, "uuid": "aaf9e1aa-3f14-4b57-a3f5-bbb526bc5f45", "value": "payments advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a8c2e5-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962574, "uuid": "14e21f40-6ce0-47f3-af26-25b6f7003239", "comment": "Malware payload (Mirai)", "value": "460e36de9f77bf37c07349bbf72b7168", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962574, "uuid": "6d996091-6861-4492-a96b-3f2aaea5b6fe", "comment": "Malware payload (Mirai)", "value": "76aad8cfa9b9aa2acedb7038c736e2db709b9a30fcef32730d53cdf24bd8d547", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962574, "uuid": "fbc2b3c3-84ac-41b6-bd37-26899c918616", "comment": "Malware payload (Mirai)", "value": "677b27f56fa36e055505974c62830eed8a98ddaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962574, "uuid": "543ce419-b526-482e-8d2e-54c884a1e58b", "comment": "Malware payload (Mirai)", "value": "43155581daa05e5aa455941375bdf2eb9e9781c4cff58f635148e280fb6e08b11f923f7ffd033e8743bbdebc6d493074", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962574, "uuid": "4a51578b-19d5-469f-938b-8ad89220dc98", "value": "T127D2E05AC2018EE1FEFAB87D8486D1C23F924AA4E36D9C0161D05F12FD1B3372B45CA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962574, "uuid": "3b7e0a05-9875-4e4f-accb-545f7f37ca8f", "value": "768:DNW3K9PuOrBJpplgfKFfji78Q2b+0V3K0O4uVcqgw09h:DNqWDr3ppefKRU8Q29V3A4u+qgw09h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962574, "uuid": "43721de7-4c07-4362-bf7c-9c78b44e7eef", "value": 28708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962574, "uuid": "54dc5154-d593-4ebb-bcc4-4a0adab34f6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962574, "uuid": "656f433d-35ef-44b9-95b8-9adf5cb132d7", "value": "460e36de9f77bf37c07349bbf72b7168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6446e265-1f2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688997742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997742, "uuid": "c681326f-2342-4201-8eb7-b742cfae6bf9", "comment": "Malware payload (AgentTesla)", "value": "cd1318a25829f10f5d92725f6837b11e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997742, "uuid": "6f5b960d-2ab9-4231-82ea-205b4ab74287", "comment": "Malware payload (AgentTesla)", "value": "76c2197af9e9527439182d13a92bcee73073641ffdd277ba667981aee87fa28a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997742, "uuid": "e8c1e3da-ce4f-4b59-8e55-580329ed90ab", "comment": "Malware payload (AgentTesla)", "value": "30f2db3c96b6a3365905b5aafde6da63f7c6d973", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997742, "uuid": "24cdb31f-c750-4c1c-9ab4-89ff3edf6115", "comment": "Malware payload (AgentTesla)", "value": "d3d5ce32f0d8619078e87e848ce3c051c160269bbe3aeb1d3d1c7eaf3d549fbe3ecffe1df049bba2b9f550b35ffb26bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997742, "uuid": "c75d9409-724b-41cc-926a-cc254d2092e1", "value": "T1B8327D3A6DC41C6ED3069037B079310AB6AC309352299D0E7BF0F596C575FCD7A32A98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997742, "uuid": "141d07a0-c6b2-484a-a95f-9c66df0c89be", "value": "192:Pya0NhGMoWJARgZVPCK44AG9xXSJ+Ej7pJYjKweKne9WY7cWehmaMAG:PyXhGMoWJANK4499xXSJf7pJYjxdY779", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997742, "uuid": "1602f004-273f-4054-8c49-3746948d60ac", "value": 11087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997742, "uuid": "3cef7247-a269-48b3-9a51-a8ac688087be", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997742, "uuid": "f82cb719-7d8d-450e-b2b8-cb59a1819842", "value": "packing list invoice.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b76b3e1-1f61-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689021269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021269, "uuid": "2faeacde-79f5-43a2-9818-b3bb5a9243e4", "comment": "Malware payload", "value": "dafeddb17e96bacbed8ad1b54f637c9b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021269, "uuid": "6f49298c-7845-4649-8858-aed52c7996ce", "comment": "Malware payload", "value": "76df0cea6e41b90ccc3927923c79b966045f0ee0f0a4769fb5ff6cb69765aea9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021269, "uuid": "6a00cf1f-2229-4684-b238-51bd7a1c0d14", "comment": "Malware payload", "value": "648673f2907087a2823d4f7e38ced6a4497858dc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021269, "uuid": "d0805fde-d0b7-4bbc-8887-66cb2e2a070a", "comment": "Malware payload", "value": "38b05037bdfeab0c483ee455a3962e2440e668c9d9c74fbadaae1a1ec479d89c766acdcc8b83526d968ba8fb5e1dd68c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021269, "uuid": "264e38da-0aac-44b5-838f-c75f900386b5", "value": "T191D3290BB5C1C4FDC8D9C1B44BABA13BDA73B56D1234B26F27C4AA261E4DE205F5DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021269, "uuid": "1a0cca0e-adf0-477a-bdc7-24dfed66cd24", "value": "3072:fGL7qZYhKchQdzjNpAQIk+AX1wrEPZj7n97aMN:fGL70LclQqyhjJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689021269, "uuid": "7bd71b01-81a6-40bd-95d7-8c169989a4c1", "value": 135480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689021269, "uuid": "8adb328d-2f9c-4662-82ba-d7e2b25d7e10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021269, "uuid": "867505e1-264b-4b0c-b0a8-1d95945a62ab", "value": "most-x86_64-20230710-2034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6652e8-1f30-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689000197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000197, "uuid": "dc8aebf7-92f7-419e-b35c-1436da24dfdb", "comment": "Malware payload (RedLineStealer)", "value": "0052fa6e5f2a8acf21c2bbf6f3bdd6cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000197, "uuid": "d1370a09-e646-411f-9dfd-f1bbccec41a7", "comment": "Malware payload (RedLineStealer)", "value": "7732b3137a721cb543261e9c4ecb5c90b51aa6d810c2df0104df6b11e319dbd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000197, "uuid": "1e8ecfb9-f95d-4b58-a2db-a61958cc80b1", "comment": "Malware payload (RedLineStealer)", "value": "3a05bd0f34c716e55ad701b456c50ef624e3cb02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000197, "uuid": "4d1cecd6-957c-41b5-8c22-06048820962d", "comment": "Malware payload (RedLineStealer)", "value": "39b5c2e52b6b2184aefa9d9069c16036e01b0bc049ae4e1e209084114d7ed72f968a7808ee4d4f88b78f151a5973cbbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000197, "uuid": "0d7f28ff-7fdd-473e-9655-90fc7f995952", "value": "T1C2152393FBD88573C9B5677099FE11A30A3A7C12EFA4C76B369198875CB11C084327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000197, "uuid": "3ed46f35-bf48-4fb8-9881-22b8ed6dfaaf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000197, "uuid": "62a03f87-4fc2-4f0c-a7d9-a6dbeab19bf9", "value": "24576:EytrgJgSxOLwdZCZqx7qJtKM3GlPNMh49OjQF:Txg3xOkdZCw4rwNZSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689000197, "uuid": "9269cebf-57f1-4792-8aed-fc7fa9af0a3c", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689000197, "uuid": "f8933885-c554-4be9-a99f-80eb1b14de26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000197, "uuid": "66363f77-42b0-4cb6-8182-238d80d0aac0", "value": "0052fa6e5f2a8acf21c2bbf6f3bdd6cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec643cf-1eeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1688970728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970728, "uuid": "cab393f5-1dda-497e-bd4d-2bc5f2560945", "comment": "Malware payload (LaplasClipper)", "value": "f2e100f576b44fdb37d874db2e48085c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970728, "uuid": "463047f8-731e-4009-b1fa-4ff9bd53f7c8", "comment": "Malware payload (LaplasClipper)", "value": "77530f67cff4fc2456c0b27abf28d1ab1f4f10fd9be039783adfa25ed1f7f196", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970728, "uuid": "c9d4f71d-a0f9-4af9-8909-4044060a000b", "comment": "Malware payload (LaplasClipper)", "value": "23091a0b5231d69d85866fede573b25577e20414", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970728, "uuid": "b0f0d9f3-6800-425a-b444-d0b092e02a2c", "comment": "Malware payload (LaplasClipper)", "value": "ee5954a03d3f5c22ace1933af30c1a59b19475b0980bcf6936a946e3809bf9bdadf8e8bd1d65687f7c376cb869727c9f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970728, "uuid": "1dddfff1-4166-40dd-bd8a-19ec27c24a8c", "value": "T19A2633552E51D0C1D14A007998F683ED2728FCE46FB61B7A679CB9275F3E3883A43227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970728, "uuid": "caf6c635-fc21-42c6-b237-446ac3cf504d", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970728, "uuid": "8402b079-05a8-4e24-adff-01d7ddb69a38", "value": "98304:fqemq9DObUSOLZ27MJuUfg7Jb/0RCh2fc/xVzVALUx:PzD3SFEuUfcLwCh2Q/RAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970728, "uuid": "2243f5c0-4360-469b-a3f9-370e12c3d42d", "value": 4567040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970728, "uuid": "537e1f7b-f979-432a-8908-ee22887e677e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970728, "uuid": "419105aa-8aa7-4e6f-9151-53ed5f74d05e", "value": "f2e100f576b44fdb37d874db2e48085c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e640214-1f19-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688990404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990404, "uuid": "61823316-23a6-4016-a897-e11b4070c63b", "comment": "Malware payload (RemcosRAT)", "value": "5512c658febe1b64c7f63d57b4eac9dc", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990404, "uuid": "9fcbd76b-6164-4111-b8dd-1708a4922632", "comment": "Malware payload (RemcosRAT)", "value": "77960fc39ccd460202d7dafd68d3ccce3d6f848a2343beaf19dae439093fd727", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990404, "uuid": "9327eccb-fd24-411c-8e4c-ed44225aa1eb", "comment": "Malware payload (RemcosRAT)", "value": "f5b7c8fb054f4f886e6db36414cfe244613174d4", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990404, "uuid": "f9f21a19-922d-413f-93d0-f6b4af888ed3", "comment": "Malware payload (RemcosRAT)", "value": "91dbbf8874e61eab5bc38d8b36a64ac3cf9cfbfc8c68de0902325a74ad79bdd12f2cb1e2724d611f57d3c2bd626c0d3e", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990404, "uuid": "5852873c-8b62-4941-8a2b-60dae0c651de", "value": "T19F512D8273DCE20877635605966F23F04B3F761F7B3E8A4B408D4C8C97E25064A577A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990404, "uuid": "1ae037b5-97e6-48ce-b576-f61c7218ae51", "value": "48:oRpNA6d8Vl1DBcrOuf+vM9jrgnASH1+XI3VtegWQQ5VC9:o/66GFf3OlC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990404, "uuid": "06d8087a-c000-4ac2-8a6a-acf5414a701c", "value": 2822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990404, "uuid": "7d19aa9a-2108-4900-9d7e-7e37d5a1b8ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990404, "uuid": "9eb1c99c-89b8-4266-a3e0-3ce6e0bd5cd2", "value": "Document-File_September_shipment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013dd468-1f3c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689005307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005307, "uuid": "64b805d1-10a1-480a-9914-df60c7b47b5b", "comment": "Malware payload (RedLineStealer)", "value": "bf447368e9d3f0ec34cd63d370831979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005307, "uuid": "7441fa0f-e5d0-4e59-9a5b-85279e8e5594", "comment": "Malware payload (RedLineStealer)", "value": "7868e7c5e31315e7bb442bafbbc16addfeb4bda998b404491976aa271fbb78ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005307, "uuid": "92f8997a-d3c5-4f32-a744-8f0ff56ac265", "comment": "Malware payload (RedLineStealer)", "value": "6d1ed6f41e7d2b566fe26eedc778eb5582c4a7bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005307, "uuid": "ce1f4bbc-dcb5-46b1-927b-7a5dbb58726c", "comment": "Malware payload (RedLineStealer)", "value": "1222b5d5e23e47d05232755a608d3082e9703f6b6c7b8cf0344726411c0314668fe843e168597d7d8291f5cb8b1b9abf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005307, "uuid": "05fc6f51-9a68-4dae-9d6e-3395224d1a74", "value": "T13B64B04365E0FC63E5264A328D3EC2E8762FF8514E597B5A22987F6F18701B2F263351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005307, "uuid": "731b15fb-6937-4c39-9537-ab6b646215fd", "value": "5a013624489e6703ae44eba8e360cecd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005307, "uuid": "3dcf9dff-246a-4b3a-a1dd-1c2859624e7a", "value": "6144:Yh+KLEk1qBC7ZyyZ684FVdQqZNlbU4yalCHFU4+gb5gFlr:k+Kgk1x4XV93lQ4yalsU47b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689005307, "uuid": "35b40ebc-0c3b-41ed-bd25-c8b751c1f534", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689005307, "uuid": "0c1956a7-facc-448a-93f2-fa41810c6f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005307, "uuid": "f76fe8a5-282b-46a1-82a8-77405cb87cd9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1638d7eb-1f18-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688989880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989880, "uuid": "b0c16a35-e9ad-494d-8c60-6fb72d6b2a50", "comment": "Malware payload", "value": "f01830cdd1ef777fc4015ccc17a4e742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989880, "uuid": "8bd3ab5f-c077-499c-a42c-79ff53beef74", "comment": "Malware payload", "value": "788946351eb96e16eed3c00532427e24c70011a3d5d3945304db9c743d8cdba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989880, "uuid": "db46fb59-0145-460e-a254-73107e77c129", "comment": "Malware payload", "value": "1bfb35ba4bc9b95425b36b02db0ad9c53d3ca2fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989880, "uuid": "06bce797-d0b0-4393-ae00-da3cdf0dd79d", "comment": "Malware payload", "value": "8e411ade2c727f7f6e58f57a3713c434c74b62e425aa4871c332db4a70ac78e3cb73f7ed6274e17009d8a3dfad2b2541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989880, "uuid": "be96a817-d948-42b8-947d-4dc57fbc0d9d", "value": "T1352491C56ECC4236F668893ABCC1405A7A1456435BCD5E92A36C73CB08732CBDFE6939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989880, "uuid": "f2fb5eb7-4596-4ee0-892e-0a47359f321d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989880, "uuid": "c01d81b7-3c64-420d-a45a-3f63d86d92d6", "value": "1536:yiWDCkbdHK6QsqyzvYVeCjf4sVw0FMFDbeqqpeL3LBkq0Abev1+xV/P0:GCkbdHK+y5+24DbehgL3LBkSbevJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688989880, "uuid": "7a6eb959-f09c-4df8-beff-20b4c5922b5b", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688989880, "uuid": "fc74a906-304c-4b2d-8312-db5c2341798d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989880, "uuid": "fbea173f-c981-4dd3-b8e6-47f9cbc4b8eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ea49bb-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962556, "uuid": "b39449d9-3911-48fd-aed2-595a8633f0bd", "comment": "Malware payload (Mirai)", "value": "711774f6e94fb798c699f66b552a3662", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962556, "uuid": "1b4c8ff0-96e1-4587-af0e-b145327f3f2f", "comment": "Malware payload (Mirai)", "value": "79027a557e4ee54ae52e5ec1a2e685dfd87ed28dce6896da91f6663da5590181", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962556, "uuid": "dc5e0fd3-0d9e-44d9-a715-17f4721a6c7d", "comment": "Malware payload (Mirai)", "value": "3f90cb0ae8aba1a47e3d2ff7e10a2047d32fed07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962556, "uuid": "6137b7c1-d00c-4ee9-8f0b-86f4125388be", "comment": "Malware payload (Mirai)", "value": "1a277e313f833a1e2312ce3fa0337268811bb61ec1963bf0a4b50cce4aa87633545a8002d14b6df100bb16aaac038243", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962556, "uuid": "a3f9535b-9135-465d-9c2b-636d6ab6d373", "value": "T13D735C34A97A2E26C1D0B13F22FB8761B2E5260E25B4865D7CB60F4FFF2065464172B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962556, "uuid": "be710425-1b4e-4448-8d89-e25b6665e637", "value": "1536:Azvh+FNkgj5cXlkqFfjzYWcSrGhQxV6vVgFpqxfyFFm:LtIYWc+8vVfxfGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962556, "uuid": "664429ac-f5ae-400e-b05b-7949e58460e5", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962556, "uuid": "26b2af07-da9c-4ac1-915b-01d0499b08eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962556, "uuid": "01014987-7a36-4f22-a60d-8db00303d144", "value": "711774f6e94fb798c699f66b552a3662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e7b31e-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962530, "uuid": "135a51cb-1598-4238-97f4-68395bf3de4f", "comment": "Malware payload (Mirai)", "value": "f84a0f1e6aa69da214b7a3ff4c4abc6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962530, "uuid": "5d0622c3-36aa-4f41-84bf-f15002622c31", "comment": "Malware payload (Mirai)", "value": "7939d2c8ffc36a2f14c2d2919a76b9a9428103ceef0f2ee708c381c696684287", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962530, "uuid": "2f254ea6-072e-415f-874f-b4ea291b06d2", "comment": "Malware payload (Mirai)", "value": "b5d92fd5779492bf3666e02084091ac665043433", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962530, "uuid": "5c328db9-e9ab-4102-bfca-3e3571f833cd", "comment": "Malware payload (Mirai)", "value": "34e352dd60e65e1fbebdfed6119655747254ad90a1e4fa4db1ff089ab642c636a9a4d4ba58259c155ea2a3f278730004", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962530, "uuid": "3ce6bf89-02c7-4754-9a4a-b671fa4e5e2e", "value": "T1E633198964112E6DEAD65CFD90724F0ADD505220B4A7171FA3AFFDC33933368EE62909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962530, "uuid": "1ae5d25b-a8d7-4943-aab6-8f47548b92cd", "value": "768:UxbcHCax7uvsasYaMKdaeOwdmmQXy6oWq8AVWOsOGZ7OjUQy+f1prtr1q3tfQeE5:8cHN7wsjYaMKIAhqAVWj7OjUDg1pxrY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962530, "uuid": "2fbe6344-f830-426f-8afe-a9336f86341d", "value": 52960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962530, "uuid": "71d4e425-ccc4-415f-bd97-a2a9415d27db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962530, "uuid": "a93dc787-3ad1-44ca-801c-8bb5412f274a", "value": "f84a0f1e6aa69da214b7a3ff4c4abc6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c95c8c-1f41-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1689007860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007860, "uuid": "e6a51362-04ba-4201-bb9c-ed01cc84ecdd", "comment": "Malware payload (AgentTesla)", "value": "96908698ef1a19e7b6c4cc2f52637d3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007860, "uuid": "2a75b7cc-4bfd-4b8c-9570-c8559090aede", "comment": "Malware payload (AgentTesla)", "value": "798fa6d044ede82b78358f22b37053faad937fe49e84a0f98c7bd3f7e329d759", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007860, "uuid": "d5173fc2-b1af-4e21-8faf-06588d63b5d2", "comment": "Malware payload (AgentTesla)", "value": "c5e1deb88c686172b30cc21f92747da8d95f7d5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007860, "uuid": "8ee0536b-bc9e-4724-bcb4-1fd1d66f4b66", "comment": "Malware payload (AgentTesla)", "value": "de64a57a81c39f64b41ad05c34afaeb1233f8fbda1aa89d930fc0d78d4dbb31586794444f9a895271614fc351b7f4cb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007860, "uuid": "d3e76ee4-932b-478c-b6ff-946ea9c3c23d", "value": "T17513F61AE79F02648F911273671B0E89A6BDB63EB35154B1785C833433EDC3D426A6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007860, "uuid": "56a422eb-9543-4cdc-83bb-33a027066316", "value": "768:uFx0XaIsnPRIa4fwJMTzv5C4I3vn6C4foKmuG58BeGRGLuC:uf0Xvx3EMTjQj/Ko/uPrtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689007860, "uuid": "04a30498-2f5f-48ec-9a01-25f51241890e", "value": 41827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689007860, "uuid": "8797e202-830b-4033-90d4-7de275c74a95", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007860, "uuid": "64a458cd-40a6-48e2-a1cf-f485e9c40da2", "value": "96908698ef1a19e7b6c4cc2f52637d3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb8c9c2-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688977897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977897, "uuid": "90c377ec-4410-40de-8811-d5f91fa9f760", "comment": "Malware payload (RedLineStealer)", "value": "7c1f606fef562c6c4e04b6a7f9bfdff1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977897, "uuid": "14481954-536e-4e15-be2f-d2452dd470c5", "comment": "Malware payload (RedLineStealer)", "value": "79d4dc3df252015895e353474a96da78323db0a7c3e50538b7ce1af04f4d502f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977897, "uuid": "29c507cb-f3e2-4a07-8c20-31e79468a86f", "comment": "Malware payload (RedLineStealer)", "value": "a18c7cbaa8ac9088b1729f9856317d3e1b763b3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977897, "uuid": "8baf46b1-e5cc-4568-8c5a-20dbb201c436", "comment": "Malware payload (RedLineStealer)", "value": "468357c1b6c0c3833247f6648360c8c939bdd1a7191a6ba9047a89d2f7c63efcd26a24453d105194b1f74aa4336d23b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977897, "uuid": "87c2ab9c-5987-445d-95c8-b45564b18f62", "value": "T1A744283921E144A7D8BA9E35BF4BC0D17116AEB4017C541F3BB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977897, "uuid": "d1cf5022-a949-457d-8293-e59f57162ec7", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977897, "uuid": "1d2c5ecd-f9ca-4c89-a57d-b73306b19f13", "value": "3072:+jM+iOHMwew7+picM/LsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:4MvOswD7SVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977897, "uuid": "0bbf2c95-f12e-409d-b20b-9a34dfeea1ad", "value": 272547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977897, "uuid": "cff03bf3-23f7-4f7e-a9f6-b620191d4f3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977897, "uuid": "a01a52a2-0118-441e-b6de-27edd2c6e6b0", "value": "7c1f606fef562c6c4e04b6a7f9bfdff1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1afcf79-1f34-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689002221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002221, "uuid": "8931bcd8-824a-4eec-8d56-cf8f048b1f80", "comment": "Malware payload (Mirai)", "value": "1fa0a21c15bc1dd86b5598ec69e174e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002221, "uuid": "e8602cbb-501a-4bc9-be26-83c1199ab8e9", "comment": "Malware payload (Mirai)", "value": "7ab9f743bc9dfc167ecf1b45387cce7c3d38661b1c7ee8e91403e7c368561956", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002221, "uuid": "b08ee074-5021-438e-82ba-2f8f812f8e35", "comment": "Malware payload (Mirai)", "value": "35046e6ec621cc3a6203c1480820f7f65fb3c81b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002221, "uuid": "14606d15-7388-4b87-b03d-9278755ef868", "comment": "Malware payload (Mirai)", "value": "aca120c80e04c9a9579be22dce3ed9d311f7c9da6b797b41309ee04ced077fb19f2271c243905fc06b3c6573cae0c6f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002221, "uuid": "2f7d95d2-681b-4093-9d30-9f3e38a5a212", "value": "T115336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002221, "uuid": "b7d5d9b5-ecbc-4bc9-965c-91624e8d7b7d", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689002221, "uuid": "04de6bde-b950-4ccd-a973-be7d77260398", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689002221, "uuid": "27efb2c0-369f-48fa-9144-3235891aaec4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002221, "uuid": "a94fe8a1-d1eb-49f9-bb2b-842331f66fff", "value": "1fa0a21c15bc1dd86b5598ec69e174e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a4b58d-1ecd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688958018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688958018, "uuid": "9a002dca-dc2e-4dce-88f6-6b283dd1246a", "comment": "Malware payload (RedLineStealer)", "value": "d012235474e6266764c91269f2e65242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688958018, "uuid": "bb02aed5-6ae2-42f3-b325-de09fcf027bd", "comment": "Malware payload (RedLineStealer)", "value": "7b21a244bdd2ee5b7fc6eea171572f36aa7ce5e965409d0a75593a0c5ef73da3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688958018, "uuid": "c929153f-8828-406b-ac11-b18d42406ba2", "comment": "Malware payload (RedLineStealer)", "value": "3802c64b799075b504d49bc8d83e16f5c3c4cb9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688958018, "uuid": "9c0a18ef-27e9-49f7-9998-ec732572efc6", "comment": "Malware payload (RedLineStealer)", "value": "d5856e49aee82e2e61d7c951ca579e2473624f0cac58cddcd6f2fa8d60f19b2e394bf715c4baa2731fc23cd546223541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688958018, "uuid": "eb5ce369-e75e-465c-8516-d81789644ecb", "value": "T16A24F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688958018, "uuid": "0bc5a975-bfd2-40f8-bb88-846ad1eac270", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688958018, "uuid": "05ef440f-6461-49bb-9376-f717a0c15d5d", "value": "3072:meTRJ0kHbnpN23kQKp5XzutZXKGrpeN84LuZAIybiy3xEfbi:FTR2AnpN2wDurXBeBuZAIMEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688958018, "uuid": "9feb6765-f8e0-4335-a399-ae487b643bd1", "value": 224926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688958018, "uuid": "730ac7bf-2166-48e9-a5e0-dc9fb943fccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688958018, "uuid": "85a76716-7382-4b17-bb6e-1e73c27be1f8", "value": "7B21A244BDD2EE5B7FC6EEA171572F36AA7CE5E965409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76991801-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688981882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981882, "uuid": "47560a2f-1a74-4dee-bb7d-1a13ae63a08a", "comment": "Malware payload (GuLoader)", "value": "620d0e482887417b089ab3e70a9031c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981882, "uuid": "6be0e619-c581-405e-b6e1-e89ad5927528", "comment": "Malware payload (GuLoader)", "value": "7b3447523ec225e7323cfa258ad943e828da6c9605539d1db338c30c8bf1608c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981882, "uuid": "4778941b-947d-4323-837d-287fcc72836a", "comment": "Malware payload (GuLoader)", "value": "36c98bd92640d00562cbe0b6859e720f01486193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981882, "uuid": "23733777-b5b9-4520-a314-2fd03b68c2af", "comment": "Malware payload (GuLoader)", "value": "d5ed6e160e4e2a76f8bdabbc0eb01e3423ca4bce787e14525968bc0164833d939ff345fdfca75240a6ac1d190aaee94f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981882, "uuid": "c26a0cc7-9bc9-47cb-9e53-dc8aceb675b8", "value": "T1ED44F1C07E92D473E9540FB5482796E68635AF2E7E70818F37407F5E2B32781920A67E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981882, "uuid": "3e8b91ec-5420-4894-abd7-22fda08d1b6f", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981882, "uuid": "485c0340-3560-454a-8cd2-014209b32aa4", "value": "6144:RZ/qRr62xlmSlMCo0oFCZR2vzkwL59ZIE2hr5JOPI:RBBUlmSlMwqcR2zkwL59MN0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981882, "uuid": "f9330c24-ba05-4c4b-855c-c7d451c3a9ec", "value": 274704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981882, "uuid": "7f8c163f-ab6b-4479-8df6-af03b0f1c189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981882, "uuid": "397c1874-ef84-4a68-a989-a5ee37a55914", "value": "RFQNew request order RFQ#0023111 DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c86af6-1ed2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1688960004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688960004, "uuid": "f0b9fe77-d334-4871-ba09-55b47ffde2e6", "comment": "Malware payload (Fabookie)", "value": "8033522a37a14e0305aa33e076b9ef28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688960004, "uuid": "8dea0dcd-3776-4554-8415-56b180b6d78f", "comment": "Malware payload (Fabookie)", "value": "7b6b64b56921581a47d4dc72b7b20a34a24af8cefa14808dbb17f5e05618c4be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688960004, "uuid": "60c87df0-4687-49b4-a756-dba08bd3fac9", "comment": "Malware payload (Fabookie)", "value": "240103c340e739a756960c0d65f417bd270ac855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688960004, "uuid": "72667d37-b397-4ccf-ae69-d8cb73e30e3f", "comment": "Malware payload (Fabookie)", "value": "cd2b4b9c6d7f1c0b64753f07a953ec0d53019179db23fa18e55b143649fdb2359595c1f318192d4b9fcddbf02ab325d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688960004, "uuid": "718ff1d7-78d3-4962-9985-4d86056846ba", "value": "T1F124AE80F390E195D64D8175C927C9B85366BC1C9A345BBBF294BB5F2E322C7403AE27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688960004, "uuid": "255db601-dc48-4279-a2a3-a531a224b663", "value": "4fd11f5c9a089e7b45c77cd8b5fde1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688960004, "uuid": "99eca60a-7a38-494b-8163-417059b44304", "value": "3072:/PDOEkvkKqUa9antF5hvvJkeXp2QhHkKqUa9antF5hvvJkeXp:HecKq99UF5hvvfjhEKq99UF5hvvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688960004, "uuid": "acfc29a2-be3d-4dae-87e3-d81efb22ccfa", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688960004, "uuid": "9d65a9a2-4b37-438c-9f81-e5261ff3a09d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688960004, "uuid": "476090ac-f195-4e5b-b9c5-6691d2166bd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1beaf259-1f04-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1688981300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981300, "uuid": "f3dcbe17-a959-4ce8-91e3-4b682a1199dd", "comment": "Malware payload (njrat)", "value": "f8b41b499604e82eb0e6510383a90e34", "object_relation": "md5", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981300, "uuid": "842e1ddb-e9c3-4a3e-bbc3-d198283ca59d", "comment": "Malware payload (njrat)", "value": "7bb19c68aaf145e837e104b39f5c2b967d52191eb8e71846ac8e697d3c027873", "object_relation": "sha256", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981300, "uuid": "e96551ec-a94d-438a-b668-ddf0d449df38", "comment": "Malware payload (njrat)", "value": "b5699fd8dba7bc35ea5946af35e8ea51a58ea4b6", "object_relation": "sha1", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981300, "uuid": "4cdc482e-8bdd-43b8-a6e0-e7b9b9fdf898", "comment": "Malware payload (njrat)", "value": "dc11794c6b733a37610372e3c6eab93899337aa121efab5e388c4e04eb32659689b9f69028467400583835d78d78c644", "object_relation": "sha3-384", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981300, "uuid": "1924b949-0d6b-4351-adc9-77272a6c19f7", "value": "T1D264D113B099CCEC61D17623595FFEB44BFBB6D1917D42B950CC0A4AABC291C8A253E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981300, "uuid": "0e55b4ae-cc05-4382-aa21-3526f544ebbe", "value": "192:iTvQpQjcZZZMC/C2zOzYEAPK+aQyleZ4nUlypKr:izQpQjwnj/C2zOzYEAy+Hy4ZeUlypKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981300, "uuid": "dde5a10b-8b96-4786-8c0b-1f1e14a9dc2d", "value": 327638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981300, "uuid": "bca64e71-c73f-4728-a947-6efc35a8a9e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981300, "uuid": "bc5f6ae6-4e50-465c-be54-282251149a38", "value": "Ad8556545S2125565444l55645554S4456M50001_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b2d70a-1edf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688965588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965588, "uuid": "550713cf-e068-42ee-a3a5-8cf21d4f0eea", "comment": "Malware payload (Mirai)", "value": "3e6e05745f9ff43c833251e0733ff1a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965588, "uuid": "fdbad5dd-442d-4a8b-9957-4000be80c956", "comment": "Malware payload (Mirai)", "value": "7cda3591af494bd7233e4ff26c5efd033c081907af775698723ffa7377743688", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965588, "uuid": "61342b95-065e-4a1f-aa04-0a4961433a03", "comment": "Malware payload (Mirai)", "value": "11d0ecea1a96e8bbb1e5904d1ae5ec2da1afb155", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965588, "uuid": "ff670192-2fe4-4e38-bb56-d4ecf2a2d1f8", "comment": "Malware payload (Mirai)", "value": "8c2c9096aa4370009ba8e1c6aa8c8f55b6c60e370c6bb8cd1e3c5d08519b786ca80d980f90d79cf7f7892771034829ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965588, "uuid": "d7c62f5b-0a4c-4465-b27b-c06bafb7f054", "value": "T10E23A40A3E258FEDF76D863487B78D21A758338216E2CA84D15CED005F6034DA45FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965588, "uuid": "7c3d496b-6177-437c-a710-e3876b5fa5a3", "value": "768:lZE/WNINoNMW+WWcX67Qq4a/S6St4jyu6EWXxhHatuPLsu0uBtu7tuauQu8Agk35:AeyiucWrtSt4eu6FHau4aTyIO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965588, "uuid": "7e3039a2-9907-4758-abb6-a598f36d612d", "value": 48680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965588, "uuid": "62f03464-833f-441c-99bf-111bc25604a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965588, "uuid": "6d94a1e8-bd61-450c-be99-925a6d074706", "value": "3e6e05745f9ff43c833251e0733ff1a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b6f138-1ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688974948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974948, "uuid": "ed556944-267e-4794-b188-9eee611d081e", "comment": "Malware payload (AgentTesla)", "value": "bac19b69fbae23262eaba45bdb8960f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974948, "uuid": "138cba02-7e0e-4ea3-ad59-c374d0304120", "comment": "Malware payload (AgentTesla)", "value": "7d3dfee679c7ced6127f994bf1fd2686b416e730ce52eeab3e7a7a63a494d242", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974948, "uuid": "a2e6f8d7-198f-40d0-bcb0-acd2a9bf0b7b", "comment": "Malware payload (AgentTesla)", "value": "f4051bad0546ac2fa05b6e7efa27a535adc6ef8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974948, "uuid": "0623a96b-cbd1-4fb7-8bec-20e59aa95be5", "comment": "Malware payload (AgentTesla)", "value": "a5b7447d8ecaedbc429e5dfb6a3571a588b6761003f01a54a9a1f2729e3481b8d443d7f1dd713cff1e3467aa36f4bd41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974948, "uuid": "17d2ca90-552e-4e5d-9ebe-754b3497295e", "value": "T12CB42350BE2462F3994F9C25FE34CC539AFCF676787D290654D14EC9AB604CB8C8A632", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974948, "uuid": "862e1301-b891-406b-9197-e0860a606a18", "value": "12288:VSMnTwRTMxONOH2PipAadtJrHSwiIWWqiHdIkMKufW:VfTc+2qpAadtJrWIFqodIkLUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688974948, "uuid": "080ef503-f801-4aa4-9c65-ddb849e0a235", "value": 536724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688974948, "uuid": "5d1ab617-e325-442d-8207-ba401f090719", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974948, "uuid": "d9b7906e-3b05-4c91-9a8a-22c8ef895ade", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f502bc22-1f15-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688988966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688988966, "uuid": "59b7e29d-4353-4d97-9100-b7c708e0149d", "comment": "Malware payload", "value": "8bc5ca389d81d716eb01813c64450dd1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688988966, "uuid": "4b423d41-fa31-46fa-8c12-655393ef2812", "comment": "Malware payload", "value": "7d75ff75aa43bfc04e53b9977c5e92b57a78105cfb9a4a738ea3cc1157ec3ca4", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688988966, "uuid": "eb519dbf-7725-4469-9f60-36a43306541d", "comment": "Malware payload", "value": "d229850972e0deb8c126d6821d33c7035c97c6f2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688988966, "uuid": "fe3291d8-0ca4-4515-b389-959d44b5b62e", "comment": "Malware payload", "value": "b2060a6489016c4794e93ffbbe64f237c58960fa2e1faf8c57fc3901219c0027a37a5c442e49d9d9bb9672b9c01cd38d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688988966, "uuid": "03aa7c74-5660-4cf2-abc3-9261139fb0a9", "value": "T1B3D633A014AB476CFB8A49DF6645574F51E7F59F028B88E20EC7C25C9D99C2B0F43AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688988966, "uuid": "2eb4568b-3a1c-4241-badb-c1be67dda885", "value": "393216:LoEsYmVmlqwpGRqeTZ5YeojoEMw05VlvmQ3Rx5a/U:8zglqwneN2ecozwGMm5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688988966, "uuid": "09dade19-0cbb-401f-9711-68d8ea20710f", "value": 13322027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688988966, "uuid": "b78b8172-02f3-4a15-a2d4-5adce6053cd8", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688988966, "uuid": "459d4e2c-e22a-4925-8194-5ac209e87c2e", "value": "youNeverKiss.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68acdb7e-1ee6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968544, "uuid": "413d1ac9-49dd-4dee-bc88-22d27debe2c1", "comment": "Malware payload (Amadey)", "value": "85e46506772d161250631fe5668b7ec0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968544, "uuid": "d3615487-f5ca-476b-a524-da2d57ba2363", "comment": "Malware payload (Amadey)", "value": "7d968b9f59678179c069c5e31916806f20b3d95e78ff7ab2779b600931c487b1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968544, "uuid": "f612b7a8-c2c3-4a5f-9bca-6df3988d7fb6", "comment": "Malware payload (Amadey)", "value": "39b20bf2aa862867e2ee1e12d869042f36ebe145", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968544, "uuid": "e85af4e2-a577-4e9f-845e-7b3f11e93866", "comment": "Malware payload (Amadey)", "value": "8abc138c047996ed99047ac0d2b40c91b8060c6d2bb3a3aae5e9ff70f48f983ea1729aa3235663a2d7d5a86e204b71c7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968544, "uuid": "c185dbd1-36fb-43cd-a1e5-f75fea970e1f", "value": "T1E0B4F1A171D29623F936147715A0822FBE0FDD325DA15A8793C97A3D87342C14E3ECAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968544, "uuid": "1c78e7e0-36a7-44a5-87e4-885f576145f3", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968544, "uuid": "0ebf1337-9031-48a6-b5e8-988edf2f0809", "value": "6144:Mk7/YCVGHBNSCWGYLUz2477X+fuhr8LDWGta9UJNe0fwyQSXKtvtFbTC:MkUhEz477Xjhr8ckNe0f3m1FbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968544, "uuid": "46d408dc-2fa6-4593-be67-12d558d250c1", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968544, "uuid": "ae6813dd-3759-4bd2-9f9e-377adcd1fdbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968544, "uuid": "1ed79fd8-7b9d-4f51-8958-cd58efa56b86", "value": "85e46506772d161250631fe5668b7ec0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af144afd-1f2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688997868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997868, "uuid": "627f0bc9-de6d-4b83-8a72-85287290c24e", "comment": "Malware payload (AgentTesla)", "value": "6cdc84b7e74246fa9ad8587f7b9a23e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997868, "uuid": "3b3596d4-ec9a-4c80-b1a4-791a5d3e7ada", "comment": "Malware payload (AgentTesla)", "value": "7d96be8384a49ede03c11eaece2a984311fb693507fbbe38d6f9882685e5386a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997868, "uuid": "738a926a-3012-4735-b30d-3e2eda5a9e84", "comment": "Malware payload (AgentTesla)", "value": "ea18ff0d6a5a7ee730bd4f6d2b22215696bffccd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997868, "uuid": "edd5cfed-1c98-4ad6-8d6d-71c5ef77bab6", "comment": "Malware payload (AgentTesla)", "value": "3b340f396912445be81be75e1e5ed8ea2034fbd46574782df38a5d0db8c3d6cc6d7e113f502d4a68745165b1801abb75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997868, "uuid": "9dce00a9-83da-460e-8623-fbea1aaeaa19", "value": "T1F7F4F126B1BFDB47D9B573FE5808184437F8891D8A70F3185C8B61FA0A7AB444984EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997868, "uuid": "0eec6454-0e7c-4778-96f2-4000cbd22073", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997868, "uuid": "cc9f8be1-e27a-4fa7-acee-e29981bf32ca", "value": "12288:8J4axp7tL+Naaq8WuWhV2wUFF247aqbE8xy+pzqTf9WEpOaCfrsViejAj08DqvPp:0p5kqKWKxFb7Ng+BqTIoOaOsViej1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997868, "uuid": "1293e489-f071-4ae4-882a-4b54a9ee9f24", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997868, "uuid": "cfc80f09-81cd-4394-81de-a48d345f3c01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997868, "uuid": "de92e3f4-3905-41d8-9e26-0c203d00483a", "value": "Purchase Order List Requirements 20230227938823 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dd44d4-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688981848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981848, "uuid": "806fa3e8-0fb9-4b2d-8df0-1b093266fc6f", "comment": "Malware payload (Formbook)", "value": "310e0ecedc626f7098624cbdedc45b0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981848, "uuid": "1bb5b7c8-7e3a-4c82-88c7-4612663a28ab", "comment": "Malware payload (Formbook)", "value": "7db4eb09d5e3b7b8cb37539295da0190b1c1416898804b297e1bc7b5f5eff9e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981848, "uuid": "9debf51a-f23f-4dee-8135-681d699fa819", "comment": "Malware payload (Formbook)", "value": "b557d4d28dade960f1709dc48276cb6fdb19a09a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981848, "uuid": "b4926db4-5d19-4272-b4ba-560dd7b210f2", "comment": "Malware payload (Formbook)", "value": "087bda9c96f006a8aa8c6f79cb51489650de807975a8cd4c88f9596f16b3a0700332e763d55f47907d28cee99e1d66aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981848, "uuid": "0a92d18b-64c2-4595-9b6f-18c1609b70b2", "value": "T12514135021CB49D7D2BA9AB9289F6F97238E877BCD11EF6037542617A070854F33443E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981848, "uuid": "7fb8069d-74f4-4b6d-981a-27bd782ae396", "value": "3072:ArZI1XGIJtv3WAUJLcVnNw4WmswPnQP4iZQCL8kpA3tb+13IkUxmEs3ChDQdIBcw:Q22Ij3WAzyciBgkpA9y14kUkyhDUIBpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981848, "uuid": "95570975-114e-45e3-86a3-08ba6031b434", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981848, "uuid": "e25f93e4-4d17-4b0f-93e3-e9f5e84490f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981848, "uuid": "897defca-d232-4c3d-a6e7-5ca3d12aa786", "value": "7db4eb09d5e3b7b8cb37539295da0190b1c1416898804b297e1bc7b5f5eff9e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe639797-1f5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689019046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019046, "uuid": "f6f2f2a6-df6b-43a0-b5f1-923dc17acdeb", "comment": "Malware payload (Mirai)", "value": "d9e36394c53bcb227a4baa6b055eb9cb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019046, "uuid": "cd7228bd-38c3-4a15-9e98-42f46f437cb6", "comment": "Malware payload (Mirai)", "value": "7ee9e1c761bf5b4b61e8be320c56565b58275b7887546b1413003bc67efa5b3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019046, "uuid": "e7b59871-bd29-43ea-a80f-ecf2c3767a12", "comment": "Malware payload (Mirai)", "value": "85c9d27a00b2e6b3b29eae9f356256c8c7222b63", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019046, "uuid": "2dbf2217-1a95-436b-9804-1b09a16e8b86", "comment": "Malware payload (Mirai)", "value": "da353a3123d7d5d5417567f36c49adf2f7070f98dc0ce05a7336261af1f14736d3dea5e74d3364b3caa2bedce213e86b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019046, "uuid": "a277e877-8f00-45fd-9cf3-a5aa72c493ac", "value": "T1AAE32A5697408B13C0D22B7AB6DF425533239B64D7EB73069928BFF43F8279A0E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019046, "uuid": "b8b715ad-f267-4ac9-b0eb-0e6641b3cde2", "value": "3072:3EAwqd/qmS35mEab6fYcPhd0ApagYWYutnCiM/9BrFmZ:3EfqtqNpfab6fYChfp91YutnfM/9BrFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689019046, "uuid": "68ad835e-72f8-4ea5-a994-21b60218dabc", "value": 156717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689019046, "uuid": "279a28f4-e064-4065-8252-10e40f5dd0bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019046, "uuid": "1f754f94-d163-4ac4-9a19-bcc5e23a8d8d", "value": "arm7.nn-20230710-1957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e089bfb-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688962567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962567, "uuid": "bbb55ef7-455d-417f-aace-1cd12c67e81a", "comment": "Malware payload", "value": "4fb7665b3b5ead30472bd0357e1e1b78", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962567, "uuid": "8bf29eae-4a9e-4c13-8c6f-7ad70fe7ed62", "comment": "Malware payload", "value": "7f390aa688291e5634ca4251edf2293190ad3be4643c4b36a336dd7eea047ef4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962567, "uuid": "a8769e59-5a37-4454-9b79-507411ebdfba", "comment": "Malware payload", "value": "54a621fffc18d5497e01dff49a5a6e63d7cda91f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962567, "uuid": "1d444fd0-eb6f-4d71-8ab9-74b1ca4eb79c", "comment": "Malware payload", "value": "cab7e84501b159f1002747d6dfaa13087101f34b3dbe65d6b5dae545abee51b57b6d6b0941b504cc35bc64d940e45cbc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962567, "uuid": "1db56cdf-1bf6-4b81-a101-f738accf8a4d", "value": "T151E33907B5C1D4FDC8DAC1B44BAFA136D932F41D1234B26B27C4AA236E4DE205F2EA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962567, "uuid": "ef725198-b1fe-4ed5-8515-c3a8c2822c31", "value": "3072:AeQsTPU6JFMb02SbwuxpaQXDH1qe/Sk6VnG8Ang2tS224c:AeQsTPRJabnULQ0tSQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962567, "uuid": "ce8c832d-4a6c-44a1-a1c0-ca7bc9e5f00a", "value": 151208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962567, "uuid": "3867c961-897f-42a6-9c2c-fe8f1894d4ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962567, "uuid": "68b4480e-30a5-4acb-9183-cfb7424a638e", "value": "skyline.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc321e4-1edf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688965598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965598, "uuid": "044a3ac3-14d5-4e99-837d-775f452c06c5", "comment": "Malware payload (Mirai)", "value": "674343efd0a2cd06ebcf928e9a190d82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965598, "uuid": "4d5e8d7c-00d3-464e-86cc-c462f3204043", "comment": "Malware payload (Mirai)", "value": "7f8490dba6d36a279f753014df3e36ce1b55d5a4ed6df5d3a50ce9ba8845e01f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965598, "uuid": "2bb2e37f-db39-407a-9b91-537309c39165", "comment": "Malware payload (Mirai)", "value": "c97274541ebb2228d4b3faf37ae90fb41adec5ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965598, "uuid": "b61299d3-f4cd-443f-8ffb-d4352f94b9dc", "comment": "Malware payload (Mirai)", "value": "eed169b303c2287319fafbca2d923b64f1be05ac73414dc941d5e993268589ad0b89f6eab6497194100e9659b941712e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965598, "uuid": "ddb37c9c-16dd-4b41-99e9-8719674b07f3", "value": "T1AED28D738D2E2C98E62E4938B5305F3E5B23E905EBAB6DE555224239D003DDCF9493B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965598, "uuid": "4c7e241f-f65c-4629-8061-53d5d29934ae", "value": "384:x/tUcbnUanlDNwCdRc+RceRI6tNrtBxe0qY/x9yr/8yZb1QHj1rF7MAzsLDQ2Woj:x1UcbUadHdRfRfRhvlmPKo8atW/MWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965598, "uuid": "5e326085-84d6-4b19-b7c4-a3210107f4ce", "value": 30776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965598, "uuid": "e8894138-cc0a-4b79-b647-48e8c27248a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965598, "uuid": "49277c06-62fa-42e6-a708-450f58927b6b", "value": "674343efd0a2cd06ebcf928e9a190d82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2acf87-1f16-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688989358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989358, "uuid": "c67e2221-1c98-41ed-a294-8c1b5c3fde2b", "comment": "Malware payload (Loki)", "value": "b65e0c5a51b249a0877ab7fff235d725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989358, "uuid": "3ef9bfaa-4b5a-4eae-84a2-825ed3666ddf", "comment": "Malware payload (Loki)", "value": "7fb59d6aa9d981d4786c608f49c8ec89f8e42e829ec7b15b7d5d4d40edc5fbe3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989358, "uuid": "81ffcff4-0e20-4c92-afd1-3a73545de37c", "comment": "Malware payload (Loki)", "value": "2af3417e00f8a7df1269cd8efad8f7f1f1f1885e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989358, "uuid": "dd5f0a52-9f7e-48f3-b101-6390e80788b8", "comment": "Malware payload (Loki)", "value": "4f49a571d735134f1bb0fb73ebeb6015a920b295287a5e9097acd6756df9cf9eae55d66f0c6bb70a1b25b9780444b60c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989358, "uuid": "770d0f31-4f48-49bf-a691-97ac1e5db50b", "value": "T16FB4012251A1EB6AD82C1FFC6141884D22F5591CAC38DF288C67CCC6DAB777418ECBD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989358, "uuid": "5bd3465c-f4f0-407a-b6dd-fa5c60e2e5b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989358, "uuid": "90035e57-0e6b-4605-8224-5bfa4cef34a7", "value": "12288:6ibhbk0jIJ0Sf5+ijacOr29YjWpfUJG5Lbd7jocuTF+NmnZR+o:6ShbNoCvWpfB5/d7jowkZR+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688989358, "uuid": "235463a5-67cf-492c-b430-80fa3e2e255f", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688989358, "uuid": "1d8aa1bf-68f5-4647-af50-57ce00bb47b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989358, "uuid": "7648c813-6368-47b9-8e0f-f62c5e560e6e", "value": "Document4523643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f109a2-1f3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689004622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004622, "uuid": "4ddf8109-ed05-4a2a-9b7b-6852bbaca5cc", "comment": "Malware payload (RedLineStealer)", "value": "e06b5216948c651a223380885f11644b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004622, "uuid": "ccec87de-a1c1-4478-ad31-413534738c55", "comment": "Malware payload (RedLineStealer)", "value": "8044914fef05ba9c7505662b3bc53edfb8a376cd0383d5f81d35a3797a9339da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004622, "uuid": "d3c518e8-5492-4d70-a2c5-7d59f4eca9a3", "comment": "Malware payload (RedLineStealer)", "value": "3fc897e29afc23767e23690770bbc85168a67a1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004622, "uuid": "c92b848d-12e2-4d7d-9402-52634d4984bf", "comment": "Malware payload (RedLineStealer)", "value": "038027f277dd5025874c41aabc2a980b77550c1d9e81709aeeb493cfca4720b8ab290e5c863ee974d84b9423a6b13f17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004622, "uuid": "db32a450-ce5e-4cb9-954e-ebd3ff38dd3b", "value": "T19264BF8262A0FC73D5664A319D3AC6F4766EF851CE18775B32387E3F28702A1F262751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004622, "uuid": "c3089044-dee8-4bcb-9643-0f2ecd63cb0a", "value": "5a013624489e6703ae44eba8e360cecd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004622, "uuid": "c31f4baf-1d3a-4e52-9f4d-d7ed8499086d", "value": "6144:lnnLQJbkvfhLq4m3qO0fKMh5DIUULPG6JfoYqKr:pnsRkRLql3afKMHDUfgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689004622, "uuid": "b64d9fdb-133e-4553-b746-e22c915192d4", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689004622, "uuid": "ec616377-220d-46f4-a56f-6020a7f66dcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004622, "uuid": "66da318e-2f66-42b1-a0dc-40da9f412536", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61baf2ed-1ee6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968532, "uuid": "cef3da2e-8b36-42f8-aedd-83a1209eddb7", "comment": "Malware payload (RedLineStealer)", "value": "608a84c850d78355b1a4896ad0ecbbd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968532, "uuid": "d83dbc5a-509e-4fcc-a26e-67a7a06a920a", "comment": "Malware payload (RedLineStealer)", "value": "804979c50ec71c47a94ef4a8fe19175f0a26921211bb45d03ebcaef3dd99f93c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968532, "uuid": "19f6d78f-6edf-4242-8a4e-5518a7bcb6aa", "comment": "Malware payload (RedLineStealer)", "value": "b518d4bb458ef652fa2b398c8b0d86d122d29000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968532, "uuid": "8fa8ff53-f619-4d8a-8638-67ef61114334", "comment": "Malware payload (RedLineStealer)", "value": "0ca4d004dea8e238df31729ca9c21981194e98957fcd822dbbe0a41174818d44428fc8e06ec40f4d7c5274ebef397868", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968532, "uuid": "6a1bac2d-59d4-48b7-8e5a-0632bff6693c", "value": "T17BB402A1B5D68633F532483714A0922FFE1FDE7108A18A97A3C9753E57291C21D3FCA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968532, "uuid": "636b2d69-490d-4087-9322-eb5bb31bc93e", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968532, "uuid": "1b918914-9721-45b1-af3f-f0555e0a2ff0", "value": "6144:kk7/YCVzHBRaCWGYLUz2476qpfOPQRoD1tCt1wBXz96UL/pMwYXXVjqhuWFxyd9N:kkU8oz47jfOPX4t1wBXoULJ4Vjm/L2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968532, "uuid": "fbd93b3e-357c-435a-8171-bb4bbfd06d47", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968532, "uuid": "3230ca01-e769-4341-b514-de34ae0e3264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968532, "uuid": "897034e9-4aaf-4d48-bc25-dc484dcd8d3c", "value": "608a84c850d78355b1a4896ad0ecbbd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73f818e-1f18-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688990177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990177, "uuid": "d747ee5e-591d-4fb8-9440-29155d5ec71b", "comment": "Malware payload (Formbook)", "value": "ae692fcbbd8eaba430718ea25e54f96a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990177, "uuid": "c449819b-90f5-40d9-971d-77f61e79e289", "comment": "Malware payload (Formbook)", "value": "80802d7e4597b03c737d2baa9bb2cb2a400f2c0546218cfa505d408ec5d99b15", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990177, "uuid": "363b5b06-0080-4129-92cf-46ddff958697", "comment": "Malware payload (Formbook)", "value": "7eb5cfaa30c6f08b6f5d24f57dd7d7b817f32cd0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990177, "uuid": "913d159a-6d8b-4613-91ed-985fa78a8e8f", "comment": "Malware payload (Formbook)", "value": "b5248d3c353fed12bbd7af7ebbb31c07f02dea8ba7160222696e8d29d3797982e9b1c0def0054259cbfff5d5e179bde0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990177, "uuid": "51fc3084-d4c6-46e1-be3d-15812b84a6f3", "value": "T1E971883C9990BDD0D3D7F2E844497E6208899F0BA5116E1AB88C14B3A72466E1D3598B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990177, "uuid": "a77a1a2e-d6cd-4766-abb2-866289655acf", "value": "48:3aVnuuu/7a+fuuu6uDDOEXotnGuuitn5uG:q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990177, "uuid": "59ff62cc-e55f-4791-b8a6-37e9783ee42e", "value": 3816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990177, "uuid": "4ead5bb6-c3f9-44ce-be2a-0e3609b14e12", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990177, "uuid": "f8001be8-36dc-4bd4-a30b-3a6067cacb7c", "value": "kpb.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fade64e7-1f5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689019040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019040, "uuid": "3fc469e1-2d98-4e76-baeb-1a689999d515", "comment": "Malware payload (Mirai)", "value": "df84f534ebddc435ca603922a50036c3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019040, "uuid": "f47d9cd0-2cfb-4efa-8fcf-dc3dade9e3d4", "comment": "Malware payload (Mirai)", "value": "8095cc6791dcd50642629c1d36e6af4181a92644e9d68f83d0103411a5429762", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019040, "uuid": "57d1dbcc-511c-49df-b933-98371782148b", "comment": "Malware payload (Mirai)", "value": "13b098b8d900608e1560112ddca053eab2c28838", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019040, "uuid": "0a26c918-3bca-4b07-aabf-015331006a8f", "comment": "Malware payload (Mirai)", "value": "a46b0370d2e59f24926128ac560c9b699a7eb3bdbaa8b3303217ccf63008b6db677a478b5282e02a02cefc3f0075b108", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019040, "uuid": "41d208c7-4749-44fa-ad07-b4bc3a60a6bb", "value": "T19CE32A4697408B13C0D6277AB6DF825533239B64D7EB73069928BFF43F8279A0E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019040, "uuid": "e971208e-9aba-43ee-9475-e8d18eea9845", "value": "3072:3EAwqd/qmS35mEab6fYcPhd0ApagYWYutOE7V7BrFmZ:3EfqtqNpfab6fYChfp91YutOE7V7BrFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689019040, "uuid": "f43e445c-73a6-4b13-9e47-34a20429a953", "value": 156717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689019040, "uuid": "2216b05f-763f-4c09-be45-225c3d827f37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019040, "uuid": "740d38a6-1584-46cc-8dbe-ccc952b246c6", "value": "arm5.nn-20230710-1957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1b935f-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688981866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981866, "uuid": "2d2ed1b0-ec04-4284-9f66-0a47cd595a49", "comment": "Malware payload (Formbook)", "value": "e4c34404382a29f6f985388be26c91db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981866, "uuid": "c556ffd5-cdb7-404b-93f4-a2510f35dd95", "comment": "Malware payload (Formbook)", "value": "80c223f70302436ab080c4c7e8d75f3b3d60c4266a41d0afc56fc6c52cb04352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981866, "uuid": "56a1d609-8758-4b20-ba6e-0e9c06ba68c4", "comment": "Malware payload (Formbook)", "value": "46cdfabc5e760540bd560f5f5df1c65119f90775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981866, "uuid": "a256a307-2ae4-458e-a5e9-52ff87699961", "comment": "Malware payload (Formbook)", "value": "02db430c76818b70aa984bedd428f505346cd1562717f891a335d75445bfb1de6f2ec3369714261679444da820fd014e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981866, "uuid": "459840bb-f3d6-46c4-907e-f70359fe2e5f", "value": "T1E4D46B3C1CBC7222C174F2B68FADC420F250956B3E618E3B61D7999D461E90269C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981866, "uuid": "9ef205f0-1a77-4a2b-9cc6-e3728b54e0e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981866, "uuid": "1568c3cc-397a-4cea-85b9-11cdcc4e14f8", "value": "12288:BJrFwnNA+GMJFkcNcnR2NwqDpcWUt8acZZ64DcijpT:SNxJF7Nw2CwcWUtFcZ7ckT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981866, "uuid": "357fcaff-1c0e-49b3-bc2d-03430fe68203", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981866, "uuid": "ed515e9d-a383-4613-9c4f-274f5558aad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981866, "uuid": "92c73bb7-ec32-4a10-910b-09edecbc9b15", "value": "JUNE#SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c5a4f8-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1688967942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967942, "uuid": "ce2c4e5f-13d1-42f6-8477-4b83d15320b6", "comment": "Malware payload (Gafgyt)", "value": "194e3677f1287e09caf9f2b3227d3388", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967942, "uuid": "a0f29a58-ed4b-4e8c-9ba8-a771945c75f5", "comment": "Malware payload (Gafgyt)", "value": "80c5187ce8a9623dba06ade9eb6ff1010166b24dd6c3db237f710f035ccefd93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967942, "uuid": "821ef2ac-2e3b-44fa-b3e6-cefbae9c9dc9", "comment": "Malware payload (Gafgyt)", "value": "71a4b5e9ded370abef2ade73c16f400cd60316b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967942, "uuid": "9cfe7686-69c3-458b-b736-3341bdf4cc2e", "comment": "Malware payload (Gafgyt)", "value": "a45355785424cc06a2124fe717dc7e374ddb1fd2fdf5fe6f8f95f34cf7e6779a63ede9a2b9065d88077d41fa682e777e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967942, "uuid": "2a4bf5ad-e3b5-47a4-9d44-868f2b2b55c9", "value": "T179C33A09E7408B57C1D2277AF6DF434A33239B58A7EB33155928ABF43FC27994E22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967942, "uuid": "e11d77bd-c91d-43b1-9d53-70b7d12dd30c", "value": "3072:ylTCodNabtap3wfARkzfP63yNdHMTy6I4ywM/9PUdz:ylTCodNWtap3wfARkzfPR8y6IQM/9PUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688967942, "uuid": "38ceb988-d0ef-4359-9c61-4d0454dc002d", "value": 128703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688967942, "uuid": "a5c244f3-dbc4-4c12-8c97-d8ae694ed0f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967942, "uuid": "3b96bdf6-1803-45d7-9c0e-e514cd5754ca", "value": "194e3677f1287e09caf9f2b3227d3388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7436cbb5-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962550, "uuid": "fcba4d72-f2bc-49fb-9ab1-4738ece6aaf6", "comment": "Malware payload (Mirai)", "value": "e1cd651fe06e47224b71724997a83ed1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962550, "uuid": "038529be-7434-4f06-b269-7187aa3e7c79", "comment": "Malware payload (Mirai)", "value": "8127ddbac0a317ee68a59d899b3401438aec8a265a72aee067a229057d6eebe0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962550, "uuid": "a5ed9ff2-11d0-41a0-b36c-78cfee71d9d5", "comment": "Malware payload (Mirai)", "value": "4c41a50ea66557b5b01fd158808253cc12c39944", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962550, "uuid": "459b19ea-31d3-44a9-9fcf-006177531cbd", "comment": "Malware payload (Mirai)", "value": "b2264da5c1c6c6fdeffd613432a51f4fa036f8955c3e2ab469d4a2ab074f0a351475dac8d967200376469daeb71bf2bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962550, "uuid": "87fb2622-2296-45cd-9f52-ed0e0a9d7562", "value": "T101539FB7C4A89D98DE255578F21088399723E008A5A73DF6EA46C656D05BEECF00C7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962550, "uuid": "a3df2775-bbbc-4c3b-b808-9e718aa1b2fc", "value": "1536:I/xN6GOJeaUV7Y3bQIf2sOqBqX4sUEfs3C+/sMDr3d3C0Kai:IJNsYjY3bQIgqBqXlf+/Lrt3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962550, "uuid": "21a19265-c90c-4a08-aaee-4b01c249350f", "value": 64344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962550, "uuid": "4f71c1c3-3f2c-4a2b-8328-2295875cea4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962550, "uuid": "41b11639-73c9-446d-9999-622ea4d52257", "value": "e1cd651fe06e47224b71724997a83ed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a685b1be-1edd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688964782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964782, "uuid": "449a17a3-b8c0-4cd3-9a1b-b9ba04be8375", "comment": "Malware payload", "value": "3d5546abea3478d7a08d4b6f6b5cf844", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964782, "uuid": "a5223091-3d51-40bc-9721-46804713eaa8", "comment": "Malware payload", "value": "8131c9b9baf8ffd125196f017bd8e1b5b24432a96b5295e8ce3b6f32e9e9bb17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964782, "uuid": "d8aa9798-ac55-4792-a3b1-c204cfe264cd", "comment": "Malware payload", "value": "49532109a0f31a2af4066c81170da8062c719330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964782, "uuid": "897bd474-fc15-4b24-b11d-8927292fc340", "comment": "Malware payload", "value": "0886b0bf2c80dc3e732ca3a18055431b1216d0f444404e6fccd47be9c1bfc74c02bf661d6ceebebf851d088756214f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964782, "uuid": "1320849f-cb4b-4f5a-b99a-e354d5ad8a6b", "value": "T1A7873383EAB508FAE7FD123FA57185147671750A03E92197355FE122AF76F622E3A300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964782, "uuid": "bd89b406-29b0-4c98-97f4-21a3970869db", "value": "809ea02d92fea89353f33279290e8c9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964782, "uuid": "161e7709-481a-4a4d-868d-0ec5ac890d9a", "value": "786432:gQxDNy6HndgAP4fzBz3t+wW7T0NuU8o8pjvEs/VmYxYwFQwif:b3y6Hdg2k53AA8DvEs/DxYkQwif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688964782, "uuid": "c6480c66-8993-45ed-951f-f65eb7088036", "value": 37162066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688964782, "uuid": "57c5f47b-178a-471a-8a0c-bb6d7351485e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964782, "uuid": "8296a049-913e-41e6-8eb0-b01e446ba9b0", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55faf318-1f42-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689008026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008026, "uuid": "e17212dd-f1ee-4f1a-b25f-cd7b47ccd8b6", "comment": "Malware payload (RedLineStealer)", "value": "75952475de125279b6105df32c1154ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008026, "uuid": "d85be720-dcfa-456f-97d0-6412e09a0fc4", "comment": "Malware payload (RedLineStealer)", "value": "81324017244a8525f925c40c88ff74ee702bff0d49beb9abbbf4b9e154ce4a98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008026, "uuid": "bb18382f-4631-4355-b7e2-8f82e0868243", "comment": "Malware payload (RedLineStealer)", "value": "e9f848fa0dfd814ec57bb3be3b06000ce3fadaca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008026, "uuid": "2654aa18-9763-4002-99be-ef6f0c1877f0", "comment": "Malware payload (RedLineStealer)", "value": "4c0b9f4d6f8637a2dbb5ffb33dcd1979af3f4443d9e178888e5a10baa3a1309820d10961b11cb9fcc7932125cecd776d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008026, "uuid": "498af827-f8c3-46f5-a55c-7215e7775919", "value": "T16D151206EEE54037C9B41BB044FE03671A35BC528D3897FB6B52BD6A1CB3680A57076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008026, "uuid": "cb907387-f24a-4e68-81f4-ff72d291b000", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008026, "uuid": "18510f6e-598d-4e86-8e64-f7a935d4311c", "value": "24576:4y/Pv3mwOnpF0wfHRLKjpMVwJrKlr99s://32wC/lRLKj50F99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689008026, "uuid": "dddd1443-19d6-407f-91dc-95f8696d737b", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689008026, "uuid": "b6df80f8-b82a-448b-aa44-d0ca224a6f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008026, "uuid": "7af12ee2-f769-4927-a3ac-35e2e76618b6", "value": "75952475de125279b6105df32c1154ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f186bc-1ee9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688969860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969860, "uuid": "d7b6a680-1cbe-44d9-9c70-9f8908788c43", "comment": "Malware payload", "value": "6d15b544f5e24cf7648d72cc89c5afe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969860, "uuid": "7c02d2f9-ea13-4875-a4cc-58aa443f4abd", "comment": "Malware payload", "value": "814c590b61a32c5282f305ec36727889bc0f18a3ecb3ac0fd6800bc7c5eddab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969860, "uuid": "557a1bcb-8b49-4d44-9189-ae2cdb8b415e", "comment": "Malware payload", "value": "19999d5f4f34543460e55819afe8d6a8e55abc10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969860, "uuid": "4c52207e-4fed-49e3-94a6-4c3f0d84be79", "comment": "Malware payload", "value": "258cf050f0472a9a939450fc31a5a288d9f6977ccda1f0b8b01d08c6a8b498b69826b66494d2d12ce68634782c73c74b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969860, "uuid": "8a083ac5-808e-4685-a806-5aad687f707b", "value": "T170163340B9C4E832D8326F716F78F7E1B209FB520E4D92CEA3585E1B5EB46F44071A96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969860, "uuid": "a2029d53-14a0-433a-bdc6-fd3017a1aa6e", "value": "3073c17da772a94c7a6a62e4ebe285ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969860, "uuid": "33f27c92-7037-4a4f-afa1-9af92168f85a", "value": "98304:WDBxWm47QytCo/o6nWWQylHdhdQg8nZjVo:Wza7QythVrQylHlQJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969860, "uuid": "54a6ec42-6215-46aa-8349-a2756e9163a2", "value": 4136544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969860, "uuid": "ba16e82d-8805-472e-ab5b-8e2d5d0cc67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969860, "uuid": "44334aae-45d8-4ca0-a57a-94b8e0f91d19", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625121b7-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CryptOne)", "timestamp": 1688990867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990867, "uuid": "ec261ac7-cbf1-4b0c-a24a-b8f7a16172cc", "comment": "Malware payload (CryptOne)", "value": "fa72a95a0d9f7e98657f71a5b6c529ed", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990867, "uuid": "f1138b57-bc1c-4ad6-9316-fd4ea5466ffe", "comment": "Malware payload (CryptOne)", "value": "81c2ce98187e55391b67b181ba9f4e26ff2593bef4a02aefa46fe602b3c48381", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990867, "uuid": "09d18578-889e-4256-8b0b-e53a897f3b94", "comment": "Malware payload (CryptOne)", "value": "5f67b46fc4a0a1cfd4225efe01752e0aa51bee88", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990867, "uuid": "76e8093e-3f22-435f-8e5b-d87dd42fd61c", "comment": "Malware payload (CryptOne)", "value": "439496a986eaf22fdce817b52dbc92d7b2630f62a2166a6079cc28d3483b287dea454f42ea72a92040114f28cf3f61ed", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990867, "uuid": "b3ede5dd-8cca-4be7-80b5-9fda7afbcb62", "value": "T128652260BAC588B0D8A619351AE08771AB3DBC311F768EEB17441B5E9F311D1D83A7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990867, "uuid": "9bde7b7b-4e44-40fe-b4c9-4f776cd62c63", "value": "91e96141ed5dbe3bc541c8aad7ff3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990867, "uuid": "5a27f412-04a3-4240-bef7-65bb5473491d", "value": "24576:pLllLl7CEt0CNkkf5a7jSxhteO+s86k93qvGUx79Y0sMzvYi995pG8lnB8ooiYXS:BllLt0CNkk4mxhteO+H6MsGUx7arqvh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990867, "uuid": "9a21c213-5ee5-4893-96d5-39ff7476b2d5", "value": 1546666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990867, "uuid": "9d434010-17ee-4369-9cc4-813821853385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990867, "uuid": "f033a5eb-8b12-4d26-a503-d9e0cd67a8f1", "value": "fa72a95a0d9f7e98657f71a5b6c529ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1247fd8-1f5c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689019453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019453, "uuid": "19307b1e-2869-4cae-96fd-f2f20d5c4894", "comment": "Malware payload (RedLineStealer)", "value": "05f37c38c24664414c0ccdd1a4b94275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019453, "uuid": "0d67c1a2-ad8f-4344-84a3-459cad0780fe", "comment": "Malware payload (RedLineStealer)", "value": "833e74031564af72eacc16657b42d7c87fbb4f300bb093950b5244909ac1815d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019453, "uuid": "d936199e-d8d1-4e8e-a7c1-edd7fde3cd31", "comment": "Malware payload (RedLineStealer)", "value": "3b589b1faeb0cd9aba3192887a4999abbfd2a2ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019453, "uuid": "e99638cc-5fe0-4a28-96f3-7e38d065fa0c", "comment": "Malware payload (RedLineStealer)", "value": "217c5d91493b5dd1d46d458ac85239233b2d14c6d37605728863a8d49e7221c45ac97c6ce9c1296acf509fcf59780727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019453, "uuid": "f144b9ff-3724-49f8-8273-e39ef34ecfc3", "value": "T1C415221267E8A133E8F1177458F312930B31BDA29D64131F2759BEC91DA36C09A32B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019453, "uuid": "68cd476d-d105-4566-bf0f-6d250537f7a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019453, "uuid": "e6301bbb-c2dd-4279-afbb-059528a59188", "value": "12288:pMr7y909lA0jCX/VkhUwSnnMfry9HWiYRySI9+QdXK7Atm+L2GQt5npujDBSh9KK:CyO+Pyp4Mfry9ye6Im+a/4+Z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689019453, "uuid": "1aad9fbd-0bf0-4232-b723-ad446da2d801", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689019453, "uuid": "959efd09-4760-4b5a-a8fd-c66638498759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019453, "uuid": "aa52d2b1-c54a-45da-9ae4-229a47323110", "value": "05f37c38c24664414c0ccdd1a4b94275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aceacf6e-1ede-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1688965222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965222, "uuid": "ae10ce51-8841-439a-afa4-35b0a7c2eef0", "comment": "Malware payload (njrat)", "value": "ec70d6e7c43106a1727c5ed6e069a1b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965222, "uuid": "469f06e1-c50c-40ef-8af2-9b762f0f29a6", "comment": "Malware payload (njrat)", "value": "843d96a70a25e67aacca18ab8fa805518dc7201637dfb5d4c94350dcf4491f86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965222, "uuid": "cf6e67bf-e5f9-45ad-9bb1-a78ed3125c42", "comment": "Malware payload (njrat)", "value": "f169736b051d2b4de73eec1ad2aa363a3b546a81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965222, "uuid": "b06da67d-4e85-47b2-a72c-1c4bec153f10", "comment": "Malware payload (njrat)", "value": "d284fe7788c9b2feb485a1e9fb846f7dd7cc95ab6849de5f1e449901706f00a54887cfd30b1e760b7b7f83ed2c70a166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965222, "uuid": "2fae4e8c-5836-4d51-a10c-013e4a3c7243", "value": "T1C084C0B9B350958EC6F90DF86C4902201FB33CCB6453C7A1788D3D9B24B2AE41D5A67B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965222, "uuid": "a9d096fb-de29-460d-8d72-85fce7e63688", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965222, "uuid": "e455373e-9290-47cb-8679-3fa7938d1c0d", "value": "6144:UHY2GhNwhy5yxXRZFDP1Pn2GhNCvGDI+c/6ezz:UHY2iNwlxXRZFd2iNxI+cSen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965222, "uuid": "03fb4155-0e2e-476e-9189-e4024bcc166b", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965222, "uuid": "652b5755-f770-413a-9097-09fd6ebdbd8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965222, "uuid": "5877d16a-64e6-49d4-b935-772d8c4727c6", "value": "843D96A70A25E67AACCA18AB8FA805518DC7201637DFB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a7ed9f-1f40-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689007187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007187, "uuid": "a9ce5e97-99c1-4b92-a947-e1c051a5d63a", "comment": "Malware payload (RedLineStealer)", "value": "81ea008f898bb51262018817b54fa84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007187, "uuid": "fbc2ce91-2a54-4a7a-826c-440de39bc6e0", "comment": "Malware payload (RedLineStealer)", "value": "844b5b76938e178a82f8c18d5600f389ee4da147c66b379dbc5cb8587d11e5ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007187, "uuid": "e0a977f7-e89b-435d-b4f4-a379b0c5f2da", "comment": "Malware payload (RedLineStealer)", "value": "df835f5a494bbd56fabb7130b8a9a82d7841f442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007187, "uuid": "2140dc3a-aa92-4755-ab11-2be1fd7e5baf", "comment": "Malware payload (RedLineStealer)", "value": "26cd3dba5896c5d1fc0076efc2c993f69a5350d522b705a61e947b7855bf90972d8be3b28ca95c963251df9a9e44c084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007187, "uuid": "1f7357cb-1db8-4758-aa9c-155be9b75bb2", "value": "T11C753346D5F8813AFCBA67F08DF502570B35BC915D2581AB2AD6B82F0CA36D80B36375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007187, "uuid": "e2f1ad70-92e7-447e-90ca-baf9fafbbbf7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007187, "uuid": "bb5eb704-cbee-45bf-9b85-5669c6ac1c91", "value": "24576:Tyr5T2KzBFhNW2AYXX5BMzudjFcDnuJnRP9pJ7lyel+C4hIa8XCGKysC8F:mxVvhYY/BFcnuJh9jZyxCKOSFyr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689007187, "uuid": "cacd76c1-c8f2-4959-a31f-5ade282b428a", "value": 1585664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689007187, "uuid": "c4c679dc-b1cd-4a64-a9b9-a94103676ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007187, "uuid": "72609e76-f165-4dcf-892a-09b8a2bb03e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741a3b77-1f5f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689020532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020532, "uuid": "11895d17-5e42-42af-b44d-858a01d5fbd3", "comment": "Malware payload", "value": "6f5fc46fdade4bb9dd96aa17e496fccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020532, "uuid": "371ec477-2da8-4c92-85ea-55e5202ff63d", "comment": "Malware payload", "value": "84d136aa66db9cc35aeb9ed4c01b0de7821c7636843fecf1dedbeda6be208206", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020532, "uuid": "464901ae-370f-470d-9956-c552f0d1180d", "comment": "Malware payload", "value": "c1bef65e3cf5222d0667a7f4b657f6cb5912d540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020532, "uuid": "ef38c8fd-205f-4248-bd3f-47163d00bbee", "comment": "Malware payload", "value": "8b1bf88b13cfb5ab1a370d8b30787fd4259e7e8c14827e0e6a2b80a2760a7ed4d5f6c09bba766027fecedc33f753186e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020532, "uuid": "bfd07c60-538b-4089-86e3-fce07107ba98", "value": "T1AE358E2C79CF8171EDE221B901ECB965F26EE1B0473156DB13C71EEAC6142D1BB32986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020532, "uuid": "d26a69c8-9c66-4326-8cd0-f7ad2a5a7b59", "value": "2e7f2667392d8d1bd01896145ab96743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020532, "uuid": "52df3190-d7ea-421c-b830-61931b945bbe", "value": "24576:C0nid6uv1xs2YU/YohC9ns6Y/XjaT/PLC6NDj:Sv1xs25EPY/XjaT/PzDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689020532, "uuid": "c9dd2a0e-0eee-4bd5-ab6d-a5331b48cf3e", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689020532, "uuid": "a4ec7283-9ffc-4a86-be19-0e7d250d77fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020532, "uuid": "cc60736f-d7be-4896-9121-c67ca8f68217", "value": "EZL04d3r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94d6505-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968250, "uuid": "a2726265-0bd9-4ac9-bcc5-7d0a3d9eef36", "comment": "Malware payload (Amadey)", "value": "46289fbd720d181b131e840766a46c16", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968250, "uuid": "13e5bfce-d73e-4a05-848b-d4098b8bea1f", "comment": "Malware payload (Amadey)", "value": "851383b5b30ec60fea9270264a30cd79f9d0b922e9e4556e4c71efd30756f1e4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968250, "uuid": "f7c61a49-5f87-45fd-9684-dab83812cf30", "comment": "Malware payload (Amadey)", "value": "87d449dbec7aa8bdd22522da33dabb38d519fe11", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968250, "uuid": "b4c3c8d6-8fed-4db5-b5f7-bb781b0e7962", "comment": "Malware payload (Amadey)", "value": "cc9fae47b004ccc3480049c068b18d895357333342f2629d6e378822b0382ca1ce9c61e5cea4ccdd7edef7d508b929e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968250, "uuid": "7648b26d-2eb2-4d9c-82dc-92d55197a8e4", "value": "T1ACC4026072D69623EA73053705A0D21FFF2FEA3159905A83A3C5793D4B381C65E7ECA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968250, "uuid": "a1f4abcd-157c-45c6-9d64-c05c33db8c92", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968250, "uuid": "2d58a939-4cc6-4b58-9c92-bf4919e3f4ae", "value": "12288:UU8J1z47GDbYuM/1Tbp51vIxPT7cT+CiFJV:4N473h/HbvIxPT7bzF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968250, "uuid": "1de7ed34-7cca-4655-ba94-7e82c82596b0", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968250, "uuid": "1a00defc-52bc-4374-8abf-49d4ae791368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968250, "uuid": "2df8e11f-4bd6-450a-868f-780256bcc03f", "value": "46289fbd720d181b131e840766a46c16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b4e58b-1ee9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688970017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970017, "uuid": "e27b6685-4281-4d4f-b73b-97627e0bb0a1", "comment": "Malware payload", "value": "bef9902fc14b980e6333e8a8b68b7305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970017, "uuid": "5e40563d-f189-4c43-8ce4-093954c33513", "comment": "Malware payload", "value": "851e879289cd1ad3b63165b1c27feaa89c428244ac05d9a676bb1164a7a4e32d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970017, "uuid": "09bee179-d49b-4270-b478-f1d3d971325b", "comment": "Malware payload", "value": "ed744a853a3a34e2480efded934c2427fd00d9e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970017, "uuid": "85c3e92e-e4a8-49c8-91bf-39627066b69c", "comment": "Malware payload", "value": "16c1812a97daa97e6a8f3d1b404cc5a8b5e6dd78f766c29be588260eca000d9eb5743cb90c251e7c884091984ac119b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970017, "uuid": "f01db39b-88af-4a98-bfab-8e3b615c9c89", "value": "T16AE4F2D6D4583475C6B049B740E05F1892397E3ABBA9A73BB74C3B878C27D0BA894347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970017, "uuid": "dd51e923-07f1-4e1f-8b74-52bf4ff58bb3", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970017, "uuid": "55afebf5-1938-476a-86a8-d9da9abd86ec", "value": "12288:7R0UiiH1fR7gr5W0kMfMZ0eNRpwNAXM8X89KfLeXgdoaHOWCH:S1q1J7UM0kMkueDuNZ87qXgjOW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970017, "uuid": "d5a091d1-1d61-48e3-9919-b54805cbd182", "value": 712819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970017, "uuid": "60d2e13e-ed0a-47a0-afd2-f31072e4179b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970017, "uuid": "6484619f-0eff-471f-b75a-0188373b7a98", "value": "REVISED COMMERCIAL OFFER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fefeaa-1f30-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689000191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000191, "uuid": "aa5a197c-c8d4-4280-83d0-3f7b1b30d8e0", "comment": "Malware payload (RedLineStealer)", "value": "41223dfc76e28480031586abab191b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000191, "uuid": "6254e626-0f35-4aa7-8984-dfdad01a5683", "comment": "Malware payload (RedLineStealer)", "value": "85594a9dffbaaedca9ea95760b5683bb9ed199e29a54525ac755697a6e18aaab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000191, "uuid": "07ff6aab-b6bb-4ade-92e3-a34e24b8374c", "comment": "Malware payload (RedLineStealer)", "value": "1cb6d3be6a20e7820d2b8b8fad788bb25f3ee41c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000191, "uuid": "5ec52fc7-5326-4b01-ac34-3448ca3d1905", "comment": "Malware payload (RedLineStealer)", "value": "530896957622c379dee35101b5a3a5845c07e2c023032887769f252d5457674b0cb94a5d4201bcf9924fd75b63b16beb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000191, "uuid": "55f87950-ec89-4abb-8c8c-ac87bf6ee6de", "value": "T14D152343E6D98073EDF50BB04CFB03930B36BC619E70A3672B56594A49B1B89687137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000191, "uuid": "af7a7372-a28b-48ee-9242-2f556a3dc298", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000191, "uuid": "9cab0cd6-b53e-4b47-b494-eaa233e07b7b", "value": "24576:Gy0c5/BYPdGsFBaaSiMfLragExjwfQjEv:V0cCtPaaayNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689000191, "uuid": "2444d988-5ea7-4849-96a4-db2a9f4af57e", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689000191, "uuid": "a872c5c7-2970-4ac9-89fa-a9e70946249c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000191, "uuid": "0ed78255-144d-40c8-8263-f2b80698510f", "value": "41223dfc76e28480031586abab191b52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0676fa99-1f3c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689005316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005316, "uuid": "8e1ea72a-7215-49ce-9da0-d2dd079ddc16", "comment": "Malware payload (RedLineStealer)", "value": "e9735e9d2e7575420eccd103ed89b871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005316, "uuid": "d6360a92-b2d0-47c9-b522-dc6857dfa35a", "comment": "Malware payload (RedLineStealer)", "value": "85c2598e001bf2c44ff55fbc16b1a9422a69dceac7a689ab7c2d162dc4b6d3fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005316, "uuid": "9c984ca5-3b90-4f89-ada3-2681d47a7968", "comment": "Malware payload (RedLineStealer)", "value": "5d545339b2e7b00c6e4141d2df146b56db5d0dd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005316, "uuid": "807054cb-1d76-406c-8546-cee50b73fc9e", "comment": "Malware payload (RedLineStealer)", "value": "70a39e0536c997fa08b8984aa88aa5be2d5954cd20018a4211af847e966940208a1917c35bf38397dc872b1b4664d333", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005316, "uuid": "0de5fe96-1d7e-4399-a373-0f6d24f01f66", "value": "T1C9752353A6F99472D6A51F3058FE01D7063A7EBA58204B672389760F2D33D816D3A373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005316, "uuid": "e15f9161-fad4-402a-88f1-45d1542c1b78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005316, "uuid": "90c9f7ff-a4db-46a4-bbb5-deac8b33562d", "value": "49152:BBwD3FfBuaYnIRqO0S+k1pu+CsPBG0NO2/Yb2:30BFYnIskV18+C0pNO2/Yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689005316, "uuid": "a2688828-eba6-4605-84ac-259611dfdc49", "value": 1585152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689005316, "uuid": "ea0d6e2d-fc9c-48e7-b53b-3e8a040cbf0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005316, "uuid": "8942442c-6b36-4e2d-8286-5acee5e4522d", "value": "e9735e9d2e7575420eccd103ed89b871.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c18b27-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688990869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990869, "uuid": "f5ebe365-d347-484e-9fb2-903f779d88af", "comment": "Malware payload (RedLineStealer)", "value": "65bf607b16954b328cd22b1ca5ca44f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990869, "uuid": "c143bdbf-1147-45b1-82d9-cb237fe3941e", "comment": "Malware payload (RedLineStealer)", "value": "85ed71309e1a64bbcf64ce85da8199eb9458d21f86fb316b1cadec95011f7981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990869, "uuid": "08b11a24-503f-47c8-90a1-e80d63dc7cc5", "comment": "Malware payload (RedLineStealer)", "value": "7aad3758a6e5368f32a7c47f240690b73d45442a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990869, "uuid": "e7a4c3c8-4a66-4f59-851d-25e5ca10de8d", "comment": "Malware payload (RedLineStealer)", "value": "db2235a30a3404a782366b3a81ee80843ecf1485d5a7f60d2615478ac4b2dc440363813146e39fe9e19d51bc2f265e8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990869, "uuid": "afed3922-e2a5-4a2f-9381-3a02f26e24b7", "value": "T1E9C4027171D29863F571143219F0922EBE1FDE7249A15E8353C97A3E8B281C25E3ECE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990869, "uuid": "5ab1298c-45bb-4030-98ad-9aff7662a17f", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990869, "uuid": "ae7a843a-5691-47ad-b38f-4e4a6d51b000", "value": "12288:ck8TLz47j2Hg1CXoIgXtzDMxZUmt5oQ4Mm8ipxwU7pk:W/479hlXlDvmt5KMmRpxwMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990869, "uuid": "4f1acfc0-da76-4806-9d9a-2a009f345a9f", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990869, "uuid": "ecec2a40-ba57-406e-b619-e59f048e3f53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990869, "uuid": "78639297-270b-4cb4-abaf-cd092ddd6a34", "value": "65bf607b16954b328cd22b1ca5ca44f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b2db8d-1eeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688970606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970606, "uuid": "3da632ae-39ce-46c6-8fb2-71e094e4177b", "comment": "Malware payload", "value": "d288b47a0e72f776e8b712a9cb4e4eb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970606, "uuid": "ee4c8d2b-476d-44e7-bf9b-5565c988800a", "comment": "Malware payload", "value": "85f852fb44601d7b12f508ff7bdb7115a03e8decbffcb87fb1d8fc5b37216355", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970606, "uuid": "f9f897a5-6cae-4c73-a859-71521f9b0f98", "comment": "Malware payload", "value": "b044cf32ecd4cca780f5df5efc37caf5f62a5490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970606, "uuid": "da327f22-b2f2-41e2-bc58-46c13f0cc641", "comment": "Malware payload", "value": "9e4ddf99e783e584af61229cf86967a35b78a7fe49e666c8fae4ee6451d3a0144373af0cdc84264332fdf205b9db71b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970606, "uuid": "23a889ad-f694-432a-871b-82917328826f", "value": "T172F633342F720CF1F411627CCE926182E2757C1A4666FE9F09C818E35E5F924AE6F627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970606, "uuid": "3e824d1a-7941-4c37-b8a9-f6f7cad539af", "value": "4346d89fe5c8297ca90187fbd7ba7740", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970606, "uuid": "38fc4384-a497-4d17-83f9-0d53c5c284c9", "value": "393216:TEqAqb781XL9dSvBiLINFWA40o1vzKtlJBQUa5y/slE7:TE9YI1XL9d8BicNQBh1eXXWy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970606, "uuid": "395a3506-5c6b-4e61-bad4-1ecb29d40f91", "value": 16423424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970606, "uuid": "34d635cf-a896-44b2-adbd-81740e4ab2bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970606, "uuid": "109e9bea-391b-4f57-965a-e696169cc465", "value": "d288b47a0e72f776e8b712a9cb4e4eb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f529ce67-1f69-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689025044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025044, "uuid": "c0739403-4be5-4016-858d-ac0bc1922611", "comment": "Malware payload", "value": "489289b1e5a9795ae95374285019f9f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025044, "uuid": "d812f956-2426-4dba-8489-4579c1ed3457", "comment": "Malware payload", "value": "85ffd2f174ee7547956a06ab20691f17e1fd0d1dfd269029ca0efc9d298224de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025044, "uuid": "88f71334-c4ad-4e1f-be3a-a481a37e524f", "comment": "Malware payload", "value": "55d6998e00f25c212433a626148ff26f83d4e6df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025044, "uuid": "f644ef86-a415-43d9-bb15-f48a6b88d6ac", "comment": "Malware payload", "value": "7fb0cd3b5dc89b5877b8fbb727b6f2b276d1e23e313950163edc8d30057347b5986dd7a448271653c2cf2836098161ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025044, "uuid": "47f26cbd-caa1-4b6c-b038-23768774d9f2", "value": "T17376333673D0847DC32A593608BD1FA2162DF6204BF80A4763A8063C7D7FE57D26AAD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025044, "uuid": "b560e52b-d6cd-421d-b509-0cfb3f49b67f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025044, "uuid": "cedeb98e-5013-4617-bbbf-24e546b6d9be", "value": "196608:P1OpU0nyvYdGXbBCB33JPZEW/2LLwKNXgqUrnyeEUOQMciQa:tOi0nhdGXVCB3Z+WhKZ7wnTEUOMta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689025044, "uuid": "fdbcc3e2-a665-473e-913c-2e7f81a17e83", "value": 7562114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689025044, "uuid": "0a8f6060-7ea0-4479-91d6-4aebe0a4f36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025044, "uuid": "e8954ab0-c7f7-433f-820b-182b5acd474b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41f8aeb-1ed0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688959248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959248, "uuid": "a06b357a-5d91-42b1-851a-3ab1c05bb829", "comment": "Malware payload (RedLineStealer)", "value": "87c6033e3f1ccc35e5f5b1cb0aa185d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959248, "uuid": "6e4f2b20-3132-4b8e-af7e-5523e0110576", "comment": "Malware payload (RedLineStealer)", "value": "866b1295e195c481a7eb09fcd0f50c8f949a2b85c5762120949ec8cc407fd730", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959248, "uuid": "adaf51d6-d1fc-4fbb-b17b-4b449366aca3", "comment": "Malware payload (RedLineStealer)", "value": "cf9c12c43a051b5506afa1101b7f0f9db76f2371", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959248, "uuid": "31d670e4-27c4-4ce1-abff-8f24a8910c73", "comment": "Malware payload (RedLineStealer)", "value": "50c8618b4d0498b472523bd2680a58b72827de83e727a54b7baf08bd45f0bf6f47e95bb8dc74cdd0fae39a71e94c19fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959248, "uuid": "44a399b8-b2e2-4f99-a377-aca3b0dc9ec0", "value": "T157B402A5B1D25953F532147318E0923FBE1BDB3109A18B8793C47A3E872C1C54E3EDAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959248, "uuid": "ef4f4423-9db2-421d-ad16-3dd148691e02", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959248, "uuid": "df6295f3-01a4-4ad4-8869-19788220a6f9", "value": "6144:Qk7/YCV8HBZ5CWGYLUz247b4p2RYm3lnsguZy6V7DuyhtWR7zR/7Q9X:QkUPFz47l1ZuVOacx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688959248, "uuid": "5f96493a-7df7-4ab3-9fbe-02f3ea8ac81b", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688959248, "uuid": "c46640a0-dbbe-4c49-9c1d-ac838326940f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959248, "uuid": "679a8421-da57-45b8-8e97-2752041be5f0", "value": "87c6033e3f1ccc35e5f5b1cb0aa185d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2c0902-1f49-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689011041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011041, "uuid": "78612357-8ef2-4346-89da-d2fb08c4bb67", "comment": "Malware payload", "value": "97ae29556caeaa42f47dd55e93dda6d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011041, "uuid": "0b680947-bdf3-4565-a72b-d07b1e5f5538", "comment": "Malware payload", "value": "87c3b63c1941edf4041ff8c8125d50b54ba8991c6a1660ccc52161ba861c0093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011041, "uuid": "a52f549a-52e3-4451-8b83-00a8e1715e1b", "comment": "Malware payload", "value": "3c7aa31d50e857cbf91fb0fac2233ba0e9db76db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011041, "uuid": "aba52659-bec8-4649-b2c0-c4712e564136", "comment": "Malware payload", "value": "6c6367c71a60cb6466ffa3d2107f1fe0f1a1851cf426584f295282ac8b4f66e30e4a0bafdb8927d0ddd08bf2ea2f1367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011041, "uuid": "d449672d-cb8a-4ed4-81ad-b77eff6ec7ed", "value": "T1FFA58E2277908076C1633931994EE379A6B9AD704B3D42F763A03F392E705D29A3C75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011041, "uuid": "cfbb911e-a357-4f32-9631-a47ddec5b6f8", "value": "277281be75b1c3fc66a5be16d8b4d426", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011041, "uuid": "58ea28bf-5c93-420f-8172-a04d85d730f5", "value": "49152:MFlnSgfpxd+zymFKu1Glia/xoPaWnHaNru7SeLijLfsgxzAurTNC5/w1/:eSgfpxEym0u176xoPaWnHaNS7SeLijbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689011041, "uuid": "9b593d80-2ad4-44f8-b2ca-f1b26ef001de", "value": 2147328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689011041, "uuid": "5740ecb0-ee39-4877-801b-0e334c16ed64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011041, "uuid": "a3876166-2e22-42ff-a550-fbf3fbd16d00", "value": "chitanda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9747458-1f0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985430, "uuid": "416eefe8-8f5b-4207-9bd4-041074247c78", "comment": "Malware payload (RedLineStealer)", "value": "198603d17746063bbcb7f248a4f62f73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985430, "uuid": "a0c86538-b051-4061-a7c3-22446c91d84d", "comment": "Malware payload (RedLineStealer)", "value": "87e2f19d070b4fcf5e3514e43e25b6a720ef862178a6068227278bb26c5487ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985430, "uuid": "5121932a-cedd-4571-ad7e-27226b50bed0", "comment": "Malware payload (RedLineStealer)", "value": "3696dbcbd0acf06dc051cf350da3d71b7d29cb65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985430, "uuid": "fb3ab1f4-63ec-40de-8025-09383a1dbdc3", "comment": "Malware payload (RedLineStealer)", "value": "8337d2c45690b390a20fa03fccb3aa5805d25cea74a78c3eec7fe9f0a289b31ca56a0c0c2249e7499cc7cfd1f4ed41a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985430, "uuid": "b53ae907-d5b7-4305-971f-e028ada03602", "value": "T13BC4026171D35523E47200332990936FBF2BDE311CA05A47A3C57A3E5B291D29E3EDEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985430, "uuid": "b2193df6-6c12-4247-a774-163fbf448e99", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985430, "uuid": "06949a4d-a97e-4393-b081-4703f6a05901", "value": "12288:xegHDVz47sr4wY1aHmra1coPp6XmGd4nSG:Rjt47snYoucI/dSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985430, "uuid": "1f10f91e-f6f7-4995-bdac-363b2506154a", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985430, "uuid": "70616669-02ec-4d86-99e4-9753f1d86a0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985430, "uuid": "290c9533-4361-4e69-9144-ea2eaf90fd19", "value": "198603d17746063bbcb7f248a4f62f73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554b6f29-1efe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978819, "uuid": "d571038e-a1ef-44cb-b296-86f5e58a3cd1", "comment": "Malware payload (RedLineStealer)", "value": "7f9cc8f51aae15a863a06b47f8cede4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978819, "uuid": "e4ffa6ab-2812-4d2a-be36-12aa314ed406", "comment": "Malware payload (RedLineStealer)", "value": "887fffe81839b37d3c7fa316d507250c6b5b6d5bb4714c97a9caf45518ecf860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978819, "uuid": "303bf7bb-e483-435b-af2c-d849248ee4f6", "comment": "Malware payload (RedLineStealer)", "value": "2d92a2322d5de347202a5bd45f7800f9aec1ed62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978819, "uuid": "92feccd8-f490-4b16-8d75-881d3b3114ce", "comment": "Malware payload (RedLineStealer)", "value": "305bef561d355d2e8c74b27d7fe9afd11f5d2304acdfbab6d767274ae4f49cf3faa53b698b6aa837380c552bb1508a2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978819, "uuid": "f08db8c8-1e71-498e-88e0-8204bf13546a", "value": "T1FAB401A031D24963E571157319A0922FBE1BDB7119A05B87A3C9B63E9B3D0C14E3FCAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978819, "uuid": "c5ea1b72-979e-4cdc-a8e7-8e18ef3fe6ea", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978819, "uuid": "5440d690-780d-4304-b0d2-8c986a9a2cc9", "value": "12288:9UUrgz47oUH3jx5s/v+wcN7Eq2m2GIiKK:dy47oYTxG3uN7Ec2GjKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978819, "uuid": "899e1e10-10fb-45c6-96b4-e30e8ed032eb", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978819, "uuid": "146a8f97-c0da-4c78-871e-7deca3fc98fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978819, "uuid": "ad083552-3477-47c5-9642-1ea014fd5d85", "value": "7f9cc8f51aae15a863a06b47f8cede4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7921fce1-1ee8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688969430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969430, "uuid": "2577db5f-c9e7-488b-878e-355fb1ea6a28", "comment": "Malware payload (AgentTesla)", "value": "70b80835d27d61987d5b8e722f794b70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969430, "uuid": "67190c79-bf0b-4349-9730-d63969084c98", "comment": "Malware payload (AgentTesla)", "value": "89158a45032d2cdb909e078ef2729bebbbcedf6ac9af01bc02f8107c199ef5f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969430, "uuid": "c48b7935-8278-4da4-b38a-6ccf6595d3a7", "comment": "Malware payload (AgentTesla)", "value": "ca493029f9cc4b834b050068f562ed3888b144f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969430, "uuid": "d0e58ff9-f9e9-4adb-b396-4636d1c80e65", "comment": "Malware payload (AgentTesla)", "value": "3da75d26c4fe575f9231f94a5bf7683d6f7cc60a7c6a0fc7ff49c7da3e88965a39ccf8e02c64eb40d7282d599fec5fdc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969430, "uuid": "3ba76926-570f-44d6-8a34-40ac8ab9a41c", "value": "T18E4501167E77C366D118A3F224791480636813A124F8E6263CDF91F95F3FF08696BA87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969430, "uuid": "59de355d-c776-40b5-bfd4-4cdf2a241830", "value": "12288:3Su0Ol/Jf0BPIHSteE4p5wRxv4qxYpLFqRROMokPYT:3B0OtJf0BPIH8efr8v42YpZqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969430, "uuid": "1477e845-3bd5-498b-b416-80e7dadcfcca", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969430, "uuid": "c9c8cbc1-a9ec-4cfb-9eae-11f8c32d70af", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969430, "uuid": "4f81dbc0-3872-4026-9e50-c40c6e393d47", "value": "Quote request.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230e2ffe-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968856, "uuid": "eaf893a0-f43c-4653-9152-67c68e78be62", "comment": "Malware payload (RedLineStealer)", "value": "9db3e0d97fe2e36de88a268db7ceb201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968856, "uuid": "b0fb7521-ca01-4ca9-9be0-edc16aded3c6", "comment": "Malware payload (RedLineStealer)", "value": "893be6a516bf3c0ca7b1d787cab49527a3d06962d1393259a92b1542934490a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968856, "uuid": "8441b7f0-6367-47a4-800c-2977a9d6c3bb", "comment": "Malware payload (RedLineStealer)", "value": "a5fc9ca616339dbed2daf0b26c9e264e8b1c4650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968856, "uuid": "0a043c66-7edc-4b36-8bd0-465374231778", "comment": "Malware payload (RedLineStealer)", "value": "16a37572f62c67f719c5475644329c89fac9c2680fe4cc81edb110046e2c15d894e4d791a1ced0305f2d2386454976b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968856, "uuid": "c698cf16-7a32-489d-b22e-be4b0fa8be31", "value": "T1F044283921E144A7D8BA9E35BE4BC0C17116AEB4057C541F3BB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968856, "uuid": "0b8015e6-34ae-4cb4-8cfe-50d6d8b2125e", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968856, "uuid": "2233c76f-b0a0-4f35-9d5c-673d894477f4", "value": "3072:5FXc+iOHMwew7+picM/wsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:5NcvOswD7hVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968856, "uuid": "995db157-2c2f-44a6-8afe-9d3ad8a1bbe6", "value": 272545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968856, "uuid": "79c1c891-dcac-4754-a0a3-a36f32536812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968856, "uuid": "8af0aabe-68e5-4cce-9933-679c3fc0360e", "value": "9db3e0d97fe2e36de88a268db7ceb201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603c2dc1-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688990863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990863, "uuid": "ba353508-59d3-4716-ab07-a40331bb3e41", "comment": "Malware payload (Amadey)", "value": "5277c8aebe30d5a0dee77f9f5fe47813", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990863, "uuid": "925fdbb3-1461-41c8-a866-a9e58c3d73b1", "comment": "Malware payload (Amadey)", "value": "89a6512e1b1bab942f922198e0295f954ed46f9fe3489fa82d15092a17766081", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990863, "uuid": "670ee124-dacd-493e-a29b-5bf63f32f4f4", "comment": "Malware payload (Amadey)", "value": "3ad5ff33f6561b76e689a9bdcc257b054ee66fdf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990863, "uuid": "3cfa0875-1f39-44bb-a55a-77bc31abfaad", "comment": "Malware payload (Amadey)", "value": "2d309ede1eafd9e52f844cf56c95f01fe59ae0971c1f5989b901b850e68bb2a99afd61abe4dcabfd76d8f9ae7aadc36a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990863, "uuid": "3ea3c860-00d1-458e-8381-5ada9738c975", "value": "T103B4027470E79623F57614372490866FBE1FEF3209A04A4783C5BA3D87291C19E7DCAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990863, "uuid": "89968694-810a-434e-a9e7-1f7c40973689", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990863, "uuid": "6d7f44f6-382f-4d2f-a86d-b2b1b82f5277", "value": "6144:Ak7/YCVZHBVCCWGYLUz247zPe9+9VmVqigr0McYfElgE47yhLXWZmeCY/Wm0wm97:AkUW0z47zm9+JiJLqpayoe+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990863, "uuid": "3f8fc085-6d0d-4a4c-99b8-11f7d3553e35", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990863, "uuid": "08c66720-8b1a-487f-9d1f-4a92d73db773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990863, "uuid": "64153491-48fc-4686-ab4c-526bb06405bd", "value": "89a6512e1b1bab942f922198e0295f954ed46f9fe3489.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2a4918-1f41-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1689007745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007745, "uuid": "1aade06d-3611-4d96-8097-c3a4168beae3", "comment": "Malware payload (Stealc)", "value": "2dd4f99aae5ca0be002c2f55d13b91e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007745, "uuid": "f9e6dd9e-f812-4db5-b111-c5ae3f1dc9fb", "comment": "Malware payload (Stealc)", "value": "8a2cf17eb94a6e38695b90efc25180fe632979ecad0e84954bde357c97d3695b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007745, "uuid": "ac75cbfc-7d87-4f2e-80a1-6d529990e2e4", "comment": "Malware payload (Stealc)", "value": "570b716ff95035d9abec439ab617c326551312f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007745, "uuid": "ae948a74-03d1-443d-b9c5-57953244fcf7", "comment": "Malware payload (Stealc)", "value": "36e385ade874b35d3b06164ec4faeb682830d8a3f2d39cf736bbfad83d2a21cd6ed93cb668a17bd37a8e9e7289ec21aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007745, "uuid": "5962d39f-879f-4f31-964e-4ec11ba8b566", "value": "T1F4347D326291FC63E567CA318D2DC6E8362EF9618F19775A22187F7F18711B2F262311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007745, "uuid": "d0802c5b-d7f4-4390-a2ce-c773b76cfa27", "value": "5a013624489e6703ae44eba8e360cecd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007745, "uuid": "8be42856-f980-4531-b277-5843d515e44f", "value": "3072:k27aLPmvAGC1q3JSatPSWInSyfxVQ73pmrH6PfX0JKcGw3WAAU/:XaLP71CtKLSyJVQ75mrankJKDA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689007745, "uuid": "c35cbb61-dd6d-41cf-9999-b18eb11cd28a", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689007745, "uuid": "817051b4-e394-46d0-96f1-05e7c9f7199a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007745, "uuid": "4acdac07-3a24-48ec-95ad-661a534fdd0f", "value": "2dd4f99aae5ca0be002c2f55d13b91e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84b66db-1f4a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689011627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011627, "uuid": "755aaa60-8b43-4244-b9a5-1dd575adfa3e", "comment": "Malware payload", "value": "6f4c1b4a613ba52fb8cf9fe4bdf20ada", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011627, "uuid": "7e7039bf-48c2-48df-87cd-70f7e3c525b2", "comment": "Malware payload", "value": "8a61b21709b5c6bc5f5f2d86868260c809c560e0a2fd774ca45d83a9b908aceb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011627, "uuid": "6f71b434-ca47-4c1b-8653-c67b54992b2b", "comment": "Malware payload", "value": "a8edf3c3afcfd23b549443db3cd033bb37adec57", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011627, "uuid": "bd3d9119-2453-403c-9610-49c973c8a0e0", "comment": "Malware payload", "value": "9483816ba06e87f05020f58515eb1cb3bcc9c4523a3e291c72ef9fa8581efcfd9e051d43cb5b54514738c24ec9648144", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011627, "uuid": "9c7ff936-729f-4473-af98-7d1aa1734b61", "value": "T17F844762A7FE1248F6F7BF08AE7916654E7ABE92AD3DD01D0260114E4971E94CCB0733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011627, "uuid": "c1f42bf3-1b46-469f-b075-581d65519a25", "value": "3072:LFk/D+/dr2U+w2zsBV1sBzpEAo3EOK3zE2Kiqjzmfq+y2FN4EW9AHTkg0HeCDqBV:LFtjVTA4iD4q7GKpNCKud2E8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689011627, "uuid": "fc8ce7fb-5eaf-4bc3-b03a-8621734ed93f", "value": 393156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689011627, "uuid": "1f77b936-efb5-4c10-a559-6057d51b204a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011627, "uuid": "f2fcc1ac-83e1-42ff-89d7-b84de645d4f0", "value": "10_jul.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f790e69d-1ef4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688974796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974796, "uuid": "35fbc63c-798e-4a39-b8b4-9d983824b022", "comment": "Malware payload (AgentTesla)", "value": "ffef1e737b45921a7a170d8ef189a02d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974796, "uuid": "91fa1be7-0029-4764-ba75-e4855bd6fcf4", "comment": "Malware payload (AgentTesla)", "value": "8b5a226b8ceaa34a62e53ad86616bbbd3c6b8f8644d36fe59bf390153f6946c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974796, "uuid": "40b9ea85-ed1b-40a5-9588-095a15f50420", "comment": "Malware payload (AgentTesla)", "value": "69db456131fe03653f5bc4efcef739071dd179b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974796, "uuid": "e9049b54-761b-46cf-b565-1b4c1bb6d840", "comment": "Malware payload (AgentTesla)", "value": "a1f87b45636b87c807d0b95382701b5370874bb5d86b27c9e738a66a07cad5c34622b70c2912d2fe5faf2e608a1a9064", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974796, "uuid": "4471818c-80b5-4c1f-9c41-48f4df142899", "value": "T1CCC40222A1A9D739DC2C1FFD2409944D33A45A586D71DE2C896B8CD1C639FB048BCBDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974796, "uuid": "f79cdcfa-0ecf-4070-9aa5-b06dc24547af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974796, "uuid": "4ac5bddd-34f5-43e9-acee-b2588d076e1f", "value": "12288:h9iPCi668W0cFOaewcDEElplffJks5ONnVh0K:hgsW0cF1JcDxlpZf6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688974796, "uuid": "871c2d19-855f-4fac-8c46-3df4979090d4", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688974796, "uuid": "55265f3c-e602-4e5c-9022-14d5f0c45b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974796, "uuid": "459f51d6-dc5e-43c5-a98f-549aeeae4eee", "value": "SALE ORDER_7.7.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1b983e-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985708, "uuid": "5f68e279-f33f-4c82-b93b-21c79c17d743", "comment": "Malware payload (Mirai)", "value": "24afaa892ab0ee8d3c7c0655701a34af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985708, "uuid": "18bf567f-cb0f-4b6e-b22b-28bb48ae4c95", "comment": "Malware payload (Mirai)", "value": "8bb0a3387b4ec96ad5ca86a40f7238b415ea6042ca9dc53f69c4f778b3e33255", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985708, "uuid": "64cd129e-b821-4dfb-856e-2d2b4038a8cc", "comment": "Malware payload (Mirai)", "value": "c7aa1bc9679b55007091efd432486187ddbb7df3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985708, "uuid": "847e02c0-a05f-4744-b7cc-14af6a453d20", "comment": "Malware payload (Mirai)", "value": "2199b50c6d62be13edc307fc2cd213e1a9892694ec4c2710f7090569e19d831950c83cee1cdf8536000ffc63874816af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985708, "uuid": "89ac839c-a281-4ba7-8c5a-429bbfea8ab9", "value": "T17D03E788FD54A22AC7D162BBF61D038E373A07A8F3DA33225D355B2137C6E615A3A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985708, "uuid": "28c90706-2636-44e4-ada0-d763151341f9", "value": "768:R5hNeQS/uMfqSjpEcIIZ/rLS4ZMDSbCYaxm+n1XmzII:jbk/HLdE4dL0GZaxVnUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985708, "uuid": "8f944ca4-3de4-42ef-925e-5b4df8c1b42e", "value": 40032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985708, "uuid": "bc99d665-c498-44d2-b863-f2184ebf438c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985708, "uuid": "e764e5a9-d800-4c47-b457-0d30386bbd81", "value": "SecuriteInfo.com.ELF.Mirai-CE.10257.28348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc66cfd-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968255, "uuid": "b340fdc4-ad7f-433f-91dd-fd7c66669162", "comment": "Malware payload (Amadey)", "value": "63285b1b377091c909d7fc0de9cb8d3a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968255, "uuid": "6d86be16-0c2c-432e-9955-376d226d98cc", "comment": "Malware payload (Amadey)", "value": "8c3a7817709cd1db9202c5ef16744b1bb9201a4df7f779f55ffffc5e69367be2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968255, "uuid": "b0c0719c-a72f-4d34-83c1-fb18441ea05e", "comment": "Malware payload (Amadey)", "value": "49cce020bc662f140fd39d147848e8fa98a77017", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968255, "uuid": "5e196da5-f287-46c7-94d8-39a1d8cf8089", "comment": "Malware payload (Amadey)", "value": "04003812cea6d4443b5ad394330b8d653749f17d34d1b6732cea6c7c5c614213c075d094ec14a3d9dc35e119b95eb599", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968255, "uuid": "02b27012-f8ae-4ddf-a3d1-cd582dc29cf7", "value": "T1EBB402B4B0D39933F971453715A0962FBE1FDE220591568393C9BA3E4B291C24E3ECE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968255, "uuid": "1e52b000-0b94-4331-9976-4c42589eeaba", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968255, "uuid": "56038bf0-12b2-4108-803b-3cdf079d05af", "value": "6144:707/YCVbHBJRCWGYLUz247HE9NhZaH9B8p7C3dc8sKUol6UcN/ZwzfW5Wt0CeqBN:70UM9z47HEHpcdc8sK5D+UeWt0BAqZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968255, "uuid": "04e1783e-396b-4b8b-8cd9-8978d2285a89", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968255, "uuid": "204d15de-1b68-4ba4-b77c-96b9bc8bad71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968255, "uuid": "b1a7a72f-745f-4234-b881-36c151fff116", "value": "63285b1b377091c909d7fc0de9cb8d3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d56690-1f69-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689024825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024825, "uuid": "18c4ae56-e100-430e-8a86-384dee630a51", "comment": "Malware payload", "value": "5fad9a11081ecf50c16106ffc8777445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024825, "uuid": "7b50a58f-10d5-47b9-bea7-54f179862d3f", "comment": "Malware payload", "value": "8c3f095428d5283ec57391611e24689e88aa93e0a6868d6994d2e26761740ce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024825, "uuid": "c5a37822-01ff-496d-a98c-a94bad74cf70", "comment": "Malware payload", "value": "0fdb015f0c016868a9d896be9ec8fd3f78c35ff2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024825, "uuid": "6fd9f8a7-c17d-4cbe-b186-3e86f0847014", "comment": "Malware payload", "value": "1f49ac7506649c85571b889942cff8be0a53f656350a8a32b415d6eb227ca41eef2b64494d37611243525d6eb92b03c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024825, "uuid": "96a0a404-a24d-4711-8e71-8990f8ccd21e", "value": "T1E4347D1366B4FE60D9E68A318D3EF6E8365FF9618F18675B32187B1F18701A2D272311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024825, "uuid": "d29468af-243e-4e94-a5c8-87f22b61bbef", "value": "5a013624489e6703ae44eba8e360cecd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024825, "uuid": "8cb057af-23e5-49f1-82f7-aa318ef9862e", "value": "6144:TnLTzWdHub3CXG4V0GFNaNa2sBICvUH8snh/:DHzWds3EG4V0u4RsBICM9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689024825, "uuid": "dbbea18b-9832-46b9-98ed-7f5e7b8f1e63", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689024825, "uuid": "c3d7e239-fe52-4c4a-a249-70aba80849d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024825, "uuid": "48d2d4c1-9f0c-4a1a-8861-0f284e7e8b71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fef02d-1f61-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689021258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021258, "uuid": "bc9d253a-c020-4e89-b060-bfae1b6a0bc7", "comment": "Malware payload", "value": "9a14aba85870d75db3aa545d0a611487", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021258, "uuid": "0916019c-38ea-4b7f-9811-63f11eb55bd3", "comment": "Malware payload", "value": "8ca7ff2af1135c8e62425fc61f92cfdd1724c1fe240e922f2d4a2bd8d5355af2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021258, "uuid": "78583dc9-064e-4777-a441-85494dacb8b1", "comment": "Malware payload", "value": "65f5a4c0b5cf29881542160a8027f1c77394f9b3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021258, "uuid": "e170c443-5734-483e-8a1d-3cb090b5b897", "comment": "Malware payload", "value": "dc4a503f72949cc71b76d9c4737f242a30b2db38426f39a562145a877ec00f1f473649630459aa16145c0ca2def83714", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021258, "uuid": "f8cc072a-0ae4-405f-8899-3899a88ddfb6", "value": "T1EB836CD5E683D4F6EC8301B25177DB368B73E439202ADB42CB69AD32DC92911D62B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021258, "uuid": "4818553f-a32f-48c5-be1d-e5de3cda362d", "value": "1536:+gXuW4LiQGm2y8SuAg98M5SKKyp3wO7QU7Bs+Sb4q:+gXQOQGm2tSu5SitKyp3n7hin5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689021258, "uuid": "37a31019-f976-4884-a5e7-5f9d63768def", "value": 88004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689021258, "uuid": "2b2d23fb-a3f0-49ed-b548-a6d6afff6597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021258, "uuid": "3bb59f16-54ad-4de0-a629-0ce0156cb4eb", "value": "most-x86-20230710-2034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb034de-1f3c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689005626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005626, "uuid": "39dfc816-3b71-4745-b85e-3d07b2ece97c", "comment": "Malware payload (Amadey)", "value": "0c66987e42db7e8cfac26662774f8de4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005626, "uuid": "5cd993d0-d960-4031-bf1e-7d70ca0a1d9f", "comment": "Malware payload (Amadey)", "value": "8d0bf361e2d2cc830bcbd1f49a2b0a8b3df0c68b9b4fe5d45a5538a745c6641e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005626, "uuid": "f9447e17-dcb0-4360-aed7-affabf50a1d7", "comment": "Malware payload (Amadey)", "value": "71519a938f46c5d64effe0a3d78b2ffabd5ed5ef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005626, "uuid": "60848ad8-6bb8-418e-b9f5-f8f35fd0573e", "comment": "Malware payload (Amadey)", "value": "eea83606c86352b0b268999a1e3c4f3036247a23e8bcbed6533ddfc759465e2462dbb2f94dffaa3e7518c9a80ff6ae00", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005626, "uuid": "4334a83b-9258-4142-8ca6-604ccadc0b76", "value": "T10C6523B928842737D030607D8590E52FFE070AF296A05783EBC77A396B952EE2D7DC54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005626, "uuid": "207772bc-0059-4d27-85ea-d8995085c2e4", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005626, "uuid": "d4e940c4-a897-46e1-9a5c-6504615ff5d9", "value": "24576:+E47kOUEfJvETlpqftmHioiS+yvk3RZARBbVTb34k30/8dRi9:+Eq5PfJvExMftmHzO0khZAVykji9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689005626, "uuid": "e2b931e4-a668-4c96-8647-013c6891e40a", "value": 1409344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689005626, "uuid": "55b5951c-6016-4407-8ca6-39554abe09d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005626, "uuid": "b2fc8148-1a04-4be7-a809-7ec0098c7159", "value": "0c66987e42db7e8cfac26662774f8de4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f872159-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978031, "uuid": "06e78967-090c-4ba2-88af-07b0eea9d4d0", "comment": "Malware payload", "value": "c21acffb9c2b1eb5952cb13b11b03b94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978031, "uuid": "ab5c02fb-cb42-46b5-aba4-1d393982ff80", "comment": "Malware payload", "value": "8d6a6c67576fc2865f677a85e98fdf5f6a0c653563980e941bc1fca894b7ce27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978031, "uuid": "72f4f737-3abe-46a5-bb4b-af14950516b8", "comment": "Malware payload", "value": "f5495c74087796215234c4e60d4457bcd6462b61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978031, "uuid": "a59cfd15-80c3-41e1-ad47-e407c8afd98a", "comment": "Malware payload", "value": "f015d389a36b18f8e56bee21739d225c97dab885bb4a45a05242c37c748157349abbb0ad62957704876e2d6d3092a2a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978031, "uuid": "a7192ed1-ff02-4827-b5cf-bfe7f85b0bde", "value": "T1E2135C57B71C0647D1B75FF43A3B27D4C3AEBA6011D896C8250EDE819372A306962FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978031, "uuid": "8c016021-fddc-424d-a019-9589f5b737e9", "value": "768:PbDrpGreAdjs9Sm2PCYUnI2+NFt6twCAIIq:PbDrpGeAkSbPCXnI2g6ydIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978031, "uuid": "43cd5b36-15f7-4af8-8644-5bd071fd106b", "value": 44732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978031, "uuid": "2bdc60a0-d7eb-4bd2-84e6-a2b599e353c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978031, "uuid": "d791c98e-9962-4466-98d2-dc2dc258394d", "value": "SecuriteInfo.com.Backdoor.Linux.Gyfgyt.BR.MTB.18143.7108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65556d05-1ee6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968538, "uuid": "045b42d1-5108-420a-aa46-5d630c783cdf", "comment": "Malware payload (RedLineStealer)", "value": "7cb3999c415fd2b51d5203dd4c8c6367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968538, "uuid": "883a3893-12ed-4b2a-bef2-f13eb51bbb43", "comment": "Malware payload (RedLineStealer)", "value": "8e0312036e80094d71ab7b0183f435113271951f4901d5259c7da33133672d34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968538, "uuid": "251d0793-8d7b-47cd-a1be-b14afc1a1ad6", "comment": "Malware payload (RedLineStealer)", "value": "e1043707dcab23cf87bcc16b5d4eae8a3505c61c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968538, "uuid": "9791cdbd-d7ea-4675-a350-638e9d75a1aa", "comment": "Malware payload (RedLineStealer)", "value": "6e37b2eba93c4ac9b7653416cf2cf2e857d56e08fbc10616286b6b0cc1a346759544124d0e39fb52cfbfa6ca07ac8df4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968538, "uuid": "9d653d1b-bc42-45cf-932f-d89801ea77a5", "value": "T1950513B0B2D65923F676503624A0D21EBE1FEB360CA05397A3C9363D87351D24D7ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968538, "uuid": "47cbc988-2f87-47b6-92f3-7ffae700c4d0", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968538, "uuid": "97eaadec-4333-46b5-9937-6a98ab77f7b0", "value": "12288:mQ4auz475uXwwEM/wq/0JZzNf9L85pWhnF3w7C7Le:VU47vO/D0JZZfJYYnFxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968538, "uuid": "9bf6beb7-79f9-4a1e-8274-44b4676c0249", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968538, "uuid": "19e9f8b2-d35b-405b-9903-e0ff778ced06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968538, "uuid": "1c7df6ac-1941-4f29-8da6-add11a10ddf7", "value": "7cb3999c415fd2b51d5203dd4c8c6367.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ddcbab-1f41-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689007729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007729, "uuid": "499ce2d5-13ce-42c9-b9f3-0955b0029b3c", "comment": "Malware payload (RedLineStealer)", "value": "764eca818bb673400536b54fe1378706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007729, "uuid": "863e3134-b4b3-4f16-9c72-47a7359a19b3", "comment": "Malware payload (RedLineStealer)", "value": "8e2863793935146282105c19ce81578a0cd28cb851910407a34017e3dbf5e5a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007729, "uuid": "2339e89e-e94b-4cee-aab3-8346506219ea", "comment": "Malware payload (RedLineStealer)", "value": "cee2523647e5d36b91039f11ba1edd72ca615cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007729, "uuid": "494d1c09-c60b-4e4f-ada4-27e3dd0abea3", "comment": "Malware payload (RedLineStealer)", "value": "4ccb176e84d2bf3a0ad173e0e608400b95804e77b6578ccd8423b7325bf6547113c61d0a653e80b92bc1720204801694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007729, "uuid": "ce13a659-ef49-4d4d-9897-08b1c0501a1c", "value": "T10FE4DF3914A144ABC4A9AE39FF4BD4C132162EE5017C954E3EB36E783BD20578DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007729, "uuid": "35b577ad-68a7-465c-ac4b-4cb123107f29", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007729, "uuid": "505ed47c-8afe-46a1-b51c-e3318b1562eb", "value": "12288:Gw3zk2E5iICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:GwDkN5BbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689007729, "uuid": "2f2def8e-756e-41ad-8c8a-77dae505d4ca", "value": 708932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689007729, "uuid": "377303ad-a65d-414d-b112-bcdca981190e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007729, "uuid": "a932d342-9d9d-4ad5-9f94-a28df8533db0", "value": "764eca818bb673400536b54fe1378706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c00567-1f0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985417, "uuid": "f46e57fd-1cd1-4687-9d40-2cb28332b14d", "comment": "Malware payload (RedLineStealer)", "value": "6bd72793be403fe61829242383ca2523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985417, "uuid": "de2a0977-931a-491e-88f0-bc5f2ea37ecc", "comment": "Malware payload (RedLineStealer)", "value": "8e2a4eade8d7612f4e89d7a51f516c75e0a54cab3fb89cd7bc1d51673a321ee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985417, "uuid": "5bfe287b-d7e2-4113-acd1-a09c55e11b8d", "comment": "Malware payload (RedLineStealer)", "value": "2b09cc94bba79888e2ea5e2a2d6d740b0851a20b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985417, "uuid": "b6ac8ba2-3d98-41e1-a591-d93c1f49792a", "comment": "Malware payload (RedLineStealer)", "value": "ff373eb0449da79c7bdbd5c4958658f7a863a637388c52fb4243aae7599f305e1ff0b0ee0104fcef5f175282a7a25ffe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985417, "uuid": "d5788252-6176-4ad4-8b61-31bfb617a37d", "value": "T11DB401A571D29923F531507718A0922EFF1FDE3209A05A8393C5BA3D9B2D1C15E3ECB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985417, "uuid": "99375dc7-ef20-4482-a131-425e7db81f9d", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985417, "uuid": "61dffe4e-0a43-4e57-b2e0-25f2c953c355", "value": "12288:TEUH5z47pa9sdBK/JUUnuBVKlPDGFpr0:H547pasdciUn0VKliFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985417, "uuid": "9ed5b3f5-d869-4a7a-9b30-63c7badc2011", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985417, "uuid": "fbe5b961-6d6f-4150-9422-88c16dbaf6e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985417, "uuid": "072d9f31-2263-4dc0-aa49-eebe90df7c24", "value": "6bd72793be403fe61829242383ca2523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6037286e-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688981844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981844, "uuid": "ce126432-5b5b-4436-8403-e0bfd4ef12da", "comment": "Malware payload (Formbook)", "value": "18f1462e47d0b497509e48626a824494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981844, "uuid": "dcf10ded-a674-4694-9b08-8598706fa8f2", "comment": "Malware payload (Formbook)", "value": "8ed78644bb395ea51016d63cd2419d9f13e8e847c06a0d4e86c44850166fea03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981844, "uuid": "586759a4-b031-4b55-a449-50f5b3fb64e0", "comment": "Malware payload (Formbook)", "value": "ccf88a75f45bfb1bfa805f2183ecfb5bc21392e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981844, "uuid": "489404a7-9d13-4263-8a20-b6c51d291dfd", "comment": "Malware payload (Formbook)", "value": "ee2c9d8960587d7ca85c85afe958044a5a4ef282f28c7796a253d18423736c8cf6a783d02756e285d34e3b5d77ac1d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981844, "uuid": "72f87c80-8a96-4fee-8bfe-2436ac464334", "value": "T16334130121F9C2BAD8131E325B6B563E3FA1AD2654B4562B23D1CF167933392DD2E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981844, "uuid": "ac477d24-0c2c-4588-b265-ef39da9f9a59", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981844, "uuid": "ef86e420-a322-4c7c-8b49-d2bcf9b01870", "value": "6144:vYa66x0EZ3y1vkQO+7qpn/+NVp8tJp5gucG72V6ujedGd:vYEx0EQ5kN1pnup8j3z2V9jkGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981844, "uuid": "101d0101-f059-47b0-bd9f-4f7a2599ad5d", "value": 243740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981844, "uuid": "1e92c5fd-2771-4f48-9520-e825f9c7a003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981844, "uuid": "803449c2-1bcd-4bc9-9bc7-e9d678523ae2", "value": "60069-PO-13228.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66765efb-1ee6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968540, "uuid": "4dec5130-63f4-48cf-80e0-c3fca152c0c1", "comment": "Malware payload (Amadey)", "value": "7f72b6ed82d5253a7ea22bd7099b8c13", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968540, "uuid": "3dff1dc8-c6f2-47b7-a085-aefc04914189", "comment": "Malware payload (Amadey)", "value": "8ede63c94c87e7d9a4f3f1212b614a593602d901861abebd8059d5e595a99292", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968540, "uuid": "facedd1f-c6d3-4264-963c-dfb05cdb0317", "comment": "Malware payload (Amadey)", "value": "0e370a1a43fd377755702b80bdd34aef44c9086d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968540, "uuid": "5885e3cb-5fb8-4e4b-950a-d9133a8c12fd", "comment": "Malware payload (Amadey)", "value": "5aaa8f8c6457a818ed6af0283fe3514fee8405a7df8a99c1ce6b3340aee96336e0248e142cd352fcfe84746d6c62d3be", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968540, "uuid": "00976cb0-20df-4480-9e40-19738ac25cf4", "value": "T12FB402A170D29663E535127315E0D31EBE1BDF3119A14A93A3C57A3E476C2C28F3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968540, "uuid": "d885d97f-2b25-45ce-9f2c-890dc23ccf6c", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968540, "uuid": "11b16c7a-26d5-4dea-bc97-59860bfc61fe", "value": "12288:ykUjgz47ig696eQ7BE6IshV5SQ+Om6oxG:Qy47f616E6Trx+h65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968540, "uuid": "8e621519-3b95-499d-b951-70b5f0b5dead", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968540, "uuid": "37990375-db70-4d4d-a5b4-7136717b3ca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968540, "uuid": "f7ff4e95-38a6-44c1-8f56-bc6467cb3f21", "value": "7f72b6ed82d5253a7ea22bd7099b8c13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dba07cf-1ee9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688969868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969868, "uuid": "df97e262-85ef-41ba-b66a-906a98a3d37d", "comment": "Malware payload", "value": "c6671fb693a7539d965ba34a7e72f7d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969868, "uuid": "3f9e24b9-4995-418f-8c91-176f371c2b5d", "comment": "Malware payload", "value": "8ee274b430932f7e8068229a7f32c2bbaead31bf6c18dd13194a1126f5cbfb33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969868, "uuid": "a7f43c97-a22c-40ce-8c60-e602996cdce2", "comment": "Malware payload", "value": "c49f39a5c5a6ddd9f44bdb9c822ccf680672703a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969868, "uuid": "d88bcdc1-3054-4237-8ebd-07e9e6afe8f8", "comment": "Malware payload", "value": "43fb2bf9e9e6f22d010cf11dcdf7e764f809d8570d5166af9dd13b10d885007f5b9fac3047581151af64a97f02c4ba79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969868, "uuid": "511b17dc-e093-46f4-9b57-1faf93287e42", "value": "T134C5330394D50212EDE467B431F362A7023ABDB64374E2C767875B5F0E726D0363A7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969868, "uuid": "d34b9be6-3783-4601-b9f4-b44b99d7de81", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969868, "uuid": "79d69cdc-17e5-40b3-9645-3119863ff8b7", "value": "49152:4ElKAqon+Tc6/vkvgC4jzNT3v5qZBIF1YHe59TssyZLj8s27tnvpr9c:tMDonnYhxjzN53YHc5yZLjUJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969868, "uuid": "31bf07da-e2fd-4548-80d2-59b04aaea9f3", "value": 2661544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969868, "uuid": "3abbf243-75fa-471c-95b8-47db97c9dd1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969868, "uuid": "98f0361a-56bc-4df5-ba29-9783e93560fd", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c169013-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985703, "uuid": "d3002561-7532-48b0-8e55-52fcf3395162", "comment": "Malware payload (Mirai)", "value": "06c6145bf7aba551ebb538fd1e458745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985703, "uuid": "a10f8ca8-8e13-4e96-8b54-6bb713cabe12", "comment": "Malware payload (Mirai)", "value": "8faeeccac7108af6a6c4d8f490f74ddb9c59f99457eafeccd7cbfe5ecd501448", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985703, "uuid": "b2b7cbc0-e782-4288-b0dd-5aa8eb048007", "comment": "Malware payload (Mirai)", "value": "ee3a4f3ba8cb3a24a0071024cad75d4334bd0349", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985703, "uuid": "8fc90b25-db3c-4869-bfe3-8bacad5386b6", "comment": "Malware payload (Mirai)", "value": "bfb64cdf747e59a0bb000caa3635256bbea48a34ab9ea55279f8526199be46f977e62745811ca051785f89dc18226a42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985703, "uuid": "51e69f24-0e0f-4165-8022-251c05634a8d", "value": "T17233F139A7079F434AF188F9DDE0CDD73F48434CD47A69B366A6140C8A8B5C067A4A6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985703, "uuid": "4e564083-76b0-4d63-b2a5-50568837000b", "value": "1536:6KGq5Uz4KxTU/FIAhHaGVmXL47Z/SkCzXH7CNB:6cUz4KxU9FhxVuL47gkqX7Cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985703, "uuid": "a5113096-0780-43fe-a17a-39a7ddbc35f0", "value": 54212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985703, "uuid": "2dcb4200-b9d9-44db-afa0-b8f5ae63d8ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985703, "uuid": "22c7be87-583a-429e-9898-f2b134090ca0", "value": "SecuriteInfo.com.Gen.Variant.Trojan.Linux.Gafgyt.8.27115.7770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3b3cd5-1f19-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688990699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990699, "uuid": "af47bbad-7a44-4fba-9fe1-4945ea27ce13", "comment": "Malware payload (SnakeKeylogger)", "value": "aa645fe4c8377f45ff998ae2aa8d5665", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990699, "uuid": "c5fb95d2-435d-4030-beec-466015874cfe", "comment": "Malware payload (SnakeKeylogger)", "value": "9027995cb652dafdfd860fe0019a3e60817530e46d7f6d8d8640f9241f625ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990699, "uuid": "621d6c35-4362-49cc-8914-2c33a97cf587", "comment": "Malware payload (SnakeKeylogger)", "value": "ae3e7e639e17f0bd5b071048118c379e95b554a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990699, "uuid": "ef70ae56-ef5e-4bd8-89a2-68f1a963ad53", "comment": "Malware payload (SnakeKeylogger)", "value": "22b2d85fb6d493b417880d172e404851ef41a518b5b1baade9e3c94f0725d887450581871a4ba50be3f9aa031ce430ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990699, "uuid": "35d2c5c6-0d91-4486-8494-6b6bd4bc7f2c", "value": "T105C4483C18BD5337C074C3A6CFE19723B254946F3562AA766DC39B964786E4229C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990699, "uuid": "9ad6b84a-3f8f-4a95-94a5-4c1bf9601476", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990699, "uuid": "18fbc329-2ef3-490f-ba47-7e073299879e", "value": "6144:B832b7sKqcN8ps7mmS9WPz1zGXzXWkkly6zIYn4cCF6Z+AoE+NkFyjKGdErBrF5A:BqKqps7mBy1zMzey3YndZb+CFxrF5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990699, "uuid": "29b268fe-76c1-4b0e-a5b3-101a9ec430a9", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990699, "uuid": "846fdcb1-8f33-43fe-9f48-be6642bb5d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990699, "uuid": "2be8bd22-05a2-4203-bb5d-a4267bb5e9eb", "value": "aa645fe4c8377f45ff998ae2aa8d5665.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05fa725-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978194, "uuid": "d531ddc3-eb65-4019-a74b-9ff4b023c3d4", "comment": "Malware payload (RedLineStealer)", "value": "ac9672cc44d386bb6e6e3fe9ba90aeb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978194, "uuid": "0c301401-0551-4c8e-8066-962410d128ad", "comment": "Malware payload (RedLineStealer)", "value": "90a109684bfaa72286fce9ba6dfaaa99e40599b573c2dc8366ce94753eafcc59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978194, "uuid": "c35b2b7f-fd2f-447a-97d6-d613da1334df", "comment": "Malware payload (RedLineStealer)", "value": "c8052a8e933cc49f64fa875a34911bf2f3f93ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978194, "uuid": "0f958718-05cb-4725-991f-c8bed26e1009", "comment": "Malware payload (RedLineStealer)", "value": "ed8d54a4d03b52307a0e3453c0fac6571f3a10df89e7359d8f3b9ccea0613608a2c68b7e6c09066f821173b53e0c0a2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978194, "uuid": "7cf68665-29de-4847-a114-b5c640cb43a0", "value": "T17D44283921E144A7D8BA9E35BF4BC0D17116AEB4017C541F3BB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978194, "uuid": "8cd01873-04a0-4cbf-b401-a59055137cad", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978194, "uuid": "e8b5dde1-76c7-4c8f-88fb-9b5090b2079f", "value": "3072:uM+iOHMwew7+picM/NsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:uMvOswD7IVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978194, "uuid": "5ab90d80-cfcb-446d-b3bc-8d148ff79bab", "value": 272548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978194, "uuid": "a3d5be8c-46ab-4288-97f7-314be1cbf0a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978194, "uuid": "ad8c7fb7-8d83-4317-9713-25625a97743a", "value": "ac9672cc44d386bb6e6e3fe9ba90aeb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791c3395-1f1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1688991764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991764, "uuid": "76696f1c-97b6-4d03-a6bc-5e197a152b38", "comment": "Malware payload (RemcosRAT)", "value": "698ee145bc863d67e0b1adc859954c7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991764, "uuid": "1c99a146-5151-43cf-9176-4d2cf98a8366", "comment": "Malware payload (RemcosRAT)", "value": "90bc8170663508b6a98ddf3a1deea37625f6cc98e552659a21e3cbe60af0f208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991764, "uuid": "1825aae4-ee29-4c8c-8454-a26b12707343", "comment": "Malware payload (RemcosRAT)", "value": "f1d427cb947d86be88969975c43873dde7738aae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991764, "uuid": "3b67274c-a230-4eb6-9bb4-67d208115d4e", "comment": "Malware payload (RemcosRAT)", "value": "8fe9a2cb40cb22a14d1878b452fc9d716ffbd523e810204a897383c5a4d7441efaf3bd583ceb3bea1daec41d90796c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991764, "uuid": "c1ab7a68-a89d-4db8-a940-3d26703361ec", "value": "T1A05402133A6CE73FCA980634793167758AB25F2398205E4733D5DE0EBD223AD190A7E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991764, "uuid": "f628fd33-ea0b-44a3-a1c4-604d38b20a7f", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991764, "uuid": "13df05ed-d5d8-4f4d-84df-322611279423", "value": "6144:kT4DteA1r5RhaQB/0O3Pt33BkX69pSrlFCMjupWJW3F/+52FL6M4hmzv5Jf7IFUp:kT/A1r5RhXBsO3P5Bx9crqSupWJ8FS2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991764, "uuid": "525f24f2-76e3-41f2-b70a-9aa78d4f6e30", "value": 304056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991764, "uuid": "952a7d6e-ed7a-49f4-ba11-62eaedfb4bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991764, "uuid": "22eeecd1-cd24-4678-aa18-e35d6f71f43d", "value": "INQ#GW1505286 G12023000003293 25566-236646 Bulgaristan - 7A037 INQ3910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9320dc-1f18-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1688989869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989869, "uuid": "fd2933b0-a952-45ae-85a7-7417b469fb29", "comment": "Malware payload (CobaltStrike)", "value": "dd87a841dcf6d3c7d342fc4cbff87f62", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989869, "uuid": "d928e74f-d5c1-4172-9ee3-a30b81d03366", "comment": "Malware payload (CobaltStrike)", "value": "90ef0ec74f1a5d49a9e605387dc8807bc8c6967ccfb5cc94678df73c340385ad", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989869, "uuid": "71bfd869-b41f-4efe-8a92-b4bc38c8060c", "comment": "Malware payload (CobaltStrike)", "value": "ab166f8fd700246ab05f9cd72fc0711d89f035c1", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989869, "uuid": "70d308ee-f1bb-44d9-a31d-e233ba8dab4c", "comment": "Malware payload (CobaltStrike)", "value": "3d3494179fd2da8e9bde5a5db98a893d02fa83498d9546ac44d09e997d6f9d69617fbac921c9750aef1c7362e22b946b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989869, "uuid": "72a7714e-55cf-4b6b-a585-f4bbb292762d", "value": "T18185E181AEF40EC7EB6A633F8CF153A27339E45A430363074D201B352D867E69E59769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989869, "uuid": "e32be8c2-cae2-4d50-a747-43c2d8bc9d29", "value": "b431941c337157e834b54d99a8a6e679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989869, "uuid": "cba429f8-6db1-41e2-a23a-2247804cfe1d", "value": "24576:KrNhFvgwGS3fGYD3ChJLfl4F2kXbu6KNAJCGvHesNHwZ19cOr2lq4RcV+wmpfYQe:qXpmS3+YbC/urueHesNHQD6M9hce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688989869, "uuid": "67d2ab41-b636-40de-bcac-6063431b1edd", "value": 1745900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688989869, "uuid": "01a6d1ef-deee-4f41-bddd-799808ebf521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989869, "uuid": "650fd2e2-b673-4010-ad5d-68da50532851", "value": "vulkan-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228e892a-1f2e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688999350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999350, "uuid": "98b6ee72-5861-41c2-8224-cd5912a4bb67", "comment": "Malware payload (RedLineStealer)", "value": "68b9d46cb4498e49e084e54ec73e659c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999350, "uuid": "0df1f562-f666-48bd-a26f-e97f01f7e6dc", "comment": "Malware payload (RedLineStealer)", "value": "91da85daf6df1f2a381493425471c65c1caf622791472ee7e1e7d551d4d611d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999350, "uuid": "dd6b8de9-51f2-4820-a983-45eaacbb972f", "comment": "Malware payload (RedLineStealer)", "value": "51c333490de2a8150ef39ce4a6fd51bcc439146e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999350, "uuid": "dcd18c31-643d-437b-ad19-32c9dace791b", "comment": "Malware payload (RedLineStealer)", "value": "ab6594ea7a1fc89641819d4d17192f951bf2dd5e0b22ec05ae599dabd6d4721a7cdac91552461dbb3ae63c4feebbb622", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999350, "uuid": "5f1f0f17-cc42-40d9-a889-e93dfb1ad49a", "value": "T105752303EAE88573E6F167702CFC53D34A37786409B593571A82896A3C76BA4B271337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999350, "uuid": "966f7c9c-3c10-49eb-b388-240880613b03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999350, "uuid": "7a2597e1-71cd-4568-879e-97b7c3300b81", "value": "49152:vRJSITORDkr6F1JXxAiTVG9DWwOESEhU:p4lRDk+F1JB1+OEPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688999350, "uuid": "ae7051af-4e3a-4a6a-9ff3-8835a7b8378e", "value": 1587712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688999350, "uuid": "01a37541-4110-4247-8542-33439ff91a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999350, "uuid": "bc43a964-6ba2-4fe5-b54e-b87899c30991", "value": "68b9d46cb4498e49e084e54ec73e659c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb2ac7f-1f4e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1689013060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689013060, "uuid": "806de9ad-5071-4257-ab73-a1d29069e032", "comment": "Malware payload (ArkeiStealer)", "value": "e8fa74f4c311b7b81c65c31be3f27bf0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689013060, "uuid": "d0446c74-4d50-4b6d-8a0f-c3378a3b51af", "comment": "Malware payload (ArkeiStealer)", "value": "9246fb98c415ca4531a663cd71a3fa2a09843fe8ca84520891eda8fb57d42b31", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689013060, "uuid": "14131186-10ea-45da-bdc3-6f9cbc331473", "comment": "Malware payload (ArkeiStealer)", "value": "2152a68d666039e737b2b4d2f1389334bd6fc763", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689013060, "uuid": "f1ce8a18-ef60-4c5d-a2ad-aa0cd94b55a9", "comment": "Malware payload (ArkeiStealer)", "value": "9e99ab78f0fdb3a73a01eeae406c24e58e66359f0c493325579ddca6c96f42aa7390798f8293792534bf4fd9307e8824", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689013060, "uuid": "e735a2eb-daff-4ff0-b34e-736947086838", "value": "T19625AFAA5A4445E8C752023390AEC57344157CE3ABA074E5E749F22303B3E87EB7B67D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689013060, "uuid": "3b943cb0-c8df-4d83-84ad-7591b6a81f40", "value": "7d778758ec3a7b9a67aee00a1e103889", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689013060, "uuid": "f505237c-2594-4ce0-9920-e5562eaec7eb", "value": "24576:h9z62mzCIUOk/nZTdqWYPEdx5Vdj1nhTN:P62nIDstgPwp1hTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689013060, "uuid": "50d67281-9f0f-48df-8670-a17f024ce2d1", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689013060, "uuid": "e4c50b2d-21ed-47ea-b2d0-1ec839af2d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689013060, "uuid": "bf5e515b-3568-470b-af71-176d3db5703f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4abc79-1ed1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688959668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959668, "uuid": "e521d2e5-b59d-447a-9f6e-23c23252ac99", "comment": "Malware payload (Amadey)", "value": "448352c3f1df16d4c6d7c6f2532d9a34", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959668, "uuid": "b691b415-63bc-4a32-bcbd-08bc1ad332ea", "comment": "Malware payload (Amadey)", "value": "92609a32716b3d8664539074506404815e764eb4b963c62098b0b39c6bb8d0fa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959668, "uuid": "d58b5725-3f6e-4b62-9b86-e8487c7e9580", "comment": "Malware payload (Amadey)", "value": "196fc238c7e887376c4c87abd57cb7886512eef4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959668, "uuid": "a2a11047-a123-4d9f-9bde-79d8b4e8e2a4", "comment": "Malware payload (Amadey)", "value": "f35f63458717cc36c567ccf8e87757406b31d6b17ff4a4d077f28a3c4325641e895527587a2afe9e6900c8c57fd2a44f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959668, "uuid": "ff190053-cd4b-496c-a0ea-5ae82d5d0e25", "value": "T1F5C40220B0D39923FA7304771590811FBF0FDA3555956A83A3C57A3D8B792D24E3ECAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959668, "uuid": "530abf0f-5937-4fb4-a806-a58d60e17906", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959668, "uuid": "ae7c86ed-057a-4d68-9b24-bbe86ed7b5ee", "value": "6144:TUSoUTLHHBtxCWGYLUz247VZwm7jZJnYUWSVFmiBvLmZ8tf4rullalqr73alyt3b:TU8Hxz474uZJYrS+iRmGAra7ql67W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688959668, "uuid": "1abfd470-7fcb-4b5c-ad58-e70d8ee48de5", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688959668, "uuid": "2f3de29f-27c1-4ae0-894d-0c7307a37551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959668, "uuid": "8720b341-11fa-4f32-915b-5dce522d924c", "value": "SecuriteInfo.com.Variant.Lazy.360290.20309.1877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20a4e89-1ef1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688973364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973364, "uuid": "2cd066c1-dca8-4f34-9e25-f9ab7de68d3c", "comment": "Malware payload", "value": "3a4aee7b25d75b53216a78ae8fb193eb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973364, "uuid": "30d0849e-ca61-442b-86e6-586c36788bc4", "comment": "Malware payload", "value": "92c1f1dd75e3a58e8cc9db8db46f742bf5748a7af92d9439a7d6fbe84d2b6697", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973364, "uuid": "add10c9b-f9a9-4958-82c9-b3b7e2fd1481", "comment": "Malware payload", "value": "0707830fe0a8bc4f820db00a8aa87321be525ac9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973364, "uuid": "8190451a-3381-4347-b13e-9ef528db4c62", "comment": "Malware payload", "value": "2aa7de5ebb62a33f866cc36ce08b29b4b24819aedb86a962114447a25830b56d29a92de92e87204959fde86802ea7fdd", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973364, "uuid": "0c6b443d-aec0-478c-87c7-8e776a606e36", "value": "T1E505833D18CAA567D278EF964424EA59F2C3B34237835BBE75D2C6A18102339F6C139D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973364, "uuid": "f4e6dfb1-4950-455d-9a18-b6cf44d6d66e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973364, "uuid": "31602944-fb3d-4cb3-9877-4e3f324542f0", "value": "12288:OkaMrcbbHMmNdpHsKr8rLZd4IcJVb9j1tL4EyVMDNc8AF9sbhz/sVijP8DcTN:N33RYbt34EyV+AF9sh/sVgPcsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688973364, "uuid": "8f8e0805-6d81-49b6-9b03-140b9a672cce", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688973364, "uuid": "9f229a0e-2be8-4a3a-b87d-46f74d0a381d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973364, "uuid": "48a8f2fd-69b3-41ad-a6ff-ef640ef564e7", "value": "DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba54671f-1eed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688971687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971687, "uuid": "397a90b2-596a-4130-af78-48516dc4ec47", "comment": "Malware payload (AgentTesla)", "value": "3073760cfff7d89a986fd5611cd997a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971687, "uuid": "b23f8304-9477-4b6d-a28b-ba09d5733474", "comment": "Malware payload (AgentTesla)", "value": "930ac5c7da662a0118aba6fa78aeadf706ed8b5ab98e03b94dbd04991dfd2b7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971687, "uuid": "2ec29407-a94b-4a8f-8c34-bb73ac3870f2", "comment": "Malware payload (AgentTesla)", "value": "7678df3bfee89cfa43a535492c96e68534de500f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971687, "uuid": "c936b667-b945-401e-85fb-3c467f1a55e8", "comment": "Malware payload (AgentTesla)", "value": "c41a3e4a90a9b1664efa59eabb97683a6a7b3ce02cf3c8d7890eb7a7052996c8d30cf52360ac13f2c3e8b57c1879d10c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971687, "uuid": "7c24e4cd-7fb6-4083-9dc5-1140a800c1be", "value": "T1E0D4F1067A3BEF23D5B8D7F30931208457F821A270B9E2165DC660F649BAF104997EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971687, "uuid": "882742f5-aab9-4648-bb72-48d8d43e51dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971687, "uuid": "892e8fc2-a99c-41ae-86e9-f8a8279204df", "value": "12288:H/DSXkE3ObVWYbRMUEoEsc9SarepAyohNPsRS94j60pl:HEkE+bh6VtCQepabURS9/Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971687, "uuid": "b947f80b-93d5-4a49-97c9-546852a8ee53", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971687, "uuid": "dba66594-6381-4653-a7a1-a36457cac144", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971687, "uuid": "54a3b26c-bbd6-439f-a577-2072f6a444d9", "value": "USD $321,369.05.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4f04b5-1f27-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688996679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996679, "uuid": "aa6c2ac6-cec2-4b97-8da3-6a5f4efdae21", "comment": "Malware payload (RedLineStealer)", "value": "554ddb66d5d561f3e5954b47c46b4a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996679, "uuid": "6a88b520-c25d-42e8-babf-1ab12fa4c0a4", "comment": "Malware payload (RedLineStealer)", "value": "933376e38f0ef413916ab8cd713b9b44b57f152c7d2e9ecb4af5b514012925c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996679, "uuid": "3509eae2-a429-4f77-9b05-dd73de12a992", "comment": "Malware payload (RedLineStealer)", "value": "af99273250955125dbea0ea90c60d048e5bd4722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996679, "uuid": "df121242-b02c-45c9-9fae-e9efd0d8a1db", "comment": "Malware payload (RedLineStealer)", "value": "0ce17bc22116905bba7543ff2a2e1f9b98af294ade83c18988d3b1af861875451c89537b455c03eadb82dfc7621072a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996679, "uuid": "b162095b-21f4-4c43-87c0-1bf24489c630", "value": "T19E64CF03A6E1BC63D86EC632CD3AC6E4367EB9614E59775A22387E2F18701A1F173351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996679, "uuid": "e259ef8f-0a60-48ec-8894-ab9767c01877", "value": "89580c01d87da774c9ed352344b8ed4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996679, "uuid": "e6aba66c-81d0-4dc8-b606-393b00da7548", "value": "6144:E7SLbLe/RRV+3DQqwhAlWWhywHdE0AV9uS/FZO:0SHS/RRVmQqwhAJkwTW9uK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688996679, "uuid": "581816f0-3cc3-498c-9820-090b1c570ebd", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688996679, "uuid": "adb56bdb-8b7a-4ffb-94ed-b08f16028b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996679, "uuid": "c7a9897d-e8bf-4d19-ada3-3f3db49e78e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0553eea8-1f3c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689005314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005314, "uuid": "1f33baa3-eeaf-4aab-b45d-a8d6a4a3eabe", "comment": "Malware payload (Amadey)", "value": "5b558774d4486b26e57bbc6e4ac6b57f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005314, "uuid": "4e52bcef-bcce-4a23-9664-b602aebdd1b5", "comment": "Malware payload (Amadey)", "value": "933ef5632cb9efcfdd066357d6d3cef5ee2fda4fda1ad8e2a5c8fa37a5e983f8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005314, "uuid": "9fc8bb60-749b-4943-8418-41a248bad7c8", "comment": "Malware payload (Amadey)", "value": "856138aaa324d4a461e2712e661c718e8f3aae78", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005314, "uuid": "4eba6b49-40d1-4ff8-8e2e-e046430e9066", "comment": "Malware payload (Amadey)", "value": "546635a7a8a52bc9fb2d14711a6684be45d061cade28bd1bceabca921e441dffb7a8cdc045cc0a1f88e23e3f8c4a8234", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005314, "uuid": "d76c4107-a0f6-428f-8582-3e12e075c39c", "value": "T14E152346EAD4C133CCB96B70A8FA07C305387CE2A9B8571B3766994A5C72751A43373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005314, "uuid": "322eef28-a53f-4e5e-be99-0040fcf6cee4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005314, "uuid": "16affa33-c07a-400d-b8cb-f7221ef434ac", "value": "24576:Py+skW5QXO0H7qvspKkkrRh8tfi/Dpy0LHOz:aPZ0O0H7EkkrD8t6UC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689005314, "uuid": "63645d59-ae1b-4057-8e88-94f7ce987ef1", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689005314, "uuid": "897ab862-b33e-4f32-be94-cab206adb576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005314, "uuid": "310252e1-76b3-443e-b41a-6f82a9bcc229", "value": "5b558774d4486b26e57bbc6e4ac6b57f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df49d8a8-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978192, "uuid": "b20ba7a5-78a8-4e06-94bc-373c36e06513", "comment": "Malware payload (RedLineStealer)", "value": "39e118c48a8234703b941312b9f57752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978192, "uuid": "75236376-0a20-4847-bd54-af7500e837de", "comment": "Malware payload (RedLineStealer)", "value": "94169a0e4f1cc9cb80e3a9e177e1fa3eb4de34a46e655c3296c838ef9a45038f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978192, "uuid": "9decc1b5-4e9d-4599-886f-6d84eaee83f7", "comment": "Malware payload (RedLineStealer)", "value": "0ea822bdba7a0df79d1e341fcdc7b33d67c62cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978192, "uuid": "b4954ccc-8039-4ba0-95da-7e1323596d07", "comment": "Malware payload (RedLineStealer)", "value": "e8ccb01a3b39733b747dc5add1e06b1d51014413414a2c9a8e64db4f66cb386cd50d2765464a031c3de1789f951b6bb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978192, "uuid": "e5759f27-7571-4cd9-ba6d-b4a29d14d090", "value": "T17AB40260B1E29A23E532153719E0822FFE0FDE714991868793C5763E9B391D18D3ECB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978192, "uuid": "7c05064a-fd98-40e8-aeff-0d635637f085", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978192, "uuid": "c4080201-6597-4af3-8e24-59c94dc3e2ba", "value": "6144:MZU7/YCVsHBF3CWGYLUz247b+YZKn5/BKBEr0KFslVPGC53h8OYilu9RxXetRu:MZUU7Lz47FABKBErFKlFGC53hVqpGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978192, "uuid": "6c83c97d-0af8-4b53-9946-115e2f69e87d", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978192, "uuid": "4e80ba40-2118-4b4a-8dbf-91ad4bd7a0c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978192, "uuid": "3ebb5a72-34d5-462e-a69f-e72824c86686", "value": "39e118c48a8234703b941312b9f57752.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a477091-1f30-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689000195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000195, "uuid": "92749cdc-dd2e-4072-b923-390cc2b2197f", "comment": "Malware payload (Amadey)", "value": "66e6e6f92470c85016112d1e95aaea0b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000195, "uuid": "38daf76f-9898-4dde-b730-05f6d2cd3d34", "comment": "Malware payload (Amadey)", "value": "946081ef88ab150b49ec465fab4848b184df2497856da09835a6d91f55c9b8d2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000195, "uuid": "c7ef56ff-0c71-4fa0-9aa4-fc0bcd120d57", "comment": "Malware payload (Amadey)", "value": "6cff3a6697981d51df4ed46127b4c46d42ae0613", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000195, "uuid": "06e61adf-8fcb-4568-98d0-a8adb21aaa5b", "comment": "Malware payload (Amadey)", "value": "11b47491fce428ad6883ef3c4c414d7c9f091a8811e2f66e52c40999664040eb65f4057c7b7e53fe73d8ae95c98f401b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000195, "uuid": "9e2e2d77-de9b-407a-aaab-e818d68b9ab7", "value": "T18515220262D80873DDF51BB058FB12A30B3B3DA68D7857672B925A091DB1BC4B97133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000195, "uuid": "ca68103a-437b-4c63-9708-b02ddb3d4f96", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000195, "uuid": "0ee4b817-d299-41ac-b366-f4fa75930a14", "value": "24576:xy7ie3yc3sFBDZWicGLr5XlvmqHzp3Zb9v:k2e31cPDZdbvH3ZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689000195, "uuid": "9704e43d-a9b7-4907-938c-d88c2e1fed9c", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689000195, "uuid": "57237dd6-62da-43b3-ad0a-65dc2a1ac37c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000195, "uuid": "81e846bf-196c-4b77-8126-7f5c91b8f21f", "value": "946081ef88ab150b49ec465fab4848b184df2497856da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8911d5ae-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688991361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991361, "uuid": "7366cf33-7dc5-41b2-87fa-a1369faa635d", "comment": "Malware payload (Loki)", "value": "ca0b257770870975eac587035f76c6d9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991361, "uuid": "88753df1-dd99-4661-af9b-0d441822ddba", "comment": "Malware payload (Loki)", "value": "949526a4d1c73354455f49c4cb0fd1a14d3e91cba9767a2b6f491ce80c59a0c3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991361, "uuid": "8c6e8e28-641c-4741-a50c-2db25fa24b90", "comment": "Malware payload (Loki)", "value": "d1f28f42839dd177f77c71e61895fedd29309171", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991361, "uuid": "956e19f3-2d06-41e0-aa08-cde7544e752a", "comment": "Malware payload (Loki)", "value": "25d5a6bc14bc3972aeb3ae52d1263c417658e20be45d493446efb6e0bf3c280c9b6ad0405fa7dd54b1408850609c191c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991361, "uuid": "fea7d6f9-03c3-4946-bc1f-6c2fa2888c2d", "value": "T196B40253A5A5E336EC1C1FFD20059489139C6C599CB8DB3C8C6B9CC6CABAB7404AC797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991361, "uuid": "fab06f0c-3425-496f-a634-569864aae69f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991361, "uuid": "0391e214-ae4d-4d32-aaa8-eacb84d8f2bb", "value": "12288:XtpHtukT7byjyQPlyJHqFSMi+2DN9ngGbDqbcYkHi:XAkfbPg0J6+DP3bScv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991361, "uuid": "da4e664d-11d7-41c2-ba15-ff2a0da9683b", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991361, "uuid": "4f10d1a3-37ba-4a6f-9a2c-936f388c43c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991361, "uuid": "ff41f4be-fc29-44c2-bebc-1ef5691c5d4d", "value": "DHL Express_AWB#3020098038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bb12ab-1f11-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1688987165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987165, "uuid": "39569283-d671-43bf-bd61-a266fd1b3832", "comment": "Malware payload (STRRAT)", "value": "cec88744f59f368b395a280edaa3c49e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987165, "uuid": "5238c0b4-d169-4947-920d-950fbe787407", "comment": "Malware payload (STRRAT)", "value": "94e0846654b56f99781b6d5d939631304a1ffdccbd95d62bac614e8ed71c672d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987165, "uuid": "f54f3bf2-b23d-404b-87cd-802d311dc574", "comment": "Malware payload (STRRAT)", "value": "003185cfa5142697b19ff55e5d8719d2dfb0eef6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987165, "uuid": "fcc3c027-c8bc-46b4-abc3-08637d4fce4e", "comment": "Malware payload (STRRAT)", "value": "7d344f526c113e23a399493ec94589bd2017f892429ee2790f28234cddb12fa42da01735b145a6eb9d8fb454d4aa65d2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987165, "uuid": "16567d43-e68e-4854-bd2c-35ba03ea8ec1", "value": "T12624013F7AE990ADE50B603655088172EA5D4AADE109C47F65FC18068D3AC3F1A43EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987165, "uuid": "c11857c0-5392-4384-a0f7-210e3ad99ee6", "value": "6144:1hgGY/tk0gSh30Y2BpU7qyQYR4GOfMo01Tu:1hXYBn30Y2BpsDQYR+fMvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688987165, "uuid": "34c08cb7-864a-46ed-9819-81d82f60f8e5", "value": 223542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688987165, "uuid": "104a24b7-9314-402c-bc9a-5036a64469c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987165, "uuid": "8779e13b-d5d9-4a40-9a00-d5936eacebb1", "value": "Invoic_#100723_pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b094199e-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968235, "uuid": "7a3fe381-10f7-43d6-bbba-675d83921cf9", "comment": "Malware payload (Amadey)", "value": "260b86351cc40fdcbcf3b27416138fa8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968235, "uuid": "4738ef84-684f-4a41-929b-e35cac642920", "comment": "Malware payload (Amadey)", "value": "95317192411cd27e77b31ef05924828cb5ef54abaec988d8a87fa1d8245cad99", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968235, "uuid": "392d51fc-ba5e-45bc-8928-7c7523e9b61c", "comment": "Malware payload (Amadey)", "value": "7a9efa561ff7b8d394eceec11f793b41d2a8b34c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968235, "uuid": "a54bf97f-cdd4-4a9d-81e7-2b7f4839bd35", "comment": "Malware payload (Amadey)", "value": "afe8fc4f9fd9fd03493489b8de897481f6482ca4713d23bb1903f4eac11288e50f622e39d93c5abee55ec9e26ee6af79", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968235, "uuid": "9236df11-6f1a-4adb-b901-3acaffda85b2", "value": "T166C4026171D68633E57340732590922EBE2FDB710D605A8793C67A3E5B292C14E3FCAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968235, "uuid": "1bbe6588-1448-49c8-abe5-bee6cb495d5e", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968235, "uuid": "349667ff-fea7-4a50-b091-695f0b5df0b9", "value": "12288:oOgHYBz47llc39gEKWYzPXWRVwvb1TTKWQm:O4R47MNgn7zXS4HQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968235, "uuid": "34e6bf84-831b-421d-a6e4-217265f4bae3", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968235, "uuid": "8df2c0da-3632-436e-88f4-1c02c4a821e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968235, "uuid": "a2273925-6b46-4a60-9690-40a0f757fff6", "value": "260b86351cc40fdcbcf3b27416138fa8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db554ccf-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688969166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969166, "uuid": "ebb13452-6cb0-4f17-84d6-794b39b52dda", "comment": "Malware payload (RedLineStealer)", "value": "cc446de9d3e32e7cec9bddca76f4ebec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969166, "uuid": "35c3da9d-85e1-4f0a-be97-12674b1a2d9e", "comment": "Malware payload (RedLineStealer)", "value": "9606e8332456670c6cd5f5dec6f9315a3fcc7eb39a9cf036d6a208d8f06bdba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969166, "uuid": "a4a6fa1b-cc3c-4799-aa69-ed91cfd90aab", "comment": "Malware payload (RedLineStealer)", "value": "f07d3a0571a4a712abe87e1f675966c62fce0cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969166, "uuid": "d12ad29a-51b2-4bd8-8deb-d4d791011d1d", "comment": "Malware payload (RedLineStealer)", "value": "a5fff749bdc19daefc2e2220c6e6fb114a0fdafdbfea9faea56b089218bc06cc3299885ff51906eb00e78ce0ecdc4f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969166, "uuid": "6b522f97-c117-46e0-902b-79a40ae17772", "value": "T10FC4016071C24933F57248732590D26FBE2BDF3159A05A8793D9763E4B291C14E3ECEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969166, "uuid": "b98e7b32-d821-4315-8aba-8f46ec2e741b", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969166, "uuid": "a1e1e38c-e50b-4641-ace3-32c322a49a1e", "value": "12288:DegHO/z47W3qKFBrm96Cyyy1+/lskXiwx:vu747uDC96CMMRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969166, "uuid": "52f659db-294e-41fc-8bb8-7374a85ea08f", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969166, "uuid": "9b64ce72-1b27-4706-8f5b-b1ed7eb6267d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969166, "uuid": "01a34514-41bc-4321-bd2a-0d6865bd689d", "value": "cc446de9d3e32e7cec9bddca76f4ebec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abeb4837-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968227, "uuid": "6127b08d-4805-4caa-8e69-6d2e613300f4", "comment": "Malware payload (RedLineStealer)", "value": "12224051965b057972d4d35d42da3d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968227, "uuid": "a292eb7e-60e1-4d01-918b-4613528d0b05", "comment": "Malware payload (RedLineStealer)", "value": "960dc41c6c706d457b1e5a963de0ff2611be0681c86988df8267628f8e0e7be5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968227, "uuid": "52fc528c-55cb-4ef2-9ff2-3ae7a6c0d6cf", "comment": "Malware payload (RedLineStealer)", "value": "fe29c44938d7e2d5a774d6dae7d32fec7a310856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968227, "uuid": "dd4ec06f-8dcf-4df6-b02c-53f937f2b128", "comment": "Malware payload (RedLineStealer)", "value": "b7d6f474416ce4306e5f43b66349d1413355c7baf4d5fd02ad193ab0f95970576c4821540828596b3409b21a0c754919", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968227, "uuid": "7282c7e3-6579-4a0b-bc74-82c9289eb39d", "value": "T1A8B402A171E24623F636107259E0C22FBE1FDA3215A0975793C57A3E4B781D20E3EDAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968227, "uuid": "63690194-a966-4859-a233-16b1b7b3ec67", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968227, "uuid": "d56b78a4-6505-486e-a71c-d9873c9ef256", "value": "12288:9K0d24z477beJGXXCekjXwXUWYwdcAXs:V26477MN8XS1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968227, "uuid": "0ac908da-32f8-4eaa-8354-843dd59fd37e", "value": 525472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968227, "uuid": "8a2e9783-ff4e-4204-a7f1-11723cbe8e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968227, "uuid": "9e3cb3b4-9a8e-4bac-99d7-06e9cfc5d63e", "value": "12224051965b057972d4d35d42da3d61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f9a36b-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688971032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971032, "uuid": "7e3df9bd-9cb8-4779-abd6-8bb58d28d586", "comment": "Malware payload (AgentTesla)", "value": "ae743e0b73a8d72949fa32216b2fd4f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971032, "uuid": "7d9685bf-d461-4c32-9198-b09f2ea28454", "comment": "Malware payload (AgentTesla)", "value": "96155416decd38f617684fe576bbfdd6437c094a900d078509a20081fea75c97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971032, "uuid": "3b80799e-05e9-4ef8-b6c2-4a1a80d83633", "comment": "Malware payload (AgentTesla)", "value": "eaef4f87ec69602014a6b0e8d8a261609a8b18c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971032, "uuid": "eae1586d-cc1d-43cd-a739-9f8690282da2", "comment": "Malware payload (AgentTesla)", "value": "6d845fd02143e042edc34d444ad0589216f97fa46e185e45d89919296b2912d190d1be14f106fbb6b06894e38421e152", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971032, "uuid": "491426a2-6243-4875-9b65-0e0029ffb8ac", "value": "T19CB423207BC69C952FD23EE91161B465C2F7D5AC1BC0E0E00C6E42EB16E9D37A452F9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971032, "uuid": "1da4139b-85aa-49bd-bba4-90ad75d7a903", "value": "12288:1EZ7v3k7bHflrOaA4DyN29H/2o4257FRJDzwc:1G4pRXS2V+o9/Nz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971032, "uuid": "a5df843a-cb8d-4780-a29c-b4075c8a1aa2", "value": 507928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971032, "uuid": "2df27ed3-1e7e-4ede-873d-e8eadfdc3680", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971032, "uuid": "24c83253-f25e-4448-b9ae-0184f0b12249", "value": "PI pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bce89d0-1f1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688991608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991608, "uuid": "f38f6732-2ee0-4096-a358-8473cf03bda0", "comment": "Malware payload", "value": "ed87cf43c4a1bd2623e19f5138e6debc", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991608, "uuid": "6d9d8cc6-2a95-4e93-b3af-fb1183b0de4c", "comment": "Malware payload", "value": "974dd7a8b2afaabc593b3e8f88bf19f52a742ca7b5c2f02f97125cdefba1b444", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991608, "uuid": "c830170d-4db7-46a3-a150-900b7b99e8ca", "comment": "Malware payload", "value": "67671e0a3697ce7c72c52fe493241bebfbe86bc4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991608, "uuid": "156ee306-b8dd-446f-b7a7-ba330d619a12", "comment": "Malware payload", "value": "0fcc67a329df988e76f283d5a46b95e75771f6266102350f31ef762036f55a6f3c94145383a7e7cb67f0d1cdd5f257fb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991608, "uuid": "7297018a-71b0-494b-90b7-8c4cc877167f", "value": "T12C73AED0378899F1DB9DF7B7A265894C023D717BB94515C8708DF68637BE3098A0C8E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991608, "uuid": "3657fac8-41ff-4145-9d28-42dddf1b4cd5", "value": "1536:I54pe+DwbMndXB/mmG4YgNU7K2w+r3TZpanJcSMsdDGatnQy8uvNQ13mQwADA2rr:IqpeEwodR/mayNp3sdDjwvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991608, "uuid": "f43a980a-2c97-4ebc-94ac-11e1ea04799a", "value": 74851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991608, "uuid": "c0454f43-6081-49e9-a478-ddc31d8911a2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991608, "uuid": "6856c9ed-bdb3-41c8-bbda-0216c3db8673", "value": "Order PSL-6726 CGF0629.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3425f51b-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688977905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977905, "uuid": "9c25dea8-083a-46e5-b0bf-0016bba9dd41", "comment": "Malware payload (Amadey)", "value": "685c520bab661d007248afd1e1934570", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977905, "uuid": "23ab70cc-bffa-4513-8dc7-5ed3db12d7b1", "comment": "Malware payload (Amadey)", "value": "977a3e714c271fcb20e291e806484c1328e32d9eedd4642f7936af0531b46115", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977905, "uuid": "6b8684bc-b465-42a6-80bc-790a66137124", "comment": "Malware payload (Amadey)", "value": "16a7471a8f6d9a0e48e78a9fa1f79fa7a764d974", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977905, "uuid": "5e9c9863-96a9-4d28-9174-b5a542ae13ba", "comment": "Malware payload (Amadey)", "value": "21dfa9801847c43dfd7099a80328014340b5e479378fa29e5a012155654751b4ae8b6225d55c2228311b046ef4141950", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977905, "uuid": "00c28ff8-c67e-49bc-92c4-77df55c2c44c", "value": "T10EB401A1B1D75123F97650331850832FBE1FEA7209915A93A3C9763E8B391C14E3ECB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977905, "uuid": "ac3e8386-2bb5-4907-8b02-a41d012f8b09", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977905, "uuid": "b3ae72db-ee2e-4ac7-a9dc-13ae1cd4bd87", "value": "12288:Vq0dGKz478+46mcOcM9hkZutwMbXLUSzhym:tGY478e8cAtNLISzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977905, "uuid": "4c74bc4c-c6c7-438a-8467-0b64a4cce039", "value": 525472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977905, "uuid": "0080b319-17aa-4f66-bae8-6c2b1026b97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977905, "uuid": "e92e3672-1e79-4dfa-bb13-96579d984490", "value": "685c520bab661d007248afd1e1934570.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8230cab-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968248, "uuid": "db8c06d6-72e4-485c-b002-ade0cd3f870c", "comment": "Malware payload (Amadey)", "value": "326578522b7e0c443103b299e7e360c9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968248, "uuid": "79501c15-5522-4b59-beb2-709737afe1d9", "comment": "Malware payload (Amadey)", "value": "97b8453beba101ca8a8d5cf0be8d21014f2add819daa37f31057421849a06c23", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968248, "uuid": "652b3bcf-6e11-41f9-ba56-08a9f44f9200", "comment": "Malware payload (Amadey)", "value": "c2bea3b5095848bcc0f78b529dc491e15abd8b8b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968248, "uuid": "c740b48f-f646-45f7-baac-57349443b44a", "comment": "Malware payload (Amadey)", "value": "0840e02511221f7b56193b755d92f53a8c0cb1df8e9e244ac9072d1c3657993d7d826caaab3f11e88ba4f9819619a718", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968248, "uuid": "0baa9248-cfde-40a0-b9be-4bab25f7a697", "value": "T1E3B4026071D25923F532043219E0D23EBE1FEE7619A45A4393D57A3E87382D11E3ECEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968248, "uuid": "21889da2-a86d-44af-b567-aef8366a9e17", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968248, "uuid": "12ce0f38-30bd-4f33-8928-a748c380b9a0", "value": "12288:20UMdz47wl9pPq8WUx3oypMhm2shKLSMnUiP:Pl47wnJq81x40aKWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968248, "uuid": "b29bfdfd-59c8-424e-873f-a0ebcc58db0a", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968248, "uuid": "1d7ee623-d461-40c0-92b1-cf72f244530b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968248, "uuid": "93dfb4a1-e470-4c21-9c1f-5100054aa10a", "value": "326578522b7e0c443103b299e7e360c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bf7c9c-1ede-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688964962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964962, "uuid": "3f83b711-145d-4882-8661-975514988e2b", "comment": "Malware payload", "value": "c9eac535c049d5a3aa51c83ba4e5f1e6", "object_relation": "md5", "Tag": [ { "name": "json", "colour": "#97AFB5", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964962, "uuid": "a67c8a88-98c9-4ef2-a9f0-e3f8e85306b3", "comment": "Malware payload", "value": "98a7485404a4c950b167e268e4631381113a25e057bc946faccbe67582037dd9", "object_relation": "sha256", "Tag": [ { "name": "json", "colour": "#97AFB5", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964962, "uuid": "3e3d964a-a43f-459a-8083-80898e834a9d", "comment": "Malware payload", "value": "9e09ff2cf920bd6dc84209f8a9de9a79034e29d3", "object_relation": "sha1", "Tag": [ { "name": "json", "colour": "#97AFB5", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964962, "uuid": "e68c4977-a87c-477b-8081-d95e2919b85e", "comment": "Malware payload", "value": "07d90ad4704352dda968cd76ba0f8920b44723f9c54f38da85d3a534ca73a638f530f73f865269af91ae185618d15b1c", "object_relation": "sha3-384", "Tag": [ { "name": "json", "colour": "#97AFB5", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964962, "uuid": "07116be9-9954-4ba1-ade5-2eb73a71a324", "value": "T11351E87B82E66011A6C697C23907345D817A62A7D650E4D35EF9072DB423DE2331ABA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964962, "uuid": "c943d85a-6265-4581-a0a5-36fabd17d50f", "value": "48:ZLIGr65Fa/pH7Ie5773nXhDVe//xzcbEdFD5YST+koozl9uIJprIs71Ih7XfM9aS:mzzyHkc73xDk5zmSOY+sQGrj71y7PKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688964962, "uuid": "35efda7d-7a40-403b-9314-58cb42d4f3b9", "value": 3023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688964962, "uuid": "40e9864f-b910-4ba3-b142-3b6a8d2ab217", "value": "application/json", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964962, "uuid": "ea3233c3-0970-407b-b59a-7d3c77e77753", "value": "804838895.json", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8105b3-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968252, "uuid": "9c027ea6-53cf-452e-b921-e59a6bbaccea", "comment": "Malware payload (RedLineStealer)", "value": "3e74fd9d332b5405272dc42e888e1fb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968252, "uuid": "78d7831b-c2d7-48a0-8a70-f6ebff7d2d08", "comment": "Malware payload (RedLineStealer)", "value": "98b4f1668de0f64afaa0cd987f32b5c36a8617402d3c0581d3e1f4e876d00eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968252, "uuid": "56673cee-8232-4533-b154-3e2527b92a14", "comment": "Malware payload (RedLineStealer)", "value": "9d895006818a3a86beddd821f811a846df0007d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968252, "uuid": "ff2e3b51-2949-435f-9b10-ef8f077c2a24", "comment": "Malware payload (RedLineStealer)", "value": "faf3260b618af655a4188c45b16c63d362e25c9907fba25a85498f76f330ebc20ae1821ee94c3e2301afd6181f44ed8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968252, "uuid": "1d7b8e2f-74ba-4c07-8a21-0d0eee8f3ea5", "value": "T15E05126575D74D23E63608732490922BFE1FEA314961AA4743C5763E4B391C28D3ECEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968252, "uuid": "01888a28-b2f4-4546-851d-2321b315a863", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968252, "uuid": "0bc7cc1d-240a-4fbd-9da9-aa35e64f07b0", "value": "12288:AS1Ijiz47Kn+EblI9PtNyl0VSLh48gv1PFQljslvIKn0WTtaSEX9:Wg47K+E2HNylGuy8ljsRdT09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968252, "uuid": "854782c7-c78c-422c-a5ed-3a546e93e507", "value": 826016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968252, "uuid": "6a1e0779-42d6-4d54-9e47-db6c719c88c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968252, "uuid": "4eca3df0-82e6-4457-9d4d-e52ebffd957a", "value": "3e74fd9d332b5405272dc42e888e1fb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00991d18-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688990703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990703, "uuid": "2f49c0ef-6d4e-475e-8358-49852358c00b", "comment": "Malware payload (SnakeKeylogger)", "value": "a43133e36b488197598f1d924ec3e959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990703, "uuid": "3072742b-e9ed-4445-ba28-6251a96ab797", "comment": "Malware payload (SnakeKeylogger)", "value": "99122d361d9da4fa84951f7bfc12a6eba1db18570a2c6fc365d8733e7bcb2099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990703, "uuid": "2b46bb57-1e10-4508-8a16-a788375ed2c2", "comment": "Malware payload (SnakeKeylogger)", "value": "78aa3212cac3aef2ca6b1bc9587b05b27832a20f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990703, "uuid": "062a08ca-d95b-4add-8c68-eadac15dfa19", "comment": "Malware payload (SnakeKeylogger)", "value": "c079ed6fcecd6c432e14768ac8cf95838ad73abe9db25dce25bd90095057f20d85d4ad8aee2cc2739b74c291012bfb42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990703, "uuid": "f9313161-a58f-425c-a847-b4b8e7307c85", "value": "T179751202BDD194B2D1721E368676AB22EA3DB9701FA48ECF53D44B2DCA305C1DB31766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990703, "uuid": "055e0264-50e4-456a-b5cb-3e3de12647f2", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990703, "uuid": "10f290be-1d9c-45fe-b470-583a8dac0626", "value": "24576:NTbBv5rUanKob7IetAHI8hEAunyTozjvKOidwt2M4KXGCpmTuqaS5kldpA:HBjVnW96AdTojvMwtzKCA7aP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990703, "uuid": "1ce5261e-d952-4252-9c61-87a55778bd01", "value": 1628526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990703, "uuid": "0553d6bd-e1cf-497b-bc31-e22f93b155cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990703, "uuid": "ae2f0ecf-fb04-4c5d-9d8c-cfed8da77fc5", "value": "a43133e36b488197598f1d924ec3e959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5317fbcf-1f22-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688994277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994277, "uuid": "8a3a3927-2bc2-47c6-9a92-fab25772eda7", "comment": "Malware payload (AgentTesla)", "value": "26d51a20f950dad60e932774cb08da44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994277, "uuid": "1a3dc4ba-d400-4447-976e-56778a50a26c", "comment": "Malware payload (AgentTesla)", "value": "99781a7acc87c8dfd9e66b868bc44fe7e3793c7caba0d0275fa27b869982d88e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994277, "uuid": "504ac552-227d-4be8-a2f4-c3c2184af3cc", "comment": "Malware payload (AgentTesla)", "value": "74d29f7145f1a1532dbf2d0962d426840a68103b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994277, "uuid": "a0b35c20-9ace-45ab-923e-ddc20e4c215d", "comment": "Malware payload (AgentTesla)", "value": "b8416349c3bd9b7b67f739cdac89e3e2e3b0a1cbea54a0e3c65b67a8676788b0cf159a4271b23721b96f701097f0b675", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994277, "uuid": "5cadb3e4-7ba2-4fa3-b46f-26b2ddd19002", "value": "T19EB18314A762D99703D4229C0B938C0EE8273C22A3289F8692D4BD9D7D43789757B6DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994277, "uuid": "cd47d22e-0586-41f6-b6ac-185ffcaf0504", "value": "96:jOayx+vn5ZETSW7Nd7qjSWJsHjeCXCdwL09DhRrazbY:NQEZIB7NoOKshXCKMtJ4bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688994277, "uuid": "4355f1fe-1dec-4230-9e46-ae1a5803336b", "value": 5439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688994277, "uuid": "d895057e-493b-4f74-8a8a-e9bd1cbe48c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994277, "uuid": "bd723ec1-23f0-4d95-8a68-c3f3718680b8", "value": "PETICI\u00d3N DE OFERTA PAR FABRICAR N\u00ba P2023 208 VAP \u00d81200, T-3015..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f82b9f2-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688985735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985735, "uuid": "0d5447ee-d8d3-48b6-ad7d-58dd4c527f1a", "comment": "Malware payload (Amadey)", "value": "960431d0163ae1c0a16c84669265df9f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985735, "uuid": "afe96cf0-5c32-42c7-9e7b-0152350ecd60", "comment": "Malware payload (Amadey)", "value": "9a01475ca13b322e201b413a00de8d39f0875300d053c1a2816fbb011ccf601b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985735, "uuid": "c76e0d25-5c7b-465a-b045-8541cd731b33", "comment": "Malware payload (Amadey)", "value": "ade46fd3efc881061e9ddf7c80ddcee96a0a49fc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985735, "uuid": "39c457e6-8a9f-4d16-b7b8-0b93362ab27c", "comment": "Malware payload (Amadey)", "value": "cd2b4f0f097e08c3eb727a2d67e2a0d605b25859b3deabbb4818c146b595b016e8b81542550470d28261cec42a5e7bf7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985735, "uuid": "a91a1078-cce2-4039-ab8f-0cc3126bc886", "value": "T104051260B6D6A923F635147328A0836EBE1FEE3114954B8793C6763D4B3C2C14E7EC99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985735, "uuid": "9240762d-7771-442e-8f1f-a50563312d07", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985735, "uuid": "06389936-57d1-4dc2-a0e1-c50651187458", "value": "12288:rcw4s3z479hfQDQEbZtYVkvKAqES4ot4y/Ih9K9e:rBj47365bZtEOKAqf+yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985735, "uuid": "8605755d-fba2-440a-9a1f-fc4d01af6efa", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985735, "uuid": "ceb005c5-288a-4686-aca9-664c849cfd25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985735, "uuid": "715ca473-6215-4219-b84c-ccd5123cf379", "value": "960431d0163ae1c0a16c84669265df9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648e6833-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688990871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990871, "uuid": "9221f5f4-dbcb-4e3a-9018-b6ff56877d23", "comment": "Malware payload (RedLineStealer)", "value": "f2f219ec70436404fe1ff585f49300c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990871, "uuid": "c70da7b3-0eba-437f-82db-0fb8abbf0cac", "comment": "Malware payload (RedLineStealer)", "value": "9a365edf5c4d4c5a2c33550e8885c0153ef3eef7cc14cb96978ac83b991b000d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990871, "uuid": "4b12ef49-34e5-47ce-b1a5-eb1ad764af8b", "comment": "Malware payload (RedLineStealer)", "value": "cb896d6a8b9fcaa1e84e63225658e2d642ab3fb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990871, "uuid": "bf5351a5-d892-46fc-a28b-9faf84469058", "comment": "Malware payload (RedLineStealer)", "value": "7239bd099f821f6fb66dcb31a62f24cca277006feca010b5db19b4778fb0564b9da2a17a729c52920218e9a88fdb2ec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990871, "uuid": "d5ff0da0-6371-42f1-91b1-3f2f701dbdb0", "value": "T1FC44283921E144A7D8BA9E35BE4BC0D17116AEB4017C541F3FB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990871, "uuid": "929134c0-7630-433f-be44-ec3024e17361", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990871, "uuid": "4a6dc98b-946d-4b3f-baaa-ae25ffdb5cc8", "value": "6144:FJBQ8vOswD7uVVctqoDo/QnfzKv2tq9L:FJSIQsw3zk2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990871, "uuid": "3774f467-d596-4b80-980b-0d0c038301d5", "value": 272545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990871, "uuid": "61e01a38-8f38-4b1f-9fd2-e70cdc2d8789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990871, "uuid": "8ace338c-ab9c-439b-949a-fa08d261d76b", "value": "f2f219ec70436404fe1ff585f49300c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67acc6a1-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688981856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981856, "uuid": "8c87375e-cc64-4d11-9a83-dc4a3f875224", "comment": "Malware payload (Mirai)", "value": "d2724a84a2ff7d817c4685ba4fa44622", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981856, "uuid": "580563a9-ad32-4334-ac96-96ac358cf544", "comment": "Malware payload (Mirai)", "value": "9a42bc294ec76ea4b6a19577820e8bfa57e711e1cb4378e1b996e55f377c0e79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981856, "uuid": "8535996e-772a-41bc-9bfc-02d0d75ffaf7", "comment": "Malware payload (Mirai)", "value": "5008f65c1898912b98da71194b7095abcda6eb90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981856, "uuid": "34372002-0723-427e-b743-88bd67e18fc4", "comment": "Malware payload (Mirai)", "value": "96029c432fa98b1f4060cc7107c642a79bb957a04f42aefb91bae26bc9e4d685c395844ccd2164b1440ac31e0abb683a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981856, "uuid": "82be0ccb-22b5-4dc8-86a5-a16e6e45e73d", "value": "T1F143F949F990A729C6D121BBFA0D128F73270B6CF3DE72315E309A7537C6A670A3A415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981856, "uuid": "0e6dd6f4-eabe-4bf0-b5ae-adbad2a579f4", "value": "1536:W4niG6CmooH9pSkaQjCTXIniUqzu8AUrx45QYRB:D61ooH9Radzu8AUrx4+uB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981856, "uuid": "1fa695cd-0b1d-4731-bda2-5316859f7c70", "value": 58824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981856, "uuid": "4c9afaa3-5031-43cd-a914-91c39d1ac5c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981856, "uuid": "3c4dfe62-87b4-4fd3-9d21-ac37adf4fb52", "value": "SecuriteInfo.com.ELF.Gafgyt-FH.9566.8627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b7ca95-1f65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1689023244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689023244, "uuid": "894e277e-b3ec-45e4-9de7-55443ee7151a", "comment": "Malware payload (AsyncRAT)", "value": "758234189af5df0fc8ef3aab2cdef50d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689023244, "uuid": "c6bb30ab-3f97-40ce-849b-9ce3a5429614", "comment": "Malware payload (AsyncRAT)", "value": "9a6aa7bc60f817e2c0761373100d5bb22207847da7d8452db757b17c03c18c9c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689023244, "uuid": "a2a89b87-2cc1-49a6-bf99-dc611afa0e28", "comment": "Malware payload (AsyncRAT)", "value": "2a64265c30c3405589f78ec8f23898fa44d215ae", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689023244, "uuid": "a60bd6d9-a3a6-4f0e-91c1-3beee4ac333b", "comment": "Malware payload (AsyncRAT)", "value": "f5ef256f8e7a6b6dccf9ff4ff9fe14c74b67c170de5107508a95b54575c0f8097787bf50c3d74eecf7782ac2ef5cfa09", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689023244, "uuid": "6a7d1ae7-8719-4e07-9907-3fb83aac4307", "value": "T189433A003FE98526F2BD9EB4A9F3654446F9A1676902D54E1CD011CB1632BC6DE02BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689023244, "uuid": "cbb66fe8-59f0-4b4b-ba9f-ef7a0ff481e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689023244, "uuid": "5bbae6b2-b0ca-4abe-87fd-78398d3e8511", "value": "1536:fQhoCxwD5cvP9NjvVwiPKb3btQAroC/BQq7rx:fQhoCxwD5c33vVBPKb3RoC/qqvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689023244, "uuid": "00f3624b-f21d-4ff5-9d47-2aa77ebef68e", "value": 60416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689023244, "uuid": "ffcfb2e1-9a12-4d25-a48f-84a29c8b4ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689023244, "uuid": "b73a167d-5c8d-4bfe-af18-c59c35556d83", "value": "bOja.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cc1b1e-1edf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688965606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965606, "uuid": "102d8ac7-a314-47d0-b783-cc56bff36a29", "comment": "Malware payload (Mirai)", "value": "e1349fe3ef716bbc1f78a33c6ba0d731", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965606, "uuid": "371c5d9d-2c26-4f84-a791-f71280b3d2cf", "comment": "Malware payload (Mirai)", "value": "9acae2e8151f25f90e326f4cf9d1e0ab8bdbdaccb7efa5671f6ca4043258e287", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965606, "uuid": "94314d9f-9461-452c-a593-0c00f27c6473", "comment": "Malware payload (Mirai)", "value": "e4b4f494e8ecfa58f2be3685bf437cb818b73a57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965606, "uuid": "f3ca9a90-aa67-4db4-a2d8-bd464390c0e4", "comment": "Malware payload (Mirai)", "value": "1a0a4bd2128e6c95361be6ffb71324dded67a10990ac12194f8226a05ce457711f89f214fe6fd01bbaf8071cac5ae71e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965606, "uuid": "ee790735-e992-4c5f-b3d7-f1b5cedfe9fb", "value": "T108F23AE2B802ED3CFC5FE77D80064A09F83272595982167663A3FC675C3729C5E66E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965606, "uuid": "019d2971-96d9-472c-9698-0f3eeb9bbc02", "value": "768:KxTM3yyzteI8Jt6cFWQ8jIlaTzRTN5rSM:Kyyyx1CWQ8jIazRTjrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965606, "uuid": "286eca82-b899-4774-8f15-2c4ce2e1c8fe", "value": 35580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965606, "uuid": "a4301e6f-8360-4ec5-af07-db57deb75f27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965606, "uuid": "2ffecb2d-92cb-44e1-bf45-27caabe0d0b6", "value": "e1349fe3ef716bbc1f78a33c6ba0d731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b92bc9-1f20-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1688993347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993347, "uuid": "ce286a09-5a65-4d17-bccb-19df4216cea7", "comment": "Malware payload (CobaltStrike)", "value": "202cfd201273c29373d1ad70a470135a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PLAYWITH Inc.", "colour": "#9249E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993347, "uuid": "c9f9d114-5612-40eb-992c-e4bfde038911", "comment": "Malware payload (CobaltStrike)", "value": "9b2b902f5fd53b72cabfcc0e0191c876c92c1c748bcdbb7c00f9d62d7ba76914", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PLAYWITH Inc.", "colour": "#9249E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993347, "uuid": "910e9f0e-89c3-4e82-8843-4f8f81243580", "comment": "Malware payload (CobaltStrike)", "value": "f5bb852e9880bbccd7c41e75d2741d06a8a28085", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PLAYWITH Inc.", "colour": "#9249E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993347, "uuid": "17409f1b-46fc-48a5-bb02-a9c4b793867d", "comment": "Malware payload (CobaltStrike)", "value": "b0cb59e6aa2106453bfa7e98aafe1b70b5286e8c6e59277ee41bf32d9ea2c2e9332712d8d2d02f99c9a34779f8f2c627", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PLAYWITH Inc.", "colour": "#9249E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993347, "uuid": "8b51af87-7512-4cae-9c3f-3f5c6b51e0f0", "value": "T1EAA47C0963A410F8E0B7C138CD535546EAB2BC054761D7EF03A8B66A6F736E05E3EB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993347, "uuid": "b25d72d0-9e50-4b5c-8311-96a6ceb22a0a", "value": "a4264121cf4de3fb28fcb63412179cb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993347, "uuid": "73efc58b-34df-4879-a65c-5c9544dc17e7", "value": "12288:OeWWYgeWYg955/155/vHqbV6+ZvuS6/wgksMo3/rdv:OefqLul/wgkZadv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688993347, "uuid": "2f6d9c8f-b863-46bd-87ed-25392f352a8d", "value": 454504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688993347, "uuid": "57f3eaf1-497c-4749-be9e-7894d1fb5afe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993347, "uuid": "e35ed411-88ef-46ab-8f7d-a910c7c770df", "value": "PLAYWITH Inc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f8a0a9-1f19-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688990556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990556, "uuid": "397fd22d-47a7-41ce-9ab5-1f6112092393", "comment": "Malware payload (Amadey)", "value": "1239719ec23aabea2e62473cb6ee4c0a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990556, "uuid": "6982956b-7ebf-4a95-aabd-af1a9aaad6b3", "comment": "Malware payload (Amadey)", "value": "9bbe0eafeb0414bc20ff19ca1589de8c6c937e110f1bbe4764eef06e2165fb43", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990556, "uuid": "4afaa340-15ed-4c87-b42f-5d1f4579d44e", "comment": "Malware payload (Amadey)", "value": "7c6ce57de1cd21968f5d1c0b7ef6040fdf40f5ed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990556, "uuid": "01b4a0ad-a8cb-4236-b205-71bccc4d5b62", "comment": "Malware payload (Amadey)", "value": "052044544dad1ae8a17de306905a477edaf4f5669b737caf139f0390bd7c0f11432eca6ab9ec05ebf347b0e341b1fa4c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990556, "uuid": "f7bbb924-c8f5-4fc7-a92e-634a88e50094", "value": "T15DC40275B1D34A63E5B2147629E0813EBF2BDE3149A04A8353C67A3E4B291D14D3ECED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990556, "uuid": "32650166-1afe-4dfb-9bc5-dd52c7eb2dfa", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990556, "uuid": "36069004-4548-464a-bebb-73a7bd993300", "value": "12288:TOgHsxz47wAbTf/kPrNKOqBrWQ5v2SNM:PMh47wCbAKOqBT5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990556, "uuid": "2ec3ee97-0958-4bd5-b977-570a59d4b161", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990556, "uuid": "87ed6289-253b-4fae-8184-e46785ed2b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990556, "uuid": "639b6347-3105-45a0-ac39-30f0241dddbd", "value": "9bbe0eafeb0414bc20ff19ca1589de8c6c937e110f1bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f548994a-1f5c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689019460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019460, "uuid": "2452582c-93ec-4085-8601-dcafe28c221a", "comment": "Malware payload (RedLineStealer)", "value": "c30d6278694817d3cc99f6ff5265da74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019460, "uuid": "44b6b511-af5c-4d5b-a133-d1ef10f2642d", "comment": "Malware payload (RedLineStealer)", "value": "9c63b1ba6018935ad5e5fbb92f79d2bbd6eeb9ee0520ed5cbe7b9e1213eb33a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019460, "uuid": "6bbf2a8f-3399-44af-a014-bc28e6f95b8c", "comment": "Malware payload (RedLineStealer)", "value": "350567243f65ea38c3bcbc24fc93272e4e46217b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019460, "uuid": "0df85cde-ade8-453d-bf80-eeefe4ff00f4", "comment": "Malware payload (RedLineStealer)", "value": "2c8f1573f04d5b19ba44e0e505c354ebe5cd64639c5f26923e14f50224f4bda6c71362421903bacf1314722096cc7252", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019460, "uuid": "f93fb281-4aaa-4f7c-95cc-da781e609e41", "value": "T10075235762CACC31EDA67F7031F227970E36BDA15D3097A71215EB5A04B11D0A0B2BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019460, "uuid": "598a8749-5f57-425d-91de-adca62282b76", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019460, "uuid": "5baed52e-9d86-4499-9fe0-f3e7c4346082", "value": "24576:cy51XtT3ttYzCJsw66AMLRzIdYiQceweiSKE70EpUSn6qY0I+mUNNqU:LHXdttB0uJKjQTkE73pBDY0I+JNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689019460, "uuid": "8820a194-fd1e-4516-bfd9-0e2ecb02516b", "value": 1584640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689019460, "uuid": "6ab00ff7-4e66-41ec-adeb-8dfd43782c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019460, "uuid": "2767bad8-7b0f-4900-b226-7cef274cd670", "value": "c30d6278694817d3cc99f6ff5265da74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9c75c9-1f76-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689030586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030586, "uuid": "937dfdc3-ebe2-487e-8474-644b0fba6fe4", "comment": "Malware payload (Mirai)", "value": "2017e9f050afa17a57f77918ba8e69bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030586, "uuid": "5a21d116-ded9-498e-a0f9-ca2aea0ae741", "comment": "Malware payload (Mirai)", "value": "9dce920699b7c2967722d926a94cb34ab98b6bab9180f10f2bf786079c4d0c57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030586, "uuid": "5aa694b2-a83c-401c-8ab4-57742175bff0", "comment": "Malware payload (Mirai)", "value": "e1419784beb2c6dc341cddf1aa567138ae789660", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030586, "uuid": "85c1eaf8-c615-439b-9e55-1a4c66b0eeb7", "comment": "Malware payload (Mirai)", "value": "f0cc5af68ffeb1ee7a79865fbf8472541e995a31ed37f1ecc043135a18a55bbb255cc75c117deb65c8755fc87405d1ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030586, "uuid": "ebc389b5-d24c-429c-95f0-0a51a9cbcc9c", "value": "T119A2D025D3456FF4DFAF9DA45381C2C27AF547C7278AC8E240EFAF012906046B789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030586, "uuid": "9b6f7a6c-2ae0-42ba-9d31-7174e54faf1b", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5W1AM4uVcqgw05VxJ4:mRxsSVsMD6xiJJE5zRWN+/4uVcqgw09W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689030586, "uuid": "f77ef2bc-ddf9-4a91-923c-15d37bfb35a4", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689030586, "uuid": "4d251aad-3303-44be-ab2f-80c9f614a157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030586, "uuid": "d8fca8c8-ef2b-4b9f-93b5-68200b5be409", "value": "2017e9f050afa17a57f77918ba8e69bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa175178-1f19-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688990558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990558, "uuid": "a344317e-e65f-4871-8513-24f0e9303b30", "comment": "Malware payload (RedLineStealer)", "value": "7ea9bffe65cf46fc2304be2dc7c5cca0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990558, "uuid": "0d1a4c6b-ccd1-48cb-ab56-46961e2f9ed5", "comment": "Malware payload (RedLineStealer)", "value": "9de4fce15792ed59e7e66b908dc84062cc5da464dc765ca8131d1ec2a884e135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990558, "uuid": "0fb473de-4543-4aec-ad28-c1a168dd0c1e", "comment": "Malware payload (RedLineStealer)", "value": "885a88d787e3ba2e82c410bebc8f606d9ad1a066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990558, "uuid": "6684376d-d35f-4375-b6e2-acb1ec7e854f", "comment": "Malware payload (RedLineStealer)", "value": "4d8a75188963c177c7ae2f38425f31a9ee3f2051e941b89dc97c0f40deafb14c205306fa29d2c837da8063b3c5038cd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990558, "uuid": "7daaddcc-f684-4927-9e31-3bb33790763e", "value": "T11DB4026176D29923F937447354A0D22FBE1FDB310AA05E8393C97A3D87291D14E3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990558, "uuid": "a8bfe3a9-c2d6-4e75-ad77-0200a1b18ac7", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990558, "uuid": "1d44460f-beea-46c2-8c3b-f036cf78ab8e", "value": "6144:8k7/YCVNHBJECWGYLUz247UUfITmhX3/+uRndcj87KPCyTxvDw3zAoy24RqbNxe4:8kUimz47UUfIq5/+8d8KzSAZbp/Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990558, "uuid": "c22b9c6a-9e3c-4d0d-bdb8-a7d4869198f1", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990558, "uuid": "5d563d9a-58a6-4439-b85d-3681a0c053d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990558, "uuid": "eae8270b-0cec-4bbe-90d1-684d19224e40", "value": "7ea9bffe65cf46fc2304be2dc7c5cca0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cf8531-1ede-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688965257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965257, "uuid": "2e7c975f-b975-42ab-b547-f4aebb4f9757", "comment": "Malware payload (Mirai)", "value": "140185e4a05e03eea19ae4cf4bd22c37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965257, "uuid": "7be10d11-c71b-4034-81ee-3964b34bb25b", "comment": "Malware payload (Mirai)", "value": "9df2fb125566fe0dee8d4ab06e779f65d5d1c2ff2484f26b5e918034a59981ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965257, "uuid": "2b79543b-de8c-4dde-80f8-995438956a59", "comment": "Malware payload (Mirai)", "value": "1789b72d859169eea811d287c2308aedeed115dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965257, "uuid": "effb921d-defe-4256-b7ad-7dd158e62fa7", "comment": "Malware payload (Mirai)", "value": "c650c0bdc1e4bc1ec33fef9c04e1ba4c4985f7c7dc493a90ea08e347cc6b043ab65034d94c5b00ec09c1ca9fa96db2b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965257, "uuid": "8ca2044a-3c7a-4225-9ce8-669dc1f041aa", "value": "T1F633840ABF610EF7EC2FDD3745B81B45348C641A22A97F75A974C828FA1650F46E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965257, "uuid": "350d59cf-45d1-4793-85d1-61d8cddc8135", "value": "768:nP843rFZLyPA+3Q3j4UC2UzglmexqeCue6XnMZnOgkXi7s6oOP:nP843rFZ2p3Q3MURG0qDuJXMZnOis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965257, "uuid": "bb4e2e74-3a38-4bfd-8ab9-99dd764afb5d", "value": 51176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965257, "uuid": "34635145-77b3-480c-b554-0547fa984ec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965257, "uuid": "31a8d3e9-624e-4e9a-8d56-0917886a797a", "value": "140185e4a05e03eea19ae4cf4bd22c37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae4f996-1ee9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688970051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970051, "uuid": "ef989463-05a2-4031-954f-f82b3b762734", "comment": "Malware payload (AgentTesla)", "value": "926db1c070fbbc7bb96d7f4b00e62021", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970051, "uuid": "5ee885e8-dd57-4d05-8693-9a17588cf2f4", "comment": "Malware payload (AgentTesla)", "value": "9f2409f84835a8c09b7799f3e2b7a336b9e4219fb86fad3fc50e9b15e3d5167a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970051, "uuid": "7060d244-acf3-405b-81f9-5e2cc0aa4336", "comment": "Malware payload (AgentTesla)", "value": "f7f2f8e6e65b89b360bf84b4700d8e376ccfccd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970051, "uuid": "293f8873-9584-4f72-844a-6d59ab0e9fee", "comment": "Malware payload (AgentTesla)", "value": "fdce877cfb593a8e9e227852c95f698b657aed52a289ae0e49c762bda6b9073a52f4b46d9e8baafa9c1aff92152946c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970051, "uuid": "b06a70c6-4808-479f-aaf0-68e22291f037", "value": "T171C40127A1A5E731DC1C1FFD2180A80D17A458958C75EE2C98678CD6CE7BB3805ACBE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970051, "uuid": "9ae2cd9e-6873-4004-9f65-a4337929759c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970051, "uuid": "5de08631-aa0d-45ce-a834-dbd8b1433d35", "value": "6144:pgCJi2GC45eIUDk8XCr3hLKwxvhhbPzgLy4nCrzj8GVMmDUnq6BDshziTCgtirGR:p6reBpyblD4CQEEnVgPGzIeasKRG3fZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970051, "uuid": "6d225309-726c-419c-8fc7-b5ddc6af8ebf", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970051, "uuid": "b2213f2a-9ead-42b6-865e-b650d180fa2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970051, "uuid": "ca458f4b-71f8-4a25-8147-3c81bed7f54b", "value": "FNC2UFJHAllD7DW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f347cf76-1f5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689019027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019027, "uuid": "614b22b1-75bc-4f2f-83e9-afdb13e841b7", "comment": "Malware payload", "value": "249e4227231ea3d08f2a833894840859", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019027, "uuid": "1cfcf71e-d664-46ce-85e4-54316e084e56", "comment": "Malware payload", "value": "9f63cedd8927934bac3a55e435fb93fd43afaa9e0267900b03b764258c8c3d5f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019027, "uuid": "33d90188-e73d-4cc9-864e-5631c967040a", "comment": "Malware payload", "value": "893b1cef66808ba7b940828da39998c518b4e9a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019027, "uuid": "465ab6f4-3e75-4bc7-8024-4c3a73a64116", "comment": "Malware payload", "value": "b8690b378d79330884f89bef7a059f2d7afe7c5caec4230349c4d3c475a8f7f42ccc7b9bc43ed64f1e80a6292bcc9fc5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019027, "uuid": "899e6976-53fd-4270-b751-e9a07bbef5c2", "value": "T1B8D30845F8408F23C6C552BBFB5E428C771B17A8D2EE71029D256F26378B96B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019027, "uuid": "9962ca50-e0d3-4954-9b6d-91b266c886ae", "value": "3072:qyjZ/5cxpuNudQCO5cbjFrwv1/1VpFiOdVS8OkBvFjxqTY:x7KpuNoQCO5cPOvzXXS7gbqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689019027, "uuid": "5716e672-7b95-43d2-a517-a2dd71387eab", "value": 141804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689019027, "uuid": "314b8c99-4d34-4ef3-9314-9540823bfc4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019027, "uuid": "3ff7f067-9ff3-4c05-a4ac-b3ec86fd01aa", "value": "arm.nn-20230710-1957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8050a60-1f00-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688979871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979871, "uuid": "3eab91ee-e806-4420-91ef-e10954d4e39a", "comment": "Malware payload (AgentTesla)", "value": "e340f05a698e71274dd72da65421e74c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979871, "uuid": "4932c73c-422a-4d64-9423-5960d7a590b0", "comment": "Malware payload (AgentTesla)", "value": "9f8dd7a2f5e56970c9e6aa9af1c62b9d1d2ee03ca5dc33f9d6d376edd3bc0cdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979871, "uuid": "53ea4028-6ca3-4086-8ea3-ebdb729b4eaa", "comment": "Malware payload (AgentTesla)", "value": "2c9f840a5d24fc56bc757c38428d109c979dfec0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979871, "uuid": "dfb322c5-90cf-4b1e-bd75-2ec66983f496", "comment": "Malware payload (AgentTesla)", "value": "98e61371899db9c1bf6aea89f9fc7e7900a1202a349f32d3779002e05acb8cfcb0717f6190023c1e68fd6d042187bd33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979871, "uuid": "855e0163-a1a4-44fc-afa1-a78ef9cb5455", "value": "T1ACF40216B0BBAB42C9B9B3FE0848550837F8991D6971F3185C8BA1F7557AF400A84FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979871, "uuid": "320fdf3e-264f-44ec-9d5b-9585b0739ca5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979871, "uuid": "6edd668c-0c63-4f64-9146-6aaae92928e8", "value": "12288:QJ4anp7tL+Nu4nLVUlinzjmRbqg5gCi2k6JKp:ip5X4JNjmYg5zioJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688979871, "uuid": "bac20e19-65ff-46a9-9e5c-801c7d0881d5", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688979871, "uuid": "37116632-008c-48af-94e5-78f4e56e4eef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979871, "uuid": "3797452c-0f27-4b55-8b19-dac87f72d0f8", "value": "23.19002-_______.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66345e15-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688981854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981854, "uuid": "2d7fafca-eae8-498c-97da-28d34ee2de3d", "comment": "Malware payload", "value": "f93053978808f4bee3879214e5bcb8f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981854, "uuid": "77d901cf-bc4d-4ae7-8390-f3f6d2338c36", "comment": "Malware payload", "value": "9ffb923ffb6bf545de00ff51bdbe9ab7dffcbbdcbe64c227537543b9000a06b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981854, "uuid": "03aac566-59b4-4bd5-8f3b-bebe07c188f0", "comment": "Malware payload", "value": "550c8579c7889d17741ebf7e404da80559888153", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981854, "uuid": "93214f6b-9bf5-4230-b035-ddcabd052620", "comment": "Malware payload", "value": "ba070f8d4f26c21e2ffa91e8438e158896077077e5a54ed032a3b68617b00048deb1e3f46b70412dce470bf2c32d7326", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981854, "uuid": "3d86a6d8-96fa-45b9-b4bb-e66725d69982", "value": "T12A130A88FD55A22AC7D162BBF70D03CE773A0768F3DA33225E355B2137C6A615A3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981854, "uuid": "6fb3a079-8991-452d-bce5-c7a9723adbc3", "value": "768:BCl5gM9IYz/yXzDcPzG/GyoYtMt4Ml0POpEEMIi2hx2q1Lew3zqI:VMW8yDDUByWGM0POpE+iGsqF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981854, "uuid": "7c3be69b-8e55-413f-b33d-b6886d101638", "value": 42672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981854, "uuid": "41871392-601d-4319-99f6-d8948ceb1172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981854, "uuid": "296561cd-fd66-4d4d-add9-767628dad944", "value": "SecuriteInfo.com.ELF.Mirai-CE.18452.31561", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb39e68-1ee3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688967453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967453, "uuid": "d0c92f10-ac2b-427f-9d75-024f6d8d5c38", "comment": "Malware payload (Amadey)", "value": "ca631e93223790b01f243368a29e653f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967453, "uuid": "17c06959-bd1f-4c84-acfb-b06a2969fd8c", "comment": "Malware payload (Amadey)", "value": "a01e0eb0fe898b7b7f4acde6529ede49d110379e7f29d3ae38dfa9d9b8ba1d24", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967453, "uuid": "e4ae4a5b-0983-479b-8ed2-238aa1575f9b", "comment": "Malware payload (Amadey)", "value": "0b8f24d9cc3f546f87b4b8300cd3b5f50a520be5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967453, "uuid": "e7baa429-6227-424b-8144-6b4d713718fd", "comment": "Malware payload (Amadey)", "value": "29fb1b784a2f31015909d474e29dd7977f22fdf74f008ac5467ce431b98c85e7ab80ab0ee2ee434697c42974353c88b9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967453, "uuid": "0c4807b8-0f5a-4db3-b201-6bfef2a94024", "value": "T139C4026071E29933E672053225A0E22FBF2FDE314E91459793D9753D4B282C24D3EDEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967453, "uuid": "39e70fca-cd1e-48af-baed-c6b62e457423", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967453, "uuid": "5a5e368d-3f8f-4be5-9e8b-0b48aa7263c0", "value": "12288:9k8FRz47Wpeyo7Z4dgOh2apDZqlXCyfxB:LB47fn7r02apDUlX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688967453, "uuid": "6493986f-b39a-47ad-8917-5b136e0b5de5", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688967453, "uuid": "306cdbc0-8d76-40cd-9f53-eb519c574bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967453, "uuid": "4a413c63-dbc9-490e-b856-440f42655fea", "value": "SecuriteInfo.com.Variant.Lazy.360290.31090.4119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebaf35f-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1688981868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981868, "uuid": "00ac1ccb-eeef-4214-9221-8e620406086a", "comment": "Malware payload (ModiLoader)", "value": "268ad9d551b4173c3bfd39eef6ad76b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981868, "uuid": "daffd00c-635d-4555-8242-db75d61a6c7c", "comment": "Malware payload (ModiLoader)", "value": "a08cd110a928227dd4b3b42b1801bc1c907dd042bea8494ac701142c5eb345da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981868, "uuid": "27617121-b2d9-4fc6-9145-dce68d2d0cfa", "comment": "Malware payload (ModiLoader)", "value": "6ca84e053936508354a7805f36b1fd7e25f6970e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981868, "uuid": "4325c402-0346-40c9-8c18-567db0f97379", "comment": "Malware payload (ModiLoader)", "value": "0a26595fa29497250665dee7da2d7bee9c4d81617ea5947006eea4ee7f7728a2d7a7c697946e20b3794aeb55416123f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981868, "uuid": "3a55fa3c-e3cd-4a3c-b935-93c3d26a2542", "value": "T18425BF73B7914437D2221B39DD5BA3C2593DBD312E28A9466BE01E4C7E70E83B426787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981868, "uuid": "3e57800e-05e5-4b42-b5f0-23ce6c2827f2", "value": "8466179c03d61f9be09e96306c739027", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981868, "uuid": "c15aed29-bf4a-430d-a272-46852b0e12ac", "value": "12288:5DQy2c+bp9/95hiFFCt2AvQBPNIkry/wNQZqLfLYUj2Msx2AWwoo+5dHg:5cnbp9mIzvQBa1/wNQULfLYUyVxHjohM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981868, "uuid": "5378e5bd-9b93-4650-a0dc-ca86f370c426", "value": 971488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981868, "uuid": "e1bfff40-ec2f-4885-8890-ff79e7ab63db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981868, "uuid": "ec1f278d-6a9e-4a2f-9897-cab034e98877", "value": "PAYMENT ADICE565 OUTBOUND.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88337d0-1ed0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688959256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959256, "uuid": "86dd6474-28d1-4e9e-847e-33fc5d76b565", "comment": "Malware payload (Mirai)", "value": "3df5de28dc1bdab61efcc7ebe6248559", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959256, "uuid": "cbd5824d-e1f4-4d73-bcdf-26f2d6cc1a83", "comment": "Malware payload (Mirai)", "value": "a1c84b21e658607a950fb82e1a36af01ad9bc3efffd13efd527aeb3a9d2dd30f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959256, "uuid": "8f52280a-e850-4919-8026-a052c35a19d4", "comment": "Malware payload (Mirai)", "value": "571cb17bb3bf7e26d880b5165e9d02bf1b87c5f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959256, "uuid": "ff5477fd-9000-4575-81ec-5bca532ed000", "comment": "Malware payload (Mirai)", "value": "ead544420aba014236c1b3aee08a57ac3dbdf9ff642f6d3602495782ee266b64a84e93d0acd653289913470b1220d554", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959256, "uuid": "8eba0fd6-4b21-448c-abef-767e8bab105e", "value": "T1C5532AC8A0D3E8F5EC14097D307AAB629E73F13FB176E99BC7E85573A901202D10666D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959256, "uuid": "a37930e1-1ced-4e17-b0ad-e7dac8b685ab", "value": "1536:i5BpWlXJcf4slZQLkAl+tJSWE/4FZh+70EngkMfe:iAXJcf4slZQLkAl+tJSWE/4FX00OdMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688959256, "uuid": "e318060b-ee50-4ee9-b5be-9d6c6c008f06", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688959256, "uuid": "363f7cf1-9c21-4820-a9e4-62462c059864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959256, "uuid": "22fa0724-0751-4f81-8bab-34b360d90f47", "value": "3df5de28dc1bdab61efcc7ebe6248559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f89aa45-1ee8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688969468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969468, "uuid": "778db07f-1257-4f87-b4e9-add055bf7ba7", "comment": "Malware payload (RedLineStealer)", "value": "abe62efbab35e8c01188281dc72823f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969468, "uuid": "f0f87cd9-f749-46d5-b10a-5f9e8009753c", "comment": "Malware payload (RedLineStealer)", "value": "a1ee45dc669e968038ab97c5b98fdef1e8894bbf4ede2903f46ca6ea2eb64f53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969468, "uuid": "7dcf1719-d6ee-4e1c-8a14-801efda0ef82", "comment": "Malware payload (RedLineStealer)", "value": "7a6cb953b7a0afcaf442a0d28ca4bacace3ce48e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969468, "uuid": "a65797c0-571a-4d5b-9f28-4b877912c42b", "comment": "Malware payload (RedLineStealer)", "value": "a1b6f8dea557be912df79880061cfba194004798b37e3c0241c75a3846454cf771b3f8e5df0f838b6a2f2bb5a5c43606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969468, "uuid": "bc051c48-b963-454f-8cd0-002e959cabfb", "value": "T117C4026170D29923E533043728E0826EBF1BDE3549919A57A3C57B3E8B2C1D19D3ECE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969468, "uuid": "c298f5d1-66c8-4e57-ba08-be4f054eb48d", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969468, "uuid": "ec82b166-71d4-4d86-ba1d-d6f2b1590ace", "value": "6144:HkSoUTLAHBt7CWGYLUz247kgo0+rY4R6PrhbP9ms0w3QPisVhrbD1RMHPHzdvi92:Hk8Avz47kv0bK+lP9mOQ5D1RMHvzhiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969468, "uuid": "9fcfbc4c-457d-4b9c-97f1-4875eb4c7acd", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969468, "uuid": "df8e076e-ddf3-4f4f-b763-ecae7ce62636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969468, "uuid": "c04358c4-dd1c-40fc-a25d-4696184bfc80", "value": "abe62efbab35e8c01188281dc72823f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff6ca35-1eda-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688963321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688963321, "uuid": "b304e0ef-0fc1-48c9-bdb5-a19535732990", "comment": "Malware payload (Amadey)", "value": "538cca3fd972a0fd52ec841d55103c60", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688963321, "uuid": "d08b29e5-3702-4e89-9ab7-73194a3427d4", "comment": "Malware payload (Amadey)", "value": "a23ad00f039571f61447e61ca055f81122fb8dba1f48bf3fd2f1a97c1a4a7fb8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688963321, "uuid": "4ba505ae-5bc8-4f06-b2f9-84fce31f71c8", "comment": "Malware payload (Amadey)", "value": "fec4cbb340a426b0539b50a992502807c0740310", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688963321, "uuid": "a80d4714-73b2-4cda-90a2-f7f3181072eb", "comment": "Malware payload (Amadey)", "value": "3897dcbaf2f04f5e058636ab0320d03c23f2541aabb169fb02e32296a851feb28cb40707d5babe304ef1050b40b98c63", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688963321, "uuid": "8fd9ec16-af78-409f-ae5c-42e42c389715", "value": "T1F1B4016171D39933E932207225A0925FBF0FDA7219A5865793C9763D8B281C24E3ECED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688963321, "uuid": "2a789baf-f71b-4cca-8535-091212cf8a72", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688963321, "uuid": "fdc38c63-53ba-4756-aadf-7bf4cd1c8581", "value": "6144:paevh5d6B8HBtbCWGYLUz247wP/8kSrye6eETj4vpla/wUyRu525R91mqXoGPXjp:pa0dD3z47OEyleEX4u/wUyRui91TX7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688963321, "uuid": "f73f92a5-ace3-47ef-b432-6875c590c5c0", "value": 525472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688963321, "uuid": "48c380e3-786d-4403-9a48-9ccae2063b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688963321, "uuid": "9d9c6faf-951e-4d17-a7b0-06c51427d5b0", "value": "SecuriteInfo.com.Variant.Lazy.360290.10616.22362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66a3029-1f19-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688990632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990632, "uuid": "357c3f6d-964b-48a9-a451-d1b3916ff873", "comment": "Malware payload (RedLineStealer)", "value": "61c6c74ac1bfaaf8546dab27f6dab8f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990632, "uuid": "bee296fb-e9a4-4aad-aae2-ad0926dd8ea2", "comment": "Malware payload (RedLineStealer)", "value": "a2949238e905b60ddd91ff861101d2877bbad4c12e1fec1bbf3c1f0b7d685460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990632, "uuid": "859769a4-125f-4024-abe6-f36df7232991", "comment": "Malware payload (RedLineStealer)", "value": "b9aa693b69b8dd0d2d679dfb2fb1cadf5f12ae74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990632, "uuid": "2bf5266c-9e1d-46cd-abd7-79b30621ec44", "comment": "Malware payload (RedLineStealer)", "value": "95c895f7218a5397191b482acef7f733eaadee03c89e2d4e926693a6b46ee38cb7174907398167aded08ed4b39ec73c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990632, "uuid": "6ca7e692-8aca-4a2c-87f1-d9dc9129283e", "value": "T142356C6039CB832DEED62C7E05ECB964C3ECA4B007E745DBE68416EAC9146DD6B321C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990632, "uuid": "6d489afd-8cec-42f0-a52f-0e56e11db92c", "value": "2e7f2667392d8d1bd01896145ab96743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990632, "uuid": "664bed3a-0430-4608-9541-cf4b790d3fb7", "value": "24576:N0iid6uv1xs2IV/YohC9Xs6ICXzoowbcWrQNDr:Ev1xs2CEPICXz4b1rQDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990632, "uuid": "360be613-3e55-4611-b7ea-44133fa40f79", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990632, "uuid": "9d9d18b0-a7b8-4d52-befb-f0eaae045bad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990632, "uuid": "2a73fd62-9db1-473f-9e28-9fd2d266a927", "value": "61c6c74ac1bfaaf8546dab27f6dab8f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007d3a4a-1eea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1688970087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970087, "uuid": "1da0de44-4987-4f6e-898b-527ab97a3493", "comment": "Malware payload (Loki)", "value": "b41ae5559aaa021a756cb79c0866cf72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970087, "uuid": "ce039aeb-e906-4d7e-a20e-fee691c92833", "comment": "Malware payload (Loki)", "value": "a343259b8ea9f547232adb3a8e5fe7e140f273f1ae0b69b2c469cb0dd1489b44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970087, "uuid": "c97f6a7c-aad0-443b-b2a6-b64016ab5708", "comment": "Malware payload (Loki)", "value": "de08d4d6a1bff9502e7cf5a32c2bbe4b6d6f8018", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970087, "uuid": "b16d58bc-f5c5-4b81-ab88-e5f1932c9e38", "comment": "Malware payload (Loki)", "value": "def4690b110cc11f74225a150fd05cab9cf35ce475213462915bbf7a6709dab480357f097d0dd1b6989f716156eeb123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970087, "uuid": "8992728c-6e76-4d53-8b7c-8360036c70ee", "value": "T1AFB4021251A5EB36E83C1FFD2145984E23951A495C30EB3C8C6B8CC5DA77BB414FCBAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970087, "uuid": "1d7b8c81-65ce-457e-908a-0733998f9aac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970087, "uuid": "63f052e3-2ba2-40a0-8c69-30252b42b35a", "value": "12288:IhgOv/ttTtu8TO6FbO+uLV6s4kdJErW/:IBTzTO6QLksVJCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970087, "uuid": "b3d126df-2891-4d30-8076-a47b60e07341", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970087, "uuid": "79e0d2a0-c818-4e8a-9d27-a543dc457189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970087, "uuid": "e70038a6-cbec-4f5b-a8ce-ad89abc056e9", "value": "FedEx Receipt_72310373717.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cff5776-1ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688975047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975047, "uuid": "7c97926a-6e4b-48cb-8c81-dd5ebfe0a759", "comment": "Malware payload (AgentTesla)", "value": "295699fb060ba9aef0e71352c9df588e", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975047, "uuid": "355e8608-6890-4162-aca1-1a08c1162d2f", "comment": "Malware payload (AgentTesla)", "value": "a461eeaeb89afa16a7369e4df891e8e0ce94d0013d1ed9d3c6b281e4e7e232fa", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975047, "uuid": "fc6e7212-fbe5-4f5f-bc6e-0e4de7956b11", "comment": "Malware payload (AgentTesla)", "value": "c7a1a3501561501e03fb36e3fd98fe0bc621b843", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688975047, "uuid": "b5b01756-6808-40e3-945e-427b5e7924b4", "comment": "Malware payload (AgentTesla)", "value": "5a2b279c7ed49665d536283e9c1dd83692e42a960c17d3054d8fe42fe6e56e28f3d1961c905800c62ea46a5a3094234f", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975047, "uuid": "c82668be-ae81-4342-9f6f-dfddc7031e0c", "value": "T12FA423E260C9CB53A1805DD2C085BB4E3EA511F7BB8EE75660C721118D2D8F4625AFEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975047, "uuid": "710f710a-eea3-49e0-8979-71b1db8de3e3", "value": "12288:U799PKM3QGgS2dDVeD1RiNkIK/HVwczSPoej:GCwgbDQxRi8zSgej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688975047, "uuid": "2e7fed44-899b-477c-a1c4-db8bda733434", "value": 463154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688975047, "uuid": "4649fff0-0719-4b4d-9987-b6b8673d4de4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688975047, "uuid": "f7805fcd-cc1e-4793-80c8-cef05abdcc93", "value": "invoice.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8331d1a9-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978037, "uuid": "34cde7b3-1840-413b-8355-f5efd1854719", "comment": "Malware payload", "value": "ba785d86e0526be7a55488e2f4f00137", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978037, "uuid": "52a79f37-6254-4723-ad45-fb235a388907", "comment": "Malware payload", "value": "a4a1c9552a73ae9d6fcd209edd7d8b8c2088c9a4ea3564610c6ba7aa679ef06a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978037, "uuid": "06a55060-9475-403a-b5f5-42f2392ca076", "comment": "Malware payload", "value": "73d082e8e05475f5e524daf13cab079b406d8d13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978037, "uuid": "ec92e34f-8886-4152-8819-d1898085e18b", "comment": "Malware payload", "value": "114e9892bf48c0f0bc573b6481c13f915a6a0a2d395b1a8c02b0634ac8980b6ab98a93d2cc3b1136f61da03914bdbd8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978037, "uuid": "8b1ee99f-c0df-4039-8ca7-fc70cbcb2f89", "value": "T186F26C42A381D4BAF51303B65876D7574232F23A5081EA3EC7996935EE27500D7373AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978037, "uuid": "63986c87-1806-430f-9057-cbc35d86ca5e", "value": "768:s+eI0/gUrKB3kv5Ri7cAFq/Dplo1kLX8GrV+wIl:sroMY3Qrkq/tl+kLf0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978037, "uuid": "2d762dd9-65b6-4dea-a9cf-3e54928c72f5", "value": 35740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978037, "uuid": "23b6fd69-26c2-4f7b-9a07-e57960346fc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978037, "uuid": "d44d94e6-ac0d-4963-a435-409db9e7bed3", "value": "SecuriteInfo.com.Heur.20230710073731091414176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cec34a7-1f3f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1689006830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689006830, "uuid": "ae33d7c4-f371-4181-9d05-aaa37d88a96e", "comment": "Malware payload (GCleaner)", "value": "fad96c6f45cbc0a417722bf0e1764e3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689006830, "uuid": "a63b9540-b69c-4738-bdb1-3246f67b1e75", "comment": "Malware payload (GCleaner)", "value": "a5099c78754968bc090c863b5b1f1577b5d162066f71502272690edcc025372f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689006830, "uuid": "da31f3cc-630b-4508-875c-cb5092bdc8bd", "comment": "Malware payload (GCleaner)", "value": "c0245de73df3f15dae4e0f63db7790b507e75fcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689006830, "uuid": "2c249a5b-0054-43ce-9886-a81dea279036", "comment": "Malware payload (GCleaner)", "value": "a7ec6fb6b9f85fcfb0cad5ba1f34b43a480c6c10af9d255a9999e4cdaba2f661d644402b6d75d8488f8bd40d85e017d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689006830, "uuid": "3f5d92ee-0f75-431e-bcb5-33e57d6fd996", "value": "T15B55339360E48138E0C2D9752F21D9814AAEFE611A3CA79EF54D2ACD9F3F3258E153D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689006830, "uuid": "2d243184-dc29-436e-baea-87fe52b4975a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689006830, "uuid": "24e35c58-988e-44ce-b749-424efeab3d92", "value": "24576:nfOyH3/kZMXCnNnCy5S12kHjOKZ6Y25G6xqB96tNdl2vSBreuS2w02VnKU:nGMsxnCWSOM9286LjFeuZknn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689006830, "uuid": "13004f19-bd42-44b8-8c0e-c2025a9cd179", "value": 1300747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689006830, "uuid": "3fafddd2-bf1b-4c57-90e4-86bb8ff59a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689006830, "uuid": "949c46ba-98ff-4a15-84d0-415fd2531c9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de08dbbc-1ee3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688967452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967452, "uuid": "e8bab7d1-7f17-4918-bb90-b2832b21953f", "comment": "Malware payload (Amadey)", "value": "826545428fa94d5c152f1b314b660d20", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967452, "uuid": "791a911f-dda9-4f02-8d83-99cd09ffb3bc", "comment": "Malware payload (Amadey)", "value": "a57f13429080a33dfaa6f76493641cce923d5f34f2810d0fc89a43b30d6c6211", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967452, "uuid": "cb194bd9-28dc-4150-b714-b7a0a07601e2", "comment": "Malware payload (Amadey)", "value": "f0278ec0048a33464e4c32d20ccb8a2731f3de55", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967452, "uuid": "bb7571dc-507d-4501-8e87-842e11db4cfb", "comment": "Malware payload (Amadey)", "value": "040eae063bc728034fb743cb720ce7cf24e0664938539715ba50281c6a35575decdfa5ba1dbdd4e0438673807842a993", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967452, "uuid": "e5263c25-c7c4-46f7-8a24-fc7bf5cbff8b", "value": "T17DB4026072D29623F97214321990926FBF1FEE7109B05A8793D57A3E47392C24D3FCA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967452, "uuid": "27b71295-d344-4bda-9b2c-2a92fc55bdc7", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967452, "uuid": "a07931d3-4109-42cf-a083-14b30ea040fe", "value": "6144:4GPD0GqkHBhwCWGYLUz2470m3kguCFd3IdyBY4gU1ZWfYVbgfxG0lbX/utzpHIjn:4GYq6z4708Vt3Yz4NvWQVKx7dutdIlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688967452, "uuid": "3cfbe75f-4cda-4a8d-883f-370d3ac7edbb", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688967452, "uuid": "a92418df-716e-4f8a-8690-38a3884e3168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967452, "uuid": "631ac8af-f64a-4cb2-8010-47449aaf322b", "value": "SecuriteInfo.com.Variant.Lazy.360290.13475.13568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97c3ba2-1ef7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688976008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976008, "uuid": "0ac49c94-b1b3-4370-a944-b5ad8b28e0eb", "comment": "Malware payload (Mirai)", "value": "2478d65078fe7a8a447ff8f7cae57191", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976008, "uuid": "1be1ffd9-3fa0-4f87-a740-5b5359f79352", "comment": "Malware payload (Mirai)", "value": "a5a4ca2e188e0655fbe7d7be371b0d355b57a9e5221928b9f4155aa933655bb0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976008, "uuid": "28b25a74-2916-4724-a1f5-bd4d9fb2b2bd", "comment": "Malware payload (Mirai)", "value": "057f05e0091ce63a117e5ab66fe17d26d8b15186", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976008, "uuid": "9bc7644b-474a-4883-891a-1fa59480a858", "comment": "Malware payload (Mirai)", "value": "779133a372641fa4313b0c1123bda85b08c820213d1833ce38527e308e7d136ed732c1ff70174af35dfb7ef294f3aa94", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976008, "uuid": "52fada6b-c430-4c4f-b44c-00f8414ec01c", "value": "T157834B55B9825E13C6C512BBFA6E028D372253E8D3EF7203DE21AF2176C681B0D77A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976008, "uuid": "471f77f6-91be-48d7-816e-87808d34bbec", "value": "1536:WalPS1OaQg9CyCU5TifF5uYU5/vb45sLKHYKdVRZss9eMvpp/lZYwbZnN:WalPS1JRW41vb8SKHZdTppbOwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688976008, "uuid": "cac2f59a-a5e9-4008-a3f4-13876528b462", "value": 88784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688976008, "uuid": "1e528d54-008a-4258-812e-921935a7aa7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976008, "uuid": "554343d5-ab3b-4041-9447-ff496d231c18", "value": "skid.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8a7864-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978026, "uuid": "fbea8383-c351-451e-8e87-fa482c0231f6", "comment": "Malware payload", "value": "d31b6f534f9a14b6617362d51aa204a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978026, "uuid": "ace29c1b-88ca-4cb0-87b6-34ec044bea43", "comment": "Malware payload", "value": "a675dfc1ad55f7dee7b317c91f2d9adfb6a9b3936f9d89aa8ede607082ce66db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978026, "uuid": "7df355b1-f8ec-4792-97bf-44c1b3a0a737", "comment": "Malware payload", "value": "eb84889636c77fd7a03a56df72491707509c54bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978026, "uuid": "b948955f-3d16-4bf4-8643-2aadcb7c4d36", "comment": "Malware payload", "value": "42350b0ff1db1c05328e4fd28a2f43205a09f27053d86ba20568c84973f8a3a165e50bae2a42f62aec6da7d2aed038f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978026, "uuid": "67db4ece-a115-4849-b23b-fe7e2cc01f2b", "value": "T1E75345797A21BFEEE67CC2310BF75E709399229126D19284F2ACC30C5EB124D589F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978026, "uuid": "9ebd65d3-00f9-45b2-b50a-aead900c70d7", "value": "1536:t+41+b8LamaoQKNhoNi3272AVaphRfBPegGYC:vphRfcYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978026, "uuid": "a3ab8cf0-a43a-49d2-b6ea-2c84ea50502a", "value": 65340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978026, "uuid": "1a7e4f31-f1e7-4a67-ba98-e7af989afdf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978026, "uuid": "58cddc79-a476-41d3-9a1b-0038f59783ef", "value": "SecuriteInfo.com.ELF.Mirai-AJJ.8336.650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a009bd-1f2b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688998382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998382, "uuid": "4660dd03-3b7d-47e0-9d42-8ba330fee5d9", "comment": "Malware payload (RedLineStealer)", "value": "ba6033ec32f4421a2da2602e3d1293b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998382, "uuid": "81bccfb9-5205-4d25-9255-c2a813515893", "comment": "Malware payload (RedLineStealer)", "value": "a693070fe4f7828104eb0cce096c9123ea34d9150011736bb5cb5ffed94b35d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998382, "uuid": "0b4c4603-951b-49f9-91fc-32d7adab315e", "comment": "Malware payload (RedLineStealer)", "value": "53fd73f2de54056ff4aff29d262115f388e258de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998382, "uuid": "9a24f411-ea22-49f4-9692-7cf485dec62f", "comment": "Malware payload (RedLineStealer)", "value": "a04f465c3dd9f4ae816503fd17fc5ccb604a500aafedfb11661527f1be84c161668baf8af7aadfd92ce022f2852d5d0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998382, "uuid": "24d1885b-9c6f-4b72-aa43-ae51881788af", "value": "T166E4D03914A144ABC4A9AD39FF4BD4C232162EE4017C950E3EB36E783BD24579DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998382, "uuid": "012999ed-efa0-4e49-bc63-23e23459deaf", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998382, "uuid": "07590441-909f-4f6a-81fb-18016956e8fa", "value": "12288:fw3zk2EDiICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:fwDkNDBbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688998382, "uuid": "c09b5a96-cd5f-407b-ba73-7460fe5ebc79", "value": 708418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688998382, "uuid": "e8edb2ad-4a6f-4862-a4d8-5788209ae6b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998382, "uuid": "a019e8a5-670d-429e-b832-4f7675616806", "value": "ba6033ec32f4421a2da2602e3d1293b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdde8b5-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688971047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971047, "uuid": "7d1f3794-68bc-4e86-9b1e-42bef2f2561c", "comment": "Malware payload (Mirai)", "value": "8d4b81c55fe5d9c6e90507ddc1029820", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971047, "uuid": "492631ec-5b02-4ba8-8778-fd78e39fb4e5", "comment": "Malware payload (Mirai)", "value": "a6f07348dacb806a6a4212e7c41d86a59d7f82155fe42be50c0da7dc4887e86f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971047, "uuid": "4898f04f-4ca3-4a04-ad9f-92e3114c285d", "comment": "Malware payload (Mirai)", "value": "84bb7f91f358cbdf0b210ad447a45e3f084995a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971047, "uuid": "a231edf3-4fee-4879-9cd3-219272b7368d", "comment": "Malware payload (Mirai)", "value": "7715cca41b9ad59b8d478999a5b5bc7d977eb5a207e9b465f912b4b87483dbd81d802b79415274fa7b2509054c9878c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971047, "uuid": "11e30192-c664-4a1f-b084-2c204640b9a2", "value": "T189530985F88B81FACA4B4D3051B7F23FCB31E97981B0976DDF49AF35DA279019212189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971047, "uuid": "bdd6996f-bdea-41dc-b7ec-937d82abcbb1", "value": "1536:T562r5PIV8g4IVSFRhkiyzxyKu9+EYDlhW7EvOur:tvFzgLVSFDk5zxAIl0wvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971047, "uuid": "3199653b-51bc-4fc3-b346-e2bce6e74edf", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971047, "uuid": "e05f1527-4cf2-4d6f-9b4c-680e3fe73022", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971047, "uuid": "663280ea-f5f0-405d-abda-bcac9a88b567", "value": "8d4b81c55fe5d9c6e90507ddc1029820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea3e5ee-1f22-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688994297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994297, "uuid": "dc402a52-73ba-45aa-a332-39c4ff7303de", "comment": "Malware payload (AgentTesla)", "value": "dfe9779e50276f8945d3316a5a25c62f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994297, "uuid": "b0428d72-db7c-45c4-a61f-c1f48fd5a477", "comment": "Malware payload (AgentTesla)", "value": "a771e432eb0dce654681e18c337cafbbedc875bd918198762933dd9d7d8772c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994297, "uuid": "3121ece3-111f-4062-bd48-5b584ea188fc", "comment": "Malware payload (AgentTesla)", "value": "0ee3a8b00131c4048508e4383205d454291b9718", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994297, "uuid": "b2dbbee3-79d9-42eb-af87-6b77242af97e", "comment": "Malware payload (AgentTesla)", "value": "ec4e76de9c789299d993c96f30017b988a6ceda9d173cf8ffd951f2782c3b4a1a26149fd77032e624c0cb23349c48dfc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994297, "uuid": "60297d17-a17d-4eab-a8fa-1953fca6d1a3", "value": "T147F4011671FEAB56C9B5B3FE1214544837F89A0C6A20F3084CCB61F7597AB440A90FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994297, "uuid": "8a23cb7c-4434-42e7-938f-8a32854c25de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994297, "uuid": "a5caf3ca-8de1-48d8-842d-0fdce747b90a", "value": "12288:bJ4app7tL+NaZPHK1AJWNDtmM3Y11zGqFE5WBzWKj6Ech5eF:Jp5jpq1AEN5pYnzPj6Dh5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688994297, "uuid": "dce63492-2db0-41b1-b34b-ed005dfd1a9b", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688994297, "uuid": "37543305-12a8-4d99-87b9-20ba7a378ff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994297, "uuid": "03777315-0c0a-4da4-8ee7-c3d580222993", "value": "New Order PO-2087_441006.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18072cf-1f5d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689019749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019749, "uuid": "734cdaf3-8bad-47b7-ad3a-fdf2a5c1803f", "comment": "Malware payload (Amadey)", "value": "9c48aaa51cf65419d11ed418bd2da277", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019749, "uuid": "87cb510d-e0e3-49bb-b518-b2d95491bd44", "comment": "Malware payload (Amadey)", "value": "a777a11027afe934646141f176344a5c05c946b740bea45e9684b9a8b98f6676", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019749, "uuid": "1394bc01-97f9-4bfd-9866-2448b6c4f78c", "comment": "Malware payload (Amadey)", "value": "bb7b03058b06c5c35df8bdc072ec392069acb5bd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019749, "uuid": "586e4600-56df-4036-8663-30e85344901e", "comment": "Malware payload (Amadey)", "value": "8ca5388dd4ea4eb60d289ecc64cf8e82f55bb0305d8d41bc7d5c94d7c3651d920d9a29944390a14858d4f2d72be3a891", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019749, "uuid": "eb62fe4e-f40f-4247-ab17-c58dad583ffa", "value": "T1B6152353AAE80573C4716BF058F316430B3ABDE19D78DB9A3351291A1CB27E40AB177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019749, "uuid": "8bf64ea1-ed88-4179-92b7-9629bccb919f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019749, "uuid": "d300b1a6-930e-49b4-a23d-55f10e230016", "value": "12288:JMrxy90R8ri0sl9RVN3oc2gVc98H85rd4517lsGG67i4C/1C9ZsVsV2b29z56QjT:Ay1r/slXbXNc5e17HfiNzdb2ZAhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689019749, "uuid": "39536289-039a-4aaa-bf74-8a420815eb06", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689019749, "uuid": "db577e4e-4858-4fc9-8dd4-35a41b0c391f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019749, "uuid": "4ea09351-c378-405f-a00a-4451d69b7baf", "value": "9c48aaa51cf65419d11ed418bd2da277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ef13ec-1f1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688991757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991757, "uuid": "07fb92c2-776f-4f86-a33a-c5d9b2033e02", "comment": "Malware payload (AgentTesla)", "value": "430f072520e927816a1d85ba7e79a19b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991757, "uuid": "d9304193-2cff-4301-b1fa-63e9d1e8cf40", "comment": "Malware payload (AgentTesla)", "value": "a95f1bebdb045dfbb7f49377b0db5d2dc5641ceb734c496d793b72a0ea335066", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991757, "uuid": "6bf5a111-d2ba-4836-8ea9-55551f465b6a", "comment": "Malware payload (AgentTesla)", "value": "6c2ab6041bc12275854ccad0ea726bdb8a6d2cc3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991757, "uuid": "77072e79-8047-4aab-99a3-07dea087c3fe", "comment": "Malware payload (AgentTesla)", "value": "4d48b405d070b970d403a4d673a6ada5eed1af388f8da69e62fa5bd36b0106a7e7ec104b15dd182f4a00b38befb6d144", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991757, "uuid": "0e2be9d5-d7ed-4264-b7ed-899bf92d44d3", "value": "T1A864DB033159ECE892E13A73419BF9B90BF7BAE5953E51B815CC090E87D2A1C49293F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991757, "uuid": "4c895110-5eda-4461-8868-05ea94ea5c89", "value": "192:B1P13hgAF7ZZZFpmss+zxtoCH78VOJe5Si5xGaUI0MX/M+oPZ5kaBcPMB6xq6qXa:HgAF9n6Si5xGxI0MX/MZPZ576PMY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991757, "uuid": "82ae92b3-6631-4ad1-8e40-13ba445eee8a", "value": 327278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991757, "uuid": "73216df9-7162-49c6-a54c-fde5e1927ed5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991757, "uuid": "56a3a426-1412-4b2c-8efd-02c7e879c780", "value": "NEW ORDER SAMPLE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32213ed7-1f01-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688980049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688980049, "uuid": "b2de933d-91e7-4ba4-9851-85085af9434a", "comment": "Malware payload (AgentTesla)", "value": "3e55652f6ae24dea51fd635b5624ffb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688980049, "uuid": "f2955b04-626f-4a14-8e5d-ed77515ecfc2", "comment": "Malware payload (AgentTesla)", "value": "a9d10e19e0bc996b8c05833981e32c22c19166eb82d45707891935f8ebcd723e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688980049, "uuid": "514651dc-dcb4-416e-b539-fffcac8172ab", "comment": "Malware payload (AgentTesla)", "value": "351175bf590add99349831dcaa712bc355467635", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688980049, "uuid": "180c2525-6131-4da3-9802-35068b6e43f3", "comment": "Malware payload (AgentTesla)", "value": "0e1ab31c92124ea33a5b60f674d2f76cb8be8267d462f13752a7fc923c823c13421494768a0ffd97dab4723250fa5df9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688980049, "uuid": "b53a6677-f2bd-4fdb-9185-846d51ce106e", "value": "T120242DC5E98465A0DD59AB706A37CD3542237EFDA874A42D28DE3E273FFB2931025063", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688980049, "uuid": "830285c0-5fe4-4785-9394-b0c681ee2219", "value": "6144:bpFAkzL7r9r/EDppppppppppppppppppppppppppppp0GN:bBP7r9r/+ppppppppppppppppppppppj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688980049, "uuid": "637908d2-1136-4dcf-b494-737c90c7cfc5", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688980049, "uuid": "1339095c-ec0a-4984-90eb-d0d1cc9becdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688980049, "uuid": "33cd8008-d7e0-4022-9375-3073ddb68d19", "value": "ASMT-AR00-AST00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365a3438-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688990793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990793, "uuid": "715d3807-facd-450a-a8f2-ffc81fbed694", "comment": "Malware payload (GuLoader)", "value": "2cca8ec7f280ae38d2ea0357f3a63560", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990793, "uuid": "4b9d3950-464a-4496-9e6a-c38b9cfee499", "comment": "Malware payload (GuLoader)", "value": "aa064dcab4141aeb1dfddd5a7c25e2f54d0fe0b226df29dcb979645a1b6435e7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990793, "uuid": "aff4dcd7-01eb-4bf2-a6b3-25c234cb0eca", "comment": "Malware payload (GuLoader)", "value": "4d85aaa3e5626100251aa9f67ed16e919665bc14", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990793, "uuid": "1ded20f5-0997-4467-a529-a1bb2f6bb4b7", "comment": "Malware payload (GuLoader)", "value": "d29f012b50e1d82174f09e88bb938960ab9886fbf558c3bf46f0b9da195da5974dd9ff895a906280b0eddbb4533ac3dd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990793, "uuid": "5ee7cabe-e380-4a58-9931-8ebaf46f68d6", "value": "T1024512933BE9943BF1534AB24E71B722EBB6EA056121431F37AD5F312721AC0CB16257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990793, "uuid": "a1901cd2-414e-4ed4-b16b-0e72df5fb91f", "value": "3072:AmpQFx8/qGOnfDjuA9bVXn9T0mM084NwbMFcPF8YZ7bqjSafciZYdQY4p1q33n2P:vZ/qRrpVXnamM0mM8jnuN35IHNREt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990793, "uuid": "45583bc1-ead6-4537-9161-60c4a52f7ed4", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990793, "uuid": "0327411f-68c4-4eb2-9142-7fc6f8c6b662", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990793, "uuid": "fd75cc30-31db-4d4c-9089-1595e9229564", "value": "n_new_order_novatyltd.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b404734e-1f04-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688981555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981555, "uuid": "4fc8c09c-72ea-4a8b-b9d7-ce34fdfa8e70", "comment": "Malware payload (Mirai)", "value": "35434f316a257c72679013a38da91a3e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981555, "uuid": "c5a5c205-fb1f-4fbe-87a4-a10faea24ef2", "comment": "Malware payload (Mirai)", "value": "aa2f34aede3480b327a808a7b6e9bb0c7323f3693d6657a167a9d4310d98174a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981555, "uuid": "d84129ed-d276-49c5-94d4-26abc34b2007", "comment": "Malware payload (Mirai)", "value": "889ef88a8b1a7cba94c2c13fd93ef283896602d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981555, "uuid": "1c94bcea-1c99-45a6-9b66-6a36bcc78042", "comment": "Malware payload (Mirai)", "value": "9134a985af7de7ed0680cdb96746a400abc5051acd9f55090ebe60c08f6303443b1aed7a8ab5c5144648b32617fb9af4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981555, "uuid": "26b75dd8-1ed9-4058-844f-3f4ebb605d0e", "value": "T1D1834A95BD819A22C6D513BBF62E028C372153E8D2DF7203ED216F21B78682B0D77B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981555, "uuid": "19bdf737-cb1d-4421-beba-afb899261cd3", "value": "1536:XiGk1U+WG5xTuN5K5C/W7I5TizXbGRz49K1wRHqyPz98ZHOCZillYwbZnN:XiGk1d5E3B4GRsVRHqyPKOlSwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981555, "uuid": "3db5a171-f438-4fc7-9044-274fe2059e23", "value": 87556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981555, "uuid": "401f0f76-931e-43d6-b11d-7165284992e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981555, "uuid": "a24bdcea-87ff-4e1e-a0f9-09a01defc21d", "value": "skid.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7a3a33-1f3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689004713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004713, "uuid": "e1c4b08d-732c-4556-8b83-ff6f8ed05cff", "comment": "Malware payload (RedLineStealer)", "value": "9c07b9eafa5a6c98981382e139e61f33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004713, "uuid": "d9d71227-2fee-403f-922d-026ddbdab4ce", "comment": "Malware payload (RedLineStealer)", "value": "ab1944db7df59717e8b318a32f59870d54e081f919a261fe3ba94f98287e65fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004713, "uuid": "80e76416-e1c5-4f3c-a29e-56be3ec15f43", "comment": "Malware payload (RedLineStealer)", "value": "527012dc267ef2c160554ec2d63bb3bf498b8a87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004713, "uuid": "45388fe2-2bd2-46e7-bd54-81b7d66fc088", "comment": "Malware payload (RedLineStealer)", "value": "423b16c690d2eff8cb92df509c7b308ec026503fcf2d884142e5a38914ccad5df131f5f587118dd234655f865675230c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004713, "uuid": "62b11dc0-7b1d-40b4-be59-f3ba8a203808", "value": "T1B415238265D54533DDB907B0A6F603E71E32FDA25C71839B2B85188D1D732E8E93632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004713, "uuid": "9a10e02f-4bc0-455c-995d-5ed93de0b0a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004713, "uuid": "9ff9127b-6ffd-4f4b-a741-55f832884dfd", "value": "12288:rMr7y90d2ekv6Oxnq/+4Drb0zHtcMicaYe3vzbB2sfWT4MQSWXH0tKOejh971gq8:4ymGvKpHyaNZXM3QSQt5QZXK8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689004713, "uuid": "cf58c5cc-99af-465d-b99e-9ffb2e77105b", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689004713, "uuid": "88f606d8-6010-4b33-9ba1-22ccb874b456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004713, "uuid": "52ece26c-5f17-4f79-94f1-c327c32bcf5a", "value": "9c07b9eafa5a6c98981382e139e61f33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e327166-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688970996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970996, "uuid": "6d05c28a-7e86-4227-b636-89405c168dc2", "comment": "Malware payload (Mirai)", "value": "64dc5efa60e82721cae7a5e3ceadcde6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970996, "uuid": "916f7f0f-2a18-43bd-b9f6-3f35302613fe", "comment": "Malware payload (Mirai)", "value": "ab3f7f41c989dfedcb31781c5781b89b9a82a1e5e4bdbdfbca28943d4c63cb84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970996, "uuid": "6ae16b3a-5d66-4df8-92e8-221b141df7e0", "comment": "Malware payload (Mirai)", "value": "a863e1992237ff105b843bf24aa7519f969e27c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970996, "uuid": "234bdf77-c339-465c-9562-804e15a43353", "comment": "Malware payload (Mirai)", "value": "3cef6f923b9ae2b4b06873331ef0af370e60598ff026fe419f03885baacec9b380b893e1f66006c00f678a9a60fe9d84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970996, "uuid": "b3ca1db2-ec0b-42c0-a911-684a92c324e6", "value": "T1E6438D3BC4AC6D94C55881B4AA289EF40BD3F504A6A27FB587868D244047FFCF5067F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970996, "uuid": "ff10946a-8a56-48ce-85cf-7119591c762a", "value": "768:I7/bBvb3aMFSaSRSueVSTp2DLdH/FCpFgQCDoLCcZ3CXo79n:I7/VvTaySaSvhKOfLz3CX4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970996, "uuid": "ab58915c-6f7c-4b07-a6e0-f837fc2e08da", "value": 56208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970996, "uuid": "ed2458a5-4f9b-4eeb-a58a-8c9b237fc7b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970996, "uuid": "bfd3c252-3cf5-4223-ba8e-5c4ceae664f3", "value": "64dc5efa60e82721cae7a5e3ceadcde6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdeec611-1f34-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689002214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002214, "uuid": "99aee748-7185-4182-a02e-cc360977117c", "comment": "Malware payload (Mirai)", "value": "103f5c9603d23f6d76a13ffcf5451c02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002214, "uuid": "d1518d8d-c948-4b25-ab1f-655e2b10d497", "comment": "Malware payload (Mirai)", "value": "abeb0ab665b7da2a24c79fbc94db7df6a957f79f89dc1f4f21ce168ce1b8c02c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002214, "uuid": "c24b0fd1-0e34-40e9-87f1-65af0eadc6ae", "comment": "Malware payload (Mirai)", "value": "098504d10d6c384c32c498d17e2cad98da6ba2f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002214, "uuid": "966185b1-dba1-4dc9-919b-dd18cef0a2b5", "comment": "Malware payload (Mirai)", "value": "8ef666c49703ad9bcc819aa8b3702699ebe5ea37c5b04760153c0336abfb071750dab39f05ad85e786435963bc354e60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002214, "uuid": "8d69df55-c816-4362-a144-b8711fb3a304", "value": "T1CEB2D0CC61543084CA8D7C7C178D4A664FACA1D0BAED9F15E354CD98B3BEA4B345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002214, "uuid": "8c9531e2-aba9-4d8a-9a5f-1b4908cd5446", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBp8ZqSWvQ:4QlS07FUXqIYSXQKquEqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689002214, "uuid": "3c499963-fbf2-4886-a006-78acbd7122fe", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689002214, "uuid": "a808bc69-2e96-4027-9dad-a3a56e850887", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002214, "uuid": "9a041baf-b86d-4164-9e9d-5c01bf7e61ea", "value": "103f5c9603d23f6d76a13ffcf5451c02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084638e6-1f06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1688982126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982126, "uuid": "8620d15b-4ef5-497b-abc2-ecac1d73b83a", "comment": "Malware payload (njrat)", "value": "01d7dcfc0d43e1a63160c2a2be09ac3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982126, "uuid": "c589da25-5139-4b0e-b757-d071ddaa26c7", "comment": "Malware payload (njrat)", "value": "ac458cf6d935c1fe276458fa4ed577c356a81662fc0978ed9708abd863b519c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982126, "uuid": "b7396408-d1c9-4e62-8853-2ab9ef65af4c", "comment": "Malware payload (njrat)", "value": "b153f050ed9297fe236e5112ce3b4a334b18b135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982126, "uuid": "13b0ab10-ce61-42d7-bae5-f2af5c91bf69", "comment": "Malware payload (njrat)", "value": "42642c5c12ae23bc218933266aff5eedec32bb36893435d4d24c765df368ec9ee9c5d33fe92900147d95649da89e6a3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982126, "uuid": "941b1354-025d-4eed-b521-632d452e032a", "value": "T162E22AADFBE64469C2BD0AB60571950113B4E003D522E77E4DCB28E62B2B7D84F58DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982126, "uuid": "f608ae07-1e18-41ef-99e7-d982abf4b83f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982126, "uuid": "db6fe0e5-a0cc-419e-8744-9c0498da4b12", "value": "768:rSHMXrwpJbb2zxxO5Seqf3isfvUuQmIDUu0tirXj:rlkK9is7QVkaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688982126, "uuid": "92ffb4fe-8a03-426e-ae70-376f6323f5ad", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688982126, "uuid": "c00f710a-911a-480b-bd97-39ed44a723d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982126, "uuid": "7fdbce47-eaa4-4da0-a240-41eb238e3175", "value": "01d7dcfc0d43e1a63160c2a2be09ac3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcbb18b-1eca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688956476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688956476, "uuid": "ab92c68d-9ba4-4e00-bf22-2ca8d43bb8c2", "comment": "Malware payload (RedLineStealer)", "value": "68908046bda0e62df4de00e709788f58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688956476, "uuid": "80a47c77-9169-472d-8623-bad684e09747", "comment": "Malware payload (RedLineStealer)", "value": "ac644ea069910fca1d872a3a2546258fa68762a906839ec2369bc2b47242da11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688956476, "uuid": "ee55293a-8aab-47c5-bb3e-379120561b39", "comment": "Malware payload (RedLineStealer)", "value": "17f1f197f4bc8479fe83cd89cf7dbda42933ff13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688956476, "uuid": "64c4bdca-106d-46c8-9d99-e8de75d751d4", "comment": "Malware payload (RedLineStealer)", "value": "a5c88b778a952a720e71bfdbb5938ba5bf0cb6f072e52ba7fac8e8b3e823a535035e06ca3c51aa09e073e8c14e9e3d56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688956476, "uuid": "791de6c9-1ff6-4db9-851a-7cec54020d16", "value": "T1D0C40260B1D34823E5B2407765D0925FBE1FDE3209519A8793C5793E8B3A1C25E3ECAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688956476, "uuid": "8717fe59-da3f-4000-9d13-cdca917b0435", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688956476, "uuid": "1055120c-dafe-4132-a1f9-370f0a0137ba", "value": "12288:tugHzDz47ez+HnIuV8wFHQ+OxW2UFV8vTtdvhyDjxo:9TH47eHuTO8OthhSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688956476, "uuid": "5c8761c4-3169-4684-993e-36fe1b67c95a", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688956476, "uuid": "43c57b54-2ff7-4fc9-9e67-7499c60bb1c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688956476, "uuid": "e19a92c6-b29b-4c6c-b881-690fa3ad8495", "value": "68908046bda0e62df4de00e709788f58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3548b2df-1ee9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688969746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969746, "uuid": "a40625de-e565-4f75-953c-d632ca16e68b", "comment": "Malware payload", "value": "8f3aca846b7caa2bd9b66922171cc06b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969746, "uuid": "a45ee7e0-1225-4fb7-9603-340e9fc27c5e", "comment": "Malware payload", "value": "acd3bac0e5044bbb4277b3a45c9adbc3944d49d0c2a445029496c2ba9178c565", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969746, "uuid": "956412b7-e0c6-4e39-8b3a-d8419ac2819b", "comment": "Malware payload", "value": "bc215f063f4cab89da38b012c02102f76ad98a95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969746, "uuid": "a5d253d0-1e1c-4652-95c6-4736ffd0f2f3", "comment": "Malware payload", "value": "7f6198355629a254c13815dc80c247454b522178a7f04a41dd01fad76b1ac14f3bf5e0e1708e01cf96dbc6ddecfda18a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969746, "uuid": "603489eb-c988-4e9f-b016-1962027f629a", "value": "T1A446332B9D1C6940C0CA46318952585C3132DF74BF028BAB9A6EFF5777BA5C3B02879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969746, "uuid": "04f37c83-01d1-402a-b570-a528058e85a1", "value": "a94549878c259a0f21633bf9ee3fa800", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969746, "uuid": "bdf57aab-3f43-47f1-b44d-42a1303a767b", "value": "49152:xlovXEslKhp8XqRBhyEb0aGEnlpVMvxrdSAhvQdJgbUdr63V6Xb:xlYUs8AXqRZb0qnlpoZSAdQHgAdm3V6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969746, "uuid": "2f62a255-9fd6-44fe-b8e7-9a30858ddb2a", "value": 5750856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969746, "uuid": "101d3a50-db83-4845-8c47-54c3dff8f7bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969746, "uuid": "917bad27-2ec8-4129-a7bb-b8c965f6e36d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970a9fe4-1edf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1688965615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965615, "uuid": "cc24ce72-9993-4174-b0d7-d969174cc55e", "comment": "Malware payload (Gafgyt)", "value": "66f22fa8068e4f9e076fd298731caa86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965615, "uuid": "cb013bc0-d008-4854-a5af-8332fb5119b8", "comment": "Malware payload (Gafgyt)", "value": "acf6568c726f9ea2a7a43e859752b626ed9b15471d3082f400bebce1c4b90d00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965615, "uuid": "5f858d01-a1d8-4d6d-849b-4c9e873c0ae0", "comment": "Malware payload (Gafgyt)", "value": "172cbdbcc506b7590b89088991c7777da1f1e02c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965615, "uuid": "c76ffed7-b187-41b7-8c46-7f8ea6db9a7d", "comment": "Malware payload (Gafgyt)", "value": "c5b86547cc255fc26e395fcfaf75b481dce145c0070448ef3ee1e91110abef00bb21d9505f77ef4d0bc9b50cffcab2e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965615, "uuid": "9fc6138c-2173-49fd-99d2-3b327d07f961", "value": "T12A0359D2C9B12F78D128D471B435AFB953636010A74F0BDE2039C2A4569FA8CF40EBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965615, "uuid": "3d923ae2-2b37-40c5-9da6-6fd11b5bd41e", "value": "768:pzr/kRMK6O/rt39i4CBS2K2MBYLaNosuy3upcxJhfUBAL8CMI:pzgRMWZtZC3KVBYmCsTunBAYCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965615, "uuid": "6c9951fa-693a-47db-a74a-704991db2f02", "value": 39740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965615, "uuid": "1abb7552-d76c-463f-bb0d-5d16de0a8480", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965615, "uuid": "e0186548-e081-43a7-9957-1b50505659b0", "value": "66f22fa8068e4f9e076fd298731caa86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3934e67a-1f3b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689004971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004971, "uuid": "bf5b728e-6226-41b7-b384-346d2926a3b3", "comment": "Malware payload (RedLineStealer)", "value": "59b74a5c0c79e277b6e9fe6814f91aa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004971, "uuid": "39428029-c9f8-432e-9510-43da1b611028", "comment": "Malware payload (RedLineStealer)", "value": "ad3de13de28407363e7200a8e71a42acad55fd725a477558d19cac5e021ecd70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004971, "uuid": "2f1bc1ae-2878-4fda-84ef-d7d0af29f316", "comment": "Malware payload (RedLineStealer)", "value": "83be9e3d38b6223c256babaa80f2945e53e1954a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004971, "uuid": "7ca11b45-6baa-4edc-8ebb-5e204783fd72", "comment": "Malware payload (RedLineStealer)", "value": "034e3e300aea13959064c8d3151837ea2b75340dabe1698e150f27cebe1906d876c0d6af45056af441c7ce8df9c29a27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004971, "uuid": "5e1c43fa-1ffa-4331-854c-cf6f63312880", "value": "T17A347D1266D0FC63E96746328D3AC6F8362EF9518F19775A22187F2F18712B2F272351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004971, "uuid": "5f45bba1-65e3-4e6d-8a5d-cc5cfef929e2", "value": "5a013624489e6703ae44eba8e360cecd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004971, "uuid": "9964bbb2-a624-4c47-a3cc-f278abb8dc4e", "value": "3072:5InLsdvCVrFBXsuSB6Hy3wlip43WyruQY/z1:OnLssbpszjjPyNYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689004971, "uuid": "08cf6c19-1431-4219-b63c-e74c92845ecf", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689004971, "uuid": "c7f04b98-c12b-44cf-b574-ed0217fe190e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004971, "uuid": "7487adb5-647d-4332-8d69-2825d4eb7f50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8144b9e2-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962572, "uuid": "c64edf36-759d-4b47-a99d-ea71ad858ab6", "comment": "Malware payload (Mirai)", "value": "5189204add2ac1853fc19b56d97f48fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962572, "uuid": "7fd35039-ce7d-48ca-aaf1-3ac3c2e0ca20", "comment": "Malware payload (Mirai)", "value": "adcd669b832f50d64af23ae4ed84f5f8ceed6e7df13d575aa3fa49c736c2d9b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962572, "uuid": "d950e478-8980-480d-849b-3fcfc1b9ec50", "comment": "Malware payload (Mirai)", "value": "cb728e9c544e85b1a69c50a3f81cc75780311c34", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962572, "uuid": "736abca6-fd4f-406b-80fd-9144fd722cb7", "comment": "Malware payload (Mirai)", "value": "3a5e8d3ba9cb783ce5c1924e84227298831dcd29ea9779277326048eca699eedf1d3ead2510f058df839eb9f0207c400", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962572, "uuid": "81321c81-c8ef-48b4-9496-baa0b74147db", "value": "T170142A46AA408B13C0D32BB9FA9F42553323AB58D3EB73059524AFB43F8679E4F23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962572, "uuid": "a98a154a-b8e6-4750-952d-e7fb00545a68", "value": "6144:MHYllfLh/da6rkX5dg3YiTApzHK0M/RLs:MHyZh/da6rkX5dA5MFKJ/xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962572, "uuid": "207c922a-c6c6-4c16-8015-b56fcbcee22f", "value": 197418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962572, "uuid": "40ded0e6-c7cc-4a36-bdcc-e71869085369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962572, "uuid": "93099012-44b2-4ca2-b747-d4d13bf810e0", "value": "skyline.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e177b6d1-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688978195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978195, "uuid": "c766d4b9-6b86-49be-b7a5-7537c76b6eb3", "comment": "Malware payload (Amadey)", "value": "bf20573765fca900d016ff8c3fc5f4a5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978195, "uuid": "cf1a59bc-4bca-4528-a40c-7b6da60ee5de", "comment": "Malware payload (Amadey)", "value": "ae5049b9993378943f2cc739289866a12af1bd4db94d6ce64eeeeb9e44becab3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978195, "uuid": "591a5fc2-5fb6-4b07-a4cd-0e70e6f8706c", "comment": "Malware payload (Amadey)", "value": "08c41ce2b9fb52934c9bf39a184f4fa264628b74", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978195, "uuid": "3ff00529-b2ea-493e-86e4-79c6e173df09", "comment": "Malware payload (Amadey)", "value": "ce3f8a4dff9e9c48cf5e02344018998e0be62f3ab6633355083618b43021b765a29f83c1d86e54e0d5c1f52a41fc816e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978195, "uuid": "19696cfa-b51c-432e-9af5-5310e1156377", "value": "T138B402A171D28623F532003359A0916FFD1FEA7549A19B8393C9793E4B381D24E7DCBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978195, "uuid": "763acec6-7ffe-4cdf-a420-b321b037ae2a", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978195, "uuid": "5a40157c-9d73-414c-a5fa-4780dac3e170", "value": "6144:6mPD0GqMHBFaCWGYLUz247ptNUinMfYkHWryEDvmIr1/Z7fKcBwBik1i0S+5W:6mYOcz47dkHWGEDvmA/ZvBwN2+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978195, "uuid": "f3a6b166-aa6e-4fee-9788-96be722d8df8", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978195, "uuid": "4306aa7f-642d-4d20-9340-5c42a5bc721c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978195, "uuid": "3ce13191-e612-40b5-857c-20392203dddc", "value": "bf20573765fca900d016ff8c3fc5f4a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2477237-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985015, "uuid": "c8a58ebe-f2bf-4c48-873e-41ceacf6ce58", "comment": "Malware payload (Mirai)", "value": "1c30e95bcfc0e49bb4030477daa4c049", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985015, "uuid": "8f3e3550-a652-4052-9fba-05cd19b9a3e9", "comment": "Malware payload (Mirai)", "value": "aeeecbb12cdfe26a1461ccd86f8b8d713df3edd46bb339b4458568d79c201cfc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985015, "uuid": "da391a16-bc49-4ce8-960c-c8307988aa24", "comment": "Malware payload (Mirai)", "value": "581aec46dcfef8d0a5b7dd078e5cb34078bd72b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985015, "uuid": "c79f643f-5f0a-4191-8f5b-5b1148ffcc1f", "comment": "Malware payload (Mirai)", "value": "1662822edd6198d2be8f444a9cba7d8f3f243cba28f1d0cc8711c3fcf9465d189ba110b3e382c7168a633336eada169e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985015, "uuid": "ca25a149-ffdf-44e1-b230-e9788943cbd3", "value": "T17F533A5BFC809F11D9D065BAFE5F224A33134B7CE2DA7102DD149A256B8AE1A0F77980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985015, "uuid": "30770a28-ac93-4d91-b357-bc70784fb506", "value": "1536:lJnhpkFpucDb9KrxalfxaKvGaNjEoiO4QdxY7P8Rs5h+e:FpkF4cg+fxaKvGaNYA4Qdxn+5h+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985015, "uuid": "10f063bc-ba66-44f0-b85f-1c36b6114e93", "value": 62876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985015, "uuid": "3433b062-40fc-47ff-9303-165bf8eff549", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985015, "uuid": "0f5e22b7-775e-42d8-ba2a-912d72d6e7af", "value": "condi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fdf798-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985026, "uuid": "40a9c24a-ff2f-4dd8-a1a9-4c0b900b7ef3", "comment": "Malware payload (Mirai)", "value": "933ad38f202a892ec60e47997afbe47f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985026, "uuid": "96981a10-c473-4575-8440-a25d19cf2566", "comment": "Malware payload (Mirai)", "value": "aef6d69715b07f167e110796d31b697ec3140a314ab57c7c9279ad5acf2a9631", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985026, "uuid": "d15f0592-8c3c-48cf-baf2-ff803d19d7f4", "comment": "Malware payload (Mirai)", "value": "8522db2ae5a4347d4c428ed6ecc2f3afff98a381", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985026, "uuid": "017a07df-dc0a-4119-8ca1-f1e0515ebeb7", "comment": "Malware payload (Mirai)", "value": "85f80fecaa094cea87a3cdb194d61fcc8aa8fde26c44afa0bf072bfc373eff5c4a5cdaa5ece5bce8585e1b749ca490a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985026, "uuid": "84dc71d0-eb82-4668-91be-e14dee0f19f7", "value": "T16783060AEF510EE7D82FDD3346AD0B0135CD955B22E93B767674C828F61A54B0AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985026, "uuid": "0b5c3cf0-e496-4213-a458-41272eb537c5", "value": "768:o40SPFJ6FilkhPt4CceBeLzezrw3wsY3YEiuUyZ8ZuFVXiaSUmgyT+l2mcnxPKwb:odOUukKz8vIh4yZuFfSUmgyFmcZs5hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985026, "uuid": "6cc90596-5edf-4c08-b9c0-f96551870677", "value": 80940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985026, "uuid": "028fece7-96b5-4a11-903d-5ae8fb9769f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985026, "uuid": "03c85027-d8d8-4c92-b8dd-8ac975b10760", "value": "update.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c605d4ee-1ed0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688959251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959251, "uuid": "992103fe-c5a4-452e-aa73-bfc30e733732", "comment": "Malware payload (Amadey)", "value": "96284c80dbf1170cf04f393f4217e632", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959251, "uuid": "ea9791e8-cd38-4130-98be-7eb40e8e0f13", "comment": "Malware payload (Amadey)", "value": "af60086592adfaf5ec65c69085a2688792b0c92a1509e9f27aabdcb20969dbbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959251, "uuid": "bc41c01e-f1c2-4852-8f5a-ca68ac5a0460", "comment": "Malware payload (Amadey)", "value": "a7559f18fefaf3ad6c1c946ec14f506201bd416c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688959251, "uuid": "7b93b733-cebf-42e6-a2d9-13121fcb8488", "comment": "Malware payload (Amadey)", "value": "cdfb95525a30db1bc27716e4f55c071cc23cd947b20fa676b1721f99b8a2710efa15958c7149d536c262222a14871d67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959251, "uuid": "f2689e5e-2d03-44f9-b990-08507d2ab18c", "value": "T1A6C40270B1E29923F1B6143315A0926EBE2FDF7115905A8392D8793D4B291C16E3ECEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959251, "uuid": "aadc72e0-00c7-4c66-a87f-22bfaf109d95", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959251, "uuid": "ebbce475-cc63-43fa-8017-84013fdc1553", "value": "12288:7k8Hoz47IJ9LjUEUD6U6aMkop1G0ulMO:rK47IJW6xnkSja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688959251, "uuid": "2b76ff9b-0e9f-4045-b45b-fc2905e42ef9", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688959251, "uuid": "2ac42baa-1027-49d5-9cfa-c0b93235f71b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688959251, "uuid": "030a5b4b-a267-40a6-ab44-d57e8b510565", "value": "96284c80dbf1170cf04f393f4217e632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd9967c-1f27-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688996389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996389, "uuid": "cee4c645-00e7-4ff6-91d6-8aafccf8d7b5", "comment": "Malware payload", "value": "99c0e6566af8ccb00b93393ae1a6bb3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996389, "uuid": "43f624a2-ca43-40ec-921f-6de50145951f", "comment": "Malware payload", "value": "af930aa7e1e1012dfe1a62ce142f283ae0bde2d57e1b8814f0e71cb9852c41dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996389, "uuid": "e54d18ec-53b7-46b3-a260-f62796cce22d", "comment": "Malware payload", "value": "577cde704ef2b0d3082e7d76d38fab1287d5e6c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688996389, "uuid": "8d34bfd7-3b23-4306-a321-1d60559c3d24", "comment": "Malware payload", "value": "06dee045657b4b59ec39ddf2c54081f5cc663ad9b45dba8a814078d9107f232ac25487fe66f5c63813e96a30d1042604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996389, "uuid": "0d274dc1-8f39-4d8e-8792-780a2cd16475", "value": "T1AE02E61053A9D239D4E30F37A8A397816670B7526A96CF3F6C94210FBC522849EA3B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996389, "uuid": "614478ec-7787-4c8a-b135-426dda0f13f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996389, "uuid": "040bf018-74e1-4e64-b6e9-ada5e7578185", "value": "96:9BJuQwAWpxfpu1EpPD1TIoDILtJ34qeq1me8MMrAocB+363WjyWwazNt:x0Ppxxu1ELeLfX1eAXN3WjyWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688996389, "uuid": "9588c415-de4d-40c5-80bf-4970f13a40dd", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688996389, "uuid": "6a7c031d-bac5-4999-a124-adb126030baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688996389, "uuid": "a0394d4e-86b2-4636-8be7-59d4085f06c5", "value": "SecuriteInfo.com.Win32.RansomX-gen.11180.14760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294cfdfd-1f61-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689021266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021266, "uuid": "e77efc4f-b705-4e52-8dd3-dec8373e2dd7", "comment": "Malware payload (RedLineStealer)", "value": "ff87e78da3952e44771a8db20c4bca96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021266, "uuid": "1bce1c41-d1df-42c4-b8a4-39f729054c99", "comment": "Malware payload (RedLineStealer)", "value": "afa4667f5567ccd61ac5a2f11927d803338c52a9a58f791ace73ce44503ed799", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021266, "uuid": "b2a61b1a-a900-4246-a6b9-8d73575c964a", "comment": "Malware payload (RedLineStealer)", "value": "9df4ff145ba5b5a881473c0c3e5ed196b2c6c539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021266, "uuid": "0ab6a81d-3b06-4bc6-8579-74d0c03a6f3e", "comment": "Malware payload (RedLineStealer)", "value": "aa2bf21a1a79317d9863f57da4330ed993184b040464974154d98d43aca2c7e19970121dd52386223dd1665638fe4f58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021266, "uuid": "1028d17c-1564-4790-b122-8bf6a4211c94", "value": "T149E4DF3914A144ABC4A9AE39FF4BD4C172162EE1017C950E3EB36E783BD24578DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021266, "uuid": "b607ef52-11d4-4340-ba8a-76ff9a2ba23d", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021266, "uuid": "edb93956-585b-49a0-ac28-bd81e3eb0943", "value": "12288:tw3zk2EMiICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:twDkNMBbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689021266, "uuid": "b639a87e-9267-4e46-84ec-b1a112615de1", "value": 708931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689021266, "uuid": "0bf18909-c4cf-40b3-a63e-f2959d19d111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021266, "uuid": "10c01e12-50f1-43b7-bc77-24997735002d", "value": "ff87e78da3952e44771a8db20c4bca96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704bd88c-1f2c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688998621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998621, "uuid": "059a3c06-98ea-4188-9197-c471ed106fe6", "comment": "Malware payload (RedLineStealer)", "value": "fd5affd9649f9203922daee93bc3e6dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998621, "uuid": "15117e1c-6213-4b31-b893-cb3d00c22973", "comment": "Malware payload (RedLineStealer)", "value": "b106631de5708f0c7db74edc5956c0b438759a051a4624664124b76ee2f29356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998621, "uuid": "fd7fe91c-034d-4ec3-8601-b1198959bb43", "comment": "Malware payload (RedLineStealer)", "value": "1c076b91ab1382eac4505d09ef7c8f044056b9f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998621, "uuid": "4e227617-9c8d-4f7c-a2eb-8cd0ba637bdc", "comment": "Malware payload (RedLineStealer)", "value": "0a005c3be1257aee9da863820162924973ee88108973b7187b1b74c090add0017b35a2d5bc2964f8bd21f9623b44c668", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998621, "uuid": "8d2b9b3e-e459-42ea-aab6-6cbf253b61be", "value": "T15C44283821E154A7D8799E35BF4BC4C0321AAEB4017D545F3FA36A386B92093CDF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998621, "uuid": "33521418-5efc-4b57-868b-50b9f4e36530", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998621, "uuid": "4cfd9b2a-8aa2-42e1-8f73-3d7fae5c8be3", "value": "3072:tti+n8geQ7+ZycM/dAGcEZsOxnI7DBh2jAddhJ2wQnUlQxogBPnIztS0q9S:tY+8gj7obEZsOa7ujXwQnUlQ0rq9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688998621, "uuid": "f8e6fb27-c920-40e1-b4b5-8ff68c724ea3", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688998621, "uuid": "5940b642-89f0-4765-a055-1d888200e28a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998621, "uuid": "253b86bb-fe39-4127-a32e-0c2e3d8fe17b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927f1c66-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962601, "uuid": "9616fdfe-e029-471d-a138-f461a32808b0", "comment": "Malware payload (Mirai)", "value": "e8cb5f1582b4e00b03a23b65e2bb2507", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962601, "uuid": "0b97b8d3-3458-4f4e-a96e-317ff954e28f", "comment": "Malware payload (Mirai)", "value": "b11581704d12a136c2793c41db416d8bacf43267de3819c9a0e72bf891b865b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962601, "uuid": "91bd5ec9-bd52-4cf6-9c4c-5a7de464482e", "comment": "Malware payload (Mirai)", "value": "595e56bf8c4b8a0c44aea8a7c901a5b22f67ea1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962601, "uuid": "f374877d-b669-4caa-95df-f05dd1954ac7", "comment": "Malware payload (Mirai)", "value": "10a4d62849a70454f39068af44dacdedf8ac77f9c149aacf641cfab1f031401736da61707925768fdb4c56b4dd95ebd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962601, "uuid": "6362e222-3a55-47ff-8372-55f6500333e1", "value": "T1B8E2D14AD3E97197C98A6D3849DF53148B42238327778EBC53059C8C3BA4BEBB40819D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962601, "uuid": "dc816756-93e3-44a7-baea-48aad27c387b", "value": "768:Z5iL2k3WFxKmh7rHCVJljEqBI7J7A02MBc2ks1dNW3:kfoxPh7roljjBJMBc2kUdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962601, "uuid": "e09978a5-9bec-441d-a016-bae00403d094", "value": 32456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962601, "uuid": "4a8cfc8c-84fd-405a-b289-3852a6a2637e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962601, "uuid": "54329bf9-7e87-40a8-af59-cbc26146a5b1", "value": "e8cb5f1582b4e00b03a23b65e2bb2507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a15cf89-1f3b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689005026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005026, "uuid": "fb242a3d-bd64-41c7-b2bf-5f4e2d2f9dfc", "comment": "Malware payload (RedLineStealer)", "value": "ba371037effb3bc1fb01bb593a705272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005026, "uuid": "033b374d-7a1e-4f20-b4fb-6b99b27f5ea2", "comment": "Malware payload (RedLineStealer)", "value": "b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e321fa61b848d8c86606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005026, "uuid": "002c4821-48e4-43fd-8221-f6dce844c0ac", "comment": "Malware payload (RedLineStealer)", "value": "a557ecb6ba798abf36b6c691d19e50e03e2285df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005026, "uuid": "ec461063-8ec1-45c3-a539-a030d511885e", "comment": "Malware payload (RedLineStealer)", "value": "26312169aea57fa6a90ee3915692b99cddb2f0936a6ceda4b6badff4608e8b18a2a892197b6dbf6cdc82b73ee3433dfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005026, "uuid": "22f0f0a7-9816-448a-a0af-525518807a13", "value": "T10A152303AAC8E436C9B9237058F613931E36BD929D70C32727A5E85A2C73585D5723B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005026, "uuid": "2de140a1-def5-404f-ac39-eda93d2860c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005026, "uuid": "56010f7c-0d37-4dee-8d91-746101b61b3d", "value": "12288:yMrjy90R4n/HwA+x/tRDFjep/9fX7ZqpYM3b3GOfGsBuku78cKIyVUYFYZT5zd+O:Zy4k/HwVZWZqScasI778FIyTYZNsiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689005026, "uuid": "90dd2534-d184-4d79-8d56-af88817012ab", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689005026, "uuid": "6161fe3a-b0d6-4612-b5e0-c8bf091752e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005026, "uuid": "b2ab41c3-462c-4949-a57a-ca76c39f6fa4", "value": "b11b1b57a3bb5f7ea58bd5b191ab3813432fcc41e7f4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b97497f-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962536, "uuid": "bfbc27cf-3b90-43a3-a934-a58bf54b7409", "comment": "Malware payload (Mirai)", "value": "90654b100dbb55c403dac28f2cd96f66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962536, "uuid": "e19344ac-3ca0-422f-a40f-c3b6d0817ab2", "comment": "Malware payload (Mirai)", "value": "b269123282a22c58ac9a0879147a3b32a94e2a5c43a0a5e796e4c179ddf091ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962536, "uuid": "dd1e662a-aead-499f-9fad-1d433da5ed51", "comment": "Malware payload (Mirai)", "value": "d9c5f6082eebb3e650bbea5e9bb093e3b1fcaf04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962536, "uuid": "ab541713-88e4-449b-b069-c664c9272720", "comment": "Malware payload (Mirai)", "value": "ee41c6cda8bdbff4b5f99760b5b778a622a34528095e179783e49bdca9a9459bd681dcd13f366e597d01ff4c101ce5ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962536, "uuid": "dbaeb041-7048-431b-9293-444ceba2a378", "value": "T1C84319827C81AA39C7D057BBEA9F108E3354ABD9D0DB7347CC140B9176CA51B0D67B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962536, "uuid": "75d418f4-8402-4ddf-980f-bdacd6692812", "value": "1536:VX3kcPLAR10ydj/BTLU8GYQ0zYJBb07N5z2yYceZW8eX4M:VnXPLJ0R5z2tcwsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962536, "uuid": "e04147e0-b2b6-48dc-9c48-0b570ba6cf76", "value": 60180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962536, "uuid": "58d0b2dc-2f55-419c-bfd7-3440320d3ce5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962536, "uuid": "9f126b20-f9cb-4c13-b7e3-82151c9d917b", "value": "90654b100dbb55c403dac28f2cd96f66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eddcac2-1f29-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1688997330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997330, "uuid": "9bd93b3a-4a4a-434b-97e4-6d0e2aeff77f", "comment": "Malware payload (Smoke Loader)", "value": "de57b149ad578c5263dbd39a3134bdf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997330, "uuid": "c3de7752-3033-4df5-8bb1-c0c38b2bf674", "comment": "Malware payload (Smoke Loader)", "value": "b2c1cf5abe85457b05137e30855c2655970a21c67d9b5f3085f55d1e9a2cd463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997330, "uuid": "78c12717-b7ea-41f7-9739-c82128f628f8", "comment": "Malware payload (Smoke Loader)", "value": "d3c8d8775b9b18745f3417979f4fdd5b7541bd32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997330, "uuid": "3291d752-ec72-43a9-9c41-b5902f973a0a", "comment": "Malware payload (Smoke Loader)", "value": "134d9e7ea53d103e70f669fe31e46e5c60761c733bcb386dd81b6c6371c7ca9ab26063180a4ff4f14b8113959d3c6459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997330, "uuid": "5d006576-c885-402e-970a-60a936eadd7b", "value": "T1ED348D0362E1ACE3F5A74A329D3ED6E8361EB5514F58775A62186B3F19301B2F273312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997330, "uuid": "73125f10-7ba9-4901-b6a8-1dd9f682da8f", "value": "89580c01d87da774c9ed352344b8ed4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997330, "uuid": "ed047bb2-cd1e-4a6d-8ff1-6114be5ec20e", "value": "3072:R+pLHfKvODHu6D+dT62jsN1Wha/2H0dd7d4mO/3BVVtJXeNUG:ApLimDHu6m624zWhau0d7GH3BfXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997330, "uuid": "0d1053c1-04d9-4310-a672-68097372710b", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997330, "uuid": "a464ef01-b2e2-429e-995b-1c0877608468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997330, "uuid": "8ec1a5d7-050b-41d3-967b-9bd28202f001", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec4371c-1f40-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689007450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007450, "uuid": "4c652c79-6fe0-4b6c-add4-609da37fc33c", "comment": "Malware payload (RedLineStealer)", "value": "1cd3ee9491a024f11a40114cbed01d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007450, "uuid": "f5717264-9429-4644-8636-5e816208f5a6", "comment": "Malware payload (RedLineStealer)", "value": "b2f05c226a94719585995d8954dfe258e0ed559cae9d1324074226a871a97594", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007450, "uuid": "f0056452-a75a-4999-876b-83941b3b84bb", "comment": "Malware payload (RedLineStealer)", "value": "96314dc75afbf0cfb819e26232a93d6c7e6ae833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007450, "uuid": "4a0a3c0f-0cc1-42f4-8274-ce6e711595b5", "comment": "Malware payload (RedLineStealer)", "value": "58f22dcdb928a87015627c18e98f38c7657f62c502875343ed2328dce5f7eee03f278181fb5265c464a1673b2526dd86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007450, "uuid": "a2d41b23-8232-41a1-9368-6abca753fc69", "value": "T18DE480A814785FB2C035CAB14AB0C090F7709D9A3365DF357BA277D6A61FA0135C7E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007450, "uuid": "09983586-87be-463d-a493-7aa258c1c123", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007450, "uuid": "408f3ad5-1300-4344-ba6a-68593e8fc77b", "value": "12288:VnwDKZAQmmaHu4yCd9TUbJpvZVC8WfyrRZHvloV5xp:VnwDKyUaHu4/i3BVC8Wfy1VOVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689007450, "uuid": "c78289ba-1123-4c7d-bbcd-45b635bef712", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689007450, "uuid": "3d7630b9-d887-485e-9c0f-863c35136142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007450, "uuid": "28f172d4-dd1a-4337-a635-b5d081c01abf", "value": "1cd3ee9491a024f11a40114cbed01d11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdfe70b-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985704, "uuid": "a6c04f3a-ac0d-48af-8dd3-d794ac8b5d23", "comment": "Malware payload (Mirai)", "value": "8f71c5d5ed45833d4c445cf16a0b67c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985704, "uuid": "d7f16656-ffb6-41d1-b95f-7992b2e44b7d", "comment": "Malware payload (Mirai)", "value": "b3468c0893bcc34bc0cff41bd8cfc0b86dce193e4aee6d5146ccddc2fcbd9c67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985704, "uuid": "59103867-7a53-49da-b847-bdf5be649cb4", "comment": "Malware payload (Mirai)", "value": "c493ea61d4387197df24e4b239cdc7bcd882e810", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985704, "uuid": "e21e3a60-5e31-4cc4-b81f-34ae496fb1fc", "comment": "Malware payload (Mirai)", "value": "7aab768960a2b198d085190f0c9091c3053babcac58722d1bd0fd231a77904f8d4348e3b98d9f6e1b8dba76a8200b11b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985704, "uuid": "e33dd80c-1e3c-464a-bc7c-dc9cf8a17ee9", "value": "T17BE2D1ECD1A82C46CEBF393AA6CC0728AED1A5C5335F4B5CC3318854591EA8A59FB054", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985704, "uuid": "9046c4d3-c5d7-463b-aefb-8f22ac89d18e", "value": "768:EyGp142eK7C3iZGSomEQx8dumXV9I1qvWG:0L4mrcSZ8um8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985704, "uuid": "b583851b-0224-4d08-8aed-838094150b30", "value": 32440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985704, "uuid": "2fed01c3-dd0e-42d6-bc25-2d25843494b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985704, "uuid": "2ab54cbd-9ef4-490c-a3fe-84aec8f9ee04", "value": "SecuriteInfo.com.Linux.Siggen.9999.25019.6495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5924f0bf-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985698, "uuid": "f2656c04-a33a-4018-be4f-c57ff88e9b52", "comment": "Malware payload (Mirai)", "value": "c9bf321b862c0e66320138e324429980", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985698, "uuid": "f5bd18af-47fa-4243-bda6-61519c071d99", "comment": "Malware payload (Mirai)", "value": "b35284e427b007ffdbc1e803daeb57ffcb88aa0abdf7a0af5d20c5a1b7f4420c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985698, "uuid": "3b5e7cff-9f46-4eb7-9bdf-2e8ac50eee88", "comment": "Malware payload (Mirai)", "value": "176f998d8ac536d688c052e97bd4526519d2a32d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985698, "uuid": "125f8755-8591-4733-9a40-2d0b22f0a97c", "comment": "Malware payload (Mirai)", "value": "952dd6fb075ada4efa797052c04873e49a3455503a1638d2ed8da51d59c14487d106787070a1f0cf56b3583bc6ede505", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985698, "uuid": "f150bcc8-6086-4991-9c80-59745336dfbb", "value": "T1F0D2D0319074E632E221543A9C6ECBC2A9A7057EC3FB36372A9056553DE342575F831B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985698, "uuid": "0a1130b5-6535-4b8d-96bf-91725e8756f8", "value": "768:+JIhENuGoiiT2wUUvmv0MeRExqV/fHqqUB9s3UozY:+gGoLT2wev0OxY/P5U6zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985698, "uuid": "b944b1ba-6e84-40a5-aab1-e6580cd0f396", "value": 30344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985698, "uuid": "9f98dc54-4e8a-4ee4-8c21-def6509f428e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985698, "uuid": "ce5df100-847e-4a50-83d5-e1c20c5e8175", "value": "SecuriteInfo.com.Linux.Siggen.9999.12969.22444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5908d909-1f42-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689008031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008031, "uuid": "9ecc35df-b8bf-4ccc-bb0a-b141c3256b7e", "comment": "Malware payload (RedLineStealer)", "value": "78d5748d3534102ac3cab161d132ee8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008031, "uuid": "c170bd0b-2f9b-41fc-aef4-cdf16b3ea998", "comment": "Malware payload (RedLineStealer)", "value": "b3766caf22922447fce99a292a71c9d9b370e7f62676f9e14d1fbaba52e7379c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008031, "uuid": "2c6fe3eb-c8fe-47ea-a45e-a144110de5d4", "comment": "Malware payload (RedLineStealer)", "value": "4e160b7a374f8575e26f4ad82aec767a3d30f6df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008031, "uuid": "e6049dfb-102a-456a-b080-ad0b073fb128", "comment": "Malware payload (RedLineStealer)", "value": "d1768caa019551a943be2a9d7e796209d0d80ffabe0352811516ea3f18410b0a158fc3580466c36106fabbe60e42fee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008031, "uuid": "a60f4567-2fe1-4d3d-a736-fea7dac8e9e4", "value": "T192E4DF3914A144ABC4A9AD39FF0BD4C232162EE5017C954E3EB36E783BD20579DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008031, "uuid": "9c60e3d5-5023-4adb-8d2c-8297fa53fa7c", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008031, "uuid": "4204ee24-1d63-4975-9304-2167579b1757", "value": "12288:ow3zk2E7iICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:owDkN7BbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689008031, "uuid": "71466a8a-f86d-435e-9840-6545d72f06f8", "value": 708930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689008031, "uuid": "ac2cb2b3-0687-4781-82fc-7bb18afe6ee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008031, "uuid": "61809197-9623-4858-bd66-386bb8615af7", "value": "78d5748d3534102ac3cab161d132ee8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf19d59-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688990858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990858, "uuid": "422d2bff-31d8-4a37-bed1-7ce314b16d57", "comment": "Malware payload (Amadey)", "value": "6ee5c317f07695c66f068340337ab733", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990858, "uuid": "67cb86fa-c5ed-412e-bf69-ca67e0435459", "comment": "Malware payload (Amadey)", "value": "b37c35acc1469d32ab38e8993fa3d7c8f4aaf128958257b87ce4601bcc3fa43c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990858, "uuid": "80edd923-889b-4aba-87fc-5ec360086bec", "comment": "Malware payload (Amadey)", "value": "8587bbba08c819c82f3118d18fd0ca4123c3a834", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990858, "uuid": "22986955-dca6-4c6e-aa95-07fc35ec183b", "comment": "Malware payload (Amadey)", "value": "4c38bc94fcc21d64e9645d1de9b2439514813ff926e178830ee711231f6986a847498265148f0fe2f739e0751ff5dc48", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990858, "uuid": "0a43b4ef-e259-4ad3-95f2-f418ea261cd6", "value": "T1EEC4026071E24533F9B2017365A0821EBF2FDE715DA08A9793CA763D47691C14E3ECAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990858, "uuid": "009df4c6-c34b-4a34-8c2b-f8a45a38b0b1", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990858, "uuid": "c24fa5b1-7757-4202-b882-abd28c22e01f", "value": "12288:EugHnXz47e/oYDea9Ru15BSlGRtkpghoIkSwf3k0:qHD47OoYDZRu15BnRtg6Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990858, "uuid": "40f18769-1e4d-45b2-a7de-1452325e8cef", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990858, "uuid": "c3ca1e37-45d9-4ad6-b6c3-6ea2fe45d734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990858, "uuid": "1db2fdc1-0901-48e0-93a2-02e6824e1ae1", "value": "6ee5c317f07695c66f068340337ab733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdc326c-1eff-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688979530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979530, "uuid": "49f32f46-6e1b-4161-adea-54f625751f01", "comment": "Malware payload", "value": "54e8788295a90f9d3ed74e5350bfecba", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979530, "uuid": "91d67055-af1e-4453-aa73-49ac6915c60d", "comment": "Malware payload", "value": "b39f214fc8e22ad1873a7b958b07d0af82d65703a3c5cf78f56be84c53318f6a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979530, "uuid": "b73cedd6-f23a-4c6f-944e-5aebb8c121df", "comment": "Malware payload", "value": "165585fe66b7be43314d68eded478a3b5d6eb7a0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979530, "uuid": "eb1c1b9c-4644-4032-b9b7-34ed9674fbaf", "comment": "Malware payload", "value": "611c2bddc10c343980c9ec861556af246518f321b5fcc4ee1ea268c5bbef801fba2c97dc6040be7feb875ddbe5a2ba7e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979530, "uuid": "7842cbde-d8c8-42ad-94ee-6a09ba84a13d", "value": "T149E16C828C460771F51CC7F9641CE33B1DE02D2BB6DBBEAB1D780D56542BA740B5B298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979530, "uuid": "b7f1af12-f4a5-4d98-98c6-562339676262", "value": "96:tPKIsiutXlEKIsiutXlA6ilOU0Lp8U9XZJxFOoU7INQQZuBt8U9XZJxrxKIsiutC:IInu7InuU6i4Ugp8U4xQZA8Un8Inuboz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688979530, "uuid": "2d030db0-77c6-4abf-9858-cb92d41c7b71", "value": 7384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688979530, "uuid": "689a0454-fe1f-49db-a9d4-9718067a466b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979530, "uuid": "fd3b20c0-0585-4d6e-be3b-60f2834eb22c", "value": "Franck-WINBANK-2023-07-10 10-41-35.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631ae99e-1ee6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968534, "uuid": "ba6f101c-99cd-4d84-a2b8-ae3cb9873224", "comment": "Malware payload (Amadey)", "value": "3b3e551cd698d9372a13feccd3d33e12", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968534, "uuid": "95ea1889-fce0-4445-886c-1936a6ae9eac", "comment": "Malware payload (Amadey)", "value": "b3aafadb09d935f75fbf36c4408983d5897686dcd99e72ac354299fd4d9715b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968534, "uuid": "fc5133da-5ca4-4f1e-a5a7-b3a7d08903f4", "comment": "Malware payload (Amadey)", "value": "770651339584653299e42e0d1d95427c775bde0d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968534, "uuid": "f997b70d-80e1-47d0-8a34-c1fa0c2e269f", "comment": "Malware payload (Amadey)", "value": "bb8fd65b2cf18a3d16d971eb0ce71cd963980864492ee407591dcb75f6faabd0149245f4c0cea0d680aeee75f9603c45", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968534, "uuid": "e4388851-bc2d-462c-bd13-aa202fb3649e", "value": "T115B402B070D69A23E932553629A0C22EBF1FDB311AA15B4793C5363D4B391C14E7ECE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968534, "uuid": "4fcf14da-8051-4468-8b81-d293a21c6722", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968534, "uuid": "dbd01404-63c2-4983-9a71-d11cd49fee71", "value": "6144:Bk7/YCVXHBRBCWGYLUz247IeqFmJAbUyIMz7LEFBpQnZX5eBF26LUD:BkUcdz47CFmJTyRXg34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968534, "uuid": "efdfa91b-c12d-459d-8233-697b1ca88e9c", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968534, "uuid": "75b8dfa0-3336-482a-84b0-9b7c23fc1f19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968534, "uuid": "e24c105b-3d0e-46fb-a277-b0c689b66164", "value": "3b3e551cd698d9372a13feccd3d33e12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aac3f2b-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688981888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981888, "uuid": "12f4f2b7-03b8-4d0d-9e57-5a0bbcfaf681", "comment": "Malware payload (Formbook)", "value": "da2f70a37f97006fd30c7d2f2460ce6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981888, "uuid": "2870166d-42e6-4d36-90f7-6b389a05a2c4", "comment": "Malware payload (Formbook)", "value": "b407e91e4e3f005698d688198db32e9ebce62920639d4af69ffed72921310e78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981888, "uuid": "b5485e60-bd53-46bd-8734-603df5a582a2", "comment": "Malware payload (Formbook)", "value": "57362ebb3d493bbfa4e7e7b2ae69dd904ca4598f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981888, "uuid": "452819bc-3678-42aa-a29c-db1d272d5c68", "comment": "Malware payload (Formbook)", "value": "c39268a77f52f28c34f8ab14fe2a6565dbeee4f538c15eff8d584e00f3392882a126bc6bba9abadc91dc2695be1f11b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981888, "uuid": "60a06a27-b67d-40ba-82f3-4a561a59dee4", "value": "T16ED4022362A5D729E85C0FFD1141A44A23D9AA459C39DB2CDC2F8CD6DB36B34019CBDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981888, "uuid": "d2d0cdb3-1295-4cae-b1db-4c53e314b8d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981888, "uuid": "89ebb31a-f4b9-46f5-891c-5b7ec17e1d9e", "value": "12288:+Xhg5KMG6UFCGLgDL6RnqIIm/7Pi9z73KLhDY0lk:+KoLFdg2h7657aCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981888, "uuid": "60a88f01-09fc-4ccc-8f3a-9e4ec4dae3c8", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981888, "uuid": "ea9ec38d-603f-46dd-bca6-75f392f29d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981888, "uuid": "ef97c444-a840-4cde-8248-a752759d992a", "value": "ZHoHhqbY8eyX4fZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3816f73-1ef4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688974790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974790, "uuid": "0b495674-72cd-447b-a4e0-ad008e93d016", "comment": "Malware payload (AgentTesla)", "value": "a41e131735ff527b9ff29509ccb83b57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974790, "uuid": "d495f145-ca53-4d9a-b2d8-5fea4f231929", "comment": "Malware payload (AgentTesla)", "value": "b40b30e7dfea0721d5a0d60d6ae9b2457b4e1d53ef2077c369cedb0b9bf22e83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974790, "uuid": "e3520011-27c0-42fa-88bd-11b1b36f3ee9", "comment": "Malware payload (AgentTesla)", "value": "a1ed1280796357e3ffd399e808c6e2ff879b63c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974790, "uuid": "eb04847a-1abd-490f-9c0b-15f0721fd8da", "comment": "Malware payload (AgentTesla)", "value": "a0509a0d5f112dba55bdac3f526079323ad65dbe127f0ba3b36be3be1ee9264e722db6c62dca6fb9d80da49ddcfd3d2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974790, "uuid": "f95585b1-397a-4115-8458-73e20c352f78", "value": "T114B42365EEAC4C27BF36BE226C7D928A51B452D823F21D351322E310C4159F19EA77CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974790, "uuid": "fa4696ab-00e4-4340-a467-762f0ec4996c", "value": "12288:fkdPGPms668UccfOaeWcJEK32jqJzF5KYDyhcEAg:fkdKKUccf11cJJ32GhZehcEAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688974790, "uuid": "6d1a960d-e392-4d7c-8dff-f3a10a30dfdc", "value": 529999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688974790, "uuid": "d7161180-53fc-49b7-ab43-40b739a657dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974790, "uuid": "38766bb7-304d-426a-bf28-ee63d9ef659e", "value": "SALE ORDER_7.7.2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4b2543-1ed3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mekotio)", "timestamp": 1688960550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688960550, "uuid": "3959e3fa-040b-4287-a968-26b45c364db7", "comment": "Malware payload (Mekotio)", "value": "9c03935079502fd8e9cdeb9c4ad4d332", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688960550, "uuid": "72842d0c-2e72-4748-9966-13988f56f99e", "comment": "Malware payload (Mekotio)", "value": "b40e0825b374d997e63a0544cabe0b318931eefbf681e1f51a2671a8394f86db", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688960550, "uuid": "60e94cae-6cfb-4f65-a250-2006dc9a1214", "comment": "Malware payload (Mekotio)", "value": "84cbd726276cb692c0eaeef75238db3fb7d16554", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688960550, "uuid": "cf63b6ed-973f-43e8-8ff4-4b14d5b923be", "comment": "Malware payload (Mekotio)", "value": "0bb171b289e3482f43eeab4f1a863eccbbb2e17e035f3454b3fb647c0298224389d6de168de82e29026974d4d9d9cec5", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688960550, "uuid": "346ea352-4e37-42ae-8688-07e01347314a", "value": "T1BC76121675C68636EBBE83781A25F77A70B57FA00BB200EB62C45ADF1D755C002B2E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688960550, "uuid": "b677caa3-f1b8-4452-8414-876007b4fea9", "value": "196608:33ffvMQqki+YMyfNRl0XWZbOmzAgZeNfvGtHZAFxfTC:33ffvMgiFFl0XcbtMgZ8CCFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688960550, "uuid": "536ed152-2762-44d4-b6a9-3e6c6dbabbec", "value": 7633920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688960550, "uuid": "6d35188d-25cf-4d16-bf2f-536a863bbc09", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688960550, "uuid": "07f6fa48-b08a-4e16-803e-ac060a61634b", "value": "00f1RT50167S56T0rTI4c2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89201944-1eea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688970316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970316, "uuid": "f44c15bd-892f-4829-aa93-49c6649a6ce7", "comment": "Malware payload (RedLineStealer)", "value": "94c3025d79b61cd59928892d80045443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970316, "uuid": "847e11b9-fe05-47ea-b34e-923a33985af1", "comment": "Malware payload (RedLineStealer)", "value": "b45c5c5e4308f24bf38a33614961d3efd92ee512980158d6f8daf3f49834bf3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970316, "uuid": "0baf2ce1-3439-42fd-bc81-b5111a3c4dbe", "comment": "Malware payload (RedLineStealer)", "value": "6e231ed10e8748a693ecda48dd4e4fbe75ec1f00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970316, "uuid": "dab69d01-76c5-4633-a6b9-1a9d098565c1", "comment": "Malware payload (RedLineStealer)", "value": "cdc05efa83ece6d9e726332d7f49beaea3186275bb3a10204483396e03689be1422b5b2a584b837c0d6a29999743c1a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970316, "uuid": "8ae953d4-06b3-4fa2-bf5c-c3ec7a3cc429", "value": "T1ED15126272C0D4B3C9A6183186E9CB762E793112579A80CB7BDD677A2F027C172362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970316, "uuid": "2eacd189-f3c5-4f33-bd4e-36a4867da6e2", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970316, "uuid": "0816e54f-e2d6-4d94-a3de-9c1f33217ce8", "value": "24576:Bk70TrcKTnxR8aCfH6eMLDkzsWr6j3fbIVE4MeWbMZX:BkQTAmnxRaaPDwIjIhWAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970316, "uuid": "6ef5dc71-629d-4ada-96bf-8d2c7714053e", "value": 923200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970316, "uuid": "bd31fe45-691e-496f-a208-3f0e078eff80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970316, "uuid": "26298039-691a-4e75-87f2-fb5a9fccc5a2", "value": "Balance Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d67d271-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978027, "uuid": "5901d984-28f5-45a7-9329-c9f1971eaae1", "comment": "Malware payload", "value": "18a11f5ae12246e89ba939380dc1fbe2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978027, "uuid": "1e7cbce6-c0fd-4c56-9d1f-11f16b21eeb9", "comment": "Malware payload", "value": "b537bb849bf46fd488727bbdb3e3fd4cc2354d0e3b793aef9df93a68c80c1050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978027, "uuid": "fd67108c-4574-4a7a-8aa2-6729b502a77d", "comment": "Malware payload", "value": "e6c06c2fce2965418d184ced32f087d33d43e20b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978027, "uuid": "73ea02e5-80fd-413c-95a9-6b0967ae6669", "comment": "Malware payload", "value": "e2c162f64ecaab92537fe84ad706ce31cc8a099b44359314d8c027fcb16e8fa2206126f6875791c550cf88028fd83d8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978027, "uuid": "e9156003-7a56-4b10-b86a-4fd99d6b8692", "value": "T1DA135C2B129190BECCAFC1746A5AEA6BED33703913B1B11923D4BD366F79E600D5D702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978027, "uuid": "653ac237-96d0-4eb4-bd9c-134d1dc0f762", "value": "768:u1Q7GmCeTBEyhbsa3HoHZuBrzl6xu9oGGV3/93F7k01I6dHHrHZO:DGmC2BEuAa3HUqEx+GV34e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978027, "uuid": "3e3cf9cc-a6f9-4378-92e1-f9001c9c87d1", "value": 42832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978027, "uuid": "8a08d3c8-6cdd-4075-84c0-dc6493788a8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978027, "uuid": "e88960d4-84ce-467b-bb29-21cc5ac70f16", "value": "SecuriteInfo.com.ELF.Gafgyt-NI.20074.9036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f55395-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968244, "uuid": "46a73df5-1522-4edf-8ec1-6f32dbefeff5", "comment": "Malware payload (RedLineStealer)", "value": "2180d79ce0db1338d7e462e1dc0d6c48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968244, "uuid": "c52f97ca-bd5a-4300-b8ba-569dcac6e38a", "comment": "Malware payload (RedLineStealer)", "value": "b53fd6dea440bef190c2a3c59cea17e001035e5399e3904a9248eb3aef77283d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968244, "uuid": "f81ccec9-fa34-43a4-b02b-ed9800d799b2", "comment": "Malware payload (RedLineStealer)", "value": "6c5f50dbae19d9636deb1567385efc4be26ac305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968244, "uuid": "3c748c5e-6a88-4e30-a7c6-7d4e402e078d", "comment": "Malware payload (RedLineStealer)", "value": "0291897dbeb5dda8b920621228dbda649a3b7d332f3914b492b870ab8a8ada7c5ee4a7992c8b2e44de9e25754a2c1d4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968244, "uuid": "9282c5c2-b220-46ee-99b2-bf191dae3647", "value": "T128C4026571D29963FA72007219A0831EFE1BCA3149905EC793C9763E5B381D28E3EDB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968244, "uuid": "7d33b309-598e-47bf-a4d0-8dd023990d1b", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968244, "uuid": "e6cd62e2-a0fa-4b60-9b27-a78de37adbbb", "value": "6144:eEUSoUTLBHB1PCWGYLUz247wxv+v969W96k//cOAbweccjckL6PYTKi1hjk4Hek+:9U8Bzz47+mVt96k//cOgrovYTJ1Jbff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968244, "uuid": "84d129d9-aa1f-410a-a048-4fc7f61072e7", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968244, "uuid": "5e2e6881-4672-42f4-b2d7-962a07970e96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968244, "uuid": "22947227-e811-47b4-817b-af95d600b937", "value": "2180d79ce0db1338d7e462e1dc0d6c48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8a1cad-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968872, "uuid": "1880d1b8-94f5-40b1-9743-5c2ddc2f5dd5", "comment": "Malware payload (RedLineStealer)", "value": "b37bf8a786a322360b3df5a82cd9bf13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968872, "uuid": "0995048d-a260-4256-b9aa-e65698a4c71e", "comment": "Malware payload (RedLineStealer)", "value": "b57c92b187bacb049a595755180ce907e4cf9780af8bf4263a01d95a6691d3d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968872, "uuid": "c8ca4f94-a3c0-4c24-95fe-0c26092fd440", "comment": "Malware payload (RedLineStealer)", "value": "2c5dd604113d5e9d7f36cb1ac486391798dc476a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968872, "uuid": "695a565c-f79b-416d-8db0-25f8f1e46d00", "comment": "Malware payload (RedLineStealer)", "value": "b4f1a9ca2bfdb83cf93145416eb203cab439156f4f9dd127473f4c5539ee6e4daa4c1699b78a75fd1ea79cbb83833fce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968872, "uuid": "fcdeb5ff-3444-4af9-8b37-342940bf0c61", "value": "T1AFB40260B2D29923E972143729A0D26FBE1FEA3115905B4783C57A3E873D1C24D3EDAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968872, "uuid": "410cda88-65fb-4701-a20b-ccc95facbe0f", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968872, "uuid": "29fc435a-3f4d-463b-bf8c-6662297ecaa6", "value": "6144:cU7/YCVRHBxfCWGYLUz247dMkDB3veBUcFugp21RLkD9Mm00TZ7f3uxAsDhvV:cUUOnz47dMK2hnpW+t0E7f3u2s5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968872, "uuid": "634147e7-e152-4a62-bb79-4910860f627b", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968872, "uuid": "4a28b42c-e1d0-4cc4-8cd3-9621ee15b4d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968872, "uuid": "1780102b-6f08-4973-9b94-77264bfb1f77", "value": "b37bf8a786a322360b3df5a82cd9bf13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcdf2a4-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985031, "uuid": "d923ac92-7609-4971-9c44-ae388ac3e7a2", "comment": "Malware payload (Mirai)", "value": "f016d1d133be373c5df89ce7d8e736c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985031, "uuid": "b75547fe-f2fa-470d-bf43-173ba8454599", "comment": "Malware payload (Mirai)", "value": "b5af8c06d2fc3a1725a63f43168b2ed3d9d97ffbf0837e375b363c6dc08d95c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985031, "uuid": "23105285-31d6-46c4-a194-927d4226f28a", "comment": "Malware payload (Mirai)", "value": "3f1b89a2deaaa6065c1db7e35f85b012a5992088", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985031, "uuid": "a8afd51c-386c-4a17-bfbc-ad3866921d54", "comment": "Malware payload (Mirai)", "value": "83381ddffea86aa1d83f7a3809eaf5af5f973ef56bfe0666aeb8ff4fa03c3b6bf386802307a65683d009d06f5e078c31", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985031, "uuid": "9e30adca-015c-4d51-8ef0-e51f30b16dcc", "value": "T15193395AFC819F11D5E125BAFA4E12497313077CE3EE7112DD249B216BC6A2B0F7B980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985031, "uuid": "17f72cc5-553e-492d-b3c5-02b55598f1a2", "value": "1536:w9wnh8AyNjCH1IQsT53MayN+anmRuBpEJXxiDbdAJ3PkLHUY76Cs5hP:58AyNjQ2xyQanmRuB4XMbdAJ3PCUpX5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985031, "uuid": "e7831031-521c-4f8d-9b0c-29e79563503c", "value": 89760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985031, "uuid": "a2e3222d-cbe6-4e37-b9b9-adee200965e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985031, "uuid": "009a0605-18c0-4978-9add-cd96d5cd74e5", "value": "update.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c3eefd-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985739, "uuid": "0d33cab4-1876-4ed4-b5f2-ada720ae2529", "comment": "Malware payload (RedLineStealer)", "value": "c07cacbe6b071c47473756f36fd6a59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985739, "uuid": "625a2113-499f-4c2c-82cd-3480c412d0e2", "comment": "Malware payload (RedLineStealer)", "value": "b5dbafe5fe2b6ad8775bbe57efa45879d750d723734aa84f79c41f87c8f99ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985739, "uuid": "602cca5d-48f9-4abc-9eed-1f4ca8dfaef2", "comment": "Malware payload (RedLineStealer)", "value": "3229acfb657b4953fd5a3333604d0c8de04d8069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985739, "uuid": "3d6a0fce-45ce-45e7-bbe9-a564ca7f36a9", "comment": "Malware payload (RedLineStealer)", "value": "7955ea7bab53b7953d9dc53738c996a33c6e00fdb3e009d69cd1a6c8204a32cab1c8db4f29621224449425382e0d45e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985739, "uuid": "78ad2842-b57f-4779-8cdd-a6dc828ca3ee", "value": "T152B4F1A171D35623E532447715A0D22FFE1FDE3514A14A87A3C83A3D4B2D2C24E7EDAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985739, "uuid": "8bef8288-f6f0-4bad-982d-8b6e23ce73bd", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985739, "uuid": "f13bd662-8582-48e4-bb4a-1d6284ff018a", "value": "12288:fmY1lz472ieNSXt9yTR3u9r27mo0bgprCem0:Td472iEorwmo1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985739, "uuid": "e014a9ed-a61e-47c4-88a4-6c3c0174f72e", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985739, "uuid": "6f961f63-5ddf-4115-b7d7-ca1e7a02c71c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985739, "uuid": "1b826661-b5d1-4cd7-9570-d12677721984", "value": "c07cacbe6b071c47473756f36fd6a59e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b1e85d-1f23-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688994971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994971, "uuid": "3aa19d5c-0cd8-4018-b0a9-fd24290863be", "comment": "Malware payload", "value": "717c48bd02b6d441f54c2713c551217f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994971, "uuid": "500b6899-887c-4121-8342-544bb03dc2da", "comment": "Malware payload", "value": "b61ee16dd044407be91d9681fa5f5bcd2dd0e5ce154cfa1428e5dcb4fb74faab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994971, "uuid": "35cc038d-65a3-4aa0-b8ce-02a2b0f4a9d1", "comment": "Malware payload", "value": "4469142510112bb47edf3bad9cd15e4feb10db48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994971, "uuid": "40e36fa2-9e5d-4375-a263-eae8570516da", "comment": "Malware payload", "value": "2f4b0e7445f28cd643802e071499ff377b13a5985c354f15411b6bd08847ebd34eaa13385aae472efcbf8585c4b8c8d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994971, "uuid": "37e949ef-d72e-4b14-8dfd-251cf48d4f6e", "value": "T1592633E7B0526CD4EB925EF1E43A9BE848610CDC6ECD4F80BF58BEBB3890E605D16505", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994971, "uuid": "8975aa57-1d64-436c-a468-2eb37b1c5f90", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994971, "uuid": "be73df22-b3b4-4536-9cdc-9ea3b59f10a4", "value": "98304:84RXG3LAmwrFeTyv8m3h4gd0sBLCDADojDrUhX:P9wLQz3mC9yG40hX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688994971, "uuid": "12355319-3307-4864-9f49-47650ac1d83f", "value": 4509696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688994971, "uuid": "1207e703-d33b-49e5-b824-99902247c9e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994971, "uuid": "0be74fe6-15cc-4f44-864e-b446ec6ada10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141b87f5-1f2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688997608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997608, "uuid": "66c0212f-feef-4545-b1f5-dd3071ef962a", "comment": "Malware payload (Mirai)", "value": "e06f338eb5b455d958491284ad3a4e73", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997608, "uuid": "a0aa8250-e9d4-41e5-b606-81843a78d1bc", "comment": "Malware payload (Mirai)", "value": "b685384db59689ae4a44003da1df47712a28aa2622c29f52f68d2020d4f8ee28", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997608, "uuid": "c591c5d2-b323-4e9a-a981-e13414470742", "comment": "Malware payload (Mirai)", "value": "3862242984f75363ece9bdc89c135946c4668809", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997608, "uuid": "b52f866a-cb3d-4117-b8f7-bfa3c2238975", "comment": "Malware payload (Mirai)", "value": "6b930f3bc7efc170fc2a375b5b97a8c38a547aa2cc1edc658e840774c878ace41fa49ce28495b760da73206bcd2e9eeb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997608, "uuid": "38bf91e2-1838-4244-9715-5ae8f61ee5c8", "value": "T19CC2D1359D4E29A2CB708C71D179D3E27FC91E78F5FE786601818BE22642412D6ED8CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997608, "uuid": "27271598-f3bc-4d6d-9034-6b84cb1a5d69", "value": "384:Elt/koxisa34beDtZwG0We9gRFVvLycPUWhePvlbilP9lVeq5mgB8B2uhymdGUof:EHsoTAZzycrL5Phckd3gVdHs3UozT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997608, "uuid": "878fa9e0-d8cc-4a90-9622-9363b9f5b826", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997608, "uuid": "04c23515-074e-4710-949b-33ce7dfad824", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997608, "uuid": "199949fc-1fe0-4cc0-9b7b-2c5d5bd9e901", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453899db-1eea-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688970202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970202, "uuid": "2f6eacc1-9e49-4275-90ea-6c3a45944a56", "comment": "Malware payload", "value": "1cac826d98049174bbcae5280458679a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970202, "uuid": "780ca2e3-8acf-47ff-ae83-db7595fff70f", "comment": "Malware payload", "value": "b68e93477c2ad03e131d866387e61f982d835bf6b58011d4350b0ac3afcbb64c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970202, "uuid": "84e5f36a-f6cf-4d03-bfe4-a998c4b20e53", "comment": "Malware payload", "value": "c48ea8abbc014541ae180c737789706f48ca728d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970202, "uuid": "66e9e32a-b8ae-48f9-be82-0240ed1e5fa6", "comment": "Malware payload", "value": "fe6f56bdd309897028eaebe94b7e2bb410d7638fca5c8787b3f8747cf459c251fc97b9e55ce0aa63da2e57c1ed207622", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970202, "uuid": "f2f4afec-0d4d-4a10-9838-f388648df8de", "value": "T135F4F1D9C5683476C7B088B700D05F18A539BD3B9BA9A73BA7983BC35D2790BAC44347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970202, "uuid": "f3bb7e76-0945-4932-9c17-ef7651874e83", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970202, "uuid": "0e46591c-1d2b-4b78-a294-7ff23e6d35fc", "value": "12288:7R0UiiH4c8PnxIGDdSDaM5yaoiEgPE/FXOz5DbKqrnPZx+eOX:S1q4coxLJSDL5yayNezdbtZxxOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970202, "uuid": "0703d714-6191-4973-a1fb-a20d983b864d", "value": 727600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970202, "uuid": "e1f9e36d-9ad0-4a04-a164-4e27bb90851b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970202, "uuid": "112a1cfc-cfc5-43d9-8de9-5bdf0ddfdd0c", "value": "doc003998299122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1a2195-1f4a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689011739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011739, "uuid": "abbec442-0417-4fac-b80f-c28ac228157c", "comment": "Malware payload (RedLineStealer)", "value": "807509619479017486f8dcfa47fbf384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011739, "uuid": "faed60f2-ddce-4d00-8ae2-1f4a08d3df32", "comment": "Malware payload (RedLineStealer)", "value": "b69a31a72a81ffe49bb766c3fce6433364ce48057178ec10335ad711614749ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011739, "uuid": "3520afa0-2916-418a-85c5-8e3593628039", "comment": "Malware payload (RedLineStealer)", "value": "0d64a3093db3e0bf704243049308e2718e88e7a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689011739, "uuid": "410fe265-286d-4ccd-a13e-c0ce1fb8fa3a", "comment": "Malware payload (RedLineStealer)", "value": "2c57290975eae8c6cc133335c3b4114c1bc917cac2e95168681df8f4ad568ca26b7e4d6f93e00eeb2fe48ac89baa39c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011739, "uuid": "3ae20a38-6c81-4410-b05b-7a9ea9fe276d", "value": "T15B75230793E4C066E8766BB44CF716E30A39FA60A876435F2795288E4D332C5E27177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011739, "uuid": "ae5fb3f2-b6f9-4fd9-bbc0-97ab24ddb0bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011739, "uuid": "3c2deea2-343f-4d78-b649-36cc0f6b31ce", "value": "24576:VyfsPgWB4yfIzxGXI6jQzPEGcIpos+8Aa7cr7ruPAodGuqedlHJjk2W727mz:wUPgWBvfIQ5jJCcr9uvp42W7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689011739, "uuid": "64692e79-c5bf-4bae-809f-4b0ded55e5e6", "value": 1587200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689011739, "uuid": "ae58d783-4f52-45d5-93dd-8d6283d37c4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689011739, "uuid": "614f6960-0c23-4978-b61e-313fbd29b880", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad060683-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968229, "uuid": "3c09a4a5-6c3f-4ec5-b718-a71d186551bf", "comment": "Malware payload (RedLineStealer)", "value": "16fdff86f86eb26ad180def7c0595a9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968229, "uuid": "42f73b6b-b696-482a-a2a8-c69bae84a249", "comment": "Malware payload (RedLineStealer)", "value": "b6d83a8539deb9fe1e5e8755b038e3f71973f7601331e4de3c12097103ce9f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968229, "uuid": "e331bc0e-2bc3-4e84-95de-cf0273a6e0f0", "comment": "Malware payload (RedLineStealer)", "value": "b89aff1bbfd0d49fd85e40dc152d4198b0445a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968229, "uuid": "8238c28e-6800-4234-b3ad-fe811fedd910", "comment": "Malware payload (RedLineStealer)", "value": "b530de490e65d93450638a47c4b80211503376eb45c2b85f7496e588bda1c89fe197c1451fcf0222fa8661b7230d0938", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968229, "uuid": "26f42b2b-4d90-42d1-a71e-a4fdbb6bfb92", "value": "T1870512A0B2D29423EA3155332D90925FFE1FEA7019E046C763CA793E562D1C09E7DCAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968229, "uuid": "5df17575-3075-4c24-aa72-652814fe96f4", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968229, "uuid": "83554479-8d67-4769-a57b-561188521e81", "value": "12288:vA4tyz47ipRGTcwbOrFPAwy5CfhPpB3yMZ+Txh1kwJwTNmemPeQg7:lQ47M0sPAwomhPLCQoDDJeNHKeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968229, "uuid": "6a390e97-fd26-4cb6-8a0c-cea5101d9a9c", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968229, "uuid": "e9209f4a-9b63-43a7-b96f-9c122065aca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968229, "uuid": "0d4e6492-9f37-4ad4-bdaa-548379ed6345", "value": "16fdff86f86eb26ad180def7c0595a9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3debc60-1f2b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688998386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998386, "uuid": "2c8d7706-50d4-412e-894b-5c90690d72a3", "comment": "Malware payload (Amadey)", "value": "3525cb41435513900d049031df22cd8f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998386, "uuid": "d85f5e5e-dec5-45e2-b046-47504aa4b3b9", "comment": "Malware payload (Amadey)", "value": "b7536c8ea2dbb9fec981fe2babbac6ba02d9885b53d1a4baec8eff48726cb621", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998386, "uuid": "2fd76e20-6d9d-4538-b826-feaf9e8b2527", "comment": "Malware payload (Amadey)", "value": "6e86c24f69f0e1c0d252760cd6e4ff5c42c16686", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688998386, "uuid": "a29a07f6-ff71-47c4-a366-a4e4bb68a83e", "comment": "Malware payload (Amadey)", "value": "ac65873a1720f44f379fb7fc485d15abe6af9c9b486551788b0e75148df141419811f85a35b1aaebbd91a8977a8b7b0e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998386, "uuid": "3cd6417d-baa5-40c2-9ba1-10684feedd18", "value": "T11B152303FBD40632E87B6BB059F603C71731BD725DB8532B1B87995A0473698A83276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998386, "uuid": "d1198466-bba5-4f97-9a7a-e9a3423989d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998386, "uuid": "6f1d1c6b-d6d0-4be2-b098-d0de13bd516d", "value": "12288:tMrjy90BEu0FK7qFR9CKE2twyVYAiiRSCbxP4u+TcCY+DQ3:ayIEDr9CKTG5viECez9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688998386, "uuid": "6469ccbf-8a6b-498a-99d6-ed68e2e53b7f", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688998386, "uuid": "6c49e5ba-9290-4386-b060-716e37a78f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688998386, "uuid": "2af912f4-b69b-4e1a-a684-c02bfe1a3b88", "value": "3525cb41435513900d049031df22cd8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff7fbb2-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985011, "uuid": "19b8a2a3-9067-4e86-8eae-74a124e617aa", "comment": "Malware payload (Mirai)", "value": "3621d017f997c6f213b7c55f124c3b2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985011, "uuid": "516aa32a-9280-48da-8057-7203d0de9d09", "comment": "Malware payload (Mirai)", "value": "b79904a5abe83ca7bc6e2218f1ea369fbbf646cc8ccbd3dce7f490b060b950e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985011, "uuid": "e7e93d94-849a-43ef-b8f0-bca89b87c5da", "comment": "Malware payload (Mirai)", "value": "8dc7a9c2e096ed1fef5d138708a654b1caebc019", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985011, "uuid": "6908eb93-36df-4a3a-843f-866e5fa031a3", "comment": "Malware payload (Mirai)", "value": "de38a00424abc855b6e449fecaaa7499165f3c335cf40371e5e3db0830116b1b7f57c53fceaf4b6f4e52cffc273fec89", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985011, "uuid": "73e42785-472e-452e-8eac-ad4ed3a01595", "value": "T1A0335B43AA41E0F5F8114471213BE732AF32E63B5457E783D7696C36AC31292A72B6DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985011, "uuid": "c854ce44-a57e-472f-9661-f501dca536e6", "value": "1536:qUNNQUABL87s81zjrA6RsAoDzl/ZBvGVmNY5hRk1:q8NQUABoA813rArlDRhBu15hI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985011, "uuid": "398ae831-0a7e-4bd0-9c95-e12172b1b77c", "value": 54432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985011, "uuid": "7d1693c5-c025-477c-a141-f1d071a65793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985011, "uuid": "16168d61-a477-49e3-9d98-6a5ceaf97a6d", "value": "update.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b576edae-1eed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688971679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971679, "uuid": "6d1cb737-4db3-4c1c-878f-8e3c8caae56a", "comment": "Malware payload (AgentTesla)", "value": "d4c6d63a4bfb758efe3a31a1c498222c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971679, "uuid": "ac858fc3-6049-4e30-b43e-5b008e981ac1", "comment": "Malware payload (AgentTesla)", "value": "b8a7cb3b57750722676f234a8ed341401292aef0a98935b193027d6eb45da748", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971679, "uuid": "720d2571-f385-4b97-9387-d91209ba8781", "comment": "Malware payload (AgentTesla)", "value": "85424054e9c697bd702793b448c2a606fbd744ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971679, "uuid": "bc9fc4f9-690e-4d09-bd6b-dfd33287df6c", "comment": "Malware payload (AgentTesla)", "value": "c8373b49bc19fd48cd8aeda718bc67c45c8195d665c78448882f84d238cbf75fa81d8852db0f5c1bac406442552cab77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971679, "uuid": "bd4264ef-4355-445c-b4e6-7636781d8cc3", "value": "T1F4B423A55DD5291BAACA25E524BC844DF0E58CC20B7E8164984FEF3AF4A58700F7D2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971679, "uuid": "7d02f127-46d5-4fe2-b859-6a79c58520e6", "value": "12288:0mNaqjak9z+PPQnLeQcPQZEQ6CAXcjuqycUYkY:0/Ga0CPswbCAXcjuq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971679, "uuid": "a592043e-8684-4103-b260-513fb510b617", "value": 511696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971679, "uuid": "97e154f8-85b7-484c-bfce-ce42f9b567fa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971679, "uuid": "8bfbd522-47ba-4618-9dca-23241733a9ab", "value": "USD $321,369.05.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b913d7-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688977880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977880, "uuid": "cc4bf921-2f63-4643-9160-71f8deaf3ccd", "comment": "Malware payload (Amadey)", "value": "1edd03e95cdb14c3bc4375f0d9a71b37", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977880, "uuid": "b569f4a9-adce-486e-aae5-8cc93e7712d6", "comment": "Malware payload (Amadey)", "value": "b8e48de354e088f0d68a69e5643ac5836ccaee4dc2a791c8eb801fbade70527c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977880, "uuid": "f9af7ee1-2aba-4b94-9324-176d54bce983", "comment": "Malware payload (Amadey)", "value": "9fa045d30b1d5b56237b9e85c1c67d284f0ef64c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977880, "uuid": "e2e68f19-196f-4fbb-ba73-f7bffd1f118b", "comment": "Malware payload (Amadey)", "value": "b0ddef2152ba0464c05f40cbc102ff237afae0a21c4178edd0cf3dc14ee5135ad5aaf1106308e62d1ec1217f0ce6f325", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977880, "uuid": "e373873e-b32d-46bc-ab46-b583a64a6f2d", "value": "T1BCB402B070E25A33E536107715A0C22FFD1FDA7149904A8793D97A3E5B291C18E3EDE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977880, "uuid": "d6a34999-8505-45b2-9e92-a4b88ecc8068", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977880, "uuid": "7bd39367-78ce-4923-8ec4-69ae131a8ebb", "value": "6144:E07/YCVbHBNWCWGYLUz247T3aku0oLCaWPSZpYvPdOdgkEl1vAPee05EKMNtvhOR:E0UsIz47Tah29PbIdg/1YPeeg4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977880, "uuid": "e73d73b7-9b1c-4618-9825-9aac19fca8f0", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977880, "uuid": "1691e598-bb90-4e41-bcd6-077aca6a1d6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977880, "uuid": "9feb4eef-41e8-4f4e-9046-65c494d33974", "value": "1edd03e95cdb14c3bc4375f0d9a71b37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4772e84-1ede-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688965262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965262, "uuid": "3ab57e2a-57ef-49c6-9b69-9cb826d26aa6", "comment": "Malware payload", "value": "1ed009e50e6afea3aabb252868b02311", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965262, "uuid": "4a437072-80b6-4e62-812b-0c27ab12bb08", "comment": "Malware payload", "value": "b9ea49a64f5c64940fd42d8681dfbac94e8223f0137d1af38205637f020801ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965262, "uuid": "48de2eaf-cad6-465f-8290-1bf898ca148b", "comment": "Malware payload", "value": "fd251e10073cffc995875f65b1c8bfb4044bb704", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965262, "uuid": "7a34286d-8057-4d66-8d0b-9b2120390609", "comment": "Malware payload", "value": "4fb13bec3653fa9efa203e5b2fd70b015a77361266beb13d3aabc25e756a6ebcdeccf5d56abe90f326c2b33807caad8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965262, "uuid": "5fe10c0b-48f6-4b80-9c82-850b897c877b", "value": "T18043F949F990A729C6D121BBFA0D128F73270B6CF3DE72315E309A7533C6A670A3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965262, "uuid": "4656b6c1-0196-4977-8bdd-dc5ae2c1f21b", "value": "1536:m4nOy6saWCNoq2XQWac02TsIkigqBG8KoLAF54YRf:v6sdYoq2raMBG8KoLAFKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965262, "uuid": "adb6f948-c235-478d-9537-7cd3cc4c5ee2", "value": 58808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965262, "uuid": "7a5848e1-172f-45c6-af32-d3619f8d0ec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965262, "uuid": "dd40eea9-5577-426a-a924-16a5bd262461", "value": "1ed009e50e6afea3aabb252868b02311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93523194-1f25-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688995674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995674, "uuid": "d79dcef3-1e6f-4124-afd8-8ba9d01bad2b", "comment": "Malware payload (Amadey)", "value": "84a6b716af50842ea914eab9746bb533", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995674, "uuid": "c517d695-2c79-44d5-871e-ac412996da73", "comment": "Malware payload (Amadey)", "value": "b9ff2fb1bff9c3375d7af3854b4b700406990bb1fbf77a0b1011147d539a571c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995674, "uuid": "403c9bf2-d05b-49b0-a0f9-a58bf2657201", "comment": "Malware payload (Amadey)", "value": "bcfdc5123ee0cc47d4f143a581c39f1b09cd03ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995674, "uuid": "55b959c6-83ec-4189-a68f-c2c40377ed50", "comment": "Malware payload (Amadey)", "value": "769a5be3a70be3a19db3dcc37949fc5634fc0c9144e47d6f96f93b3ccc4172656513dc2e7bd2e6af685a75ac122902c7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995674, "uuid": "8697598f-6066-43cf-82e7-14173e4b45b7", "value": "T1DF752381B3E50273ECB52BF0147A1A830B367D926E78871EA7845D5A1CB2525F63837F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995674, "uuid": "1120f28c-05e1-46fe-b2c3-0866dd752cf8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995674, "uuid": "59e6574e-266b-4fda-9442-d906cf55592b", "value": "24576:kyyu6WVGow39YKxClWAmXurUwR+QnGb/+9Kdvmy4S4Q+QoHWoaCpOQ9HSw:zyKA39YKwmwRHw+9K9myPZ+h2sl9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688995674, "uuid": "2ebae997-f327-4173-aa7e-dc1d65024dfb", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688995674, "uuid": "293d33b1-2c84-43ef-adc1-a10699e5acf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995674, "uuid": "e61ad189-be25-409e-b400-d953b58dbd0d", "value": "84a6b716af50842ea914eab9746bb533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80826bef-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978033, "uuid": "ac80058f-0274-4c0e-b2d6-923c3547bde3", "comment": "Malware payload", "value": "4dce69feb10cd341da73fafb38b8b73d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978033, "uuid": "e20fce63-4900-42f0-9a0d-85ac77f62258", "comment": "Malware payload", "value": "ba3231f899f0c85817aa15c18b1d0ac49092a57edc5cd3d2618265797cbff86f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978033, "uuid": "9d55e06b-b235-41e6-a37e-bf4af673faf7", "comment": "Malware payload", "value": "17abb06b05ed8e3590c1940573993607a62c3866", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978033, "uuid": "ff889d15-9f68-4b17-bccb-c82d06553471", "comment": "Malware payload", "value": "bad25f931229b41b716f9ac05b3aa825d64283d7767c186bf3e26c6584bf3be6e73d210de6b6f1b7783d067a56f94e9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978033, "uuid": "097a1f4c-be60-47e2-9964-d11b4fc043eb", "value": "T180130A88FD55A22AC7D162BBF70D03CE773A0768F3DA33225E355B2137C6A615A3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978033, "uuid": "fdde931c-c470-46d0-a451-845ab90ca42e", "value": "768:BCl5gv9IYz/yXzDcPzG/GyoYtMt4Ml0POpEEMIi2hx2q1Lew3zqI:VvW8yDDUByWGM0POpE+iGsqF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978033, "uuid": "d0c827f9-8f9d-417d-bfdf-228502bad677", "value": 42672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978033, "uuid": "1d485306-f2c0-4203-9111-5ef92296ffad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978033, "uuid": "2b1f89e8-dbc5-4654-851a-182fb41a58de", "value": "SecuriteInfo.com.ELF.Mirai-CE.26410.19719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad6ab24-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1688981862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981862, "uuid": "efb6032f-8eac-4b2f-827e-17d8c8500126", "comment": "Malware payload (njrat)", "value": "44fdbcd579d04f924e952a372c091b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981862, "uuid": "4652944e-5ee8-4b75-bdfd-9f7ead34b04e", "comment": "Malware payload (njrat)", "value": "ba87c90d95b2f855242a7045cb97061198f098aa7d46c0327d5a0ee1e278eca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981862, "uuid": "f7e7f8ca-a8eb-4b0c-ab3f-6dbe6f3645f8", "comment": "Malware payload (njrat)", "value": "d6be152a4782aee8f700b26f032ab77ff02b3323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981862, "uuid": "d9a7b72b-d998-412c-a24b-5060de10936d", "comment": "Malware payload (njrat)", "value": "1439cfdcdc331316b9df7310dacf32ae214c3c63afdf13769febce74997fc44888b75dcc9df926e83155b52fb61852cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981862, "uuid": "54d347a1-e5d8-481c-87ef-a22635fc918c", "value": "T1B715234B188E702CD6514DFEC5700EE40BF4E8985C57B7CC25CD13B88B959CB8AB2AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981862, "uuid": "19829867-56dd-4386-8db6-545d809f60d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981862, "uuid": "896bb52d-ff43-4fc0-9443-1a522027e4a5", "value": "12288:rbt12i2c9b20yCX4q4aUKYJzmuf4vcfKKGqCM9x:eqU4k9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981862, "uuid": "7a853ad9-dcb9-4895-8418-b0a077908dc8", "value": 898688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981862, "uuid": "033b5948-d936-4a02-9707-66814b423171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981862, "uuid": "ab94d314-e14a-486b-90ae-8ed37cb1f536", "value": "SecuriteInfo.com.Variant.MSILHeracles.94456.17615.28658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5123965-1f0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985422, "uuid": "d913bdc9-9d22-4d1a-9eff-c8cb9674f36b", "comment": "Malware payload (RedLineStealer)", "value": "2b12867b4bdec491aa8571953414d810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985422, "uuid": "462032ce-81cd-4337-ac40-5494a2fe280c", "comment": "Malware payload (RedLineStealer)", "value": "bab02fd6d3dbfc283b4f66cd461729bfe8e7bc1c284b3313f408012c2a47e075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985422, "uuid": "3edde919-73e1-49e6-b9e7-b168805f8700", "comment": "Malware payload (RedLineStealer)", "value": "1f8694bc431fd5097100a66d93cc5e70fbb68947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985422, "uuid": "a8e3842c-eec1-40d0-8982-899ecc2fa63a", "comment": "Malware payload (RedLineStealer)", "value": "02b2d1c4dc08700adb1bd6d9978a9c5052c4cabec1542e86935d4f39ee3f15d33bd417eb71eb2a9377fbe19d4174a7e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985422, "uuid": "85f93fdf-db4f-4aca-be75-e4e8b9ad4f2f", "value": "T16E44283921E144A7D8BA9E35BF4BC0D17116AEB4017C541F3BB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985422, "uuid": "cb2f0cb3-fea6-4066-9965-dc170d067716", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985422, "uuid": "05c1c48e-f3d9-4fa4-9db3-c6a40f31854f", "value": "3072:bSiu8+iOHMwew7+picM/tsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:bu8vOswD70VVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985422, "uuid": "d4f149e9-5626-48b1-8e7d-977e672274b2", "value": 272547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985422, "uuid": "a70daf55-0413-4537-9cb8-3840fba084cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985422, "uuid": "85a25f3a-cfaa-41ce-a81b-97158f05af3d", "value": "2b12867b4bdec491aa8571953414d810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee2a2a1-1f34-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689001948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689001948, "uuid": "83062f2b-9449-4cb6-a4b7-47fd11e00b11", "comment": "Malware payload (Mirai)", "value": "67d3a1d99741839ad74d02adc44b5195", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689001948, "uuid": "9564cf83-4b88-48fa-92c1-61181c2aafe1", "comment": "Malware payload (Mirai)", "value": "bae1aff1ce03e03bfdaef9cbb0822922dbe59f61614a9ed0e9b555b162ce5aba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689001948, "uuid": "70f318cc-c8cd-4e5d-b006-0276d161bf41", "comment": "Malware payload (Mirai)", "value": "b8deb8ebd149435030172586756faf276cf3884f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689001948, "uuid": "88c06c71-d861-42fc-89bb-2e468cfc5cd3", "comment": "Malware payload (Mirai)", "value": "e822e7f8bf145f1d2bdceddae0203dda8e6a3d1c11f58d32317e0d58eae296b9aa3f86d4f7bc50e00036bdaa2bd29364", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689001948, "uuid": "01658ea8-6189-4fef-a71c-4361f14be56d", "value": "T127A2D029D345AEF8DFAF9C9492C2C2C277F547C6278AC8E340EEAF017516046B788D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689001948, "uuid": "98b48827-a55e-4350-8409-06b60467f0a8", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5uM4uVcqgw05VxJP:mRxsSVsMD6xiJJE5zRWNf4uVcqgw09R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689001948, "uuid": "aa491e4d-92a7-483a-9700-20e43b8ab074", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689001948, "uuid": "d288fbf8-578c-41d1-af4e-07788a71b738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689001948, "uuid": "23c3b849-6237-46aa-bf76-4270e5556798", "value": "67d3a1d99741839ad74d02adc44b5195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8345c63a-1f03-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Conti)", "timestamp": 1688981044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981044, "uuid": "3f857e25-4316-4986-8de4-d97aa2f123f1", "comment": "Malware payload (Conti)", "value": "cb92f527371f199b76b1bc7fa7b238fe", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981044, "uuid": "c4dfe18b-a3c5-4598-ad89-6fb4860d1474", "comment": "Malware payload (Conti)", "value": "bb64b27bff106d30a7b74b3589cc081c345a2b485a831d7e8c8837af3f238e1e", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981044, "uuid": "0be49aba-7dbe-422b-aa09-d6d64abba194", "comment": "Malware payload (Conti)", "value": "573b84fa126bbe3d1cecaff70f6bd5738864cd1a", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981044, "uuid": "b420ddf7-71de-421f-9839-f004fadfcdf1", "comment": "Malware payload (Conti)", "value": "ade1a5b18eadb6b948311ce8c84fa2cfbe195630f79d536e28f860706f6bc289a9ecc7b87a9b22a4eca98fbc09769c31", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981044, "uuid": "e9bae289-15f5-4005-a0d7-e949d043ac10", "value": "T18EF2D7377D644939C8C3E33F34CB4756DAB0A4B2A732110F1689357D6B32685AA1EB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981044, "uuid": "f60a8323-fbbf-47f7-b22f-b1b331a30bd4", "value": "384:E2F9i9sCegTspa71cdXXeWpPDNmP5/2wLGhjwSgzpQiIiE1p+3WQlrn0x1+2+JJg:Xk9sCe/l6p694lq+2+3iSE/Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981044, "uuid": "2247014b-edde-4470-ab95-da651a2757ad", "value": 36344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981044, "uuid": "c55ee261-e820-4dce-886a-c02245bde2a7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981044, "uuid": "9196fa7f-8952-499b-8983-3148ddd41a8a", "value": "bb64b27bff106d30a7b74b3589cc081c345a2b485a831d7e8c8837af3f238e1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3237df-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688991365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991365, "uuid": "dc259fd4-9f6c-4cbb-9c39-67d00e98fe4f", "comment": "Malware payload (AgentTesla)", "value": "458db1b1ab52d61dd2fb2497cc70ac59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991365, "uuid": "aafdc9c9-b3bf-4802-909e-8aa288c4674f", "comment": "Malware payload (AgentTesla)", "value": "bbe92250148bf9b32bec53cf78cabf792b87e8392d0dd4f2f1807ef11768f5aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991365, "uuid": "74ca6f05-d759-4151-bb17-38aa8a2d3983", "comment": "Malware payload (AgentTesla)", "value": "c47f36e2fc3e4843b593808eb64af71e4342f1dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991365, "uuid": "627eb032-d97d-490d-833a-2fe00a12eee4", "comment": "Malware payload (AgentTesla)", "value": "f8a3cb095564c111f603b85d1c5481473f398f2f916901e656517476c468c1e4509e982f455e095cc61a85d25c5d579e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991365, "uuid": "be8907fd-ae5b-4b7c-b8c2-35c2caf28b74", "value": "T1A0B41262ED341D52C439CCB54C335BE14EECA7E68202F3E9C25878E7D4DBA24BA145A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991365, "uuid": "4f21b0ac-d4b7-4f0f-b808-3832dff14934", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991365, "uuid": "00c74165-b8bf-4e18-9e3d-1c1b37ffaeb7", "value": "12288:Si8hveShnhb/xayCkctVOh3dPs0+zmXyBR0h:n2veihVpceNk/zmi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991365, "uuid": "dda4d117-8d0f-4c3c-aac0-90585eacf093", "value": 508928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991365, "uuid": "aff2717c-a254-455a-9214-389039a5a293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991365, "uuid": "bd08fd7d-858a-46f5-ba26-44db11e555ec", "value": "dhl invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94811fa-1f35-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689002690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002690, "uuid": "a372db6a-fcb3-4a2b-94cc-9eb5495a8f72", "comment": "Malware payload (RedLineStealer)", "value": "cee605081330473fda87ccca1d021587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002690, "uuid": "8528b18d-76c9-4661-bb23-d8a79708c85d", "comment": "Malware payload (RedLineStealer)", "value": "bbf666b7359b580386dbc053fef5d6016abaee6a3dce4a41d3c3658906d37093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002690, "uuid": "295c5705-e9c7-4f1b-8803-7eafda49d4b5", "comment": "Malware payload (RedLineStealer)", "value": "70f83ef0c15f4a36c5d79b5f7f6b5a85807087e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002690, "uuid": "34fcb404-817c-49c4-9e4b-5c09383da3ba", "comment": "Malware payload (RedLineStealer)", "value": "406dbb53b431fc2fef835e3f27f6490f5a18f727574700a15759e2d2b80a35acd2900aa42405e3e09dc68c9cc5ce24e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002690, "uuid": "aedcb0b4-0a57-4590-9613-f1c58e92a235", "value": "T154753346FBEDA033E9A517F028B757D30B3B3D4158B486AB961295DA0C326C4947273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002690, "uuid": "8b0ad5b6-b53f-4664-9ac7-b70da76aeb71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002690, "uuid": "d4c973e7-5524-4df9-b2c4-c267324e6761", "value": "49152:nl22ddlK5B/gKYmBqaQwazoUXPKCPn819:U2ddlK5NVL5rHU/KCPa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689002690, "uuid": "13ce3638-f0ce-43a8-9129-bff06488d0f4", "value": 1585152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689002690, "uuid": "27ca0647-1b82-4ccd-9512-8a5c1f638d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002690, "uuid": "6c261123-b4ef-4f89-962d-f646ebbd9a3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b55964-1ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688974988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974988, "uuid": "9a7f70ba-bf31-4661-b318-3f7a13e5764c", "comment": "Malware payload (AgentTesla)", "value": "0e1a4e5c41efaddb55790e200978f376", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974988, "uuid": "8c0afcc3-e1e7-4214-be50-07c15af78e46", "comment": "Malware payload (AgentTesla)", "value": "bc31cbfee477b14539e46e667fedb8ed5deee11cd26334a3c0af600cc111a416", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974988, "uuid": "5748a629-59bf-4a3d-92ef-d53cedad6f81", "comment": "Malware payload (AgentTesla)", "value": "5abae12fd8ec2da491bda7600770d400f0344e86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974988, "uuid": "7c6d5d1d-aa96-41fc-a74a-abdf2503b9b9", "comment": "Malware payload (AgentTesla)", "value": "69ea5d04321c9a04450fafcb6138710dfb9fa9133fc40d7d8b353f10de830a1833f1156d0786a910419aa971a149847f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974988, "uuid": "e9b9cf19-1ada-4a81-b90d-7574f476c44d", "value": "T147B423C4761B482C36A1730A0081354B413DE2F9F4C0718ABB252DE9A9FD875BFAE5E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974988, "uuid": "f0be7ad9-2114-4187-9dce-f4045183ac36", "value": "6144:DD48Q5avcLeTZPhUNcRvOs1r4jAGkIZmY4vE5M1AYABfyqbdGZNy+yVz2SQZpHX9:DD4P80LPo31rG8852V0KmOU5VK3yVIMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688974988, "uuid": "b1087cfe-5b05-4b15-a2b1-c701444f8202", "value": 532588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688974988, "uuid": "0fc0434a-ce04-40e3-ae20-017742343876", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974988, "uuid": "74e7fc22-68a9-4274-8148-5ca13852e72d", "value": "132000032.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a51246-1f0f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688986036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986036, "uuid": "ae73a162-931d-4675-bda6-39f1ea3ed3ed", "comment": "Malware payload (Amadey)", "value": "7b0a32ba3dd2afcf099d61b303857c50", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986036, "uuid": "bfcca4ee-78bf-4f9c-bdc6-839b07398951", "comment": "Malware payload (Amadey)", "value": "bc9ce83b1e607007655474734baf77cee4656d106c4a35eaa248fc6c3d5bdc84", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986036, "uuid": "f152a146-7cab-4e7c-980d-2545a8ae4e66", "comment": "Malware payload (Amadey)", "value": "a08fd6c0cb73433414aa535346cc066bfcb4677a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986036, "uuid": "7f32c9b2-1d11-4d88-ad0c-ad244bc41db5", "comment": "Malware payload (Amadey)", "value": "ebc75a5cf45f3b5f4478ef20f6da04db84bb4113cb6ad62a7c2376c89e49b34b7b30c87ca6927b065e2247eb27e813e6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986036, "uuid": "1a19d7f5-4e18-4234-8ce3-474688fd3077", "value": "T1B605122072E69673EA76553729D0826FBE1FEA3019A01B0793C9753E472C2C54E3ECD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986036, "uuid": "70a67448-e5f8-42c0-bf1a-100419471ed3", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986036, "uuid": "8bb769ad-d1a0-4952-a808-549321f7aab2", "value": "12288:DLw47Az47bbC4S22F41xyMibdoTDUgjXbivejQUgjM7heL:bS47b+4kFYydoTbivejv6ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688986036, "uuid": "ca8b7be4-c8a7-4f2d-86f1-5ad25654e8c4", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688986036, "uuid": "7dcd0d24-aed3-4158-b0cf-b85e09001cb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986036, "uuid": "37c216a5-cce1-4901-baaf-cb5cf0d45a2c", "value": "7b0a32ba3dd2afcf099d61b303857c50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942ab8c0-1f46-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689009848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689009848, "uuid": "9ef1b22a-2401-4063-a1a1-b5a05356aa57", "comment": "Malware payload (RedLineStealer)", "value": "56547b83cf0ac3ea3dc4e5a8757f5297", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689009848, "uuid": "f5a9a68f-7835-4d14-873e-0620ef0cd505", "comment": "Malware payload (RedLineStealer)", "value": "bcef32f044a0b53e8e220afed1d1a578c06c5e19083936cc5b1b03cda902d159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689009848, "uuid": "b34211b7-42f7-49b1-b3f5-ddb6e6d19d56", "comment": "Malware payload (RedLineStealer)", "value": "d5d568c895d304ce99d6b18d82b58ff047e36611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689009848, "uuid": "eeba5f28-390c-46de-89f7-74cb231bda8d", "comment": "Malware payload (RedLineStealer)", "value": "57e5ffbf043312a9f6c58a1ec248510b1393755ee22931a8b4c09618ce952b6020f27d820029a0ce1cd76f2d38359936", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689009848, "uuid": "2e01dc11-972d-4ada-bf59-7fb39b9fb661", "value": "T12BE4D03914A144ABC4A9AD39FF4BD4C232162EE5017C950E3EB36E783BD24578DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689009848, "uuid": "f5c8e14e-5128-4d8d-b495-fd81c3080c7b", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689009848, "uuid": "bfca6e71-bc50-4aff-ad22-dd698fd997c5", "value": "12288:xw3zk2ERiICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:xwDkNRBbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689009848, "uuid": "9a852d88-ccf6-491d-8d9e-5d532aac1e86", "value": 708929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689009848, "uuid": "235f25ac-9297-4ade-820a-b9a03b58a81f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689009848, "uuid": "7f1070b0-7865-4fcb-a1b8-97508079003c", "value": "56547b83cf0ac3ea3dc4e5a8757f5297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e6358e-1f61-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689021267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021267, "uuid": "521e3ea2-222f-48aa-b8ca-b1646fbe85c6", "comment": "Malware payload", "value": "2ef99b1dab69133c3420da0378bf5c77", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021267, "uuid": "6c006d55-5f40-45be-9c6d-3579043f9562", "comment": "Malware payload", "value": "bd78e29a8c3e99637a12561de6194684b5afc7b55e00d50e5816c931f980c265", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021267, "uuid": "a885cd9b-c604-4e2a-92e8-aa2e860eed19", "comment": "Malware payload", "value": "e89d4b03481a76aae3fc55f5d20a86358f44f396", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021267, "uuid": "2298f6e0-b4bf-418e-a384-f5214fd0ecbf", "comment": "Malware payload", "value": "e727af7506d4e2d519f4a7b140321b02da18c868b44677f2de64c21b78d59ad5ef6654335197e04dd5f16af1226851a0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021267, "uuid": "06f9c1a4-36e9-44b0-8b2d-524640dfec52", "value": "T101C30845FC509A13C6D612BBFB5E428D7B2A1798D3EE72039D156F20379B86B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021267, "uuid": "d31001a8-8551-4b66-a4ec-b505c9c02030", "value": "1536:lkHcBv2iEMFIrjnr7WFKAhE74VhcdpTu1sPgF+smpUQhP1Y4lCAwyw+RzY2xxoJk:lkH0e9rrrKFKl483y1sPgF7W9gg52+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689021267, "uuid": "f4450b4a-e834-49f4-a861-863360225585", "value": 129420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689021267, "uuid": "f93d6230-d4ac-40c5-90f1-06911d003693", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021267, "uuid": "3cf2e638-728c-44cf-ac46-d79ce7900a1c", "value": "most-arm-20230710-2034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323a8870-1f61-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689021281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021281, "uuid": "5d126b37-4e36-4184-b59e-483c12b3ccf7", "comment": "Malware payload", "value": "9f9af9112a1c4ac620744d5b80aa63ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021281, "uuid": "c24b9a36-19c6-4daa-a87a-6cfd3f73044d", "comment": "Malware payload", "value": "bdc02f8a9daf80141ad708451f2eb5de91890aa584b0a2b41b958f87f8c85a40", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021281, "uuid": "5ef74a23-4d8b-4beb-b266-0509f1ddeb1e", "comment": "Malware payload", "value": "e51ece9aeb0e9d6a25aef56f5bc22832859f885e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021281, "uuid": "ab77030d-db85-4a3c-b799-e1446c0a8741", "comment": "Malware payload", "value": "35cd6df395178e3de2c8549922782de821aa9cce43d4ec1a5140af0d134e94979d1acddbd9a4377471a2d027b4be8327", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021281, "uuid": "8b5a85b1-baf0-4b1a-a997-95f84d6ff7f6", "value": "T100F3D70AAF610FBBDCAFDE3706E9070139CC951722A53B763678D528F54A50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021281, "uuid": "7ced25ac-8242-468d-8114-aa50e4a22d96", "value": "1536:5Fdr0+x00/0faFjWaNL2JGFjDcl9kl1/mJkl+y9LoxdhDvuNnpFbOQa9y5tH6+K:5FdC0OadWad7OKlf4dhD2Np9h6+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689021281, "uuid": "d5aaee53-6288-4a27-8c1b-6166c950d375", "value": 170560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689021281, "uuid": "fcd6e70e-9b57-4f58-93ea-9c5d3aa44ec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021281, "uuid": "d4e95513-161d-477a-98d5-3cb8703c35d3", "value": "most-mpsl-20230710-2034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211cf84d-1f37-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1689003213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689003213, "uuid": "be493d36-67ef-4a03-8c3c-5450c67c284d", "comment": "Malware payload (njrat)", "value": "03e8bd924081919f09deb93a6a697419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689003213, "uuid": "9f207314-eaa0-42a2-a707-e739ddd6dc7a", "comment": "Malware payload (njrat)", "value": "be3c0b1950670cb33e98be7161c5c2a1e3f62ba2722ab16fb2c3504d487e4ff9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689003213, "uuid": "1db22bf3-1b16-4295-87af-c33a106cb89f", "comment": "Malware payload (njrat)", "value": "500ac2d014d63df724818248ee1b62ad53d6d0a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689003213, "uuid": "5c9abde0-bf78-490e-919f-1ad53ae56397", "comment": "Malware payload (njrat)", "value": "56981e914b3e8b132fda6a202e6520d2265175976525074a172f30d188cb084a1c16444be0dac11643b86f88055f2ac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689003213, "uuid": "bf636405-304e-4fee-9c00-38c9fa1459a4", "value": "T113C2F82C37B68231D2EE067E4562EE5043B4D44BF267FB0E1CD958E94B5B3CA0A41EE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689003213, "uuid": "18380874-0d56-4542-af9e-3bfb8b2b72d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689003213, "uuid": "b30f7be3-896b-44cd-a3c4-a170fdd77eaf", "value": "384:9LP7+aLz+oYDCBcbQM70PbNBJMFAQk93vmhm7UMKmIEecKdbXTzm9bVhcaw6Tr6s:tz+waIWFFA/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689003213, "uuid": "a66f8755-114f-459a-b037-006694bbda28", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689003213, "uuid": "3309bcec-7155-4f9b-9af1-05e2ee1dd716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689003213, "uuid": "b36f0b16-83f1-4ff4-9906-ee5296ee204c", "value": "03e8bd924081919f09deb93a6a697419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd129d51-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688978188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978188, "uuid": "ebc99f8f-a0e5-48d5-ab50-63930946cd98", "comment": "Malware payload (Amadey)", "value": "9e444cce33400d1a8625ea18256b604d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978188, "uuid": "fb510655-a9c9-4cfd-a5a3-02893971a247", "comment": "Malware payload (Amadey)", "value": "be50af163cd1b4a8f97ce881f1cdf1a089dce08d4fb4ef5211518604cc51c06a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978188, "uuid": "d6678619-e504-4607-b0f8-da586b258526", "comment": "Malware payload (Amadey)", "value": "db71bc1e8c9724811f94ab6ea181d969efa19163", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978188, "uuid": "7d7e1fe8-095e-472d-88dc-89ba453da4b3", "comment": "Malware payload (Amadey)", "value": "43e1adda37682d163a88b31f99037694015c70ad652498ae7a189a69e122bffd12ee636382fa82106e3e9ca2a8d747ac", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978188, "uuid": "52102659-f0d2-43e1-8ddd-7039001e7a97", "value": "T17405122071D69823F572107229A0C32EFE1FEA255A619B8763C8753E97392D50D3ECF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978188, "uuid": "9ee9e7b5-f71d-4dd7-8b2f-dd401297399f", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978188, "uuid": "f745bef9-b2ab-44de-baf7-578b4588db47", "value": "24576:3K47NkaMZE+wS60x/z++fqVwPIryVcSK:3KqSaqE+wP05y+fqV+rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978188, "uuid": "d065d040-f598-42b6-b46b-5d99f0dc8e35", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978188, "uuid": "08994778-adb7-47d9-88f1-a3e4a667e6e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978188, "uuid": "c1274b66-9d46-42f7-999d-efe70432b694", "value": "9e444cce33400d1a8625ea18256b604d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f299dfc9-1ef7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688976077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976077, "uuid": "1a42afb0-257f-41c6-a1c6-18047abf1982", "comment": "Malware payload (Amadey)", "value": "103132dd25d920faf1a80c863ac6f7de", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976077, "uuid": "483bf612-b13b-49ac-ba6d-c79ee8052515", "comment": "Malware payload (Amadey)", "value": "be5c43354185758418dcde039f6cb40f13c995c4ce9235bfe0c42b052507219b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976077, "uuid": "d8c8d9d6-e38f-4dac-b1a7-36d50600be7a", "comment": "Malware payload (Amadey)", "value": "1ba3729ba97186544b892eb09cf49eb4f8f6592d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976077, "uuid": "d243ba87-e426-4e14-9133-c156caed13b0", "comment": "Malware payload (Amadey)", "value": "bd201460f9c560ed4be70c06fb493f2f44c91ca30a9344e14ffa2585594469b065b76d0689867a0e77b89e91f65a4d8d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976077, "uuid": "d2743101-5235-41c8-8c1d-abf631981995", "value": "T1BCC40261B1D25623F572103725A0D26FBF2BEE3108E25A8793C8793E57291C14E3EDB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976077, "uuid": "a2d4deec-b2fd-43e5-897b-116911a66076", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976077, "uuid": "238137bd-bc2f-4351-b6e1-121395bf1c3f", "value": "12288:a+gHKtz47FkX8YzQuXwzqVq/SfO4xUdb:EqV47FkX8YV9VjO4xUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688976077, "uuid": "771356f8-dd73-4b38-8a1d-7ce838d0ba47", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688976077, "uuid": "7e937259-26c1-4bda-bc7b-2692806a7834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976077, "uuid": "13dfb132-274c-4bbd-8cf9-d2c066f2d816", "value": "be5c43354185758418dcde039f6cb40f13c995c4ce923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb850279-1f17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SystemBC)", "timestamp": 1688989835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989835, "uuid": "7b8d64e6-27c9-411c-91ba-fe9c6d33b22c", "comment": "Malware payload (SystemBC)", "value": "e8adc07619649cf7775aca6366e44505", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989835, "uuid": "e82a542b-bbcf-44b6-8ac5-8641da947bcb", "comment": "Malware payload (SystemBC)", "value": "bebd19c9564d5fcd30b61828bd864c06dc3a421b850488972473f8330ad91bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989835, "uuid": "f9025bd9-d82f-4c64-a0f2-54c93d2ed648", "comment": "Malware payload (SystemBC)", "value": "3bfc662e6b49193788008e914b9f785110fe6b37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989835, "uuid": "29415704-91a5-4a97-9296-3b4e5411ba59", "comment": "Malware payload (SystemBC)", "value": "f3a63e2df51c6cb210599106cdfe6c536ad221a6ab998c98f7891ab959410ba403a32e1ed91fb7eebbcd5d6c3317897d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989835, "uuid": "60e6f06b-df03-4f87-8400-d1fe6b472cb2", "value": "T1FC2612FA21442668C056C9385833FD44F2F6A51E0AF9E5AEB5EBBAC07F7F400D615E06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989835, "uuid": "710633ac-4f82-434a-81b5-7d839da83b68", "value": "fdb86ad1221188d05cf134b7ea883a73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989835, "uuid": "d60089c4-5af8-4674-93f3-f324d1a6de02", "value": "98304:zfWvjcEr2WI8tUGMQS5bzddMhaiz9U+PnHT7+51N:zev72/8tUG7YzDGaixTPnHT7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688989835, "uuid": "e8f242ba-6475-4306-9b0d-1d3c73ae2ef7", "value": 4636160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688989835, "uuid": "54359fc0-5c69-476a-9af1-d782ab81072c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989835, "uuid": "d2f71072-7a18-4d72-b7db-a60790a5140c", "value": "SecuriteInfo.com.Win64.MalwareX-gen.3823.17263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8809b31d-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962583, "uuid": "84de49f0-cf95-42b9-a04c-7caedfd3bbf8", "comment": "Malware payload (Mirai)", "value": "4bbc57bcb95f8f4109a92932d052d270", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962583, "uuid": "995981a3-7694-411d-be8d-9d83752f749d", "comment": "Malware payload (Mirai)", "value": "befca934b080e6c0ad958e2590cb540389525ca94189bdaab6aa75dbb0491de1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962583, "uuid": "bb1433ba-4d1f-4f59-8fbb-9c7d890c372b", "comment": "Malware payload (Mirai)", "value": "bb5ee2008bb61c142f940c646ca482d8aa2c8646", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962583, "uuid": "aed275fe-d11a-4d65-90b6-7ef229806834", "comment": "Malware payload (Mirai)", "value": "3b6f64bd96554b7934135866ace054fc135ea3313de03c02b430df2b85b9c582880794ef4d73ecdbf7c2bb51430150c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962583, "uuid": "981eb999-4fac-4367-8d28-9cf0374943c6", "value": "T14214A71E6E228F7EF768873047B78A25975C23D627E1D684E1ACD1105F2039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962583, "uuid": "b554a5ae-6d88-400d-8400-bc3c4597fcea", "value": "3072:prDNZXSACW9ftsF/+y1ib9k4Obrx17ZpbyHRtaSab2jHpmC:prDvCDZ1ib9k4U7zGHR1ab2jJmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962583, "uuid": "03a5b69c-dcc3-4f51-b13f-764451ffe746", "value": 191080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962583, "uuid": "39668b8f-4088-40ba-a09a-8ea0c69f2ecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962583, "uuid": "5184bc51-9565-47b5-aadd-b1982c987ef4", "value": "skyline.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ab8b70-1f0f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688986208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986208, "uuid": "e7cc9a61-6afa-4995-8ed5-b3ab0b2df47b", "comment": "Malware payload (Mirai)", "value": "24e3f49e0492b6a515503827ebca0e9f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986208, "uuid": "78ba0841-d537-4615-a905-461660905134", "comment": "Malware payload (Mirai)", "value": "bf2fcb2c09549238505744f52057d330d1a41c6a3dd32d929f0c3cd4a69ad2db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986208, "uuid": "d5643cf3-a95d-4438-8a22-657198d9ce46", "comment": "Malware payload (Mirai)", "value": "e8e3829b370a7ceeec1f50b3a296519843264dd3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688986208, "uuid": "9fc2d9b9-cc18-45eb-9ebb-691b1a3128a0", "comment": "Malware payload (Mirai)", "value": "87fc13c23dcf5f720a3e0d44a99ecf7176fcdee4b95a72b9bfb3495f9deca1436f5495d6e23e6721981e57dd728bd351", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986208, "uuid": "c65a396d-382f-4656-90a4-8a8f4376350c", "value": "T14AC2D0621EEF38B1C27460B6EC7CC6C7620F4EB965F15521725057A1CEE200352BA8FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986208, "uuid": "53c02181-cdda-420e-ba20-909c4f02e51a", "value": "384:5XNSIfjdxuZ1DUofVOyPqMvt6GqAAdq1K0jzNH7EUz6z6RNo9chUNHYhymdGUopO:LjKX9vt6GqA3Q0jzV7EUyUq9nms3Uoz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688986208, "uuid": "4694139a-73d0-4505-900d-0f18826ede99", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688986208, "uuid": "9e84e3b4-d110-4419-a34c-b2236bb3d2ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688986208, "uuid": "0d29aaff-abd9-43ec-83fb-6d8657b65914", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a33d0e2-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968868, "uuid": "c4dd1ad3-dec7-4238-ae76-303b8494ddef", "comment": "Malware payload (RedLineStealer)", "value": "41aac8d6c6ae26c06de7f517e50d639c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968868, "uuid": "b372ab1f-c3e7-4bf2-a491-a23f606c8e20", "comment": "Malware payload (RedLineStealer)", "value": "bf42b60aeea65ba25a9e2add2b01e4488f9e981f793b26a8c84c9d5a8c4d9b5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968868, "uuid": "f3d6700c-c738-4b70-b2b9-c257bdd8a129", "comment": "Malware payload (RedLineStealer)", "value": "083b2b6c87cd2667bd434b8ece61c31aa2713882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968868, "uuid": "7fb6ee7e-f83e-4cee-b949-440d2a58fa82", "comment": "Malware payload (RedLineStealer)", "value": "845ad030b02e774d83250e01e57d402f36690e208e470e9936fa0ccae018ac25b9dc7daef40e0b3e7382b904780bf2ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968868, "uuid": "04c54c97-3ad8-4319-ad7f-6ae6624d81bc", "value": "T153C412B1B1D68523E535053309B0C26FBF2FEA311EA0459793C1763E8B691C25E7ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968868, "uuid": "d267e4ac-1bf1-4a50-be67-3ce0aa71ae64", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968868, "uuid": "01958d04-5e86-4853-adda-fc2d60e462c6", "value": "6144:GsESoUTLTHBlNCWGYLUz2474yi63Vky389c4s/OJqI6WryhSM5ipeI5j4F1kFyF8:PE8TVz474W32yM9cFLI3ruYpZyznZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968868, "uuid": "951542aa-2e7c-429b-9052-6315a123e5ce", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968868, "uuid": "d457d797-22d6-4321-8327-95ff09bb80f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968868, "uuid": "aed6aed1-7ce8-4bca-80e7-42cbf2fb10c2", "value": "41aac8d6c6ae26c06de7f517e50d639c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f14be45-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962568, "uuid": "88554135-d125-466d-ace5-4f977dda204f", "comment": "Malware payload (Mirai)", "value": "11e79de8ade5ed3582725775ef9b8b37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962568, "uuid": "1c6f0ce6-16bb-40e3-9afc-699a15a38bd6", "comment": "Malware payload (Mirai)", "value": "bf4a4ba6e62b6cb2add8b3f129d35e7cca2bb800773f3176aede5ba565e7babd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962568, "uuid": "1b9eb385-465c-4790-af0d-1cd10a83ad23", "comment": "Malware payload (Mirai)", "value": "86c444cc405a3ac045352b922d4f1f5926bc6131", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962568, "uuid": "4c762179-f983-4942-8a0c-a1f017fb0f1b", "comment": "Malware payload (Mirai)", "value": "f743d13c09f2d81ca643fc9b864d916c7ae9dc3f4b8de20e4e3c4970f66daf186b2b4cf97c7d92524d362a2b0648fb6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962568, "uuid": "617eb656-be14-47c8-924a-bd6a460b0f2b", "value": "T1523302F276514E72482312B7BBFD449C3F7ACBA8E07BF3521BBB04382597901A9D0665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962568, "uuid": "df7b01ca-2b7c-4402-8c02-1082f1a01e23", "value": "768:Df1XHf0foPJ0LLfjRcNGApvifAUcCP+s1UBWJsSfypyyz9q3UELq07qj6u7qSkCy:DtX/luTj2AH9n1yyLl7Z/SkCrx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962568, "uuid": "d8230793-260e-4718-9959-b09457a50033", "value": 54204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962568, "uuid": "94239244-fc9a-41c3-8093-c0828ffaeaea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962568, "uuid": "51449db9-b147-480c-b0b3-017ab47e7db3", "value": "11e79de8ade5ed3582725775ef9b8b37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0c2d6a-1edd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688964607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964607, "uuid": "63e1bf68-6e98-43e4-9e89-42790c0551f9", "comment": "Malware payload (Mirai)", "value": "c23fe33c297599f6453da8f93f53b0f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964607, "uuid": "4399f35a-5009-44e3-ac12-d2921a74df75", "comment": "Malware payload (Mirai)", "value": "bf5b9347c719b5c7cdcc8faa18e8dcb86367bdf3e3b5ba6736cfae5b74d8ad82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964607, "uuid": "2705f523-e70c-42fb-bafe-a569525fd4d2", "comment": "Malware payload (Mirai)", "value": "53c2d0c1c6c602c52f0c9f586b9f4ce521c14f47", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964607, "uuid": "672655fa-341d-4b63-b15d-97354723f74a", "comment": "Malware payload (Mirai)", "value": "fee8e81fdd5ff06fe2c7160b209a193e45338cf42d7ba87be520199830de730eb024e62874252b94c2892d7adbb72de8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964607, "uuid": "0ac414af-ae09-4430-a609-6bedc77900bd", "value": "T1EA03D785B9869A07CAD4537BFA0E42DD3B2573C8F2CE3313DE162F51368A92B0D6B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964607, "uuid": "addee63a-7262-4d21-8314-e2f61e8c0cca", "value": "768:L8cgPbzj5HoD2ogElo5fEFn8fuP5KZ7mrLIZUI:Ycg8oDfnfuxy76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688964607, "uuid": "77eeedb7-527f-4c6a-b837-971ce03d39b0", "value": 37884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688964607, "uuid": "7ac17ce4-5b80-41ce-8bad-effa7fab0e10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964607, "uuid": "f90340fd-8f9e-49a0-9c1e-901c63ac1f66", "value": "miori.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c65234a-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688977892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977892, "uuid": "c9b1db3f-ed23-49da-8105-9ce6603c1e60", "comment": "Malware payload (Amadey)", "value": "241371d784ac532da3c2e3ac629e15d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977892, "uuid": "b8dbd504-052d-48cc-9a10-4bd8681f29f0", "comment": "Malware payload (Amadey)", "value": "bfea7c574075018a09a26275906b5ca0acfca42ef6cc39d48927505dfef9b31e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977892, "uuid": "6d1cb3c1-52cd-479c-a200-db167be0c4ce", "comment": "Malware payload (Amadey)", "value": "528e04cafeeb9bbe206acddf69e2ab8f46d07dca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977892, "uuid": "2099282e-b465-4690-8339-a13bc792071e", "comment": "Malware payload (Amadey)", "value": "c7bda92dadcd8db32e45f86bb40226e2dc4edc5027942a6bf8803a2165079bfaf168cbd51e318c7ce82b2bf3ef0568e7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977892, "uuid": "35dfc47e-9f1f-449a-b5de-960ad574e08e", "value": "T15805122171D28923E172153718A0D15FBE1BEA3119E16A87A3C53A3D97281C74E3ECFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977892, "uuid": "75b56e74-c43a-43d6-8dda-3d832b4d1986", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977892, "uuid": "759220ac-b945-4166-92a2-80a7bcbe460f", "value": "12288:qA4osz47pHqtMdolpxHAN8kXUoSCpQKPYZxJobEk3F8CsEv2XDO:Tm47p6jlLgekXUPCpQKPYrJobE21vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977892, "uuid": "70fb3dac-eb50-455f-8208-05fabc55949e", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977892, "uuid": "21f2befd-2a08-4390-9bb9-be84aaf46374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977892, "uuid": "946764d1-80b1-405a-ac76-dcb2100daed6", "value": "241371d784ac532da3c2e3ac629e15d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05333ea-1f22-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1688994434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994434, "uuid": "fe317941-c451-482f-af3d-ffd597014b29", "comment": "Malware payload (zgRAT)", "value": "adcf92ae5e6f6d06a8539ddd2956623c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994434, "uuid": "d6cd40f9-af1f-410b-a238-f03502aa60c7", "comment": "Malware payload (zgRAT)", "value": "c0258497ad1af8619e82c38f659dc62dc5ef0b6d5c097671b9892f12fe753d3c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994434, "uuid": "12e425cc-366b-4ea9-a663-ed769c8a74f3", "comment": "Malware payload (zgRAT)", "value": "271ac555c4109f2c6190e3056edfeff9a41b1ae0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994434, "uuid": "88d18f8e-eb5a-45c3-9a31-ac59bdffb466", "comment": "Malware payload (zgRAT)", "value": "c60e5b8d2400088a520400a7cb27492847e8d963ca7b4da6678243c82a1a07d6cc960fb3911cdff7b90ccc8d37959118", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994434, "uuid": "e4c5b751-149a-4175-9916-0872ab4f7f5d", "value": "T10BA3AED0638899F296D99BB3A2645D4C173D213B7A8611CC705AF6D43BBF3188F0D4E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994434, "uuid": "47b63209-2e3f-4baf-9e5d-8b46bf5d173a", "value": "1536:oay2zJh+l/DAuxQQJOH+bSXkSRDOSRn7zCFcWeyZW07iFsIZKe8kb1C44Ue8f2Sl:S2zJQerQcDX0d3A9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688994434, "uuid": "79bbc517-d3ae-4041-819a-2607a06d490d", "value": 99657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688994434, "uuid": "6c1350cf-1cb9-45c0-85a5-8d5cea4a99ac", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994434, "uuid": "877d738a-597e-4a8f-b9bd-960dfca829f6", "value": "NewXorderXPO-12642945.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed33f05-1f00-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1688979614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979614, "uuid": "3db29bf2-7fba-4199-9df1-7c048550c98e", "comment": "Malware payload (STRRAT)", "value": "a400bed55e254bae583c7f7cea8951a1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979614, "uuid": "b7d92bd3-681b-4811-9dd4-abda182e709a", "comment": "Malware payload (STRRAT)", "value": "c02655fc4460bca547a039d7809112a6b4b81069ac893d602160d3abe8b9a4e0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979614, "uuid": "6dc08bd9-9ade-4516-96b7-2b8c88d6d0b8", "comment": "Malware payload (STRRAT)", "value": "cbfe8475d0469ea0d33549d9c850d6ddc816a3f6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688979614, "uuid": "351e8d92-96bd-4757-a013-feedea9ff0c0", "comment": "Malware payload (STRRAT)", "value": "ca1d4d2023996083c69c023fa5c01804be4b5f1112f8490e4591b093360012c50db5810ae452703cf9699acee7dfd550", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979614, "uuid": "09b47700-b741-4321-9481-e72937da4469", "value": "T149941991D597BEE1EF8EED736208DF652491ACFC9707C04A42A02EF0D851A7CDBA0D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979614, "uuid": "2a33dd33-26be-4481-ace0-e838be036224", "value": "12288:8kraQ3Tieqpaaoxu5GllvSbpwB7VnFdms9raQ3Tieqn6:8WaQ3TieqkaoxCGllaIL19raQ3Tieqn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688979614, "uuid": "46b0f2cb-3c32-4a74-a24f-cd1001e74f00", "value": 445137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688979614, "uuid": "ebaf7d11-5b98-4aa0-b977-714e89aa82d0", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688979614, "uuid": "baaa2bea-7de4-4c54-8e2a-8f1b06ed3763", "value": "SWIFT_COPY.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d10c64-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968864, "uuid": "5be92bd5-6842-4605-ad9d-182d9fbf28ca", "comment": "Malware payload (RedLineStealer)", "value": "b445f2d8f0c23d669909a85925f83835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968864, "uuid": "955b6d81-02b8-43d8-953f-921d5f78d390", "comment": "Malware payload (RedLineStealer)", "value": "c0b0f8dc945814d07c5ffbd5464244b0191488c83651388443f1440cbeebcf0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968864, "uuid": "9c1d3a2b-7f93-4a35-a29d-bd3b56413a7f", "comment": "Malware payload (RedLineStealer)", "value": "ca5e56cd6f9d94d833f6f3134592837fb0d028da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968864, "uuid": "763fd0cb-b2df-4d9d-8c40-5c54e216a13e", "comment": "Malware payload (RedLineStealer)", "value": "0936370a458846b2753183972c064d0a726ad4e52ad064b1797a88d2d769fbc60c22cebccbd160d0b00e2d785b279e11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968864, "uuid": "73eb4f3a-c42f-4c54-9614-ce22a50418fc", "value": "T1A444283921E144A7D8BA9E35BE4BC0D17116AEB4017C541F3FB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968864, "uuid": "f7febc8c-3cab-4ce0-b50e-41ca7cd35dd9", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968864, "uuid": "e462f228-fbba-42b8-a31e-58c21083c9ed", "value": "3072:zx1s+iOHMwew7+picM/XsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:zx1svOswD72VVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968864, "uuid": "5c01d967-3b39-4df2-8769-7bf4eb9305b8", "value": 272545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968864, "uuid": "709412c5-29ad-41ac-ab7d-10713af266b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968864, "uuid": "9e182d5b-1c99-488b-ad55-7f077c09beb6", "value": "b445f2d8f0c23d669909a85925f83835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ccab14-1f21-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688993852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993852, "uuid": "b7f6cb9e-a9ee-4493-b3aa-842090276aac", "comment": "Malware payload (RedLineStealer)", "value": "02d3cc52bf2daf9027e9f5f03f9d5c60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993852, "uuid": "56aa19f1-8797-43d0-b3cf-a946f7764d70", "comment": "Malware payload (RedLineStealer)", "value": "c0dad59a3bf41db6ecf798e4bdcef76482de14c96e0a17733413f0a05a686cfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993852, "uuid": "655dd6fd-2664-4796-a526-ebdbe783d1c4", "comment": "Malware payload (RedLineStealer)", "value": "64a54dee7b09794656ca9507fa03519451ebe600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993852, "uuid": "696bb97b-b116-4763-bd73-329bd2d21617", "comment": "Malware payload (RedLineStealer)", "value": "0c69b9605617db243fd6efdf8a53d059de08070a15213cd0174dfe54497973b2dad3cd8e3899f18cc050f85ab90a0dcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993852, "uuid": "e2d46b6d-0b0e-4351-bafc-c7fae8ab6be2", "value": "T13675231773F8A875CA754B302AFA05D31E35FDB2A9B4C21B2395DA1E0C32794923671B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993852, "uuid": "ebfbad09-f707-48af-b344-fb1810c37bb3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993852, "uuid": "8998d1ac-7a81-4fec-9563-514b5ee53a35", "value": "24576:Sy43P8nmHHvHZb/3jXiV4MpypFR7uDMZiq3lDNGKVIAF/smmFJycDaV8ENEMKtAR:5vmHHPZb2KMpypFZflUKKAFmF8cN4Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688993852, "uuid": "f2c78cf8-805c-4f58-b0da-844244fb1fa3", "value": 1586688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688993852, "uuid": "43a5b8ed-7b2b-4531-80b9-57b628370c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993852, "uuid": "53b9725b-4bbe-42dc-8cd5-afd320bd4a75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923ac893-1f25-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688995672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995672, "uuid": "37eb1cd9-def9-4505-9527-e63a36bca7a8", "comment": "Malware payload (RedLineStealer)", "value": "64d1fa415c1423ec1ccf9625939dc535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995672, "uuid": "4c6a2f20-f46f-4834-b021-7b4903314f3b", "comment": "Malware payload (RedLineStealer)", "value": "c12be2cf6df383188eb7852ce98f698ccdfbd895bd1a4e6b413d625cc35420b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995672, "uuid": "8ea4e9fa-981e-4877-bbac-04308c8efde9", "comment": "Malware payload (RedLineStealer)", "value": "656f06c7a77c440a79d34f7bbe8fa74aa723b75a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995672, "uuid": "1aa19810-cf0a-45ae-93f4-5193d0f4703c", "comment": "Malware payload (RedLineStealer)", "value": "3cc3e08b07ad1b256d4cacd762f5216d67389297864ab0bae6f5fde9e1e802e6d2e90653b4994fb9f85bbd8085ca5fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995672, "uuid": "e92a0bd5-2c66-4db0-b79f-b026c3da655e", "value": "T10475012924A640F7D8951838FB1BF9C233765AF20078881D7FD32DB86BD3956A4FA1D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995672, "uuid": "6f489517-128c-4513-b1ff-8811e04ecd33", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995672, "uuid": "5d0dafb9-5a66-4767-94bd-7e0c1e429a96", "value": "24576:IwDkNkwvN1kZz9rJ1VgwlSWN/MTtlqx10H+jnAopwzZ6kOBbVTb34k30/8dRi9:IpKwLkJJbqyja+xKH4nAmkYykji9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688995672, "uuid": "7e9b36ad-4264-4a84-9e28-8211c952f3f2", "value": 1574724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688995672, "uuid": "3c0daa9d-3cd7-48fa-9ea0-5e1f7499ac3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995672, "uuid": "c884a610-a98c-44f5-a64b-8c98c99dffdd", "value": "64d1fa415c1423ec1ccf9625939dc535.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957b1514-1f29-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688997395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997395, "uuid": "805aa273-1bae-4c1a-bec0-510fe0ea9ac5", "comment": "Malware payload (SnakeKeylogger)", "value": "5c4eb74986a42af286131be50ef36133", "object_relation": "md5", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997395, "uuid": "390f21cf-3691-4880-b92f-f85bb4a62592", "comment": "Malware payload (SnakeKeylogger)", "value": "c13b30e8ab69cc2a3b987350e1ca50f747c8e397e2ee3db2d935eb4e8c9b1db3", "object_relation": "sha256", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997395, "uuid": "f1123a9f-6b82-4a61-b18b-868c9461339d", "comment": "Malware payload (SnakeKeylogger)", "value": "38cf1fe51e106a537d8741b88a6b566d18f298aa", "object_relation": "sha1", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997395, "uuid": "f5b925a8-7531-438b-9218-d86a11d0a604", "comment": "Malware payload (SnakeKeylogger)", "value": "03662936551dc3cab0dfbbef4bca525b3bf2b0bfc6239b68155b3679bc155d23831c6a10569a185a8521907f7ebb9418", "object_relation": "sha3-384", "Tag": [ { "name": "bz2", "colour": "#AC1CC3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997395, "uuid": "dec5ae52-d24b-4af5-b4ac-83b22ffb9e0e", "value": "T1EFD42387B629FC90D67AD816E503163C734CAB9EAE4CF507E60CFA9CD814897E4E610D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997395, "uuid": "506d44c0-8fa6-4d1b-b857-f44ec3a2707c", "value": "12288:FjmAX2eM9lKD2cNbnV5dm6by+DLkDs7agBslTFNnODGlM7AXpDWz8eg7:MAX2eWKac5VOaB3kGovWWpKz8eg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997395, "uuid": "01e214c6-145b-4740-bd1f-7fc2ee2714e7", "value": 629770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997395, "uuid": "de9c1e3c-543b-4a3b-b104-3853d18c55d4", "value": "application/x-bzip2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997395, "uuid": "53e4678d-d813-4e1b-aca9-1303335a08a9", "value": "Transferencia en divisas.tar.bz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5f1795-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688991100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991100, "uuid": "52d325a2-8dae-4f55-961a-343575c44688", "comment": "Malware payload (AgentTesla)", "value": "4c346dedb60a0880ed8cab320f11c666", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991100, "uuid": "90f41e75-6614-4662-bedc-429477e61c5a", "comment": "Malware payload (AgentTesla)", "value": "c18a88fef1d4479c7a6a16f8600977b586999d0f72f8a9f844d156a6c4437d1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991100, "uuid": "e860d04a-4a28-416a-8453-64ca87e25c4b", "comment": "Malware payload (AgentTesla)", "value": "c81466adb3294abbd8dd5f9df95fc351b54d17cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991100, "uuid": "4ad60513-977e-4773-8755-c6fa65c25d13", "comment": "Malware payload (AgentTesla)", "value": "35f06c520c0cec4bf385e60e181e685fdab32eeeeb13517a054f4c37d39616c0464030e6d1c50458b370022a19e6b5ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991100, "uuid": "a94b94de-d698-46e8-953e-5e1bbc984aa4", "value": "T17B23D25EE78B02A48F411373271A0E8996BDB23DB35055B178AC933433EDC7E46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991100, "uuid": "c443ee6e-d3ad-4ada-a7f2-22d0869ec1c8", "value": "768:MFx0XaIsnPRIa4fwJMXD1YWabu97vYwjt860Et17DnF9koJU8LWOVXC:Mf0Xvx3EMXDDaiBAwC301vFO4SOVXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991100, "uuid": "bd330faa-69ae-4351-b73d-bff362318832", "value": 47743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991100, "uuid": "9da2d7be-c1fe-453f-aa8e-334ec217373f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991100, "uuid": "9883c3e8-3eaa-4f70-b97f-fff81e3096ac", "value": "4c346dedb60a0880ed8cab320f11c666.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d256028-1f40-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689007125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007125, "uuid": "b7eb3f2a-ccb7-47dc-a7ca-cd3740b3ab3a", "comment": "Malware payload (RedLineStealer)", "value": "a9fb19cecb5d76f8a3732a1ebd13085e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007125, "uuid": "86c1fd6f-3dc6-4c69-b10a-c7df74f6a20a", "comment": "Malware payload (RedLineStealer)", "value": "c26db7eb73217eb6599ca2a4c8be93c0ef9dc773c5f321ae5284887510e47e08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007125, "uuid": "29b462bd-8226-44b3-9a48-274b1264d3b8", "comment": "Malware payload (RedLineStealer)", "value": "6825ede7bb0d9b1306155d600b1fc0f968c88dbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689007125, "uuid": "d2051d2c-0291-401e-bbdf-0841e79067f9", "comment": "Malware payload (RedLineStealer)", "value": "88a2486bef0efe0dd01578fb79358ddda45f00743df641d3e398c86e4e79a6d30e2f7664bc58e17eb8fe77fc2149ea2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007125, "uuid": "48e70e6e-edfe-4fd1-8cb0-661332974f3d", "value": "T198152216D6D48072D9B5677450FB12D32E3ABCA29E78433F274A980D09323E499793BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007125, "uuid": "23226438-1d98-4a69-a8cf-3af3cbb01bc5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007125, "uuid": "484f901f-6a5f-48f4-8dbf-366ad87ad793", "value": "12288:mMrJy90U1pqL5zv+a0i+edbvE2Gmu6PvoLKM14RduLVhURlQ:HyMTZ0iLdbvBDu6U12EVSnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689007125, "uuid": "3136ac4c-566e-4133-8518-a0a2ac950e11", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689007125, "uuid": "5d07ab07-b9b9-4b6f-9d98-99b54ff5825f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689007125, "uuid": "8cae4337-fe3c-4719-a551-441ea5622708", "value": "a9fb19cecb5d76f8a3732a1ebd13085e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a27d114-1f1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688991766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991766, "uuid": "d1a67e07-83c9-420d-9f63-8802b9a541b9", "comment": "Malware payload (GuLoader)", "value": "7deef9c22e5a7e9fea1c71f7b508d1af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991766, "uuid": "b79ff61f-e9e6-4e52-9555-4026ff6c20a9", "comment": "Malware payload (GuLoader)", "value": "c36591c7c0ef136b66dcf2955035ffc43ccd7fa6d6ce8c65f747dbe0aff7814e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991766, "uuid": "549dd168-ddae-42dd-8e88-2c0b59b60b16", "comment": "Malware payload (GuLoader)", "value": "fb34a732ecaea61afce62d9b6e8be4b3021d0fb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991766, "uuid": "336679e1-262e-406e-ad75-23feea38ea09", "comment": "Malware payload (GuLoader)", "value": "5499e646993821cd0561f089a8bb7f9913e4697c17f795a069a479f8dac8a85ec37040d6e538b31a7267ac8adf267ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991766, "uuid": "644952cf-965d-45a6-9fd6-e0746ba2acca", "value": "T153845B9239D975AFDC2F4674035FEAB22A795CE07382086E4F80761E4C3654A80EDDDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991766, "uuid": "490db189-3cc3-4fd3-a38e-ab75115ecbbe", "value": "b40f29cd171eb54c01b1dd2683c9c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991766, "uuid": "57e2530f-084a-4910-8cdd-f815a32267c0", "value": "6144:/oShfEPZVheNA+ff03xSVng/nd1Gras34M0bcMf6rb16:QqCnhe2e4xS4jSF0tfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991766, "uuid": "92410b71-ca8c-4046-b7d5-a25c4b47697e", "value": 377601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991766, "uuid": "4a557bd3-d80e-4c2a-a216-c3abf353606e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991766, "uuid": "02014301-19f9-4f09-8ada-a655f5dea56c", "value": "Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8177711f-1edf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688965579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965579, "uuid": "27be795c-ca79-4ec4-b109-403886acd4fe", "comment": "Malware payload (Mirai)", "value": "7254f16fd4dc7e8fe7fde972f8567341", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965579, "uuid": "7ae00eb3-ab3f-40ea-b1e3-1e1a4e9348fa", "comment": "Malware payload (Mirai)", "value": "c40cef1ec6d74b8bfc191bc72891d37a63a7bec7e178b8339b58baea4c0338a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965579, "uuid": "1f3eda20-22f5-4807-aef4-8bf7366d6f5f", "comment": "Malware payload (Mirai)", "value": "3a3834f6825d0bb0eb374b1b29f1977e1aeea5bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965579, "uuid": "51c1e285-c0bc-4f3d-b339-f6a8f51c65ea", "comment": "Malware payload (Mirai)", "value": "07e06de6e87b0b906e7613b6ac015120bd99a0a5b3bcb248a187f901be1f824f7f4af19dba21dadd444de9e916754cfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965579, "uuid": "04374400-ab33-4660-8597-f1a40439a841", "value": "T1F7731981BC809E15C6C517BBFA6F118E330297A8E2DEB353CD145B6477CA81B0E37A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965579, "uuid": "390e69c5-e7dd-418c-a659-71491205ee4b", "value": "1536:n1nblFlufknASOgUb+AAYg+y2HNclsuxIw9mrsplDKZUCQBKXAVan9X+F8Jyv+BN:HFlvO5bzA1+JHNcsS79mrsplDKZUCQBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965579, "uuid": "b7a2858b-2a35-40d4-bf82-6491ebe0c15c", "value": 80108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965579, "uuid": "d805ef32-7bb3-45a2-967c-1d3dd7a86965", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965579, "uuid": "566a43e0-dee7-404b-af23-f0acee22faa1", "value": "7254f16fd4dc7e8fe7fde972f8567341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e04e013-1edd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688964607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964607, "uuid": "53cfa802-54f5-487b-a2a3-c057e58b5e86", "comment": "Malware payload", "value": "1fcba3040a28673193405fea8ce03dcf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964607, "uuid": "6f5134d2-215b-4538-8e14-ed8f0de17f2e", "comment": "Malware payload", "value": "c449efccfa6a5ec224a728a3f78afed5c330f2993f0486c0d1b06531e0697fde", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964607, "uuid": "49441007-ccec-417c-9de1-d744d10cba9f", "comment": "Malware payload", "value": "47c4423026d44b6001f65b0ecf95cd3b033bd12a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964607, "uuid": "27ae6307-4bcf-4069-87cc-3fb4e1da8b85", "comment": "Malware payload", "value": "b59c334de47c4ff573d9135d7fd44c13aad0fbce780b7e9ff834173d1ea8af68c9f8f622785eeb5985969ecc142ddd5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964607, "uuid": "ae392690-0781-495d-b5eb-046e8b7de4fc", "value": "T15423FA88FD55A22AC7D162BBF70D03CE373B0768F3DA32129E355B2137C6A615A3A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964607, "uuid": "37696c04-ba01-43a9-b4d3-56ff14c01d49", "value": "768:pK4YbS9Icv6XeRczzG/ACowxMU1pF0POGr12rD32zoUVq+wmTnvbI:SSWtORg/Cq4j0POGrw0d9Tvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688964607, "uuid": "b6a175d2-7bc1-4739-bfb5-eb5e93f9be7a", "value": 46408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688964607, "uuid": "814aa37c-e73d-44c8-8c30-b76c3f3c3b2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964607, "uuid": "6bfd77bc-830a-4620-ac03-7d35c3a10606", "value": "boat.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdf7d6c-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688985709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985709, "uuid": "ddeb982f-6f16-4436-983e-cfeea95c34ee", "comment": "Malware payload", "value": "9ab14b0b1ad5e9674bfd89444a5fe3b0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985709, "uuid": "e59a3a46-7627-4201-a4d0-ad113463cc9a", "comment": "Malware payload", "value": "c49d726731022ab7068201cf4f4a9d4462e897a2527f4c978461289c208438c9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985709, "uuid": "27dd24c2-fc96-4ef4-bae8-533dfb68b76b", "comment": "Malware payload", "value": "6b4085d3c6bf95ab9f3bd07f119faaa7fbb30ff0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985709, "uuid": "8e8228b2-46ce-40ed-b4d4-b88f687ae4c0", "comment": "Malware payload", "value": "6c0ad746fd9bc657ad22fddd8892b64374cd442d2cc083529d90b1f9ffc0f2ec0904cc536dff1fcedc4384e06db3dfab", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985709, "uuid": "9a861376-cbf1-45ab-83d8-b35250da4a1c", "value": "T16BF41202F4849917DE05A3394ED355539299DC227EBF888B9C8AF79E13387E04C97F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985709, "uuid": "4a8da179-fa86-407b-bf4d-f6db392156f3", "value": "12288:eUIf6iwcxCQYmwLwMeMl05jz44VbiEz7nJJSQfIb9QsV1W35YAn/CiSev0vqSYjI:1IiiwgYDLwMeyiD0EzJwb9QsT45YAtvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985709, "uuid": "c4180344-b183-4a2c-9391-637a48562686", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985709, "uuid": "e5152fa0-a154-4549-8856-0fd61d3f1273", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985709, "uuid": "a5ec9d72-5e3c-4829-83d8-831c80195f5c", "value": "SecuriteInfo.com.Exploit.CVE-2018-0802.Gen.17941.3039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76aaed56-1f3d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689005933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005933, "uuid": "d61cd80e-2f7e-45f8-8d5c-450720ef3401", "comment": "Malware payload (RedLineStealer)", "value": "0060b4d57da09bbe90464bcf58af5029", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005933, "uuid": "17b5e4e7-0d92-4b2d-9de6-76d99ec6a64a", "comment": "Malware payload (RedLineStealer)", "value": "c5a98e78bf10877dc2c60e51ef5b5abc78309c104330b6c8acd9d92d5c000336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005933, "uuid": "1d3c3af1-cc55-4cd3-94f3-87cdfee66a63", "comment": "Malware payload (RedLineStealer)", "value": "b34773979bdab5129d9d18cefcec6143b03f0c72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005933, "uuid": "4fd61322-3e08-4a7b-add1-dc2dd7452d55", "comment": "Malware payload (RedLineStealer)", "value": "30c775bfa5aef822a9de4e8836efa3a1ee7f22666c6ad81ad7626cec4ea083edd4a2ccb2fe995799c48157f644166086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005933, "uuid": "86d97525-a672-42a8-86ef-fe3c4589d564", "value": "T1D66523B928802737D030607D8490E52FFE0709F296A05783EBC77A396B956EE2D7DD94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005933, "uuid": "f5aff8fd-1f5e-4d19-bf9d-c636e1eb6964", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005933, "uuid": "b26e94ce-5a8b-427a-8c66-d72377eacb7b", "value": "24576:uE47kOUEfJvETlpqftmHioiS+yvk3RZAHBbVTb34k30/8dRi9:uEq5PfJvExMftmHzO0khZAzykji9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689005933, "uuid": "89639738-b186-404b-84d3-c048b72c5270", "value": 1409344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689005933, "uuid": "127c61f3-09a6-4f76-b91c-911a08add677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005933, "uuid": "6474850d-7151-4eb9-922f-d368b5bfea1c", "value": "c5a98e78bf10877dc2c60e51ef5b5abc78309c104330b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c63894-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688978182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978182, "uuid": "bc91cc06-8a0f-4f9e-b26f-d2035b919701", "comment": "Malware payload (Amadey)", "value": "b51efcb9377d2df51a9bd31bfdb540a9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978182, "uuid": "d9bb60cd-cc76-44b5-8a80-105be56a9faa", "comment": "Malware payload (Amadey)", "value": "c67129b336a4c8cea90b36eafcf4c2cd3084cefefc649e7c62e5890522e7a4ab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978182, "uuid": "b34bb880-e908-4f96-99e0-267604493be2", "comment": "Malware payload (Amadey)", "value": "326569498f9deda2d5c0c154b558e017b6a33e43", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978182, "uuid": "e584dfce-14d9-4522-b529-83f7025c1b42", "comment": "Malware payload (Amadey)", "value": "3df448ba47093436bfb7a3aef28d74b39bd04dc2b37538660e9de5b40a1fef4dbf07e25262a46641bfbe97c6582b712c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978182, "uuid": "e1a324fa-60a6-43c9-adf2-3906ea12dab8", "value": "T1FF05127572E65933F576003718E0A26E7E1FEA710A5149C793C5793E8B382C24E3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978182, "uuid": "b006d274-4940-4a03-809d-f1ec58c1549f", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978182, "uuid": "cec3f253-e7cb-4675-ac2a-43bf85510ebf", "value": "12288:Tg4roz477H7ePyhORCJUjG/YSnGNtKBYeGE/4fBQLUJF/O2DiEG7:3K47XwFNhS4H/E/4fBS6GYi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978182, "uuid": "9b85518f-b2cf-437a-ae88-8721b72502d4", "value": 825504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978182, "uuid": "b33a7795-16fa-40e8-8f09-571af2420fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978182, "uuid": "6b860550-1e24-44d8-8559-dab788c864a8", "value": "b51efcb9377d2df51a9bd31bfdb540a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67003d0c-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688981855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981855, "uuid": "0716833a-12fb-460d-8c80-ae00457e23b5", "comment": "Malware payload", "value": "fc8af4d22df27ad491e938bda921863f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981855, "uuid": "bf5c1900-0b77-4ceb-8308-9f2faa38e563", "comment": "Malware payload", "value": "c71423649450bf46b189e5a331d98730b970e9c1351e87473270ba6359701c12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981855, "uuid": "0b2b2f25-60a9-494f-a85b-32336b042dd9", "comment": "Malware payload", "value": "d188544ad06a4878c5ea8cf5c439f8fd8f4d7490", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981855, "uuid": "63bc589c-bbaa-467d-8d1f-5098f165fab4", "comment": "Malware payload", "value": "512be5f0fd20d1da77f54afecbc2b71b39c20bb4faeafff85d6b7186385703054370a6926878189d635870450b0134aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981855, "uuid": "1ce36211-b512-4ab2-b9d2-b8d37d95af5b", "value": "T108135C2B129190BECCAFC1746A5AEA6BED33703913B1B11923D4BD366F79E600D5D702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981855, "uuid": "dc41ad95-fa85-4050-b5c5-2f3e087d5f97", "value": "768:u1Q7GmCATBEyhbsa3HoHZuBrzl6xu9oGGV3/93F7k01I6dHHrHZO:DGmCgBEuAa3HUqEx+GV34e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981855, "uuid": "7c8fefc4-955a-4571-b3f5-d64d8c70aecc", "value": 42832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981855, "uuid": "56aa82c0-61ee-4fdb-b908-f2753b48f153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981855, "uuid": "c5d45f70-ed99-4227-9774-65609eddfb7b", "value": "SecuriteInfo.com.ELF.Gafgyt-NI.29321.14671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf96feff-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1688991023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991023, "uuid": "ac3e4a9d-91a4-4817-8e75-c3f7d84ef4eb", "comment": "Malware payload (Smoke Loader)", "value": "9ec50fbe4d4fb8cb1189dec0722081cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991023, "uuid": "ddaf3b5a-c1ce-4ca0-906b-cdf2d83cba30", "comment": "Malware payload (Smoke Loader)", "value": "c862c9ce5cc849f7e292a61984c11b3a61a137f71ce19b3e72b653932602a0fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991023, "uuid": "e8a3ebaa-f6f5-43b0-8486-b9992c86eb49", "comment": "Malware payload (Smoke Loader)", "value": "fc7ac904815d2023536eba30cd89faa856e93d2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991023, "uuid": "41873e8f-3e53-400f-a824-7f9e78cc3671", "comment": "Malware payload (Smoke Loader)", "value": "3d97b5d2221acd8d42e582678f3955ad2467790fb7b60968c36191ba4155b987c9022ad4d60efa99c913e9e68a72ae3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991023, "uuid": "1b0bca38-91a0-4102-9fa0-35a3c66bb581", "value": "T1B5347D1272E1AC61E1665E328D29C6E42A1EFD918F2567DB331C3A2F1B701F1C672B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991023, "uuid": "8fd32140-a9e6-4132-9001-cd9c078de71a", "value": "9d2762e965ff0660272a162800813381", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991023, "uuid": "8882b189-f5ec-4ff4-86f4-662606140664", "value": "3072:jBBmoJaMdE0v7O16WsMAGtMx/Xebf/TkM6JVfwQZKaD4WMm12:60lBTOoYAjXebfrUi2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991023, "uuid": "a14a41cc-2949-4ffc-8db6-13a491ba1fe8", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991023, "uuid": "ac006843-a05f-4093-9ac6-25113c49ff3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991023, "uuid": "703b4d88-29c5-477e-b872-96c9218d80d7", "value": "9ec50fbe4d4fb8cb1189dec0722081cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab005cb6-1f3b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689005162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005162, "uuid": "3d466815-fcca-41d8-b811-b7836cdf2e9c", "comment": "Malware payload (Mirai)", "value": "0e79aa2eec908e03729fee895992a564", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005162, "uuid": "f436fc90-7f48-4804-8982-47b2f88a1598", "comment": "Malware payload (Mirai)", "value": "c8b59d4310a786fd21b88464523eb136340f29dfa19514a314c98a93277f5092", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005162, "uuid": "56070e6e-5d3c-41e3-b00a-9885b3ad01d5", "comment": "Malware payload (Mirai)", "value": "7f4e8afe3ac7e263181adcaaeaa411890ea49a3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689005162, "uuid": "092054ef-89b2-4d75-8931-4646b2104db2", "comment": "Malware payload (Mirai)", "value": "8f7484a5c14b415a2c274c53ea306305b7f06d118e8e2c84f3a71b0bcebdc62e1cd372efb2681147005e794f6fa87850", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005162, "uuid": "55718414-dffb-4786-b3c3-fa653fa4be1b", "value": "T15D432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005162, "uuid": "a379e486-fef1-4fa0-89cd-5c1447fd19c0", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwB:RqtmZPuutfbltZFBSJsBcfDSTFI+BEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689005162, "uuid": "6560a826-2d65-4434-ac40-a85b83626b55", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689005162, "uuid": "46be1d40-ddea-4873-96ed-43f5ff243606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689005162, "uuid": "91319857-a284-4d1e-88b7-4c56c0b9585f", "value": "0e79aa2eec908e03729fee895992a564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a08201a-1efd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978505, "uuid": "0e49b89c-7456-451d-9d34-705d412b7bc8", "comment": "Malware payload (RedLineStealer)", "value": "d595f92fd64f1992f3cfa556a1213f22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978505, "uuid": "a17d6c2e-359a-493f-b55c-3d35506e8500", "comment": "Malware payload (RedLineStealer)", "value": "c8e5cd22f608cd7712cf958f6291ca2c805526763a288add257ebbe986d8c781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978505, "uuid": "2d3e2e04-f6a9-48ad-ad0d-9f20ba74c281", "comment": "Malware payload (RedLineStealer)", "value": "124392b3bb25cae2b99058363094c7fd90f6be2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978505, "uuid": "ad0e9dbb-75e6-47b2-98eb-0e1f217e2c99", "comment": "Malware payload (RedLineStealer)", "value": "1105f9e6d7723adb54079622b06286b76e1aa7b9b65288e75c02be3fd393539ace5f0f44519ff163ae8be8c3dde9812a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978505, "uuid": "4da70248-f7cd-41a4-b777-cb558dd74dfe", "value": "T158B402A071C29663E93304332D90922FBE1BDE7559905B8393C97A3E8B2D1D14D7ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978505, "uuid": "e1eb4006-3741-4ecc-a3a1-d0f9d1ee5947", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978505, "uuid": "23013586-0f4e-4e4c-9b54-5edff22029e3", "value": "12288:EmYOKz47wrn1HjWvKPLD9h4lGsN/J+V3hB:9Y47wb1k4pAHNuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978505, "uuid": "600bd230-e95a-475f-9716-99b4baf7c416", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978505, "uuid": "ba08f7a3-7a39-4def-9b0a-d5a0704b0e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978505, "uuid": "783cbd91-510a-4cfb-a89e-354eae89a8fc", "value": "d595f92fd64f1992f3cfa556a1213f22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65317f5e-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688981852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981852, "uuid": "4b21b82f-9d6f-4824-bc6a-837be40da2b3", "comment": "Malware payload (AgentTesla)", "value": "8560712e92050b126209625784bac522", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981852, "uuid": "edff2e0a-b969-406c-ac9e-9c9d9d5a3f20", "comment": "Malware payload (AgentTesla)", "value": "c8e68f203b9337e1c2fcad8e7e07ef501ed983f5ea597172d7263631d65aad89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981852, "uuid": "e2c6b7ef-adb3-4d57-b35c-2bfd6d266a9a", "comment": "Malware payload (AgentTesla)", "value": "31ace913c80581487089a4ce88a03616cda905ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981852, "uuid": "a8babf1b-f2e7-4c6e-ae9a-9b20b8c1c066", "comment": "Malware payload (AgentTesla)", "value": "8f0dd5dd4a7e4499941dd151440c1c509f1b4f4a25c405a4fd2703b6d3a6d282b0268b7d0d2d0f1c3ef8e88c6a19c3e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981852, "uuid": "474c6ce7-3aad-444a-92ca-89435bf4d9c9", "value": "T164F3286C52C98D11CB3D40B4C5B121585AB2D3BB925AE35F1EB1ECFA3F16383363A865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981852, "uuid": "ea7fc7db-8cf8-4bc7-ae19-0becbb0791b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981852, "uuid": "5dc0409e-5286-4c1a-af52-65a42bac83d5", "value": "3072:m1VaX9IL8+itIZCFLC4MNfFaj4njUj4s0zsW:JXI8+itIUoqj4jUj4s0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981852, "uuid": "4875d293-e83e-449c-a143-7099bdf6bdf7", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981852, "uuid": "70574892-2d87-4b8f-a6d3-6a246045e1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981852, "uuid": "5b07f1eb-f554-430a-b906-0768368d2226", "value": "c8e68f203b9337e1c2fcad8e7e07ef501ed983f5ea597172d7263631d65aad89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b17deb-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962581, "uuid": "deb28be2-13ed-4892-b975-68290ff17bf1", "comment": "Malware payload (Mirai)", "value": "1dabc3ad079830ffa32ff5fcd37afe93", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962581, "uuid": "ed73c42a-88eb-4dac-9a57-fc114b6aed0d", "comment": "Malware payload (Mirai)", "value": "c9423b5d8009453017df831d3d1760d2b4ee6b213a8c3131687b9a7457297cdf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962581, "uuid": "6b901867-4074-4e52-9a80-e319eea26cfb", "comment": "Malware payload (Mirai)", "value": "2ec75faef81cd3878627e430a62d285a4da574a8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962581, "uuid": "85c3a0d5-1e74-49d5-83e8-c86a33e41661", "comment": "Malware payload (Mirai)", "value": "aaa29d6b8393c39fdc9ae5fc792ddf1476ed300a466fe478efc8270157796cbacca92f16e6a709f628f59cc60469f285", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962581, "uuid": "a570e48e-7aa2-44cd-8628-b23057aeff62", "value": "T135E3F845FC518B63C6C612BBFB5E428C372A1768D2EE72039D256F24378B95B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962581, "uuid": "f84409c1-2dce-4184-b8eb-f478f6079782", "value": "3072:3QL9rZ4LE3goAFI84T/Po+Upyf9gVQnV+dU:3QLLwEcu84TXo+UcV+dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962581, "uuid": "7b54e213-9d6b-4a59-a376-7db5fdf70808", "value": 145804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962581, "uuid": "19951cd9-06a5-4c89-9bab-c3e67d57f8c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962581, "uuid": "9c813377-5e31-4993-b799-9ce368840ca8", "value": "skyline.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c2c355-1f2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688997964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997964, "uuid": "fa76188e-5a24-499c-b37e-5a0c63f8f025", "comment": "Malware payload (RedLineStealer)", "value": "508bbdd63475923790bea3020e5f701b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997964, "uuid": "7fbc1f4f-2a42-4150-8f0e-34c962399425", "comment": "Malware payload (RedLineStealer)", "value": "ca3c6a4c08e5fab0105dc5ac39ebfa918be5ad7a2a75d89792e857597b609952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997964, "uuid": "87020b76-f6bb-4bc6-9831-2fe3eb6f49b4", "comment": "Malware payload (RedLineStealer)", "value": "559bf51e0e22583f0da9f117f95f3122ba72a532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997964, "uuid": "1174d5d7-94b0-49c5-9a81-38eab962b743", "comment": "Malware payload (RedLineStealer)", "value": "d74351cc7a3afbaa76663ea50a688ea2b8a5524e0b1a71ded49e81dd2a499cc69804b60dcfb036f536c43ea268efbd2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997964, "uuid": "5cea6832-cdda-4c1e-a1fb-0266e87b8afc", "value": "T1A664C0036EE0FC53E96646328D2AD2E87A2EF5504E59775B22147F3F18B11B2F263B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997964, "uuid": "861e3ba8-5212-4068-8360-a90d18732b67", "value": "89580c01d87da774c9ed352344b8ed4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997964, "uuid": "64b5d188-fa50-4ce0-ad5d-34db4dae10d0", "value": "6144:SOfLDZ+jO+B4nqAchV3CVWWUvYgDAmdRKekT:lf/ZvQ4PchV3CAWUwwn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997964, "uuid": "227961d6-422e-424d-a283-671500f5ddbf", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997964, "uuid": "0326f694-39c9-4ffd-8a47-bca41bc4a5df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997964, "uuid": "c8b7f2ea-7875-47d1-98fa-5943eb68331c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1011e93b-1f31-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689000607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000607, "uuid": "8b3cc27f-82c9-4dd2-9624-8cdbcacee0ad", "comment": "Malware payload (Mirai)", "value": "e250ac03761bb6c197993dece6931fd1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000607, "uuid": "6a67d3f6-6875-491a-8bde-8fe6c7c5e4b9", "comment": "Malware payload (Mirai)", "value": "ca6298703b0304d4826a826c710b08db8784fb9f1663149f3ffc6ed09a8dd342", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000607, "uuid": "7e28165b-e334-427d-bbad-12342f85e723", "comment": "Malware payload (Mirai)", "value": "1f24675ec01e7cb7d8d6a271b90dcff9c1039315", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000607, "uuid": "1f8dcf61-7719-48f4-a91e-61586bfd3671", "comment": "Malware payload (Mirai)", "value": "9bcce3fa047b3167c192237c3e20f4165e4ed49d6cb8a09c21d42acdac2c096e465d92017e33a55e90f94697c6e9395a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000607, "uuid": "17700033-7858-4103-992d-1b7670fab104", "value": "T1B7A2D01572632D56F3ED1C3DC96A8357F9A61BFC90F632B539406620C94D24A3E38A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000607, "uuid": "ab137592-d57c-4005-9048-ebac3f11185a", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjcqwhymdGUop5hj:TvQn4j+ZO5fKAlxIqws3Uoz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689000607, "uuid": "5cbef010-dfd9-4ff4-9bc3-e88abceab1a9", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689000607, "uuid": "701f94cd-9f34-498b-a785-7b9555b87942", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000607, "uuid": "cd75e984-ffab-461c-9689-e3162b520f68", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae07ec1-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978184, "uuid": "db664a9a-2705-404d-a809-9a521d9c9670", "comment": "Malware payload (RedLineStealer)", "value": "8e9f98d2e51807ce732dfe6ee6548820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978184, "uuid": "0fff5ba1-8ccd-4a15-ad3e-7664fccb6fe1", "comment": "Malware payload (RedLineStealer)", "value": "cabae178b3ae05bde4b3deeb27cea53d645d49134a252b971983d9a69bfe1c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978184, "uuid": "f81793a7-0ac7-44d7-bd3e-6dde5a78286f", "comment": "Malware payload (RedLineStealer)", "value": "ffdc9aee33e2a0fdb4e939fedbdd5e8a7a7c6cf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978184, "uuid": "a5e94c94-b51a-4c6c-aa3a-7bfc5c895cfa", "comment": "Malware payload (RedLineStealer)", "value": "a2fa2973f69d4149edff57d83cf422b336550497873bfdfbf59123d4dfedbbee1954a44356b6db716a4f23bbe670ac5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978184, "uuid": "cc6354ed-34d9-451b-9ae9-084f52996ff0", "value": "T1CCC402B075D3D263E172117705A0C22EBE2FEA3119A1568393D9BA3E5B281C15E3DCED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978184, "uuid": "fcdde359-d51f-46a7-9bfe-371f6b962608", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978184, "uuid": "f44f0a72-3d2c-4f87-ab7c-5a045b9bc9a0", "value": "12288:oE87wz47Vaguyuhf9pxxjOO+BZ5fWL/2N0P3ok:+i47Ithf7roD1o28ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978184, "uuid": "b27ee625-5f46-404a-a86f-f8aa33249bfc", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978184, "uuid": "f9073749-e094-4ac0-8a65-e5c8362f0eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978184, "uuid": "ae566273-c7bf-4970-a2ed-5ed8ef10ed76", "value": "8e9f98d2e51807ce732dfe6ee6548820.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ca12a5-1f04-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688981560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981560, "uuid": "693a0df4-39e7-4caa-adc5-24df706de192", "comment": "Malware payload (Mirai)", "value": "d81632b85ba577c6cadc0cac8e32a180", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981560, "uuid": "e98d3ea8-e38c-45db-b65c-c0554c5e9a88", "comment": "Malware payload (Mirai)", "value": "cb31c572163a2e4029e0aee2ceaa7fe4b2633c2ada87f57cd31ddc1e92b69643", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981560, "uuid": "8a174f51-ec97-41b1-91cc-d52d93c3c499", "comment": "Malware payload (Mirai)", "value": "f53b537afb64b0af3b53c66f2633157c382880ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981560, "uuid": "2985c9b5-4c7b-4512-981f-0ab88c4297b1", "comment": "Malware payload (Mirai)", "value": "c6ae3085968579b944157df853268c94af3ed854d13ab4b8e7233813531263312a8aa82f31e78507a203995fa825c6bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981560, "uuid": "1a07e33b-47af-4ac4-81dd-ca5a00dba217", "value": "T169A31856B8819F11C5C512BBFA2E018E331257FCE3DFB2239D206F24778A52B0E67995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981560, "uuid": "3763cf4d-a170-447e-9d84-8a838cc1ea40", "value": "3072:K+MHNAff8m8sF0aHq+2vruP2ZGhfwbZnI3:SH5m8C0aK+2/GhwRI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981560, "uuid": "cd421e97-9cc0-4e3d-8c8b-443b1988dbfa", "value": 99844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981560, "uuid": "0ec456d5-e1bd-4861-937d-8ae37f0027d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981560, "uuid": "4005ef58-5375-4cce-af29-0f3c0b9e49ec", "value": "skid.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3362db22-1f61-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689021282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021282, "uuid": "550f5164-363e-4bab-aa8c-0acf4e872567", "comment": "Malware payload", "value": "af94e663859618d8dac467e61443fb14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021282, "uuid": "2e2e85af-bf98-4a20-bb88-25f6a6c086bb", "comment": "Malware payload", "value": "cb4ba671b15b059cb180964b040a7939dc523d336dc5029655f90e6a8df93f4e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021282, "uuid": "f3b85c9b-dba3-4658-ae51-6158f3e73c24", "comment": "Malware payload", "value": "b1ae69ea6d3838293d921060cbce57d8e76bd566", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021282, "uuid": "8b4caef7-8e3e-4a5a-b9fb-8adc3c490ce8", "comment": "Malware payload", "value": "243cdb905bd9803412fa3eaf4714c9e1628b3b7342d2db39fe938f06177ba973e27d173705f573fc486d008374a1391c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021282, "uuid": "6c7ab164-5d73-420f-9131-292895b6153e", "value": "T1CFD2E686BCA2956BC1D4237BBB6E4A9D737537D8C3CF3B13C8058B50668A52F4D63A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021282, "uuid": "2e780357-55b4-4c01-a5e1-e52146fbe16e", "value": "768:O2KRdOzezjPk2xAG5L+SiAbIVbDV2FuoMIg:abzjPk2eG5L+Hl8Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689021282, "uuid": "70982297-ffc8-47cd-9f4c-0363cce37b19", "value": 30612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689021282, "uuid": "90b8dbdc-afa1-4bff-8a09-df7757a41f7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021282, "uuid": "4aa3eaed-95ee-41cc-b412-67c02eee611f", "value": "most-arm5-20230710-2034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953f2a65-1f46-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689009850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689009850, "uuid": "75a58387-edaa-4d0d-8f4c-728b3bcf3e5e", "comment": "Malware payload (Amadey)", "value": "91ec857d44b5a831bf0011dad05db4f1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689009850, "uuid": "71088ba4-6f8c-45e6-8e28-84969f3d5051", "comment": "Malware payload (Amadey)", "value": "cb8229d199e3e765d34048177b06b98a7030abec3762f86aabd5ef42ff240a89", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689009850, "uuid": "d678e335-b25b-4bd1-92aa-d05440c8fbf9", "comment": "Malware payload (Amadey)", "value": "ccd0bcc86b6d00a886bda500d60c0d27a27bfff2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689009850, "uuid": "ed21bf8b-30a3-4e8b-b601-b583ee371939", "comment": "Malware payload (Amadey)", "value": "b734f537782ae590501025f3d8b71475c19e51e39cef9697a8c0f3397a541bce9d10eb2d7ed2f73b94262f2a1c7efbdd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689009850, "uuid": "b3eed8c2-321a-4d43-b769-5fe34bb82cb5", "value": "T1536523B928802737E030607D8590E52FFE0709F296A44B43EBC77A396B956AE2D7DC54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689009850, "uuid": "8a7048ce-a5df-43dd-a35e-0713bd1efbbb", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689009850, "uuid": "9c5b4da3-6e73-42f5-8f4a-2b6bdf8589d3", "value": "24576:7E47kOUEfJvETlpqftmHioiS+yvk3RZAYBbVTb34k30/8dRi9:7Eq5PfJvExMftmHzO0khZAyykji9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689009850, "uuid": "3de3ca5a-ddf0-4d60-bba4-a32bdcf5f196", "value": 1409856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689009850, "uuid": "57d787c1-2a73-41ed-bea1-48fd305cc71f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689009850, "uuid": "28269676-5d4e-4442-ad3e-4f453060eeb4", "value": "cb8229d199e3e765d34048177b06b98a7030abec3762f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb251b93-1f1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1688991982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991982, "uuid": "4e0ef370-c8e4-4bbb-a43b-c533d82ab3ff", "comment": "Malware payload (Fabookie)", "value": "c756bd728a07726e9e92529b4be0b3ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991982, "uuid": "1f3dc977-51af-4b92-9256-cf32cec9e2fc", "comment": "Malware payload (Fabookie)", "value": "cb9b591fb411abb5ba554f6679775eea77df4b035618f679e5bf11cccf215574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991982, "uuid": "e683ce25-1b17-4b34-bcc0-49428294194f", "comment": "Malware payload (Fabookie)", "value": "32bd8d19833ff2a406befa44b156148bd42f7303", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991982, "uuid": "b60c4b05-1192-4075-8871-467197d27f9a", "comment": "Malware payload (Fabookie)", "value": "49bf8db6c6331b7c16972c561b670b080d8c3373a6def540c2d5e7e01a0d448f9679837746076b45489d9b541eaffda5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991982, "uuid": "324777bd-e6dc-4010-96c7-a1431d59e882", "value": "T155546C56F7A80961C4A7C17ED592A7A2EAF0B8401F2047C703518B7E5E33BF5EA39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991982, "uuid": "b7faeefc-34d5-4cf4-ac32-cb984e36046a", "value": "31e556ae7fe1ed4edcf727f836365d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991982, "uuid": "61c7a620-0db9-4b35-8011-7592a973eb89", "value": "6144:Z8pJxC9ZBkhD5GsFNJdA6NZ+BPFMMUcMUDyu5Wp2i7UdSGZRW:GpJxVvNbp8PViUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991982, "uuid": "64e39db6-2870-4cfc-acc0-328dfab3d112", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991982, "uuid": "d30438c3-c76b-4b47-91e5-79752b92c3e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991982, "uuid": "0cb28aa1-4475-4281-943f-a3fee646f62a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100995ea-1eea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688970113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970113, "uuid": "91512b93-ac26-4935-aabb-d180e03bb8ed", "comment": "Malware payload (AgentTesla)", "value": "2c6fe9d9e55ac92a571988d9d3382ee8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970113, "uuid": "e6b4a9a4-a187-4585-a935-da4551db5bf6", "comment": "Malware payload (AgentTesla)", "value": "cbbf42032230a464fef0879cd80694ac3db6cc98cbf8ad48aa276eabfff3e316", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970113, "uuid": "c1bafc9f-b8e7-48ee-859b-7dda90b4841c", "comment": "Malware payload (AgentTesla)", "value": "db90418222528d04308c934d46ddf14a4e43b0ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970113, "uuid": "600395e4-b2f6-47c4-9d50-8a863e229c56", "comment": "Malware payload (AgentTesla)", "value": "2c608989cacdf261d4f3f99d9ea2fe4d42ab5110450420b967f75302a0b364dd539551f4525808c3e7edd5da0054f073", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970113, "uuid": "0bccf284-2908-42be-99d7-646c59475d54", "value": "T187C4022761A8E335DD1C0FFD2445A48627A81D08AC75DA288D6B8CD6C77AB7014FCBE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970113, "uuid": "00ccf9e4-17ee-446a-b380-c6d210deed63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970113, "uuid": "cbe62830-6ee8-41dc-842f-97004e56523b", "value": "12288:GjuHhvnDdt42BKfF1zEUvmwGp2eYw4SgsOGkpP4GbiJS9+:GcFRtLBMZmWw4SgsRkZPiJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970113, "uuid": "4b6d1229-9c3f-4390-9629-225da4b55515", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970113, "uuid": "ee9cd285-8654-4bd2-9a2a-cdf54a4e6989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970113, "uuid": "b670744a-edc4-4805-a77a-4df15904162d", "value": "4501029752.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcff388a-1ede-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688965249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965249, "uuid": "7b146248-52fb-476d-adfc-5f6ede015a68", "comment": "Malware payload (Mirai)", "value": "100f5a4a0bd535f48c515de1a736fc1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965249, "uuid": "10b5878e-52b3-4a9c-8471-fb5f49b7393b", "comment": "Malware payload (Mirai)", "value": "cc675e30b068638b6e3bd434e443a287795d89fa4bb456837e5a83c2fe7c36e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965249, "uuid": "611e4d55-c794-46bd-ab96-19aba9cceb84", "comment": "Malware payload (Mirai)", "value": "e32cf2ae98527789dc26e3db8ac4ebdcc6bf96cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965249, "uuid": "b5b5b230-4480-443f-ab37-ba396ff98006", "comment": "Malware payload (Mirai)", "value": "7e9fb739ffc75b005063e52221e14f9fa99dc2e384cace0d1ffbe4e3957e3988c7757db302a25204d21265b7f0e8c2cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965249, "uuid": "1950a696-bff7-41be-a0d7-20c0652ee06f", "value": "T1D003D785B9869A07CAD4537BFA0E42DD3B2573C8F2CE3313DE162F51368A92B0D6B145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965249, "uuid": "638f610b-b739-4f23-9638-7ce43c6231f7", "value": "768:R8cgPbzj5HoD2ogElo5fEFn8fuP5KZ7mrLIZUI:Gcg8oDfnfuxy76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965249, "uuid": "baff27ff-8739-4141-9035-a697eadd8b22", "value": 37884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965249, "uuid": "bc0e8bbc-3dde-4e7e-b758-9c9ce8c7e449", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965249, "uuid": "3b039c84-b3fc-49f6-924e-dc18ecc2be6c", "value": "100f5a4a0bd535f48c515de1a736fc1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b72c2ac-1f62-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689021860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021860, "uuid": "4bb49e0b-72a0-4840-863d-1bdd03d5c572", "comment": "Malware payload (Amadey)", "value": "56c308d5a44d9a8f2f024c0490e54d1f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021860, "uuid": "e290fcf3-b5f2-4ed5-aa6d-b2b05a22015c", "comment": "Malware payload (Amadey)", "value": "ccc698730af26e8c42b7f6eb168a1f01df42038554d20e6f1297864f70cf720b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021860, "uuid": "2ae46c7a-f302-4458-bffb-3932b549f5f7", "comment": "Malware payload (Amadey)", "value": "2924bc61aa94dfbebfb88907105812bf4577d4f1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689021860, "uuid": "cdf086f3-2357-4eca-bb18-580e1cac9d24", "comment": "Malware payload (Amadey)", "value": "a79bdcbe356a272c799412c126ec2297c025bdb4cf9121ee15c3a2f763f1e384627fae0de9d41492cc5238bfc3346fc8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021860, "uuid": "ce258e6f-0850-4c77-b877-59f4a879034b", "value": "T173152213AAE89076D8F86BB008F202C30336BCE16C7D865A6366694D3DB34D5E57573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021860, "uuid": "c22a8cdc-006c-4801-a0a0-fc9118914307", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021860, "uuid": "e72fcff0-5d01-447d-b456-6e99c0b7f5ed", "value": "12288:YMrXy90+x/HZqhshkPt8zX+gINwu4eW41sDwfX4epti4yqZrSMykEBoDAN+j/:PyVZRe87+xW2WTDD4yxWEmD5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689021860, "uuid": "15062c5e-9506-4643-bf51-d6664bfc80a6", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689021860, "uuid": "c8620f4b-5888-4918-8ce8-5552c7fd840f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689021860, "uuid": "99f1704e-20ee-49f8-9562-944cb147a5bf", "value": "56c308d5a44d9a8f2f024c0490e54d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586f22ce-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985696, "uuid": "fe36264a-af42-4bac-84cd-74a7cbfa7b72", "comment": "Malware payload (Mirai)", "value": "700e6894e0aa1b5ccad724264d3a3583", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985696, "uuid": "b5cbf079-d484-4f09-97de-eaba5f4ef47c", "comment": "Malware payload (Mirai)", "value": "ccedf35643887b988b6a6222ad18b306f32eb80b7056cc850c27e82919e3cf1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985696, "uuid": "5c36f168-b5d2-4c16-b68b-c7674bcda390", "comment": "Malware payload (Mirai)", "value": "b1f39170af8ef05d8f6aadc31b147772014bb4c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985696, "uuid": "53ea536f-0819-488f-9076-e8c980daa6ff", "comment": "Malware payload (Mirai)", "value": "a626236f01337081418e981d48ce7d80a780fd164d4c2fd7354d059eff4cdf0eea2d4b29ae20693d1bf8da1bbbab3d1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985696, "uuid": "4a7e50b3-00c6-49d0-ab34-080f78d355a8", "value": "T15BF2E15087710C15E9F41C75DEA4AEC08F182AB474FF30A116F99298B84634167EDE97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985696, "uuid": "3428c78b-1031-431b-96de-04b1b8020cfc", "value": "768:AmNWoMZCHyHz5PPqy2TBO8eq1oD9q3UELQK:AQKZ1T5qy2Tve2rLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985696, "uuid": "4e399bc2-2449-4a1f-8c99-2a6ae825b5ab", "value": 34888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985696, "uuid": "bd770819-c2f1-4376-b12b-4bc98013b7d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985696, "uuid": "ade0a518-de0b-42c1-9f6a-398dc7c1dc55", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.1.5373.1967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f977a738-1ee4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688967928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967928, "uuid": "cae59f71-bcb0-48b5-b621-b2e7bd434fd2", "comment": "Malware payload (RedLineStealer)", "value": "0c4ba5aa45151ac0ec7c66efe0442be6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967928, "uuid": "f19e3c0b-0a72-4338-b8ea-2f1d8c433044", "comment": "Malware payload (RedLineStealer)", "value": "ce250dad812a4f50c7236d15c462ef6a04059503bcc77b87f9bea08e72d43193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967928, "uuid": "5c6ff557-9f5f-44bf-a200-0322419291de", "comment": "Malware payload (RedLineStealer)", "value": "7517bde1c9de30dcecaa486cfd085008d5eb608f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967928, "uuid": "c0fda53c-d5f5-4086-b624-4c860859e7be", "comment": "Malware payload (RedLineStealer)", "value": "d4e3c409ce4d1afe9c8f09aee1f4cfccf71112114ff4e1cc5e667061b7700590e7cecb063a66bc83a283b84b38b675d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967928, "uuid": "8e2e8061-d0c8-4114-8216-98a57e082d91", "value": "T164C40271B1E28623E47355B319A0522EBE0FEE214990978393C5B63E4B391D15E3EDF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967928, "uuid": "00941f06-636a-49c0-b1d9-ae09b6c5e231", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967928, "uuid": "698f90b7-9cb6-4c65-a558-394e5f7553e6", "value": "6144:hUSoUTLvHBhuGCWGYLUz247gL1trR+fY25PB724B9m7IZJFPcMgqNYySJwlFTOew:hU8vHz47e1ttz2z724+7IZvrNKPJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688967928, "uuid": "768a6e18-ada5-4af1-bed4-adddc2665059", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688967928, "uuid": "3b732c15-f134-4fd0-8343-b567b0ac24a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967928, "uuid": "2fdd5dbe-3ca8-476f-8c76-b1206cd67aef", "value": "0c4ba5aa45151ac0ec7c66efe0442be6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122cab4c-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688991162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991162, "uuid": "aa672b13-5dc7-4657-9f3c-d77545405fca", "comment": "Malware payload (Amadey)", "value": "a4f69cd57334be49170c7ab894dac316", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991162, "uuid": "7f641793-f059-49ee-876b-32efc34a577d", "comment": "Malware payload (Amadey)", "value": "ce9bc4c07bfce620e04a7e34b47a6ef3d58a2dce348fdbf83068a195545c31a0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991162, "uuid": "67bac3e0-7a0a-4bc7-adeb-47e73d38a27d", "comment": "Malware payload (Amadey)", "value": "5acbada37417214ec2db8feaae5e203b085dffdb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991162, "uuid": "90b4300b-42e9-4bc4-94f6-12e5eb7680c9", "comment": "Malware payload (Amadey)", "value": "563f268b2a047eafc69fc97e9cff154b662677c879146dc82f1f00c2eb0bfc1524741e252ed52e5a323cd3bd1d466d42", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991162, "uuid": "ba3fbc38-0b90-4390-a0c1-1b7397c64af1", "value": "T18AB402B0B1D28423E672553325A0825FFF1FDB3219505A9793C97A3D9B281D24E3ECAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991162, "uuid": "7fb2b5c8-350c-43b2-886a-4070dea69c53", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991162, "uuid": "bfdf2b6c-e2ea-4a50-807e-54bbe795fdfe", "value": "6144:eWPD0GqUHBhiCWGYLUz2474VWNI/IzUuWVzvomUzx0CexpW3TTIvuEiEdThIpSqk:eWY+Az474Vn//ofzhD2D38A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991162, "uuid": "4d9aec1d-81ac-401f-a6e4-2b206aa7dd32", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991162, "uuid": "3ed2f22a-9acc-48bd-8765-84f22232e5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991162, "uuid": "12f841fb-6950-406e-8e07-e7874f1be896", "value": "a4f69cd57334be49170c7ab894dac316.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479a2dd5-1f47-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689010149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010149, "uuid": "3d51d107-28c8-4ad9-8eca-8b0b605482e1", "comment": "Malware payload (Amadey)", "value": "2c52c514ed30a21dbfc181f9a56e756d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010149, "uuid": "bf668e73-373f-48bb-9d6a-591fde1a6093", "comment": "Malware payload (Amadey)", "value": "ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010149, "uuid": "6181c9d4-cfc3-413e-9d5a-2d059e0fbc56", "comment": "Malware payload (Amadey)", "value": "251cf6719d43e1fd2c52df211e76b8644c3cd2b0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010149, "uuid": "5cf614a7-fcb3-49b1-8438-8922d7be00f5", "comment": "Malware payload (Amadey)", "value": "7b7ac4afad13b36eb20acf85eef8429911f1c5c414e91c928b606987b4382378e5adab2a5569da717fab81283ff764c0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010149, "uuid": "44d4df94-5e40-4def-9c2a-1975cf03b9e6", "value": "T15B152207B3F49061C9B5177055FA2B932E35FD506A79E22B2754961A0CF3B80AA3373B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010149, "uuid": "ccc6f776-211a-4a71-8823-6a71cb3f1709", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010149, "uuid": "59cb282c-8693-4108-970d-842760f6eb2e", "value": "24576:5yQ6k1XlUuV6gbsDRA/vTXLp3qiwikDLDJtgYBNSu+KpEFMe:sQ6knTs2XTXLpFusYKu+yQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689010149, "uuid": "d06b3bf1-539c-4980-b09a-0c3b7c6e68cc", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689010149, "uuid": "faa925ff-38f9-45c7-bf35-b29290052012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010149, "uuid": "680f39f3-d3bf-4c5c-a7ff-4bbd15788ee4", "value": "2c52c514ed30a21dbfc181f9a56e756d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c1fe7e-1f1f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1688993233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993233, "uuid": "1098b6aa-55e3-4c07-93b1-85b76f9ace8a", "comment": "Malware payload (Fabookie)", "value": "a0d8a8e105e65e319db5396515faf94e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993233, "uuid": "ecc5dcf6-7483-479b-ac08-45dc812b4d78", "comment": "Malware payload (Fabookie)", "value": "ceb1651df489067a66c80b1c3cd1f22133b24b0b02a8cdb78150b51bcface64e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993233, "uuid": "b2d682d3-85fa-4a79-957c-97aca708c266", "comment": "Malware payload (Fabookie)", "value": "edee0be06d833a0f3c7782ac1e6902589e1313fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688993233, "uuid": "7c1c8259-e9b5-45ef-8001-7c7dadbebabd", "comment": "Malware payload (Fabookie)", "value": "6b4bf2fcea122cf515b8ea3d7f51fde84725b91d87f03c180feffc75bc55e1f2c6af4bccc5c17ccb11eb59c06503cac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993233, "uuid": "f2d1eb4b-dfde-4808-8696-5a0b9f2a259b", "value": "T1E6546C56F7A80961C4A7C17ED592A7A2EAF0B8401F2047C703518B7E5E33BF5EA39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993233, "uuid": "f65b926d-54a9-489d-aa3d-3e4ec178256f", "value": "31e556ae7fe1ed4edcf727f836365d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993233, "uuid": "2bd2c98d-fab4-4d2e-8e0c-a5a6b826509b", "value": "6144:Z8pJxC9ZBkhD5GsFNJdA6NZ+BPFMMUcMUDyu5Wp2iDUdSGZRW:GpJxVvNbp8PVqUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688993233, "uuid": "4e403eba-1ea4-403d-a631-876c7caab918", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688993233, "uuid": "bb25dc9f-7895-4d4d-acae-32ff431a649b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688993233, "uuid": "71bc3072-8057-4490-b756-255813882074", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77eaa803-1ee9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688969858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969858, "uuid": "2a7030dd-624c-4f17-a526-17979109a22a", "comment": "Malware payload", "value": "d79cb033111b69e98e6b8bf804a44d39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969858, "uuid": "291c2c23-c7bd-46ff-8d92-a42df250f4b8", "comment": "Malware payload", "value": "ceda1c6ee001d408498455bd2e13cbee14e99aef2923e76984dcd736e8672b8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969858, "uuid": "7d43f045-1927-4219-a1b5-2babece456ab", "comment": "Malware payload", "value": "d4727955b8768755f5797358095aeb051ad76191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969858, "uuid": "cf6f2ee5-e3cd-49d5-b129-d2a4c9830d65", "comment": "Malware payload", "value": "f1e7cb8c8e4a3ea8e021423d92d8d7d80477223be4294569b04a608357e9634d001fcaf0ef969029563aedb3719d94a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969858, "uuid": "ec97a2c0-4eda-4e00-9bfb-e18f93ff4785", "value": "T1B1050162B2D2C471F47316B08DB99770A5B9BC6C5674840E77D03F2F7A723A29622B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969858, "uuid": "6e1df57a-3391-42b1-a92c-5819817a5185", "value": "3eaa732d4dae53340f9646bdd85dac41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969858, "uuid": "efeabd05-b5cb-465d-bebd-8eb0e98e4d2c", "value": "12288:7RWNcr8oxnFEAmDAmSuW+3ULMPIxtVatCmbUdN0gCtrQBtsteCG5B4wYQexvVnVj:cNBIFR3+nPIxz9WUEr+tEy4wYLvVnocF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969858, "uuid": "ce41209c-24af-4003-b590-a2b2e907835f", "value": 841774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969858, "uuid": "ebc0f950-ee0d-4056-81d6-73b8ff53a959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969858, "uuid": "30512c06-d985-4f29-8be6-f81954572644", "value": "Demanda Civil.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c9a27d-1f04-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1688981477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981477, "uuid": "58392f77-0edb-4ba3-9c5b-f8dd11b805d1", "comment": "Malware payload (Quakbot)", "value": "dba952c6b2d44a17e9a1843989393e08", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981477, "uuid": "0c347c8f-a83a-43a0-8174-4db447d006cb", "comment": "Malware payload (Quakbot)", "value": "cf5295f7c653e106bcf8367feb1daa26144f94e7721f0840d2c61f0ec7bd33c4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981477, "uuid": "4ca0c15f-eadb-4255-bd60-9e12dc0964ba", "comment": "Malware payload (Quakbot)", "value": "c1030557dae9544507fbaa9969804efaa6fb252d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981477, "uuid": "cbc9bd8d-8f78-4906-bfc5-2d4dbb7bede5", "comment": "Malware payload (Quakbot)", "value": "0f039dd2f900d72996f56d470f35bf97ba94abad8fe305dedd59f5bfd2aa2b996dc93b952a4f2fceff3fcebe29fe2845", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama271", "colour": "#B0CAA0", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981477, "uuid": "dadec59d-fca6-42d3-beb7-1e03cb6167f0", "value": "T1A874496654C2F860431BF779623FE8CED1BF0A5049880C5BD0686EC0976DF66E9F58B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981477, "uuid": "ec0bcb10-e99b-4d92-9838-9a2cc05e1259", "value": "6144:bcFYID3OLgu44c/3F1amoAk5MuXvCG8YtnZ5936:fIS1xb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981477, "uuid": "4bb0f9b2-c8bd-4526-9ec2-ecb7487bd8b8", "value": 350611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981477, "uuid": "e61edbe7-2672-492d-8997-d5769520cdd1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981477, "uuid": "cb1110c3-68ef-4106-8630-0f7fad4e5f19", "value": "BSN-1525063912.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e0fd68-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978201, "uuid": "7828e9d6-5dff-4bd9-b19d-7bd229d2e599", "comment": "Malware payload (RedLineStealer)", "value": "f42dd1c2758f16790b1dc48fa4bcf1d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978201, "uuid": "8f47084e-a3f3-4bfb-8454-6b2792566329", "comment": "Malware payload (RedLineStealer)", "value": "d141600de28f4961f7bd5d8c31fe6f197655c9e777fb4094f4e6d57af7c38c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978201, "uuid": "d4100e82-88c0-4cd0-af05-9ddbba84f0cb", "comment": "Malware payload (RedLineStealer)", "value": "d027f3bdb33c941241a7533128042e80467a9bee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978201, "uuid": "c7df7aac-a440-46e8-b256-ddf5ecae5253", "comment": "Malware payload (RedLineStealer)", "value": "9ea7f3261a19cf4538825ef94be198333808b5fb6aef18024cfef667d2ac03fc88af7f7d06639ceca704fb74f378e7f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978201, "uuid": "8b9745fc-e580-4df0-9b6c-c9161d36b6ce", "value": "T19644283921E144A7D8BA9E35BE4BC0D17116AEB4017C541F3FB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978201, "uuid": "4f63188e-aed0-4d71-a422-e8f6a0376dc8", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978201, "uuid": "fa12bd2b-df44-46eb-bd90-63b73ad3b34e", "value": "3072:DsGc+iOHMwew7+picM/LsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:NcvOswD7CVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978201, "uuid": "e8288855-da93-4d08-9578-8395e0ef76ba", "value": 272550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978201, "uuid": "c47b7d78-0621-4846-a59b-d56931f41e92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978201, "uuid": "7f04afa0-3216-4708-904d-1dc5d6e9d60c", "value": "f42dd1c2758f16790b1dc48fa4bcf1d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9695af3a-1f25-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688995679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995679, "uuid": "280d608f-ba11-477c-933e-c6db3547fca5", "comment": "Malware payload (Amadey)", "value": "97aef4bee439ccbafa4880e46e5ac44b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995679, "uuid": "cc2cf8a6-f99c-4a83-b1c5-1a649b5abedf", "comment": "Malware payload (Amadey)", "value": "d18203d25bee6c7a5505f4da2c5b31893bbfc1b9fe971ba3e8458557473e702f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995679, "uuid": "aa8e877f-a75e-458c-85b5-c180a636b514", "comment": "Malware payload (Amadey)", "value": "4dc61a3040fc21cc02163ff56b1caf178899f21d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995679, "uuid": "b97c206f-178d-4f1c-a0ed-fb03ebe2d6ef", "comment": "Malware payload (Amadey)", "value": "aeab90eb2b8131a755d711c7853b3349c11a77663f7dd067dc38dad77dbd3d93962f22a87edb4cdaf0b21952289503e2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995679, "uuid": "3932ad66-89e1-4a35-97ac-3251a46fbef3", "value": "T134152322E7D48076E8B523B148F923C30B357CD55DB8A7AB23C1AD4D0EB23A594B2757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995679, "uuid": "61f0b5b1-b7ea-48de-8efb-5f37eb3cf1b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995679, "uuid": "ecaccbdd-4dec-428d-ab9f-d1daba604e73", "value": "24576:pyl3Z/J2olNQQf894iLD7kM7g0Fv8VNHdR:cXZlNa427Q+vqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688995679, "uuid": "fe77256e-d5b3-4fb9-8a61-d6612288e5dc", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688995679, "uuid": "4cecf27e-3ebc-4dbf-9434-b9ffc9a79e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995679, "uuid": "6ef7448f-0a4a-44e2-a0db-80b864c7bc0a", "value": "97aef4bee439ccbafa4880e46e5ac44b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32726205-1f34-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689001954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689001954, "uuid": "22c3278c-9c2e-4e26-88eb-71db06019a48", "comment": "Malware payload (Mirai)", "value": "7ea3ca3d407f533f8db36d15f71eb993", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689001954, "uuid": "c2625e90-7d32-436c-b2fe-082079eea839", "comment": "Malware payload (Mirai)", "value": "d1a8b0d669e0269007e565620bf71ba6b7ac2b89d4eab2253a69049ae0528186", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689001954, "uuid": "7152ffc2-5883-4c99-94d6-fa4d540f82e1", "comment": "Malware payload (Mirai)", "value": "4f1e9eb0526d33f1ba71a0e381e1c620b948d07f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689001954, "uuid": "1a042f50-def1-405d-91a9-8b0a845e8910", "comment": "Malware payload (Mirai)", "value": "403d87314365461985b9e9216a0d6279e01644abf10b1a7272c046c57741ed21bc7875957164b9f4d6a4a2e0a77d0208", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689001954, "uuid": "88140528-824f-45aa-aa1e-004408c4e8ff", "value": "T1CD82CF30629B74F5CBE24430EAAECEC6971A0BFCD1FC369317596B78894650611F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689001954, "uuid": "66640b49-e4af-44c9-a186-4da0354de4e1", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMajL7hymdGUop5h5lE:2dV0P6+kom0tVAoNvm+to137s3UoznlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689001954, "uuid": "21db44b2-2473-4ac8-9059-1ad4de0c2758", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689001954, "uuid": "bb14a754-765c-45f7-82db-727b5cc4d998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689001954, "uuid": "fbc6bf70-0608-43c9-a932-d6e9abe7e2c7", "value": "7ea3ca3d407f533f8db36d15f71eb993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacf2179-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968225, "uuid": "72d8412f-bc05-4ed8-8e12-64f11d6657dc", "comment": "Malware payload (Amadey)", "value": "0c5508f18632a2b5be6894a1b8f57a90", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968225, "uuid": "db3da1dc-0b66-4568-82fb-012050708092", "comment": "Malware payload (Amadey)", "value": "d2005f7e381fe8158f06f44fa23887a7ba9eb78f54f72f80ea466914fbf00e4e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968225, "uuid": "be6cbbe9-9d0c-4f23-beba-8ac8b5a77d9d", "comment": "Malware payload (Amadey)", "value": "998c87ee971763ee6e45ae91ca577ee221d31a01", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968225, "uuid": "45d3c223-092c-4902-9c43-4478e35b2541", "comment": "Malware payload (Amadey)", "value": "15279224c0a70be594ef5d2172cc4096205b09e27eed6fe1f0ab0b151b9c1764b278e9a439c11bad96d838d32aedc31d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968225, "uuid": "20e88ba7-b874-42bd-bf6b-01cd97e5165d", "value": "T1E6B4026171E38923F57214731990922FBE1FEA7219A18B8793C5793E673C1C05E3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968225, "uuid": "77c44499-f282-49aa-bfb1-17aa14bde33f", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968225, "uuid": "4965c60b-e7c2-4d61-8053-885250ab87b9", "value": "6144:Ok7/YCVVHBtICWGYLUz247EKYYsKAjFIxtwcFgOyQn5Q8Nn8FXLJ0za3S6H:OkUmGz47EgIFuFgOln7NngXizA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968225, "uuid": "8b1306a6-0580-4805-8437-f50fc040e25d", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968225, "uuid": "e7b9432b-0223-4e04-85e1-82d3991fbdf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968225, "uuid": "2b11952b-9c19-42ce-a6bf-c51d48473007", "value": "0c5508f18632a2b5be6894a1b8f57a90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f7c67d-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962577, "uuid": "42b9c6bc-1b5e-49c9-9cee-a13c7cba4b16", "comment": "Malware payload (Mirai)", "value": "f83fb5310ef317209cf9f3735c8db893", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962577, "uuid": "84be8880-c0d4-4dbb-a62b-76afc0e33eb5", "comment": "Malware payload (Mirai)", "value": "d22cc8307da44d5c35355e78092b6b5b977ef182977cf5ea2cff45460467a688", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962577, "uuid": "cad8ee1a-dcc3-4f0d-a62d-9a76720bac68", "comment": "Malware payload (Mirai)", "value": "98420dbb650413572f9afab5f11d4ed3ff49c2fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962577, "uuid": "437fb588-94a5-45e9-be84-576168362be6", "comment": "Malware payload (Mirai)", "value": "23595994b4f8bab819287d3adda726b61ba36b27cfcc432b09ef69f8604f63938bd37686725daab700431f2045023a6f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962577, "uuid": "83a594e7-fae1-4a18-9a2d-26cfc3b4eba5", "value": "T183E30856F8819B12D5C152BAFE1E028E33131B7CE2DE72029D246F647B8B97B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962577, "uuid": "ebccb00d-401e-4112-a3cd-092455d7a282", "value": "3072:6mcO+MrUqldAhXyXq6YrDLa8aH9rk26LR4CosPwLpe8:NcilghXya6Kna9C26ils4Lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962577, "uuid": "1a6c8f64-cde1-4c09-848e-90fc4b6c4fdb", "value": 156304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962577, "uuid": "67ec02cf-6428-42fd-aa50-077f3d2aa375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962577, "uuid": "6283d065-86c8-4f06-ae9f-f5ca1dbde766", "value": "skyline.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d81bb1-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978035, "uuid": "2b47bed6-6204-49b0-af3d-e9cc983a1cfe", "comment": "Malware payload", "value": "fea7b4c5f00148e4775e09f32fa9a822", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978035, "uuid": "d83f8110-49ac-4b6b-87ae-d17902c7af12", "comment": "Malware payload", "value": "d2c669a8e2cf972cfec81ed86636dcd88b69e0cc9e888047263c7fa4ea717639", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978035, "uuid": "415652f8-7620-45fa-ae7f-9b6e4498e50a", "comment": "Malware payload", "value": "33b74c9dd9cfa3c5cbaaefd9ff4368948fcd8cd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978035, "uuid": "e9195011-e065-4815-9c98-f6b7609f07c1", "comment": "Malware payload", "value": "3c82e82c0a2b9b1a1c2fc631ecda766ce19c8571857f006aae2752b56d07211981693bbdd4d9d52581bc7a49cd4c9f02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978035, "uuid": "4609202e-6d27-4e95-ab59-45970ce03039", "value": "T14A23FA88FD55A22AC7D162BBF70D03CE373B0768F3DA32129E355B2137C6A615A3A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978035, "uuid": "af739693-b9ef-4ac9-93ab-3977613cd649", "value": "768:pK4Ybv9Icv6XeRczzG/ACowxMU1pF0POGr12rD32zoUVq+wmTnvbI:SvWtORg/Cq4j0POGrw0d9Tvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978035, "uuid": "af195728-e22c-4681-a656-089667f3615f", "value": 46408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978035, "uuid": "7f8c3073-d82a-4ee5-902b-e35fe0ce4598", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978035, "uuid": "e40aa644-dfac-4f97-94f4-268591e9c61f", "value": "SecuriteInfo.com.ELF.Mirai-CE.11903.1958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2763c7-1ef1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688973356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973356, "uuid": "c37a30ee-cebd-46c3-93b2-b889667dc3ee", "comment": "Malware payload", "value": "60c04998252da6637f90410da8fb0a99", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973356, "uuid": "86a38612-03f6-4ff8-ba69-1dbcd5cd89ff", "comment": "Malware payload", "value": "d616e51c97dfd25932e40ebca3de7a600928153e9250b2a8060723a77fd6a7d0", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973356, "uuid": "71066fae-8aa0-48ff-af02-5a6f5221da7f", "comment": "Malware payload", "value": "6ff82e8a85316a70ffdacdf20bb0f355dceafc66", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688973356, "uuid": "51697ee3-a0f2-4649-bf39-e04e47fd8409", "comment": "Malware payload", "value": "1e71b429d45d262d64cf6bd274cc1a017b6905246705cbac8317492e7a76d25b924854609cee4a075f07cf5057e2b4b1", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973356, "uuid": "37710559-fbb8-4d12-a39d-7cdb5f1dec82", "value": "T18EB4237E64D825A33972DD448E8CEF21B39C42D18895D30065BCBFEF85E16848D27E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973356, "uuid": "65ad7e73-c408-49d0-b483-66bc8f74795b", "value": "12288:Y5BmHOCerAbyOsYlVP9jTtL4WOVaDNc4oFpS1bzHGVij/8Dcr+1:YnxC8AbyOsuPth4WOVAoFpSJHGVg/c6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688973356, "uuid": "fafcb5a6-0063-4773-a504-3ec88fcbcbe9", "value": 521677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688973356, "uuid": "b8d22cf4-6664-492b-9fb2-40379b44a732", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688973356, "uuid": "844488aa-de9b-44c5-84e8-a216b298ba91", "value": "DHL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f87024-1f33-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1689001745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689001745, "uuid": "df59d561-229d-4184-a5b4-57e81d88f537", "comment": "Malware payload (AgentTesla)", "value": "5d6587016908738d163aaffaa88946d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689001745, "uuid": "a75edb63-2381-4531-af04-68abad3cf375", "comment": "Malware payload (AgentTesla)", "value": "d628b5f0140b53d01b46c6bb1dd3dc7a028cbb1ebc6ed53a949d140dd57b485d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689001745, "uuid": "c7a40287-6f88-4a50-99f7-a02d54d6de8a", "comment": "Malware payload (AgentTesla)", "value": "14d0c4d8a27637c7e3bdccbf85976f6ad74189b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689001745, "uuid": "719295d1-9976-482d-b832-f8aa2b49f03e", "comment": "Malware payload (AgentTesla)", "value": "d01dbc1ae2ffbc29786d1d9945e786bbdd1c38d5bac7d0c6ed10127522eac83262e34acf2e3dc0e20a167d588ea8008e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689001745, "uuid": "592b2fec-df36-4d58-8b17-991a9f65a3b7", "value": "T111327D3AD9C82BEED30B107780B93504F6AC789352299F0E7A30E566C5755CEFE00AE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689001745, "uuid": "9b03bb87-6047-4dd7-a2fa-be2b24a8f1fd", "value": "192:nya0NxOcAWBARgZVPCK44AG9xXSJ+Ej7hJYbKw2K3e1WYjcWeZ7Zzl:nyXxOcAWBANK4499xXSJf7hJYb5VYj4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689001745, "uuid": "d7796015-e1bc-465c-8bd8-d2a86a2a6037", "value": 11084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689001745, "uuid": "12abcae1-795c-4a6a-9dc1-b75169f61bae", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689001745, "uuid": "a7cf6da2-320e-4bd0-8442-0613606acb47", "value": "PO-071023.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34aa35b6-1f12-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688987354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987354, "uuid": "8a43f04a-25b4-42ed-8518-60aa51441ccc", "comment": "Malware payload (GuLoader)", "value": "c7fde6e1eaf7c691079ec36a0cbf7abe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987354, "uuid": "de8d8cd9-1720-4125-89e3-081c6610e13b", "comment": "Malware payload (GuLoader)", "value": "d75c6300a7db46a94eda087e3034608a13befbaab2f306e4c34a2cfb4b88f5c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987354, "uuid": "5176b579-ebc1-4c26-bd91-be4fa9748eee", "comment": "Malware payload (GuLoader)", "value": "bfc774215a1df2ee860cd8d5d131dadbc7e7763a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987354, "uuid": "81380b2d-8927-433f-aee6-8fc9a55d8f84", "comment": "Malware payload (GuLoader)", "value": "1e109dcd1ef8d3dedd0f5a9370eb77a82677b6618620d268127dbd5699afc8471ef0a11743a0c270023d56f9b03d64ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987354, "uuid": "49c1629c-a429-4f56-89bd-1a175514c41a", "value": "T17A541297A238CDA7EA3242329935936DB2E79C1865B48D0743703D0EFDB12D1E51FA61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987354, "uuid": "7218a127-f16b-4725-9653-377cea3323b1", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987354, "uuid": "f406053c-f5c7-4d87-a922-7fc6318c721f", "value": "6144:kT4DtwaWeUWsvrswamdZTuCMieKz5T/2gSo2hk40ex:kTLaWeTsvrUmXRumT0o2jx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688987354, "uuid": "4c49e2be-7ac9-4037-9960-9223dc5f5617", "value": 284977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688987354, "uuid": "b5caae44-e14c-4fda-8840-6398e965819a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987354, "uuid": "f4c3ad1d-d119-4911-b1fa-9d9848fe87dc", "value": "ORDER HNCWA2069528-MEV BILOM DECOR LIMITED 48591 SUNRISE POLAND 839271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792b3866-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688981886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981886, "uuid": "0eb08788-4d0d-4f8b-aa69-98d9bc840d8d", "comment": "Malware payload (Formbook)", "value": "d02418d46ff3f56818601351fd857a1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981886, "uuid": "e496d5f1-fde8-48ee-9313-62c2ceea7c39", "comment": "Malware payload (Formbook)", "value": "d7dc562043640713d90764ada278ccd53dcd9c727688934a7495a0d11b47bd3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981886, "uuid": "58c164d2-4456-4076-b364-c2f89116ce73", "comment": "Malware payload (Formbook)", "value": "330488f85a1662ddb371e596031e98a6b2316e86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981886, "uuid": "38829fb2-d2a4-436a-a036-6e9adce74622", "comment": "Malware payload (Formbook)", "value": "2f59c17037c8890143107bb344ff8e847e69a2a9d4868771ed4216fe5576eeac56e537377df67ce88917a59c3f2c913d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981886, "uuid": "5c0de89a-0e49-4d72-a2de-f8b8b08de501", "value": "T165D46B3C1CBC3223C174E6B28FADC461F650996B3E658E3B65C39959071E90269C7E3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981886, "uuid": "c2b3c824-c515-4876-8a59-bf0b50e7dbdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981886, "uuid": "55f7ffd7-2ad8-40e2-adc0-0ae9c9c721b4", "value": "6144:HjKR2geL3C9QNRHXkxCI5rPBkwyFB/WKPson2l5SqntUvaEYUjPciCyRyoc97Swa:lPgKDJjPtCyckwLy6JGo3DIUKdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981886, "uuid": "6d993f55-d692-40f2-addf-5e202e77374e", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981886, "uuid": "d408f3c7-6a21-4dfe-a7eb-f95c8849ba9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981886, "uuid": "8f3f4685-35f8-4233-8b45-b25de6cdabf0", "value": "SWIFT 2701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2095a6-1f17-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688989647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989647, "uuid": "a3860205-4570-4cba-8cc8-3424aabeb316", "comment": "Malware payload (RedLineStealer)", "value": "e3ed3fad0f285e38a8a07319ebd81c34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989647, "uuid": "bf728ca9-b982-42e8-b4fd-2d2f8d779f1b", "comment": "Malware payload (RedLineStealer)", "value": "d7e549998d7972f0632ac70615d6d8beeb4c367924c56def8dd2bc94a13f3989", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989647, "uuid": "b44ef765-c052-439e-98e5-3ef940511007", "comment": "Malware payload (RedLineStealer)", "value": "a277e5a91d58678a852acf8f3b991f0787b98755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688989647, "uuid": "ee406e7b-dd5c-4cbd-863e-f119f1c5eb1a", "comment": "Malware payload (RedLineStealer)", "value": "37d3c4fa1ff2bbf4c80de3f616ad275e30f9b1f7ec86e6e9dfde08abf448b78b79955ffa4c80f055353cc59026f0ce91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989647, "uuid": "06e333f1-4f13-4b0f-b39f-1a147b14dfb6", "value": "T1E5C4026476D39A33F57204772890521EBF2FE93149A09A4393C57A3D8B391D18E3ECE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989647, "uuid": "37a02fb6-3da7-411a-8ec8-0326052d929a", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989647, "uuid": "f89fa0b7-ed5a-4088-aed0-97e3eeb3980c", "value": "12288:+OgHf5z47LRsq7dNTAEvCxMuer63qg77lVEQV1CT:o/547Leq7dmEaxMu2639773EA1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688989647, "uuid": "f34841b7-5a20-43fe-b5a3-b0b97ae7c984", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688989647, "uuid": "cdf70911-48aa-4c15-a512-cdc0d86eaf4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688989647, "uuid": "f1cc0106-ed98-48eb-8e9a-c28a4af156c0", "value": "d7e549998d7972f0632ac70615d6d8beeb4c367924c56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f0da2a-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978038, "uuid": "fb82b4e9-f2fd-4a95-8419-d1eb8bc08e6d", "comment": "Malware payload", "value": "ed32434966ba0f65c93e09abf773473b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978038, "uuid": "7595e5e0-11be-4a9e-9e02-408ac48baa46", "comment": "Malware payload", "value": "d99ce4aa2728475af07df99512fe248bfa39e59bf74dd1bd7ddf3f4310064c59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978038, "uuid": "a48a9609-f8a8-420b-9a01-8c051d6eeb2a", "comment": "Malware payload", "value": "ee55796d907e56c09aed719971ddf1905f327b5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978038, "uuid": "eacedb27-4f5f-4b89-8ec5-da7ca3fc6f84", "comment": "Malware payload", "value": "eab141ea57f46c8a2f6567d4dc9887f265f89b943b80932780737ef037f33bb239634558f9b1d49ea4849cb4959c8229", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978038, "uuid": "c0f02595-2a22-4a74-97d7-6ad8a2be264a", "value": "T1E8130A88FD55A22AC7D162BBF70D03CE773A0768F3DA33225E355B2137C6A615A3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978038, "uuid": "05535952-f0c6-4cc3-a257-6bc8a94c4464", "value": "768:BCl5gK9IYz/yXzDcPzG/GyoYtMt4Ml0POpEEMIi2hx2q1Lew3zqI:VKW8yDDUByWGM0POpE+iGsqF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978038, "uuid": "e614f6aa-34ec-419c-ac24-711900e64be2", "value": 42672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978038, "uuid": "96ef17e4-21dd-4e9b-903e-b6cd82d97630", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978038, "uuid": "2f8f2e3c-88fa-4c43-96bc-03d5e7680c4c", "value": "SecuriteInfo.com.ELF.Mirai-CE.9476.20297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b692b7-1f69-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689024825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024825, "uuid": "2b539841-9d24-4d22-b13b-01833c99f802", "comment": "Malware payload", "value": "e65b9b5d5cbeb175e87ab1aabec096d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024825, "uuid": "2157e0e0-0b7a-4404-bcb2-94866ab3e029", "comment": "Malware payload", "value": "d9aced29cd0fc871bc8e7c90a3eaa64d303b4f73ce519508826006c3de5ebc70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024825, "uuid": "0318d1d7-755c-42ba-ae83-b30d7622617c", "comment": "Malware payload", "value": "c71675ad588477687473cec9a2855d1add6af3bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689024825, "uuid": "d3533f41-2ea8-463a-a464-6d934cfc998d", "comment": "Malware payload", "value": "134489502c45c0d45fa9813506fcf63499a50e3ac1d06cdcac13447da62a72fba2105628de9a07bf368b4178f1fddba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024825, "uuid": "60e1dac1-3f62-4faf-a1a1-769b938b53f7", "value": "T1E9347E0351B4EE63D9E74A319D3EE2E8366EF9708F08665A32147B6F18701B2D273359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024825, "uuid": "2afa5733-7aff-45e9-b52d-6e153df0eb8e", "value": "5a013624489e6703ae44eba8e360cecd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024825, "uuid": "dd317e89-a484-4ede-89b2-25e7532c4e68", "value": "3072:wPLi2L9SPngVuP9JxcX7CjqHfqqAJShamPCf8LN6gmJQ3WwV//:N2L9+RP9Q2jMCDShkf4NPmJ9M/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689024825, "uuid": "c460f4e7-14fe-4d41-851e-e133b92afc50", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689024825, "uuid": "cf98301d-0b39-407b-b34e-d90518680fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689024825, "uuid": "799710cd-7a64-4b6e-ad93-2f453c7cf757", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8752836-1edd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688964893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964893, "uuid": "d97aa55a-8e20-4c4a-a225-8acfbd84f234", "comment": "Malware payload", "value": "abc7a9c5b732b72a8f47fd85ee638c09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964893, "uuid": "704287ce-f901-4eb6-a6d2-8d1b92f8f376", "comment": "Malware payload", "value": "d9ebb6958afcd1907651487062108ec56a2af9eb935f2437156584081cb56b2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964893, "uuid": "df7595fd-7235-4ed7-a869-8ca55488e802", "comment": "Malware payload", "value": "9876415085f95c02d6bcea9b1fc990d5b5c50d1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688964893, "uuid": "5bfce9cf-ff06-459c-bb78-ca02426bbe45", "comment": "Malware payload", "value": "48c99e178a9ce52b96e9530424123fbf944f91f874df622b6da2b1a97c8877d42e48703503c26a31c477bf3f4aa5632e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wjecpujpanmwm-tk", "colour": "#96F4D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964893, "uuid": "189a61e0-4ea6-4a2b-bdba-e7f671672e36", "value": "T14E1733418D4E2E71F4BE05FA7227D8A05E25600F6EB0EFC5EB1F963A6272E07D098157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964893, "uuid": "034968f6-d7e3-485f-a6de-3055608e4113", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964893, "uuid": "9f962a8f-1eba-496b-9cbe-d7b7212ae2db", "value": "393216:Nnth89b9hPjaWpw6MrB10G6dtx5zhEKX83YJM6uyD/uLHztUP8S2k9:Ntu9b9ZOYdtnz9X83Ku3Dk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688964893, "uuid": "ddef779a-cd47-4813-b810-8c5d31c416dc", "value": 18595672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688964893, "uuid": "2f8cd67b-dc44-45d9-9afd-c7438534f72d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688964893, "uuid": "45298ee9-390b-4291-ad38-b96ac24fabb2", "value": "d9ebb6958afcd1907651487062108ec56a2af9eb935f2437156584081cb56b2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e844371a-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978207, "uuid": "1ade7c4c-8ae1-4bd0-8d0e-4db762342585", "comment": "Malware payload (RedLineStealer)", "value": "8059f57d30017de67525ade5f5b23d04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978207, "uuid": "1552c55f-d488-49e9-af37-17fd108ca646", "comment": "Malware payload (RedLineStealer)", "value": "da1790c82ac4317bb2a889c1035283310c601c987dc53b6ec86514f80ba10d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978207, "uuid": "536f908a-536a-4e81-a746-09f1e3a52d47", "comment": "Malware payload (RedLineStealer)", "value": "a6a2ec7a2fdc8671ccaef9e6c6d4a5435b434c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978207, "uuid": "ffc1bcef-e66b-46f5-b9f0-788467c0c3a2", "comment": "Malware payload (RedLineStealer)", "value": "92bcd438c0cff7836d9d7215e60283ffbf15b909d72e6324216f80f7a390a62dfe2c641665c878303d5f6086fb548711", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978207, "uuid": "948ac0fd-9666-4262-bc93-fce0ad823348", "value": "T1DFC4026171D29523EAB514332560822FFF2FEE351AA08A9353C5763D4B391C16E3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978207, "uuid": "f15d3366-cc86-430d-988c-68338c152be0", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978207, "uuid": "2857c303-9234-4c4c-a9cc-b9697e451941", "value": "12288:lk8lzz47P3hhY901sAKEQzJjTZk4VVfSNDu:bX47Pw8RQzN1k+VKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978207, "uuid": "d44a8d5c-517e-41a5-951d-a4cba2aedd7b", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978207, "uuid": "323c7e45-3905-4fd8-83d8-c10cf4ee39a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978207, "uuid": "a4fdba3e-5771-42d3-b1f4-75709cb79572", "value": "da1790c82ac4317bb2a889c1035283310c601c987dc53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f790e38-1edf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688965602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965602, "uuid": "81cc44fc-d5d0-4b49-be0d-4ad9594d8b03", "comment": "Malware payload (Mirai)", "value": "917548b7fa96ddf3fc112ec68c568b9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965602, "uuid": "a6081f4f-20bc-4e88-950a-be22fa64dba2", "comment": "Malware payload (Mirai)", "value": "daacde4161b523976ace166920df2164cd1000341fd00b8a7e95c402666cd025", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965602, "uuid": "f8689931-fd0a-4856-879f-a63d34fbf70d", "comment": "Malware payload (Mirai)", "value": "9444d681825cde401b73946ef4e4fe323a4d4b01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688965602, "uuid": "e1a3fa84-c0cb-4cc1-a2ae-d9252db94a6d", "comment": "Malware payload (Mirai)", "value": "92493a4596d7b6e8999d70e23c31fb8e56e350a333c4b2d64bf5b51f27e5795035977c174eee8d86f59c68603a01c982", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965602, "uuid": "58e1167a-3248-4886-8b84-8a93d98754c6", "value": "T1E6E34D06B70C0E47D1632EF43A3F27E193EFAA8121E4FA44655F9B8A9271D321546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965602, "uuid": "e5c69e60-dbcd-4e46-8224-b4053536c9f5", "value": "1536:KTa47TwjhUWrsSlHxprvR0UVTjrbqdckUn3AMr/fA2vAPWJIf0cfAKKCasV73w:KmwSlHx1JxjEUQMsfPlZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688965602, "uuid": "aa279e84-ad7b-4fd6-83bc-e84bc87e40f7", "value": 145924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688965602, "uuid": "a1a10e60-c457-400f-bc9d-bc199633a411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688965602, "uuid": "fca2aec7-138c-4759-a98b-69c5b5e079e2", "value": "917548b7fa96ddf3fc112ec68c568b9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b18b757-1f06-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688982345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982345, "uuid": "20e52b78-bc1a-45da-a08c-83949e50a951", "comment": "Malware payload", "value": "d010315437618fddb6e538901b17750c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982345, "uuid": "97270f50-3c52-442c-85f3-2219793118fa", "comment": "Malware payload", "value": "db3397be54e1e264937fc410a3da4b1d72cb79dfd57885032a728155198aab3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982345, "uuid": "f7bd1728-a82c-4d98-9283-629d35bd042c", "comment": "Malware payload", "value": "932351e240a2fd6e4ad834035eb0f59042667221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982345, "uuid": "872f09da-59f0-47cd-b879-031e8ed3f9f8", "comment": "Malware payload", "value": "79f799f4b3d5592708e63d8c5dcc32f62e194a5fc373011d6551c383b1f06c1e3de3a545a39a0eaf9f4f37b2eadb5ac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982345, "uuid": "9fdc4008-c7a7-4ab8-bb46-a3632c85ac6e", "value": "T1207419A4FA45FDF6F8458B7D14E1235D139EA391EB2CE7337860FD78000AA5882B754A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982345, "uuid": "2496b0df-9917-48e6-bf75-2f897c5c1c51", "value": "fb3bb2a326a35ae09397b565839e4f1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982345, "uuid": "5e405e9c-3208-40e3-ac37-b4a31c14f903", "value": "6144:c/BmfKKX24eOlCvSd0GW1+laB2kEykdCuLStm+w1ZTN3iifZpW:0BmiVaeSa9MUskzdfwNTJiQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688982345, "uuid": "e57ce698-68c7-48b4-bf40-09ee7be97bcc", "value": 362858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688982345, "uuid": "f0dab2cd-65ae-45e8-905e-de6bdd9ffdfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982345, "uuid": "4cb273d2-c0bb-4ea6-a4fc-252b8d478a64", "value": "d010315437618fddb6e538901b17750c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcdd80d-1f25-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688995503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995503, "uuid": "cf58c065-447e-442e-8cd1-d684b5d2b888", "comment": "Malware payload (AgentTesla)", "value": "f73a0429aba2fa8576b1edca14dddb2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995503, "uuid": "deb70967-f5e8-4670-a5a1-eaefa1d65fac", "comment": "Malware payload (AgentTesla)", "value": "db8e94d4e4064fce82dc25bf64aa58cdb05a06b23af3a0b7d396ec599c0df2bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995503, "uuid": "c6106258-3a85-43e6-8c46-ff5665b389c8", "comment": "Malware payload (AgentTesla)", "value": "bb9a0be6d088074fcb7e337c2fc307d3e6c55e6f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688995503, "uuid": "fba00816-4345-4680-9692-ee30afa2fead", "comment": "Malware payload (AgentTesla)", "value": "56bfa9b4f7ed8825be02100f1fa9f2edcd04a49120265208491ef50b8f3a9b03252eb5c2cd5da64f03a7723053f48126", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995503, "uuid": "2f5c4740-ddaa-46ec-b66c-1fa44b2b32a5", "value": "T17DF4011671BBAB16CAB9B3FE1544694437F89A0D9930F3181C8B52F7197AF040684FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995503, "uuid": "cbebe997-7fb6-4317-989a-255d76732006", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995503, "uuid": "13491c31-ce34-4dd4-a229-248d9d021b9b", "value": "12288:EJ4ahp7tL+NA+KDGunXu+94GawKTgN0DpYOt8GlrfQw53MLcFmK5H2/x8H1w:Up5SKDGueoogN0DaOt5lrfQwpAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688995503, "uuid": "2ba99a7f-c2c7-4f0f-823f-d8e96d9f3131", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688995503, "uuid": "df2dc6f6-b593-41eb-b548-ffe257f0c38f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688995503, "uuid": "4c9e8fd7-6a89-4f35-a623-2b3c0a9b2f97", "value": "10353690.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bda7be7-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978025, "uuid": "a727fcd7-a516-4d61-b0f3-54c2ae9cfa58", "comment": "Malware payload", "value": "80ef7b279b9f5904475c4094943c3512", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978025, "uuid": "920fcd7f-127b-484e-912b-ccd09c029782", "comment": "Malware payload", "value": "dbac90147c3bac6e60d3e13df36a3b6478394a10ac70d0339fd40338d2c4968b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978025, "uuid": "74e14e36-9ba1-4d8e-a093-85cbd0254250", "comment": "Malware payload", "value": "cd2a35ee802eda0956081cd405c2f2b1d61d94ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978025, "uuid": "afa9ebbc-60c5-4b71-bca7-b372db84923b", "comment": "Malware payload", "value": "e8bd5729df21c9b8232624c334fd42db44c74260d7a5a99f13cf49d3fa2130eca68421a3256cc3b87914dfb394052f55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978025, "uuid": "200e7bf8-8b82-4b8b-ab38-db47c60d6028", "value": "T107F26C42A381D4BAF51303B65876D7574232F23A5081EA3EC7996935EE27500D7373AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978025, "uuid": "ce3c013f-277b-4a62-8ad1-662ca03cdc38", "value": "768:s+eI0wgUrKB3kv5Ri7cAFq/Dplo1kLX8GrV+wIl:srbMY3Qrkq/tl+kLf0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978025, "uuid": "82924812-a02b-4f0d-9247-84f1239deb38", "value": 35740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978025, "uuid": "741d435e-cfe6-4d6f-98d7-51201eac2edc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978025, "uuid": "ea3e81a8-4b64-484e-a2ff-dfe9961760fc", "value": "SecuriteInfo.com.Heur.20230710083520202869547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa69705-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968878, "uuid": "48a2ac3d-1d26-48e8-8de7-e1e881748e4e", "comment": "Malware payload (RedLineStealer)", "value": "90b85e8ae80e0d01f8e74621fc2b341e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968878, "uuid": "27b66d95-b06e-421c-b141-930cea37d29b", "comment": "Malware payload (RedLineStealer)", "value": "dbc88b1771266ee4517e25d366d9ac3d4602f79735aa38aa4ded190ca1ccb5e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968878, "uuid": "bba18573-9eaa-40af-bb17-964d08dbed83", "comment": "Malware payload (RedLineStealer)", "value": "1575f143d0432c30c0b257ed07594c235637e00e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968878, "uuid": "845d3363-fe51-4e46-bba1-0592b218ee26", "comment": "Malware payload (RedLineStealer)", "value": "d7ec56d0b282f6d8bf5a0fc0d8f37494e77eb4335314b1986811fa9909ca9853f50b91d83a8aa59a30698f0332ae37c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968878, "uuid": "ee03a476-2bc3-4f95-b547-04f30a7ce3b8", "value": "T15E44283921E144A7D8BA9E35BE4BC0D17116AEB4017C541F3BB36E386B914838EF96E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968878, "uuid": "1942e631-37fc-4f23-b11b-f7748c7aa482", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968878, "uuid": "1868d593-476e-4e2d-9ba2-6401221b9f42", "value": "3072:waM+iOHMwew7+picM/BsVVct+Z7bYH9jqyo/QnfzKX+9MByRtq9Lxfx:fMvOswD7QVVctqoDo/QnfzKv2tq9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968878, "uuid": "be50bda3-853f-41ef-a00b-b24fe234a6e2", "value": 272547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968878, "uuid": "474da476-e985-44cb-8eeb-52b2a82d362f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968878, "uuid": "f9315ee7-027e-4eb6-b61c-79466b4bbe2f", "value": "90b85e8ae80e0d01f8e74621fc2b341e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cb2d09-1f34-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689002229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002229, "uuid": "78ea8c62-325c-45b2-a59c-909a4321f9ad", "comment": "Malware payload (RedLineStealer)", "value": "7ba07d755d2759edd9a3c1b7b30d0b04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002229, "uuid": "791a161e-69a8-4c82-9a4c-bce7f2c4ed40", "comment": "Malware payload (RedLineStealer)", "value": "dbd265d75c4a65cc8404e7ab1fe732bbba65ae3674b850ef522f881995d01df9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002229, "uuid": "5b05482e-f1b0-450a-a71c-e61ba345fec4", "comment": "Malware payload (RedLineStealer)", "value": "93aea74b0cac4a8c15448fd34c8c42152615aad7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689002229, "uuid": "4b5454f3-98a6-45a9-8978-05eb9d290246", "comment": "Malware payload (RedLineStealer)", "value": "1d0210d66042d625cc3e89739006ade4d8703ff0de6ea259172bbfc216dd33792cf9611738adb658b5325542168590aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002229, "uuid": "c09ae9e6-a404-4d48-b3af-9d883e9867d7", "value": "T1C775332BE2D54476E674237048BB97E30F7ABEE19970D56F63D0980C18332986570BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002229, "uuid": "d0cceee6-00ad-473e-8beb-8e81c8a40fb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002229, "uuid": "613a0136-51a7-4362-998f-c3c2d182e7fa", "value": "49152:3mV5yW9DS7Ylza+D5B0+/KNixjhKpFI4yDSkw2piG:W7kKdD5B1KN6SuLDShG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689002229, "uuid": "2549d155-698b-4aa2-8a5a-a4e60bec48e5", "value": 1589760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689002229, "uuid": "c76d0aa0-58e8-42c3-8e31-8d6e07def9bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689002229, "uuid": "567d0089-0fea-4803-8af8-bbb2edc8fb88", "value": "7ba07d755d2759edd9a3c1b7b30d0b04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf30471c-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985037, "uuid": "6b23dc20-f6d1-496c-ba4e-c1fde11edb77", "comment": "Malware payload (Mirai)", "value": "9e8f64649d5a45bec203fd90b08820b6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985037, "uuid": "8ea0979c-436a-4617-a8de-dd9c91a5df20", "comment": "Malware payload (Mirai)", "value": "dbe88fa6b657fe57a88b756d9cf88407f1cb2975663a8b735dd0d2356b7b0468", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985037, "uuid": "64f9592d-5182-40d3-8ea9-81c935b30541", "comment": "Malware payload (Mirai)", "value": "c3368253777aea5673c65d85d2ec66dafeaa20d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985037, "uuid": "d2c698e6-f92b-4944-bee3-b96407189881", "comment": "Malware payload (Mirai)", "value": "0b539d583a914651d108ff74540826c6d520df9c387446981c914b88c39c3598650f59d577d71848476061c038b0b25f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985037, "uuid": "1e6ef420-20fb-4616-aa34-6f28e8a605da", "value": "T17943C61E6E214FECF758C53517B70A25E76973DA22E192C6D2ACE5002FA024E146FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985037, "uuid": "2d5c9fe4-d339-4a3d-9a40-885c337fff07", "value": "768:bbKgkKacvtEqFWDXXsKdkwO5Jt3Tfkj8ThyI3K1egfus5hrIgO:qKJVBFAsg6bTfkgU1egfus5hrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985037, "uuid": "e4766df3-e5aa-4cdf-aac1-ea12be8efec8", "value": 60212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985037, "uuid": "64199a56-faad-4e70-99da-44a8bffad19a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985037, "uuid": "4b1590b8-156c-4d2c-b93b-a350e77a4460", "value": "condi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c56b595-1f29-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688997272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997272, "uuid": "888e7fc4-1d4e-4f75-a3c5-bd5fbeadff11", "comment": "Malware payload (AgentTesla)", "value": "e263ad234a3af2cde6efecc6fb9682a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997272, "uuid": "5218483c-1f69-46cb-b15d-02e1979b67d5", "comment": "Malware payload (AgentTesla)", "value": "dc7f9c2cbc0466c884b6fcfa3430a74b2e582446e4560133495cabb5ce05c940", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997272, "uuid": "97c864e0-9ccb-4512-a479-0f2bc47b61f8", "comment": "Malware payload (AgentTesla)", "value": "801ba9e33d2d11e2ce2282f8fdbf530b6d065b19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997272, "uuid": "2b14bae8-3474-4553-9a48-85804de5d28d", "comment": "Malware payload (AgentTesla)", "value": "83559cae8496f8aea4992e3e6948c2b623b1a47a4a2082e395a87a1fb68a94dce03a690f30a2eda07bf0a01499288080", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997272, "uuid": "fc113178-d291-40d3-8da0-817aae721b13", "value": "T1D4F4011772BE9B53C6B9B3FE144459443BF88A1C6A70F71C4C8B61F6497AB040984EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997272, "uuid": "779feb62-ba69-4b6d-8169-156eeca09075", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997272, "uuid": "b19e0dfb-e9aa-4cf4-b186-290780047476", "value": "12288:aJ4adp7tL+NotoZyzveXzpB9B68QwYYgGrvA9dFSwtBOoIL:2p5NpzopB0SAbdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997272, "uuid": "6ffd8093-08d2-41aa-916a-e79f1345dbe9", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997272, "uuid": "64ddfdb8-c4e4-4e28-a172-16f8b788e074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997272, "uuid": "37345452-7ee1-466a-8545-52b286ba57a0", "value": "Purchase Order.#01222023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee26254-1f58-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689017517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689017517, "uuid": "b0fcb876-8401-4fba-9851-19d42522e318", "comment": "Malware payload", "value": "ec85909d422f65dd9b94e694ed64294e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689017517, "uuid": "1e3b0186-c8ad-408d-8987-cfcbe3157e53", "comment": "Malware payload", "value": "dcfd05c361c1ad65278c71cab7e4db1b68037e96813a9316c14249efe1dc69f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689017517, "uuid": "12dc4be3-ed7b-437a-b572-251241854814", "comment": "Malware payload", "value": "a7bf02ab6da85d5e49b8c5affe84b0d7a2b2109d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689017517, "uuid": "57141a9b-0666-47d3-9399-cb8a098999bc", "comment": "Malware payload", "value": "058ddc3324e3c7d842c2238bb666cd8b5e115fd3e22aa50da6fd7adfa311343b12334d8e9d5a6ec23a3b3d5cdabb602c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689017517, "uuid": "1f33cf02-a521-4479-851d-aa32e638908b", "value": "T1F3E56D23B2C4643FD06B4A3A4837E5549C3FBB6129229D1F5BF4098CCF3A5516E3A64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689017517, "uuid": "0b53ab82-38c3-40eb-9e08-dcf5c25d859a", "value": "d763aa24f45e9477690cd25a8c967984", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689017517, "uuid": "b976d646-4414-4f0b-95ca-ef165a38f24d", "value": "49152:JSDLe2+luGeBESIMaIY1uCCJHfGM2TLvFVz:JKWluBXCCJOMSvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689017517, "uuid": "5c5174d4-b281-41a1-886f-eaf4dde766bf", "value": 3105280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689017517, "uuid": "86fbd9bd-3044-4a11-bd60-707d302a0c0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689017517, "uuid": "a58f717c-4597-47d8-b5aa-3fc22ca60bf8", "value": "dcfd05c361c1ad65278c71cab7e4db1b68037e96813a9316c14249efe1dc69f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3db72d-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688984814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688984814, "uuid": "a3ff4fb6-7802-4b18-adcc-10181462effb", "comment": "Malware payload (Amadey)", "value": "a69f7a0b8fce0a0be4b782712eeb8a74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688984814, "uuid": "8c0b73f6-ac0d-4589-a719-fdf4ab831bbc", "comment": "Malware payload (Amadey)", "value": "dd6f3251a84294d960bf06b20d52a9628787827114341f01eecebd82d1b1bba8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688984814, "uuid": "6f865dce-ffdd-474d-9640-7c9de71cc58a", "comment": "Malware payload (Amadey)", "value": "7f430f56173bc1bbd0f043a55941997991b1b37a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688984814, "uuid": "7cc2b764-de98-4961-b617-62ab28e77681", "comment": "Malware payload (Amadey)", "value": "baa7859954e5c60ad8fd8eb7b4d614e8f5ddc275d262fef48cdffe526051b29b46d0c38f4b631968864916efa0808d98", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688984814, "uuid": "d59f60bf-4589-4f87-ae6f-a4de5a4b7a66", "value": "T1F7B40160B1D24933E572103725A0832EBD2FEE354AA4969397C97A3D4B391C24D7ECF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688984814, "uuid": "2d511a50-6bc9-4f07-92f2-f98310a970a0", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688984814, "uuid": "6e36f3a8-25d3-48de-92bd-a0fbc3f8125c", "value": "6144:PWPD0GqOHBpOCWGYLUz247vBmm49HuUe6yUDbgEaFkYm0OEteOH8MxZPwlNI:PWYYkz47p3AydFtLxZIlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688984814, "uuid": "4ad02a5b-7996-4da6-83c0-2ebaeecacfe4", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688984814, "uuid": "10dd7aff-5d75-4c78-b29c-8a78953e7d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688984814, "uuid": "d75e116f-c8a0-46e0-b16e-829d59621b74", "value": "dd6f3251a84294d960bf06b20d52a9628787827114341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09256dd-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688991106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991106, "uuid": "894909df-b310-427b-a71e-3ba739b33bc0", "comment": "Malware payload (Formbook)", "value": "70e05259e807ed0a8bb8848a6247223e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991106, "uuid": "643eca1b-da96-44b6-8c20-d1f7258d845c", "comment": "Malware payload (Formbook)", "value": "dde049f4dcc839ba3db45edc58d80e860ae4375f8669d662ffd54a2dd8881d82", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991106, "uuid": "5434e819-b23a-46f6-bd33-a1ad3f293929", "comment": "Malware payload (Formbook)", "value": "97b2a27317339301e0a44241311cf2ee2aac2c56", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991106, "uuid": "7ee2bdf5-5c34-4b59-8a2e-e3f7a5967ba3", "comment": "Malware payload (Formbook)", "value": "45a6db35d1c080d91d6d8a42deb6d1823e6713b2c8bd6e453da56a2031ef8498dc3bfce88fd0b2302177dbb374eef925", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991106, "uuid": "334ef106-d4f5-4f61-bb30-6fffbdb01b14", "value": "T11613F65AE38F02A58F4112B7531B1E899ABDB63EB3515471386C833433EDC3D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991106, "uuid": "7c8cc796-b112-497f-af32-111231288732", "value": "768:8Fx0XaIsnPRIa4fwJMlZ3qxbtTw+nN09yAC2c:8f0Xvx3EMnwJTw+nnf2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991106, "uuid": "ac7090ff-1492-45d3-a731-b4807df93668", "value": 43722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991106, "uuid": "d1900261-31df-46d4-bb64-27a4dd91a6e6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991106, "uuid": "1fbb8554-94e5-438b-9f34-91fa0c4ba9d4", "value": "70e05259e807ed0a8bb8848a6247223e.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d163d9-1f1b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1688991358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991358, "uuid": "788ee1c3-8181-4ab1-b8ed-e3d2c9b546f1", "comment": "Malware payload (Formbook)", "value": "700c7773b9c6e9b3a3440b2dd9370f2c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991358, "uuid": "4df935c4-0048-4b3d-bf01-04fcdd0ddd15", "comment": "Malware payload (Formbook)", "value": "de30e038eaa635585c23ec16221f9307e49152fe0d42d6f49a9435beb42f1f9f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991358, "uuid": "5c756956-6c0e-4013-9aa7-99166ba0b92c", "comment": "Malware payload (Formbook)", "value": "cd2c1ce82af072c52f2248d8cad9be3793b8d5ff", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991358, "uuid": "58fea698-7413-4b64-91a1-fe9ccaf3d0c4", "comment": "Malware payload (Formbook)", "value": "82e100c0d0a3583bf22771b6e294d17bb159b6ead60ef81bc24c0d2d5fec1fc334d5d3a24d3350e320c8a41c781b5983", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991358, "uuid": "7c82f3a9-f2f0-4a0d-b24d-ce3d089b5757", "value": "T1164412646345A3FEC0A8047071AE7E2458E2A93E07FF52DAC3271C8CDD6C9179AC561F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991358, "uuid": "2679be65-2394-4f82-80da-8bb8fd53a63b", "value": "6144:zvTeNBlexoP39vogFrJexGfb2uPWbqmBV+UdvrEFp7hKuNg:zre7lexI9vogFNAGKuyBjvrEH7BNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991358, "uuid": "82d84603-5cd5-428e-83c4-049d1281a0ec", "value": 277447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991358, "uuid": "20fde480-ab46-4fed-9e35-271ab7ec8b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991358, "uuid": "e8f35ead-6b13-4ff0-a319-25904f750864", "value": "DHL Shipping Docs00945_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a49ffe-1f0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688985019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985019, "uuid": "56d727a6-8108-4718-b00a-4eed95a75c71", "comment": "Malware payload (Mirai)", "value": "d5bc5c722de51b381d616d7fc5e4c150", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985019, "uuid": "23e27067-320a-4c00-882b-4ac5d27d4750", "comment": "Malware payload (Mirai)", "value": "de3c5a535c7098b83af74499b85dbb9e0383844507f35287bc7c14063f865906", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985019, "uuid": "2d5ae88a-79c4-4860-8a12-62530c566ef3", "comment": "Malware payload (Mirai)", "value": "d1c5e8e03a3f004f36f11d6dbe2966c34f4c4a9f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985019, "uuid": "3d641f72-6770-4c9c-af61-9936083f66b4", "comment": "Malware payload (Mirai)", "value": "287535cbe65ed7f1b13030ba20d9a5f437677a93e37e65b4fd104b2bd07881e3213b0b0c9fd2ff17ca845814e527b5a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985019, "uuid": "6da58cd6-1eca-4157-bbb6-242b1caf7a5b", "value": "T107334B86BC018912C6C446B3FB1E038C772753A9E1EB7207D9295F216B8696B0F7BDD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985019, "uuid": "b912bda5-37ea-408a-ad26-b445d24ba983", "value": "768:60WjBd8Mr2kA0ZoJZbOinsDj4bcMsFuOyOU7pHBoGVzlzwSAXvQs5hhI:rqWM6DpOvescOyOU7JBLd6vQs5hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985019, "uuid": "8037e97a-e781-47c7-985c-cc19e5e46307", "value": 54360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985019, "uuid": "66db75a3-919c-42dd-9b99-0de15624df95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985019, "uuid": "ee68c00b-7b79-4dfc-bf82-bc445fd1db44", "value": "condi.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965bb104-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962607, "uuid": "11f1aede-37ae-4074-b0d1-dfdbf7ee1aef", "comment": "Malware payload (Mirai)", "value": "a2796afbd30ecb0d09b3738eba0f72dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962607, "uuid": "0e40263d-c16c-4605-ba7e-7e659f03bb9f", "comment": "Malware payload (Mirai)", "value": "de8fbe974f3f42508dd6a725646a40589d9255c19c8fe21ee9868fa1980b573c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962607, "uuid": "80e377eb-36af-450a-bfba-5a26a16f874d", "comment": "Malware payload (Mirai)", "value": "b5e7f7e2df64f451b54de26a9eecf2c0e5feb90b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962607, "uuid": "31d3fbc2-3ed1-453b-82bb-b6c91bef2220", "comment": "Malware payload (Mirai)", "value": "67701c4009adac1a4527fa236be7008fe52a073ceef9d97cf1125a4cf29d6a7d7e9fd1545f125e6745b4a4946d557b6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962607, "uuid": "73aeb829-075c-4993-b9e9-f7763decf5ae", "value": "T1F1D2D071BD0859C093E4853898788142B79B5BFD22D2723FC15A89A468C251AF7ACBF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962607, "uuid": "b22236ba-a7f6-4de0-b247-71c0719e1ea8", "value": "768:xnApEnTOBVyzXD9OY9ta4bW3UW6ZD8cX6jZFos3UozCh:5zwVcDAY9ta4bWUhDyzCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962607, "uuid": "24af8829-7b1b-4a9f-847f-9fda12a9ff49", "value": 30356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962607, "uuid": "37495e6b-8057-4885-b56a-6c93bdc7209e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962607, "uuid": "2d6b3bbc-60be-45b9-b36d-e0e7f7488751", "value": "a2796afbd30ecb0d09b3738eba0f72dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1d952a-1f42-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689008033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008033, "uuid": "fd3581cc-711e-489d-a998-3b6b9279f989", "comment": "Malware payload (Amadey)", "value": "a85e4b8403f70f8c8c2a4694b484c3a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008033, "uuid": "1036f2d2-bc32-4bc6-9e98-22c990fd9e05", "comment": "Malware payload (Amadey)", "value": "dfa156ac28a140cde5b62ac7d594d1000da526091fd584c8e8caa96c692a5bff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008033, "uuid": "243c23ab-260f-494b-923e-afd505e5269e", "comment": "Malware payload (Amadey)", "value": "ee614a34528cda5db2c436bbc77247c3fe213f60", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008033, "uuid": "05454d55-3787-4564-9cb9-09f55b425ad2", "comment": "Malware payload (Amadey)", "value": "555befcee9256f5b129859568a6f38e140933b7ca1b55be8c8b6ebe867b130924c986c8548f3327be0871b8bbc69d6af", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008033, "uuid": "79611935-d891-4222-9e7b-6a307dde38f6", "value": "T1B3152303AFDA4062E5BA377488F203971F35BDA3AAB58B177755389F18B2280D531727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008033, "uuid": "585c9571-8e39-4001-934e-604b20c07d80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008033, "uuid": "427c1086-7828-4d8d-91da-faceb2886f45", "value": "24576:5yRfeUF4xX+YYKqx+QgmUpqWngJeXUXDH7:ssUF4xXPY5gmRVJeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689008033, "uuid": "7cf74693-8526-490f-aba9-e6800ebc7c5b", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689008033, "uuid": "cedadfaa-a5ca-494e-8324-b3edbfc641eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008033, "uuid": "e7d1a116-1a23-4678-8a93-e7dbc5f66daa", "value": "a85e4b8403f70f8c8c2a4694b484c3a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd01544-1f6b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689025806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025806, "uuid": "8ecd8009-4436-4a26-809d-056a9774c6db", "comment": "Malware payload", "value": "b32b723b3a5a4915b5212394315da7d1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025806, "uuid": "0710fa6b-2618-414a-83be-f6e9b4cec4fc", "comment": "Malware payload", "value": "dfeb8b9291ac35cb6479e6f98496badce94d71019129934dae19a2e3552ab15b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025806, "uuid": "ee58b5e9-0df2-4f13-8b94-08f0460e95e0", "comment": "Malware payload", "value": "25dca5ace8a594280cf7394bcc1d0becac5cef3a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025806, "uuid": "f2df512b-6940-43d1-b688-888468674fd0", "comment": "Malware payload", "value": "1069e5f5ab0bbf9451c688e7bdd4f3d65b830d91fcf1b50b6c16533080adbaa4c984af8e9fb2c32383c75b4258ca95f2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025806, "uuid": "dc4a1aa1-2c6b-449f-b3eb-33a9486aede4", "value": "T185A2E11566A32D56E3E81C3CC96A8317B9A71BFC80F632767D416620C94D20A2E38A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025806, "uuid": "fb8fe11b-cbc9-4285-be4c-0dc422f1f6c4", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjAwhymdGUop5hm:TvQn4j+ZO5fKAlxEws3UozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689025806, "uuid": "f4a33c84-ed02-486b-8e19-d868e155b19a", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689025806, "uuid": "052e9fa6-a41d-40d4-837c-9961a36627ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025806, "uuid": "61e54aa0-ce07-4069-9cb4-892dd28fe1f7", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accb831e-1ed7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1688962216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962216, "uuid": "c261ee36-c893-45d4-99d8-1768485ff75a", "comment": "Malware payload (Stealc)", "value": "e06c3e59c710b8dbc0307175ef4aa3ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962216, "uuid": "e7bc39a0-fe08-4c06-9474-b1fc1bb97519", "comment": "Malware payload (Stealc)", "value": "e124209c6637013d1caf3965280e6f51160fcd514deb457603af67e6cf57165a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962216, "uuid": "40f54618-d797-49e1-af24-d535a0993773", "comment": "Malware payload (Stealc)", "value": "853e257e323bf5027d15bc0bab9492284668ee6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962216, "uuid": "6b4bc347-9002-4c41-af8f-8f3152502aa9", "comment": "Malware payload (Stealc)", "value": "401f6c4bdc23a39e36a6c159af176c17def1d2af0d9b9dcb4d1d75c444b7a45a01183a9a5369dadc20a2a49d54702c22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962216, "uuid": "c08ac46b-d321-4d05-a942-ca8b385280ff", "value": "T14E75AEB971C0C8F2D227553178B0A5AEDA7EF9FC6F50E6977B5812261E3C1C08E059A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962216, "uuid": "be6baace-4c3c-47ba-b42b-539c528776ca", "value": "8452d406e4e0962b2ab9adcb341caac1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962216, "uuid": "5164c3d2-8146-4b20-85d8-22f33534258d", "value": "6144:slRqiMpkPiC538uvV94j63cyvE2xr9liDUjMGfn:slRqiMpkxtCj63yyliD9gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962216, "uuid": "730aedc0-6499-44e5-b13f-a4c4cee67a9b", "value": 1648736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962216, "uuid": "eaf079c2-5f7b-46e2-b5ce-4ce1af424f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962216, "uuid": "4ce04c91-aee0-46f6-9996-86620292e27d", "value": "E06C3E59C710B8DBC0307175EF4AA3BA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57efcc21-1f42-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689008029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008029, "uuid": "b84c2f7a-6447-4107-a12f-f127184f10bd", "comment": "Malware payload (RedLineStealer)", "value": "60efbea4d044ad5ec2c3da8855201515", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008029, "uuid": "6f4015ca-57b9-49d7-a24a-60b062c148bc", "comment": "Malware payload (RedLineStealer)", "value": "e140638dfc1bf2f21986f072364b2b6bb4d2311a8425865a961e7cc7e768338d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008029, "uuid": "5b985f9e-c59e-4377-94f2-b8bb824472f7", "comment": "Malware payload (RedLineStealer)", "value": "cc2451bac86c546230cfc9d0960152dee7045408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008029, "uuid": "fd002196-71c8-40ef-8ba5-0c650e85570d", "comment": "Malware payload (RedLineStealer)", "value": "5bf63507b7787aea5a5db69824afbf1e346eaf9207e4797cd25f13a813baf464adb87a8e74d71ab76c10f56994f101a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008029, "uuid": "93f5307a-127b-4949-9193-411555048762", "value": "T1E4152301BBF58175EDA90BB0A0F657A31B35FCE15C78932B16919C5E4CB2284A63733B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008029, "uuid": "fd6571a5-4493-48c9-a99b-07f8e5be8f6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008029, "uuid": "11ef8adc-83b9-4b08-a3e1-f7548499e77b", "value": "12288:/Mrzy90CvKxZOyQonKmZFEdsqjQdur8kA/yANsZiZ+GKh6mJRsMIZ9Fu:oyRK7dpKmZqddMzko/sZZGJmLsbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689008029, "uuid": "3a1ba358-ef02-49e3-bd5d-766c0f0d8c5b", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689008029, "uuid": "7d65d501-7f6b-49ce-85a5-266fed1412a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008029, "uuid": "66e41abf-a800-4916-8126-775d71f46959", "value": "60efbea4d044ad5ec2c3da8855201515.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97473f6-1f76-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689030607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030607, "uuid": "0bbc7ccd-7ccc-4478-9623-f2c75a121284", "comment": "Malware payload", "value": "edb0cd8347a8d36132407556deb47151", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030607, "uuid": "f8792ca5-f208-44a9-aa7e-a1d122a3b2a4", "comment": "Malware payload", "value": "e1d8e0a2ce6f5200941c74e2b4498a8d00cbf8c6f1feec3e7f3a9f933590e15c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030607, "uuid": "afd714fc-f440-49b4-bee9-6980b01b165c", "comment": "Malware payload", "value": "a0259fc7b042efdf3829fc9cda97803de01273be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689030607, "uuid": "c20827a8-2821-4f07-ad98-94ed919752fd", "comment": "Malware payload", "value": "ee2256b1e4960694e78085c51cbdece85c4ce82a20f9f45a29d93677ad4ede8f8be7d8c029dc8c335dc5ce835b025fb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030607, "uuid": "a54836da-c4aa-4cea-aadb-0ba12b1455a4", "value": "T12333FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030607, "uuid": "1cb70255-d252-4bbd-b243-b0b40a59f647", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGs:r/hqaJMcjeqK806MHdMfQXoHuCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689030607, "uuid": "46235e5f-6be4-4460-be53-56b56778c7c0", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689030607, "uuid": "84055565-13d1-47bf-a5b0-2858877ffc93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689030607, "uuid": "0d4f424d-114b-4389-acad-08974f40b095", "value": "edb0cd8347a8d36132407556deb47151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46850845-1f47-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689010148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010148, "uuid": "0f98de4c-0438-42ed-bfbe-d01d6647d640", "comment": "Malware payload (RedLineStealer)", "value": "e51f5ef0b3d5038c9e1b0b5516244e8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010148, "uuid": "509f701d-74f9-4b34-9ffd-7514baf51c91", "comment": "Malware payload (RedLineStealer)", "value": "e25842dbe6ab8469f81bd821ab70c2818962c7a681f45dfcd09f741409b2bb9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010148, "uuid": "9fc0c044-c5f4-4ecb-948f-3978119302c2", "comment": "Malware payload (RedLineStealer)", "value": "d1d5a940665d849f900e8a369c29f0fac7c1374f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010148, "uuid": "4352fdd3-48d4-4606-8d48-cd4089b1fa80", "comment": "Malware payload (RedLineStealer)", "value": "5e8e318a5770557f3c7c6bbbf968516c48fd891b280989b708f84eb3be51ce3f0afd3949261b316f3b651b41649efe0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010148, "uuid": "af5146a3-9794-4bab-a9f8-dec29f209511", "value": "T139151347ABE88373D5B107B15CFA06A31B353CA58930877B231AA49E1DF31D4A935B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010148, "uuid": "151bfbd7-131a-4b87-9cf4-1c5d344b03a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010148, "uuid": "7666ed6e-45f5-41ba-809b-1c78832e1a97", "value": "12288:7MrFy90I/vsuqkr+jSMqxvObV/znJyyd34t6G6Gxzbj4kx2R2V/dBAo+HES2VN9T:myN/vXx+6GR/t37sJbj/fLAZ6Nlb9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689010148, "uuid": "399a6023-c1ad-41f1-874c-1ba5b64e2919", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689010148, "uuid": "b017f1b6-20e2-4d5b-b53d-57059d4ffd7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010148, "uuid": "fa2718de-9cdb-4d63-ae59-865b3da7caa8", "value": "e51f5ef0b3d5038c9e1b0b5516244e8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c429550-1f3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689004708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004708, "uuid": "c4f6358d-99a5-4181-b1f8-b4609dc153c6", "comment": "Malware payload (RedLineStealer)", "value": "e98aa748228fff41aa9cd725ddd9cc3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004708, "uuid": "5690d522-a727-49b5-a2a0-1a5176664d9b", "comment": "Malware payload (RedLineStealer)", "value": "e283dfc7162c3107baee15027c09917ad7bc7d1023a8581797039abd074cb015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004708, "uuid": "0a7d2ec9-1b71-407a-bd4b-d5ce76a7c208", "comment": "Malware payload (RedLineStealer)", "value": "b91290c6941b4e218ff947413cfee05c0dcddc95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004708, "uuid": "0d18755b-2050-4c94-a7a9-f5c991e87cfa", "comment": "Malware payload (RedLineStealer)", "value": "94ba5d03763d846c0844721a9d2e2b7f02d26aa4e55347b12ab2111358e393f595db40b895824970dffc61cd1c573c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004708, "uuid": "8dfc2654-d422-4839-a1e0-f0005c21f1f4", "value": "T1FBE4DF3914A144ABC4A9AE39FF0BD4C231162EE5017C950E3EB36E783BD24579DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004708, "uuid": "36f1e942-bc31-4507-b3f3-cafc12f2bbd0", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004708, "uuid": "1536ef74-fa81-4a08-93bc-0545e28a98a7", "value": "12288:ww3zk2EjdiICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:wwDkNxBbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689004708, "uuid": "757bf7e1-a766-4556-aca6-986365cd01d5", "value": 708417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689004708, "uuid": "a54451fa-58f6-413f-864c-25853bc435f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004708, "uuid": "012f4956-4d85-4a47-88dc-0f5f4d81029f", "value": "e98aa748228fff41aa9cd725ddd9cc3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2b1e35-1f3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689004706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004706, "uuid": "05b23171-1f5a-42d6-871c-34b524aebe17", "comment": "Malware payload (RedLineStealer)", "value": "32d48c8cdbfd96746a7f1c55f20a4947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004706, "uuid": "9b739a8d-0717-4133-983e-6d24558a64cb", "comment": "Malware payload (RedLineStealer)", "value": "e500bee084b2757ef23283d465255eeb1eed61d9ed67171a24f814de66cf3b71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004706, "uuid": "9f023b16-81b2-4265-b02e-413edae69462", "comment": "Malware payload (RedLineStealer)", "value": "7c8dc77a635685a78606165716662958487c72a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004706, "uuid": "189fad86-6fe4-4abe-8c5c-20bf901aeabf", "comment": "Malware payload (RedLineStealer)", "value": "8802f36506b7f5a38abc3234a5a315c7a76a18948c74bd4be5aa46bc8e21e927a874fa2175a4ab8f9ae3f94be0705ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004706, "uuid": "9056dd3a-fa98-4c6b-9842-fc92c1524299", "value": "T18775230BF3E4A277D5B55B346CF703030B393CA58C78869F6A6A780D5DA3194A83177A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004706, "uuid": "88e2c58b-284c-4ee0-b07f-ed8cdbd15a9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004706, "uuid": "99f6cc75-bf0d-4bee-8ef2-5f1bed37e21c", "value": "24576:7yPZKhpcvJxHm4U5sa6uyHWkAN+dX0xecCgTOffPGzedaNycCe0XM7fl1h6MlzY:uyGvJxG4Cc7J7gqffP/tcCtXmflnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689004706, "uuid": "81ee7dac-f13b-4151-acd1-5b9e72139a2a", "value": 1589248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689004706, "uuid": "23419e15-0f93-4181-8ea8-84cee9ac8eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004706, "uuid": "a8c723bc-faaf-47f4-b30d-b720da691e78", "value": "32d48c8cdbfd96746a7f1c55f20a4947.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65c2ce3-1ee4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688967922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967922, "uuid": "c6d9191a-0e03-4abf-99a8-1e267bafdf13", "comment": "Malware payload (RedLineStealer)", "value": "c8190631a674f4d720de980efddcd03b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967922, "uuid": "3e87aaf8-98ad-4f0b-a493-4fb23f02cadc", "comment": "Malware payload (RedLineStealer)", "value": "e5ed912b5a5fb28ee413ade1a7f8a276f07369a69b7a0e087060e25b7466cf1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967922, "uuid": "994e1df3-9b5e-4834-bde9-a79ff3ec0de8", "comment": "Malware payload (RedLineStealer)", "value": "8528de5f0ed483627a9b57bb7a2ec273b1265c60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688967922, "uuid": "7372072e-ad84-4fbd-b49f-69bd8f350b19", "comment": "Malware payload (RedLineStealer)", "value": "67391ef8e04f8e8f8201dae1b9b16a881cde90795de363eb3163fd47879e32c7ef9bac9d93e4ce8ff34aba69ba14613e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967922, "uuid": "8b52192e-0a01-40b4-895b-646ed8ce9e6f", "value": "T151B4026071D69A33E572107319E0961FBF2FDE7249A08A87A3C5763E9B341C14D3ECA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967922, "uuid": "adadc391-b7fc-4334-a4bb-40a704fb0baf", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967922, "uuid": "1464bb4a-d7c7-4366-9942-b19eeac3319b", "value": "6144:FE7/YCViHBZKCWGYLUz2472tEgBAOnrb394BHMOEsMuzCN5FyS+J/J+5bCJa8q+3:FEUZQz47POrByFLMuzU5U+5Ok8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688967922, "uuid": "e60b2e27-f977-495a-b3c8-125bccc6d2b8", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688967922, "uuid": "a6868ae1-ffe4-49d0-a353-d769e930bdf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688967922, "uuid": "ec2edd16-b10f-44bf-848b-79f272770761", "value": "c8190631a674f4d720de980efddcd03b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060ee8e1-1f12-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1688987276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987276, "uuid": "5784edbd-cb76-459e-8adb-49dcc657593f", "comment": "Malware payload (SnakeKeylogger)", "value": "f51828bc02015919cdbad9c46c36bbef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987276, "uuid": "cece6302-dc24-4202-8b18-8661284e6f71", "comment": "Malware payload (SnakeKeylogger)", "value": "e5fe74a699fdee524980b0ccdfe82a6a98abd5c011ba909822455b831720b686", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987276, "uuid": "0061b30b-88a9-4d32-9d00-1a1ef6c2d015", "comment": "Malware payload (SnakeKeylogger)", "value": "224ffc9efd42fb374889dbcef02cad8f76d02b45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987276, "uuid": "c53119e3-dcf3-405e-9eb6-e95520469614", "comment": "Malware payload (SnakeKeylogger)", "value": "328b94056c0cbb9c7487e8a4f8e72593456cf30907eecfd162816c6316adfa9d1966e2c5edb2a4a74bdd6bda2eac35fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987276, "uuid": "2fda864d-62b0-48d2-a896-ea7354af4c8d", "value": "T15B257DD1F1A0C99AE86B17F16C2A653021E7AE5C54A4D10C5D9EB7B726F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987276, "uuid": "d1d5ed08-5c22-4b3b-94b3-c10083299a0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987276, "uuid": "72a9d50c-9f13-4c58-8652-82355a5a2935", "value": "12288:iJ4aSp7tL+NZ4ZJVJH1qfGK2tWuIyafbx44dkGNs0BYhhfsqZRQ5:Rp5i4ZJfH4juIfN4WkGNs0Chh0qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688987276, "uuid": "48b075c8-adf3-4a8b-9288-bd7dfedc909b", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688987276, "uuid": "08556e7b-8d47-43bb-b707-73c5c018a4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987276, "uuid": "82784c70-04ab-427a-aed6-08db8425013b", "value": "FOTO\u011eRAF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfc13b7-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978186, "uuid": "90df4304-2150-4a82-b9a2-588aa097d6dc", "comment": "Malware payload (RedLineStealer)", "value": "98f2e317722f7b49b4621cc8f9a13057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978186, "uuid": "394f5bd0-f60d-4b04-b0f2-6c3386bb26c1", "comment": "Malware payload (RedLineStealer)", "value": "e6050ee86f6fd1d9e26f5094ab9e2ba52975d875f0e275e1278c44a9789745c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978186, "uuid": "b49b22cf-e36d-45d5-ba89-749439aec09d", "comment": "Malware payload (RedLineStealer)", "value": "f2b9cd1d85849fc6ef5fb1d81c9b4842e0561d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978186, "uuid": "3e33a273-5b9c-4e83-ba45-7a05c98d9885", "comment": "Malware payload (RedLineStealer)", "value": "bb3a6561bc5ae6adbb7c713d7229731b5aa52e8686d15963eb7400d06ee5f5fe4d03fda6d8a65923fed8cf331b8c2545", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978186, "uuid": "fa218234-5fe4-464e-8d06-eac56d72276f", "value": "T1FA05126171C2A523F236253B29A0D25EFE0FDE311AE0558783D8713E4A291C28D7DDBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978186, "uuid": "0b12e77a-6545-4bcd-87af-c056ff053b2e", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978186, "uuid": "7f96ff84-51af-43b9-974d-54be72c972a8", "value": "24576:4p047hktBZ9cexH7LabO+EmUk0I3+alhES:4p0qOoexbLXLsthES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978186, "uuid": "79a7790a-b4ed-43fc-a212-095276f3fa03", "value": 824992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978186, "uuid": "fdb74b5c-eb25-4435-a300-e8dbadb3e3d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978186, "uuid": "506ff279-9644-41f3-99a5-6e9000fcf4cc", "value": "98f2e317722f7b49b4621cc8f9a13057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec99c34-1f30-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689000498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000498, "uuid": "282fb12d-dfe9-4800-85ee-b705780647db", "comment": "Malware payload (RedLineStealer)", "value": "b33790d64f4e897248623dda78cb120c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000498, "uuid": "4731784f-af21-4ce8-a35a-74c47a6e77b3", "comment": "Malware payload (RedLineStealer)", "value": "e65284cf8f18cd1454fa864e985a2180853aa2c8e196fc66ddd23b4c4e01850f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000498, "uuid": "98b4c990-9e7d-4198-8118-f3303a7d4ecb", "comment": "Malware payload (RedLineStealer)", "value": "ca9e47a31e26a25a1708569d09a013e86743feb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000498, "uuid": "e8caea19-4f03-4c68-92ee-69782cbf6872", "comment": "Malware payload (RedLineStealer)", "value": "0c15e0797dee9000cf5e216f0df9bbf6062f9ac5bf4783fc4669fc3fabd20267d59053409e27ef7ecb6804d9e2849797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000498, "uuid": "2f3ec8e3-5c7e-4fff-bbca-b256ad90806c", "value": "T1BD6523B928802737E030607D8590E52FFE070AF296A05743EBC77A396B956EE2D7DC54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000498, "uuid": "3ad579bc-090c-4f9e-a383-a318315ac4b6", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000498, "uuid": "ded699ca-3ec8-449f-b595-fede58186ae6", "value": "24576:6E47kOUEfJvETlpqftmHioiS+yvk3RZA9PBbVTb34k30/8dRi9:6Eq5PfJvExMftmHzO0khZA1ykji9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689000498, "uuid": "255468d6-e117-4b5f-98b3-413f1af02cbb", "value": 1409344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689000498, "uuid": "6c1caf85-fcc3-4545-82f5-7757f9e09dc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000498, "uuid": "8f21e527-9136-4506-91e4-e350565e18f4", "value": "e65284cf8f18cd1454fa864e985a2180853aa2c8e196f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686f072b-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688981858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981858, "uuid": "f67330de-f7a9-4ec9-bf15-67b1b1457cda", "comment": "Malware payload", "value": "16ffdb5bb170f2084e08608203315059", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981858, "uuid": "121f04fe-3f35-4388-815f-e8f437b2a2ae", "comment": "Malware payload", "value": "e6d2a18b5a3ea037c621aeabbafe30a4a9ef516bac528d64478ab54e59d73452", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981858, "uuid": "a04624a7-5d1b-4bd3-8446-e22ac995dda8", "comment": "Malware payload", "value": "9f18acb6ab89c07bc6b45302721e542247acf804", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981858, "uuid": "530d5e5d-c59e-4e0b-92cb-d33343142238", "comment": "Malware payload", "value": "e05009d01c8925fb26833ce233c80f8e6cedc13818b970bfdc420785571860cab89c0ab5fe53676e56f217b9b2f7623f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981858, "uuid": "65d8fb35-a775-4339-80d6-42c8cbb8fad0", "value": "T1E1135C57B71C0647D1B75FF43A3B27D4C3AEBA6011D896C8250EDE819372A306962FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981858, "uuid": "a143bdd1-3c21-4770-a746-e9cdb9f61286", "value": "768:PbDrpGQeAdjs9Sm2PCYUnI2+NFt6twCAIIq:PbDrpVeAkSbPCXnI2g6ydIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981858, "uuid": "90d57b17-6c55-4181-bcd8-69bdbfd659ba", "value": 44732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981858, "uuid": "ee4ff815-a2c3-43ec-9edc-72d2b4d6e207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981858, "uuid": "107511b4-e85f-45e2-8555-e83ff7044e8f", "value": "SecuriteInfo.com.Backdoor.Linux.Gyfgyt.BR.MTB.27250.30143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e2f53c-1f47-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689010449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010449, "uuid": "bfcfe41d-525d-4a4d-b0a4-c67b27f510ad", "comment": "Malware payload (RedLineStealer)", "value": "03c70427b7f46efb268904efce07e208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010449, "uuid": "be6fdd76-c4b7-4122-aabd-e0ea847fbc81", "comment": "Malware payload (RedLineStealer)", "value": "e72a6e51dbac1e6313459eab1ffc1832d973b0fd23fe10aba5acdee9ba028f6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010449, "uuid": "93d20151-613d-42d3-aede-88678e268db2", "comment": "Malware payload (RedLineStealer)", "value": "6201e0eb7f063348a80543fce2e4f92f064624b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010449, "uuid": "0a54cdaa-bf25-4ed1-8093-591786f3af90", "comment": "Malware payload (RedLineStealer)", "value": "6b8b407fc00bb36d26678d6364781cb49eeb963d476f1bb6ae67aba939f7976bc3ba3694b06ab4a04de078d8698954af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010449, "uuid": "29f294c0-7855-47dc-9193-016acd9fe6a0", "value": "T14405226397D88032D9710BF0A8FF13830A36BC949CFC526B72819A5E4C726A0797577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010449, "uuid": "c6d7df28-c0b0-4a22-84b1-929eaa2640ee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010449, "uuid": "355747f4-17ad-41d5-8349-62cd11458e5e", "value": "24576:gydW77VD+If1MjC21MKDHlSX6YdG16mys76:ndY7N+7RKeH0XXA6mn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689010449, "uuid": "285962d3-9e2a-447a-ba3e-2dd7216db9ce", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689010449, "uuid": "836e36ed-24cf-4bf7-9804-15fed4238254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010449, "uuid": "cf67f88c-b59b-4c30-bc3a-68593e367156", "value": "03c70427b7f46efb268904efce07e208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d1d06b-1f2a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688997604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997604, "uuid": "cf80cc5e-d4b8-4717-a1e0-c4c772dc8217", "comment": "Malware payload (Mirai)", "value": "e8a212eb68c5f257d6782cbf18057229", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997604, "uuid": "4f83a207-c56b-4f81-abf3-2e9606f846d7", "comment": "Malware payload (Mirai)", "value": "e76398d81b7ae35e233031d41f57d7dbf324c51eb52f2e6b7250bab174ffab14", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997604, "uuid": "86e7c7f8-5021-4645-931f-fd70a4e41064", "comment": "Malware payload (Mirai)", "value": "b3ef99a8a273d1ffdeddc2cc004ad383d945e02c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997604, "uuid": "b3b688d6-8b84-49d3-be33-f2ab6810f384", "comment": "Malware payload (Mirai)", "value": "ad1dc1689c4dcd61d099f457fa12b89822939743ef22b622ecc0e1aedab480c6199c98b266fdcd46bfbc69f244495905", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997604, "uuid": "31609676-8362-42d7-915f-cc7b7697940d", "value": "T1DB330233DB76706691616773EE3194B7A704AE7CB07AB24654B065026FCB8119FB02CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997604, "uuid": "a60c07e8-3ef4-4057-be00-2467530d7212", "value": "1536:j9O/31Zb/VOHHqALcPqF1aBexo4opKZbg:j9O/3fbdOrLGqFUF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997604, "uuid": "d5bef0d4-0bef-451c-b4c4-7daf79cfe706", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997604, "uuid": "624fa786-36d1-4462-a12f-82745098c63e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997604, "uuid": "52264e5f-1d5b-4320-81a0-094af49dd458", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8131a13e-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978034, "uuid": "5ae2bbd3-fdcc-4090-b8bf-305581472cec", "comment": "Malware payload", "value": "13f70599d45462eebb3c350b2d3047aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978034, "uuid": "2f62a730-f2e0-48ac-9ca6-64b07a547e3b", "comment": "Malware payload", "value": "e782759582e4131edd6f8cae6b6a4ef9a292f548b4eab6a1095525ad837f8377", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978034, "uuid": "242850c7-29ff-4729-9fe4-49b8117cbe04", "comment": "Malware payload", "value": "eb35e7a41ba2ee1b72d7f2a037afe0d01759bbf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978034, "uuid": "62994d0c-c7ea-4c3e-aee1-e2f02f87be7b", "comment": "Malware payload", "value": "7c85b91c6f5154f547c4db2c8a3d369d168f5f74e0b4e8ffd7a08846dbe13ce8e02f6b920ace8e19358ac24a111a753e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978034, "uuid": "f7db1d18-25ee-4015-b83f-93322022e9f6", "value": "T1AE135C57B71C0647D1B75FF43A3B27D4C3AEBA6011D896C8250EDE819372A306962FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978034, "uuid": "c1f7ae38-3cce-4c3d-b407-130e438cad6d", "value": "768:PbDrpGueAdjs9Sm2PCYUnI2+NFt6twCAIIq:PbDrpjeAkSbPCXnI2g6ydIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978034, "uuid": "c3feda81-2663-4c35-acfd-39d20c15bd41", "value": 44732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978034, "uuid": "d866c055-e90d-4fba-a6d5-23f1d037799f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978034, "uuid": "a404d9f0-0b8a-4fc4-9af5-764154ebaca7", "value": "SecuriteInfo.com.Backdoor.Linux.Gyfgyt.BR.MTB.29575.14577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c2e2cd-1eeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688970923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970923, "uuid": "efff86fa-c4f4-4dbf-83a5-38452163f691", "comment": "Malware payload (RedLineStealer)", "value": "555130b15de00912192ccbcbe542f38c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970923, "uuid": "5a897e2f-9caf-4730-975d-7dbe46c4c3d8", "comment": "Malware payload (RedLineStealer)", "value": "e833637e5768f06be352be55cedbc8b33dc41fc54b20e1699ab2d8fa09c045b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970923, "uuid": "5e3cd301-b21f-49cd-9ef2-5ac85a0a8172", "comment": "Malware payload (RedLineStealer)", "value": "eba264d34e0fda68f692d34a564fb499db587229", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688970923, "uuid": "81fd6bd2-41da-4089-8c97-f8b2c9ac0a1e", "comment": "Malware payload (RedLineStealer)", "value": "8a11db3ce0b2cb935ae736ee4539f081fd1f39e7b759fb4703eac2955b804b067809890342f2e84d14b2a3e843857ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970923, "uuid": "bc615d8c-8cc8-4f25-9876-8619e65f520e", "value": "T1D2C401A175E2AA33E57210725A90831FBE2FCA711AE05B8383C5B53D472D1D24D3ECB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970923, "uuid": "e2f52b01-20f7-4ce4-becc-e4af6aef1854", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970923, "uuid": "046edee8-6e45-4502-9d5a-1264dda0b9d8", "value": "12288:6regHeDz474LFDc42uM3RoKQfwT6NldyV2:6H+H47sDwuMhoKQImY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688970923, "uuid": "078af461-dac3-4609-bdfe-9e556437c8d4", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688970923, "uuid": "b863c911-7f8a-4879-811b-d65fefc39e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688970923, "uuid": "a036859f-d57a-4791-b7b3-1f739077966b", "value": "SecuriteInfo.com.Variant.Lazy.360290.3736.2342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b3ad9e-1f0a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688983917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688983917, "uuid": "9415bb02-4d2e-4b61-b3d6-6aada16431fb", "comment": "Malware payload (RedLineStealer)", "value": "ce7e1d1cd104a4a7c242689ac5c39b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688983917, "uuid": "2f9597e0-fea9-4da5-b7f4-322678b34152", "comment": "Malware payload (RedLineStealer)", "value": "e84450dd9afdaacd15e943271f9e0d0c52b2d98f615bbe91e701238f2b4a13ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688983917, "uuid": "c1c16676-a10d-440a-80c9-2e5c7e64903c", "comment": "Malware payload (RedLineStealer)", "value": "c6fa8af4763985ed39b4d285ed76624cfb8f0ff2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688983917, "uuid": "4db3594b-22d6-4eaa-aab4-5d3323b09bfe", "comment": "Malware payload (RedLineStealer)", "value": "ac9e52d327cd4a69aa2eae592b4b8a2e06b9f1fa8298b04f723f59b7a881eecd7924f4160f9666702e68399f3affb63d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688983917, "uuid": "2c3ad74c-e691-423d-aed2-8fa688f4bccd", "value": "T177B40270B1D28A63E67214336590922EBE1FDB7658E1578383D57A3D8B291C10E3ECBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688983917, "uuid": "c9b6a75a-d21d-40fa-b657-1d2858e356f1", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688983917, "uuid": "0163ab36-6d23-49f4-b03c-339ff14685a0", "value": "12288:30UXez473QJ2y2+w4fc6gYz+GQF1zZrPLcttZ7MwV:bk47gUd+wOc6gRX3VPutZAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688983917, "uuid": "7df50076-993f-4cf9-9ad1-586c0eea07db", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688983917, "uuid": "5805f0e7-58cf-4b9e-af20-480973071026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688983917, "uuid": "f21ea6bf-cd23-4155-bbb4-57dd6cc21bbf", "value": "e84450dd9afdaacd15e943271f9e0d0c52b2d98f615bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4fab07-1f13-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688987849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987849, "uuid": "f431ed3b-b127-4e53-83a1-303cabce56f2", "comment": "Malware payload (Amadey)", "value": "8d9b21e2e4b30c87adad3fce37cd1883", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987849, "uuid": "2dd41a36-f9b2-4f7b-80f9-b75b95b63b2c", "comment": "Malware payload (Amadey)", "value": "e8fa1db3685a162be6fa212aff39f207b68d975eaea69b2b9a5620d296d82eba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987849, "uuid": "0531a7ff-dc2d-41d8-9e60-159706f1b769", "comment": "Malware payload (Amadey)", "value": "af7a9585d2760c18c255c950c24620ff49bcaa61", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987849, "uuid": "5e9147ea-e235-4230-848b-0656c030c8dc", "comment": "Malware payload (Amadey)", "value": "9068e95e572485bcbc96e8b96467c54512b9ec0fa9fa19bb6d6f02458c0f8416ce77611e11069426881892d76056bd95", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987849, "uuid": "32d91cd4-4e24-4ca9-b692-c772db12f157", "value": "T106C4F16171E68A23F133043705A0D26FFE1FE6315AA09A97A3C5753D4B282C15E7ECE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987849, "uuid": "ec9d3a66-6870-4f30-b585-5f79ed692c9b", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987849, "uuid": "decefdd0-2317-448a-a40c-8166ad7e4005", "value": "6144:joGEwjb5HBZVCWGYLUz247hf1mn4FZXFg05bJ+6p/tgRoGVD62WjIvRX3NAaa9Vl:jog5xz47V1mn4dgG10/D7WKRHp+mF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688987849, "uuid": "1e551be5-f209-4ff9-aab2-779581d3d41d", "value": 552096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688987849, "uuid": "dc64901d-7572-4b35-b00d-b7c846b63f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987849, "uuid": "f37685de-b251-42ab-a34e-819be28b1bdc", "value": "e8fa1db3685a162be6fa212aff39f207b68d975eaea69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864c9748-1f06-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688982337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982337, "uuid": "a5882ba9-e2df-432f-8c2c-4c6c9e256e47", "comment": "Malware payload", "value": "2fa621fbcf8eac365dfa70e1d43be896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982337, "uuid": "da2bb3ff-f4e0-4ddf-9a05-6198a5630d34", "comment": "Malware payload", "value": "e9d66cf6f1db943e894e135519dd2bc6a8d01caf710c0eb1c513669cd10b659a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982337, "uuid": "1947b5fd-13b4-4731-918b-bee1af8b03c9", "comment": "Malware payload", "value": "e923e00bace86dc809e7829f207cfd069bb79f26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688982337, "uuid": "a238c0c0-1089-4aab-bbac-11ac8c2c3212", "comment": "Malware payload", "value": "36e92014323a89ffe667f661b31d1bf47ac4bca0cf7109f822aa2f0f63c5a2db299bd0e9f8f8977cb2d196dd3a0dc079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982337, "uuid": "299da2a8-420a-4b70-9f2c-b7acbafc5a2c", "value": "T16AB63349F3A108D8D957837BE4C2C852A972746B43FCA28703BD78950E87495BDBEF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982337, "uuid": "4db7e5d4-9355-4dab-ac92-5d4e33451af7", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982337, "uuid": "0a47a3b0-e740-4e42-9426-3735ec9982d8", "value": "196608:IdAVhi4FMIZETSwjPePdrQJpaw2cnUXIZVDBNOq00W8/LajYPLm3:nV0QETSwvJpaw2qrOqzW8iKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688982337, "uuid": "641a18d3-ed26-41d7-87ee-6f078633603a", "value": 11045275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688982337, "uuid": "27d5dd26-3a1f-443a-b84c-653542246a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688982337, "uuid": "e0a76958-7900-46ae-825f-b7e565846ad3", "value": "hello.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672a859a-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688981856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981856, "uuid": "1b2a911a-2aad-4001-934b-e1be31be703e", "comment": "Malware payload (AgentTesla)", "value": "a868d6441a220f8b3e0c5692d818a99f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981856, "uuid": "49492e0c-d4c7-4c79-a13d-535e560e1d83", "comment": "Malware payload (AgentTesla)", "value": "e9e8fca16128ab24243e04f97f894a93f4128a14927522d0b6586022560463fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981856, "uuid": "4af40652-bcf9-4371-bc9a-efa3e3ac0950", "comment": "Malware payload (AgentTesla)", "value": "384084c887d37eafa0b5347b1c2dac384e67231f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981856, "uuid": "831c7651-50d6-4c9e-8893-a3b5efef6065", "comment": "Malware payload (AgentTesla)", "value": "c33da3f058ebfa7efae058f9b673657dd27ac703adb5a68e49ceddf752bf45b2bfdeeb12a3ca8f26530c22a8615acc69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981856, "uuid": "aa859a7e-9624-46b5-98aa-c41a1cca0e11", "value": "T180F45C3819BC5E22C475C3F64B94C061B26499EF3265CF2A5BC296D5461EF022AC7E3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981856, "uuid": "89a93fac-d1f7-4087-93fd-6589a467006d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981856, "uuid": "7f53b6cd-9d36-4001-8187-cd0e7cef4895", "value": "12288:umRyl+gorm8n1WTb9L1gEbIvejHEJrQsVkwq5JXb:Ul/onYTb91gKIvIHGQsVkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981856, "uuid": "9ed1fd5e-5322-4d13-85b7-9c0375aa626b", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981856, "uuid": "26afe6ce-db56-42ed-853d-c1a3c1884687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981856, "uuid": "b57e3076-9ca3-4e1a-8700-c73f3c538bdd", "value": "Doc#3256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d76a5b-1f6b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689025803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025803, "uuid": "8e68b49e-e298-4440-a033-14e576dfd84e", "comment": "Malware payload (Mirai)", "value": "64b720f27539906cb944fac76ec09b4a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025803, "uuid": "55b84328-f433-418e-a3e2-6820ab0129af", "comment": "Malware payload (Mirai)", "value": "eb812589966f7cde24f0913132ab7d2167d5b0f2f660973584dd8e7bb92941e7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025803, "uuid": "4c342d55-d694-44ff-b9ea-a0d2fae573c3", "comment": "Malware payload (Mirai)", "value": "59cbfd8faba52f80e0052de3ab70b25724ad564b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025803, "uuid": "a2661752-9bf5-47d3-b432-97705ef60a5e", "comment": "Malware payload (Mirai)", "value": "3e85eebcfe9b97545cda94bd001f6ac4ae938c639b0fa93e9a0f689234bdd51ba3ba074e8c6c1ff349e7f7f165e93c0c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025803, "uuid": "9f3088f2-9cad-4414-90a7-1b32ce9a9113", "value": "T138A2E155BF18818BC832297551E9E9D21253FC72F2EDCC192A40C16FF1A33A91874F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025803, "uuid": "af39e32d-2126-4707-ba22-76adf26169a5", "value": "384:MsiLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKg:G98o08kxofBE+ZkXaqGbp2F2TWul0c5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689025803, "uuid": "cda2d120-4385-4d6b-9bbf-fb2a9bb3917d", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689025803, "uuid": "24e3dbac-aba6-4c19-b308-7bd3fee97963", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025803, "uuid": "7010d3e3-e516-46df-abd6-3c965ddb8607", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b17db5e-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688985755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985755, "uuid": "6a76ee06-f36d-412e-a715-14c10a322d2e", "comment": "Malware payload (Amadey)", "value": "a87666481f7d0ad8d0505f0307c367fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985755, "uuid": "31750991-f21a-4ff4-aa3c-13234b39dd49", "comment": "Malware payload (Amadey)", "value": "eb89291c737f05c2b6bd862d9e83ab5a1cb5bc2333a65b1a95816010e59d50a7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985755, "uuid": "2315bacb-802e-4772-8bcb-2277d3c1596b", "comment": "Malware payload (Amadey)", "value": "a27ece97ae5e2a477552537de975758c287169bf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985755, "uuid": "8d23c880-da3a-480e-af08-bd94cf043847", "comment": "Malware payload (Amadey)", "value": "0863f45112f1419a592768d0f2d6976ae94e25345f7a9e307a9ed94f9c08d1b7e2e8dc5426df48ff38670ce5ffe93b4c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985755, "uuid": "fb327235-8815-4c20-9e7d-fa2b08a1111c", "value": "T1350512B1B1D25123E532247759A0912FBE0FDE361D9096C7A3C5763E8B281C34E3EDA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985755, "uuid": "48abbfab-7bea-46a3-8fa9-e9f29860d039", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985755, "uuid": "22f26e8c-b663-4b77-b917-a42afae45dd5", "value": "24576:6J47/ojk3XSMcSf7QnL0bu8iPtgX3JroL:6Jq/oQ3XSzW0Lqi10J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985755, "uuid": "f5a34bee-bbd8-4b5f-b11f-f59486f786a0", "value": 826016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985755, "uuid": "2934d44f-c5d9-4111-9b01-bc2048bbe005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985755, "uuid": "8e821622-ac09-4412-a97a-6c817d1456a5", "value": "a87666481f7d0ad8d0505f0307c367fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70b090f-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968246, "uuid": "7f791c2e-23cd-41ca-b541-e631693af6a4", "comment": "Malware payload (RedLineStealer)", "value": "328033700dd006dafddeb02cd631bc36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968246, "uuid": "b6c1d036-10f3-4096-9aec-0a1651016f54", "comment": "Malware payload (RedLineStealer)", "value": "ec41416a602d3574487fe6d421cc0a579213753d3e770edbf4bef3c3a48396b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968246, "uuid": "ca805492-32e1-4ff6-a079-753a85b17e49", "comment": "Malware payload (RedLineStealer)", "value": "0320be07156be30d5963db61df35db2231919600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968246, "uuid": "02ada241-bedd-4d8a-b759-d44c9148d256", "comment": "Malware payload (RedLineStealer)", "value": "589bb3c742a0213c65b7fdd883ace170f5640874cda0c0f8ea5864957081fcd282f10959b3f15ac12d21b1651ca53cd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968246, "uuid": "4ec938c1-6712-45cf-af55-f4743124243b", "value": "T17EC40270B6D24563E67215331990822FBF0FDE310A60569792C9763E8B391C18E7ECEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968246, "uuid": "56a19500-09ec-458b-a1c1-15330a03ab3d", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968246, "uuid": "71201e2f-93c7-4aef-bfa0-3747797baa1a", "value": "12288:BU8M6z4716iKOKlIQhoe9cXkid76i+rtIK:io47gOKlI+RVfIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968246, "uuid": "a3b881aa-e169-40a3-a68b-648bc12d43d1", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968246, "uuid": "d46e3d0d-5d98-420b-b1a5-1b62224f83c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968246, "uuid": "57fdcdd1-cd75-4ee3-91cc-9be089ff48ff", "value": "328033700dd006dafddeb02cd631bc36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370c9a1b-1f5c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689019141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019141, "uuid": "235c7dff-7bdf-4ae9-92b0-6d1741b27cdb", "comment": "Malware payload (Amadey)", "value": "102cc57cf59a9b99f5615c58ba8ae4a2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019141, "uuid": "e41e7baf-1544-4d51-849a-d9eb11118276", "comment": "Malware payload (Amadey)", "value": "eca60134d922b4bca2cb5060841b6d45581f33e04f763a9c118fc9f22e289e3f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019141, "uuid": "0a1cfabc-3525-4982-b5da-f6ba86796d21", "comment": "Malware payload (Amadey)", "value": "0e92c89813cae891a354a5feea121b2aad6d77ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019141, "uuid": "0ba1445c-97e0-4312-8003-a51b1441d7c6", "comment": "Malware payload (Amadey)", "value": "6c43fbeada5ba65e7e5c6eed2718cab4420b721c5dfe4d8fe07dde71233e5bd0b3748f452350193a9f0f28530bbff223", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019141, "uuid": "5be6f73c-5fbb-4760-bc97-61d3cce91c87", "value": "T1BE152303B2C695A6DC76277499F70BC31A327C92EDB4875B2B54560B0CE36989D30B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019141, "uuid": "ed68bc51-e1c4-4f6a-8e19-408075f23445", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019141, "uuid": "e6affa8c-431f-4cc0-b935-fa373619db43", "value": "12288:6MrMy90GsPfX7+uwEvNGQdJ6HpKFKeVNxsZMQDkbQFUoSCfd07Cw:+yqL+ubvUQyHkFKaxsZZugRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689019141, "uuid": "25742bcc-852c-4f12-b8a4-840a99cf5f2f", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689019141, "uuid": "09cffc78-3d4c-4043-8b7b-5394bf464bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019141, "uuid": "b1dda363-69cd-408c-b126-7a4051465a7c", "value": "102cc57cf59a9b99f5615c58ba8ae4a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6376e78f-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688990869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990869, "uuid": "30ca3b68-4e9a-4b6c-975e-71e8361629b7", "comment": "Malware payload (RedLineStealer)", "value": "c3fa8e032f5d861d937b6f06bcd9afe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990869, "uuid": "7456a4c6-e678-4db2-a993-bb75047f3cf3", "comment": "Malware payload (RedLineStealer)", "value": "ecac19e39c6b7f18fff83c933f4228ba45f704ea3313563102c666f1a13bf2ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990869, "uuid": "21e9eec1-3c32-43e7-92c8-a2396d57946c", "comment": "Malware payload (RedLineStealer)", "value": "9fa4d5a8d6996741fa392c14c3c1c66268160a95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990869, "uuid": "1a32fb50-ff57-4077-b435-6c4efa4cc2a5", "comment": "Malware payload (RedLineStealer)", "value": "d15f839ec73bfcbfbdf5151998bbc657f988880c8bb8f8730905c137d1a1ab26d739ab0cb30cd36f6d3423a0732035cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990869, "uuid": "2006e15a-f8bc-488a-846d-a5cae3e96ec0", "value": "T10EC4026571E30623F97210761A90D26FFE1FDE3105918A8393C9793E8B2E2D15E3DCA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990869, "uuid": "d0b3191a-97c4-46ef-950a-c608338ef8a9", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990869, "uuid": "1a3da1b8-4cc6-466d-b6fb-ee51b878f906", "value": "12288:GRegHJfz472AMLw/IBDPpNfswYjSU3nqqu:Wpb47znwBLf+ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990869, "uuid": "61f56fd6-e107-40e2-906f-d2912c110cb3", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990869, "uuid": "2257891c-4435-4e99-8e01-cc2c43c0fc08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990869, "uuid": "43abd5ad-1e45-44dd-808b-a0b1dfa74446", "value": "c3fa8e032f5d861d937b6f06bcd9afe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866c4d5f-1ed8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688962581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962581, "uuid": "a7da58d5-f78b-4b2f-96c3-d6c9bc33d32d", "comment": "Malware payload (Mirai)", "value": "c39ca71c74d70ca85ec61ebf76e9df50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962581, "uuid": "4c40b47c-aa1e-4327-b042-83e5bfe3ee91", "comment": "Malware payload (Mirai)", "value": "ed05ca1014d490938ddd7b099b7179685a8a99c0c83159dce6519b82fcb13327", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962581, "uuid": "1266b79c-d305-4162-abc7-1456a61ce381", "comment": "Malware payload (Mirai)", "value": "069f0fe2fc04c2b100fe7b6db82fb4fc62a43651", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688962581, "uuid": "cedaa71e-27ae-44f7-838e-bc722c22c1f2", "comment": "Malware payload (Mirai)", "value": "bb22a253c427d435a04f2a56462561d5f8c49cc3e4e77189609c5c70108721471952cfe35204ebfeb9514062b45160ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962581, "uuid": "0768793d-64c2-4592-9c55-548eb42a7667", "value": "T1CAF2F11063D6FD61E73C9AB4CC6B009F709A17F190BB31A2ED8107A9297F61327A900E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962581, "uuid": "b9f55892-09a4-4cf0-8120-eb6e28e5d2d0", "value": "768:aMI5/Efb4u5uUQSzCzx3po06jRzHsL4L2kV7YL9q3UELQ3F:alsT35u9SzCfE1zTL2kV7bLAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688962581, "uuid": "bf36e280-4a0f-4f23-a0e4-b0491f87e861", "value": 34896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688962581, "uuid": "5f71cef1-37b8-4ffd-8072-45bc01fef08b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688962581, "uuid": "1f1aef28-7d88-4d45-8f7e-9dce18c755f4", "value": "c39ca71c74d70ca85ec61ebf76e9df50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a76eae-1f5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689018843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018843, "uuid": "322b7cee-47bb-4311-8ada-2186b19e8709", "comment": "Malware payload (RedLineStealer)", "value": "606fbe646ebb4df5c3f5b54e46c0fdf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018843, "uuid": "44a0433f-ec13-4d0f-a60f-63c7fd68a0d8", "comment": "Malware payload (RedLineStealer)", "value": "edcd11e45efed930a5a9563c77aa25c91d52061edd71739f3b01b63568f9d706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018843, "uuid": "3f981c0e-fc2a-4eee-b977-1e082bae2028", "comment": "Malware payload (RedLineStealer)", "value": "8ff94dd2d2164452af6a4b3dcc070b3d83df1a08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689018843, "uuid": "c86400cc-6a58-49a9-a963-54c5718ef90a", "comment": "Malware payload (RedLineStealer)", "value": "1dd91f768735ed173ad88e2f9136f9930f5e4f790fc68bbe9581e75f4e6962829bbc900f9c4612c25dfc96018bac5e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018843, "uuid": "956783a2-bffe-4662-af7c-26ede1b24e2a", "value": "T135752323BAE894B2ECE10F7154F355D30F26FEB9153102772718AA2F19B3A905936736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018843, "uuid": "e9a48bd1-3400-4b04-a766-64172cf5a67c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018843, "uuid": "619ff5c9-ac66-4760-a3a2-b3c6e7cf844d", "value": "49152:7ir0XAypplkMlIMLZ3RqJfPoH3SRm0QIrbQX:G0XAyJEMLZI4H3ADf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689018843, "uuid": "b327502a-9efc-4338-853d-903a74340995", "value": 1589248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689018843, "uuid": "7ff2fb64-d69f-44a9-9f98-83468ccc523b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689018843, "uuid": "d078b5ed-65f1-46c3-979b-831da0ecddec", "value": "606fbe646ebb4df5c3f5b54e46c0fdf1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ca9207-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688968879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968879, "uuid": "5b7476c3-6a55-48fa-b1f1-76988d9ec047", "comment": "Malware payload (Amadey)", "value": "dda01c237c5a096170569ede178fd7fa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968879, "uuid": "7583f46e-ab78-411d-9ef7-4d6b321a4f66", "comment": "Malware payload (Amadey)", "value": "edd2dc4b0833fb089b241f0a2493766d2c70efaf339162462672af68ea310e43", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968879, "uuid": "d41ff1f8-8260-4cb4-8194-372dcdbcf77e", "comment": "Malware payload (Amadey)", "value": "763e08f979c863fcd77b327f216ad407555d78b7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968879, "uuid": "acfdae26-65cc-4016-9e3e-c14f95031af4", "comment": "Malware payload (Amadey)", "value": "501b12b7ff9d3fc93a2f202961b8be45ca0e6d91dda81560f540a00425bd7e69b85b1b0a38a6f3baa7148685aaf56d45", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968879, "uuid": "96d0358c-e239-460d-b9b0-2dc91833925d", "value": "T166C4026470D29823E632143729A0826EBE2BDB7509909B93D3D5753E8B3D1C15E3ECAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968879, "uuid": "4ed3135a-150e-4726-8b78-5bae210aeaef", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968879, "uuid": "d515d899-0316-4955-b162-8d9d83bf5292", "value": "12288:a08ajz47lupda9C3Bw2UJ4M0BQEjM3En46MD2:xn47ApdaCxwDJPQME46Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968879, "uuid": "67c30b38-7d2e-41aa-8a82-8fdd12b7d2b8", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968879, "uuid": "6be53662-c230-45ca-9f0c-96956c520c42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968879, "uuid": "0b411489-5d4c-4b6e-ad34-082e1d73c93e", "value": "dda01c237c5a096170569ede178fd7fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcff99a-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688969113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969113, "uuid": "02f8b55b-96ae-43fc-9c8e-51a4ffb83811", "comment": "Malware payload (AgentTesla)", "value": "18b12335e3816c8e0bd4e848481c4c09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969113, "uuid": "40c998a6-8a4d-4c34-b41c-e7974485c0aa", "comment": "Malware payload (AgentTesla)", "value": "edff708fc8fb47bd60e83e14d6fddbfb71b2d8a5d81262e512501e57ab703e04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969113, "uuid": "89d0c259-555f-4609-a722-1011049ffe36", "comment": "Malware payload (AgentTesla)", "value": "36dbda2234d3b911f3b6b4c28c448f69b0d209bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969113, "uuid": "c4031f28-32d6-4d80-ab99-ff106657c3cc", "comment": "Malware payload (AgentTesla)", "value": "03a8de4e922e820a21d217e17cabdbe075d8e600eb8f8fd5ef495c597d4eb322cb263f1ab8dc6403ac632eecd0e247af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969113, "uuid": "5b0a6001-14a6-487a-a352-629aea434cc9", "value": "T17DD423D209C1D4A85FAF1D19F381EDBDE0CEE816961D147E30C22177B8123AE63E65E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969113, "uuid": "dc1e0cb4-e2b0-412f-a794-65951bb02c6d", "value": "12288:o7I80SJBAxvebjcuPING33ZX8DwlJ2vq8jkHJOlaiUjWja4p:oc85BAxebAbWpMDnq8uiUjWja2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969113, "uuid": "ca1e9af9-f958-4bd5-8ffd-5f294b546e92", "value": 645299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969113, "uuid": "7cc61e00-b1f3-48c6-87aa-67b922fa5cd1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969113, "uuid": "f1134c7b-cebf-42fd-8074-37deee51e8b7", "value": "OOJHG6B7cVYv5YX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77832c33-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688985749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985749, "uuid": "08bb09be-7d20-4964-91e2-0519f745b3c8", "comment": "Malware payload (RedLineStealer)", "value": "ad72ce3d6a76a9cb11553ae8220f5fe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985749, "uuid": "619eebde-a685-4eca-af80-5be5518fd374", "comment": "Malware payload (RedLineStealer)", "value": "ee745c72514949d204f54a6978f389b8fd6105f495b16b914f25d10bdae27681", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985749, "uuid": "bf5f6b8f-43d7-4f63-a550-71114f532a21", "comment": "Malware payload (RedLineStealer)", "value": "647fd1355eed754a38105a1b6e88ae2b3abd9a6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985749, "uuid": "1575ff02-26b1-4f42-a07f-303faec6d325", "comment": "Malware payload (RedLineStealer)", "value": "5b1ddd85d6d55df57ebda1379cbe1e59d203cf9cb30d0bac8d6c48986853af81ff10e992c124f25425dc4a3bfccb43c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985749, "uuid": "6bf99df1-a930-4189-9017-fb2416cf4d76", "value": "T111B402A1B1D39523E93300775950D22FBE2FDB3159A0568793C97A3E87391C14E3ECAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985749, "uuid": "0a6441f0-e21c-4134-8b04-6b494e11d088", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985749, "uuid": "dd838033-174e-4bfb-bb2f-0c51e02144ff", "value": "6144:+GPD0GqfHBFwCWGYLUz247voS1UnERnRifLxHIHs2SCs1hO8NMN500QVf:+GYZ2z47vr+ERRaM/SD1hO8FH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985749, "uuid": "8c7908d1-b88c-4d8a-abba-ab67dcbd5394", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985749, "uuid": "859eaba6-8540-4368-bf3a-d07a845b4f2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985749, "uuid": "2dab8208-8317-4046-84f1-8f4aece423bb", "value": "ee745c72514949d204f54a6978f389b8fd6105f495b16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9725d5-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688985705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985705, "uuid": "7e8daec5-cd4e-42a5-91f9-062e7b6a435c", "comment": "Malware payload", "value": "2b84db399b2f62a0e0c5073eb5a6525b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985705, "uuid": "b0f28cd9-6400-4727-beda-ddcd89e2a08a", "comment": "Malware payload", "value": "eea607d352acc2a926a260b29b37b48568f7308a154194c4ab6fdd793688ae9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985705, "uuid": "d531bd4a-b0d9-42e5-9950-3ee783c68baf", "comment": "Malware payload", "value": "f90a79368d3fecfed3bdc16f3202c021978fe435", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985705, "uuid": "860ea069-330e-4c7b-995b-d898bfa6ca5f", "comment": "Malware payload", "value": "7f4b9f703e21cd5d61b9a6c7644831fd1e4d7845dbd95096cbe4d775c06cf859447fd19eb8e9abb1a54697b5310728ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985705, "uuid": "5369c8fb-689b-40ba-8099-9a1e5d6da564", "value": "T1635366697E21AFEEE67C82310BF75E70939522D236E1D284F26CC3084EB124D589F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985705, "uuid": "683774be-dd5f-46dd-92ac-c7eff3d2d1f6", "value": "1536:il1u7fHczaV9JpFgJtqyLyY71axQVDeOVJAra:4x1axQj2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985705, "uuid": "881698ae-a5c9-41e8-9b1e-4283c0e89b66", "value": 61472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985705, "uuid": "028b14bb-ad33-48b0-b6ce-6fc7ea6af70b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985705, "uuid": "ba408c73-3995-4674-b9fb-49d275c43e06", "value": "SecuriteInfo.com.ELF.Mirai-AJJ.28119.19169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0e1628-1f3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689004704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004704, "uuid": "7a155428-24dd-465b-a7a2-3dc1e03163f2", "comment": "Malware payload (Amadey)", "value": "327d4c708883a33864d87e20fe338e4e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004704, "uuid": "a5269981-060f-4e6a-b2f9-cbf878936bee", "comment": "Malware payload (Amadey)", "value": "eedc883713775fd0c74224f0bedec2b1e88a105737c823318fc8ba819901d991", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004704, "uuid": "b3923bb9-fd7a-46db-bec0-b785322a7d94", "comment": "Malware payload (Amadey)", "value": "113fd0267f24bbce914cc6c40946666f949e71e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004704, "uuid": "d79d2663-f057-4bc9-a40b-59e3d8f0f69c", "comment": "Malware payload (Amadey)", "value": "eba97c0a11ffc76e41bab312193a21960f1fae83229f65d07306fe3381722a063bdeb3dc8df38bfbce860ece98edd70c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004704, "uuid": "0bad7fb8-cbe3-4324-af36-ac70e280ef27", "value": "T12D152203FBC5C137D96117B194FA03531E35BDA5C9B4532F27DAAC9A0CB2690A23672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004704, "uuid": "f79ceeb6-a8db-438c-b315-9a480d947fc4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004704, "uuid": "36f61b37-b18c-4f61-af38-8fcc9630502f", "value": "24576:Gyes+XVnvEZEwluVaizN/nbr+pr72IbKJZz:VesgvEZcVa+hnbKp3KJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689004704, "uuid": "ea6f2932-5345-4861-8570-cdcc7c415b74", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689004704, "uuid": "dbff0a51-8171-425e-b2e5-fadc5e1807b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004704, "uuid": "35a9e929-a6b9-48f2-bd31-4a98023babbb", "value": "327d4c708883a33864d87e20fe338e4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbfb245-1f5f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689020659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020659, "uuid": "bfb7c8de-8d15-42ad-b38c-bdb035bc2280", "comment": "Malware payload (RedLineStealer)", "value": "ef3be28bcdf8a1a9af579a4ada1ebeb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020659, "uuid": "a8bc6103-532c-42cc-bd84-4be3f6e862bb", "comment": "Malware payload (RedLineStealer)", "value": "ef10358f6699d268ee57bf197c7b69caea70f503fa2570b160171f907afbdcca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020659, "uuid": "634f987a-866d-48a3-955b-3c58f5b80255", "comment": "Malware payload (RedLineStealer)", "value": "8396c56ed2440737e4cba9bd02dc7c8167dfc8b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689020659, "uuid": "fa438fc1-0269-4035-b5de-2e2f8363b0e1", "comment": "Malware payload (RedLineStealer)", "value": "a3660e8adff84e050ecb3c3d5a6e36cc8d2b621a2812ca6c51d63ca49b5cf71d66d042bc0bc35fd9eff2504b963926b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020659, "uuid": "c10a27b1-b974-4972-b7f1-3a8ac7349402", "value": "T1AA15220BBAD8D931DCB25B7048FE03C30B35BCE2EE64856A2785594A48727D4993277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020659, "uuid": "77377917-c13a-4fa5-936e-e83f7d21a2bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020659, "uuid": "b068ef5e-ceae-4267-a9f9-69fec9826823", "value": "12288:AMrly909HkVBmTTidIui+XPa36sj0mbCPOgjQVdmPlNhDje1shJ53:1y2HkVQe7L/lAMOJdYje1shb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689020659, "uuid": "3da94c08-64e8-48ba-94cf-80e9d8a352bb", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689020659, "uuid": "227778d0-f283-4b19-8dff-0c05b53df3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689020659, "uuid": "1f23dc6d-a87d-410e-868a-651df36bb09b", "value": "ef3be28bcdf8a1a9af579a4ada1ebeb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b08888e-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688978023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978023, "uuid": "3a8dee1a-cc63-44b0-a052-3eb3934c29e7", "comment": "Malware payload", "value": "798a5db883c8172454f1c3e132b15cac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978023, "uuid": "738e794d-9126-411d-b36c-3455f6c81743", "comment": "Malware payload", "value": "ef99f7c9cd9184132b041323921aa1f482f9e15a2700561250d124025f96bee6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978023, "uuid": "c06ba36b-21ae-4d48-bcc9-03cdf8b78a4f", "comment": "Malware payload", "value": "d276c6e03b766c4877738f1b6affff06e05ceb81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978023, "uuid": "4a13683e-5df0-4a7b-887b-6082b5ff8897", "comment": "Malware payload", "value": "a63227363252238adc7192114b48850e3f17d42036dea2c29ba8d390d16e39765ab70d44e7810c13cabce8f99ad64f8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978023, "uuid": "d8040157-eb65-47c7-9948-4065e047375c", "value": "T1A323FA88FD55A22AC7D162BBF70D03CE373B0768F3DA32129E355B2137C6A615A3A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978023, "uuid": "d20876b7-90c9-423d-a18f-534ada21a041", "value": "768:pK4YbK9Icv6XeRczzG/ACowxMU1pF0POGr12rD32zoUVq+wmTnvbI:SKWtORg/Cq4j0POGrw0d9Tvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978023, "uuid": "3b56429e-dbd0-4ade-abca-2627160f686d", "value": 46408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978023, "uuid": "4761260a-b9d0-4508-a6b0-66a1720891ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978023, "uuid": "bb431805-d7e0-4f6a-904d-bcf46cba172b", "value": "SecuriteInfo.com.ELF.Mirai-CE.22674.11613", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a35db6-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688978197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978197, "uuid": "71ee2c2f-1a8c-47cf-8681-6f653662d78b", "comment": "Malware payload (Amadey)", "value": "b810e661378b0a3e898aa32c65e8659d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978197, "uuid": "e2b4830b-e380-4f8b-94f0-57c15cee795c", "comment": "Malware payload (Amadey)", "value": "efcf2c587acbaf2e12ee67d4b8173c32ee00f1e5669cb295af64dc690a6893be", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978197, "uuid": "81703112-7369-47cc-bf70-b50f3afe6742", "comment": "Malware payload (Amadey)", "value": "fe7bb3b05ad283bec668065c7c507ef9dcf6f0c8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978197, "uuid": "6cf5d851-1f3d-4855-8da3-26f14a05da5b", "comment": "Malware payload (Amadey)", "value": "011429327898142269384c871795f8f7104823ba57639dec063191ad88b2b18b3d3afdc55a68c9c7acfda7f006a0d142", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978197, "uuid": "c617c36c-0906-4464-a010-9161334e6b7b", "value": "T1EEC402A171D29523E97210335DD0831EBE2BEE7514A09B9393C9763E4B391C24E7ECA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978197, "uuid": "bd67d4f0-92fd-48f5-af51-4975dea66dad", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978197, "uuid": "64be6894-dc5a-48a3-ad1d-f57c9bc6ff1f", "value": "12288:7PugHdxz47lfx4Q+vtW0H+NaYnKn1AZM:7L9h47lf+Q+vtzQnKnqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978197, "uuid": "df60059a-a1cb-4891-af41-e223ca2db4db", "value": 551584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978197, "uuid": "68615b4a-5e51-449d-84d1-54b2d97d8ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978197, "uuid": "9f39d892-ec8d-49fe-8ea7-3413ebcb4821", "value": "b810e661378b0a3e898aa32c65e8659d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d561ba-1ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688974923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974923, "uuid": "991b4c92-c53b-4a72-9db0-ef98ce30dd07", "comment": "Malware payload (AgentTesla)", "value": "ad33007c693a7117e9a0dddefb3a0c9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974923, "uuid": "be29ed0d-84ea-472f-8de7-49133bf9b9ac", "comment": "Malware payload (AgentTesla)", "value": "efeed523859d81083307c7ede48a25cae675055a529b33d8aa19935ec24c3f95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974923, "uuid": "d5525bb2-a13e-4fa3-8c97-43945680d316", "comment": "Malware payload (AgentTesla)", "value": "1e677908b8d47a920ea58a673bfd55a98df36b54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974923, "uuid": "6d3027ff-a507-4183-8ccb-6c1845dd7f1e", "comment": "Malware payload (AgentTesla)", "value": "cc8a953fd66cfbc9042b99fb6d984f966d030103d101be5f2461fb1c433276f8464c4b8aa43d801df313c6fa15b7c46e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974923, "uuid": "37fee6c4-0001-4503-8cde-3d82cd595502", "value": "T113D423D2C6A1F11BBF9D362AB02B55FA4FB4FBA708963F1B0179637724B745404A009B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974923, "uuid": "6f7eabd7-7e02-4f1d-be42-fc2dddb8b626", "value": "12288:yNXcnkphfn2GAIzSI2LcyOkYjsdSmUTFBFFbDUPUidgiY:yS+hfTSLYg+FBfa7dhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688974923, "uuid": "ca154958-f0a9-4e46-83f1-e5e1e63b5553", "value": 616571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688974923, "uuid": "d719d9e6-3545-4736-a2cc-013e68613871", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974923, "uuid": "421610cd-b66d-417b-8276-af35651ce5fb", "value": "Lukas 5.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9f03ab-1ef5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688974969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974969, "uuid": "b22bc902-c7c6-43c6-b128-52a1c5f7847c", "comment": "Malware payload (AgentTesla)", "value": "ef9b0fa53c151c1377d31518cebb31ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974969, "uuid": "c161ffd5-925a-471e-b831-4eac632d10f9", "comment": "Malware payload (AgentTesla)", "value": "f001558e465e5423a5a84efd37713c76bfa63078c5e6acff852cb00a3a4532b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974969, "uuid": "1523ac93-bb46-489a-85eb-1be4b6f9c3b0", "comment": "Malware payload (AgentTesla)", "value": "ca53bb6058dc045032df7cc40612758ad007a5a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688974969, "uuid": "11286601-dc65-48e2-ae57-2e681e5c1141", "comment": "Malware payload (AgentTesla)", "value": "856ba7893fdf576464fd165b394c1bd2f29fc58ee778cec3ee15b097490b44062476d4c7ecb0e6ac4bfbafaf871d1bd6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974969, "uuid": "e0a1ae6e-0575-45ed-82bb-2d66be737304", "value": "T1A5B42336FADDE486581319BC5D1C11683118B4E6689B3A71F1D33BA82EE8F0725E1B39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974969, "uuid": "aab81b05-bcc1-4516-979b-03d4d21a5b43", "value": "12288:KAgnQjzyQnp88+L2X/ySA9lsrEAgtdGih2Cm9djSCLHznTooHeRd:cnQtAaX/GlLondRHzkjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688974969, "uuid": "57ccf2e3-f821-4e36-840a-433c254da006", "value": 536839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688974969, "uuid": "e9a788bb-4d0c-478c-a74b-fc5087ff3f6f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688974969, "uuid": "0f5cfd00-ce51-4bbc-bb00-ee7e89bb8b1c", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d7adbf-1efa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688977104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977104, "uuid": "1460670e-04f8-46ef-b031-ecacec9aedec", "comment": "Malware payload (AgentTesla)", "value": "69d229cf043f982b47b84006887a7b84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977104, "uuid": "81b957d4-6ad9-40d2-9710-ef303fcc6d51", "comment": "Malware payload (AgentTesla)", "value": "f16d3ab44c9c775aecf7b6a86470f5becc727b24e0106c27d54ae1c685bd9c2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977104, "uuid": "050d34d1-db6e-4c00-8a3f-ccc5ce3d7e94", "comment": "Malware payload (AgentTesla)", "value": "b1e5f8138b87eb4a6d6274c26be5f60732806fae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977104, "uuid": "5970c508-424d-43d1-ae25-25d64b758a97", "comment": "Malware payload (AgentTesla)", "value": "23a526398da2d4d0b4ce29a650af36574244bf4ae5798f7becb249011e3647c570216aed1b95424529afcc9399eb8d41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977104, "uuid": "b7446527-589f-489b-b279-8a2090ce6324", "value": "T1F4A4231BD7BAFE6EB5639F90138DBCD8C52EC065153994C7829E1E4A834349C7D2CC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977104, "uuid": "f8356a84-7d5f-409d-97e9-b09145601756", "value": "12288:6df8urTBzNxAbjy5CUuYV4VTkDU2xyjeckbhWzj2oyLks:qfbrbxWBUupV3eTWzjmLks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977104, "uuid": "00262c08-bb4b-4d0c-9b50-b3756d0f746f", "value": 461961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977104, "uuid": "00ceb5b5-80d4-4fc2-b177-750ceacc514a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977104, "uuid": "488793fa-1335-4123-8b68-c9739ff7e497", "value": "Shipping Details.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0ad3c0-1f48-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689010747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010747, "uuid": "15d6aacd-3f97-45ee-80be-6120c81e57dd", "comment": "Malware payload (RedLineStealer)", "value": "b256e9fc25625b83e43a74ea8307026d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010747, "uuid": "f7a03a2f-1149-402e-8763-9b9507c3e6db", "comment": "Malware payload (RedLineStealer)", "value": "f1ae7fab47b54b57b64fe4b0569d28421b914cc77c243cf2d59a0645d15e8ecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010747, "uuid": "5e38bae5-b5a1-4615-a617-0a3693480456", "comment": "Malware payload (RedLineStealer)", "value": "8bddc4828acbc99bb6b144ed6c2ca8ea918f9345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689010747, "uuid": "e8db02e9-032c-4937-afe1-ed81b2b5224f", "comment": "Malware payload (RedLineStealer)", "value": "5c5799b16037afff8d4cddddc3588192e95b2ef0d1e88747a023390293adbf495e2a469675b59627c49997253e6d5576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010747, "uuid": "756a77f9-45fb-4a6c-a3ba-55feae45bf99", "value": "T1CF151203DAEC9137D8B217B06CFA0243173DBDA75C7C53AB2782A51A0DB35956831B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010747, "uuid": "96ff9ac7-d202-405d-a9e4-791da7abd296", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010747, "uuid": "ffa0553b-b1ad-4609-a60b-39bd5290a63a", "value": "12288:EMrry90/YoqPF09KlVJVkFpsJHw/zCZjnNHTSNKdiWBCDnz17X2dvVvtXIHsnzdR:/yMUnVDknWCzCjnHOjzN2d5t70yrNhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689010747, "uuid": "2110dfe5-70bd-4047-9377-239a989c7e4d", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689010747, "uuid": "2c9417e1-fc5a-4f78-a7d8-773a001c8b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689010747, "uuid": "493f1a5c-a8d0-4397-a39c-461942151335", "value": "b256e9fc25625b83e43a74ea8307026d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debf7170-1f69-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1689025006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025006, "uuid": "980d415e-ba66-4c60-842b-8c7289b8afdc", "comment": "Malware payload", "value": "56270856311af456a2d0216129d8daf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025006, "uuid": "0e7ec44d-9cb8-471f-8b29-b25b8caf68de", "comment": "Malware payload", "value": "f23ffdfa7f009f89ccc1629a17278019bb82a5046315eed79c921171d4b7b830", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025006, "uuid": "cff9d2fa-400f-4f33-a6a4-6ccf944854bc", "comment": "Malware payload", "value": "c0fff6d6a9fda4b7086422efa1e4b1fa3e3258c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689025006, "uuid": "23846ec3-2bf3-46b7-8196-265f5d95ca5b", "comment": "Malware payload", "value": "4eb082a7456ee3ee6cdd3ff181edb8bcd922f35cac9b4c7a2ff83d384d31b7be784daf30cff39dbebc522e560439a91e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025006, "uuid": "2f2061d3-cc08-47be-9994-051b62e823e6", "value": "T12446E02E5E3AA984C400BDB99F7BD3517F33D9348970CE60A5427D6A92F64C272F8748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025006, "uuid": "409583db-2f3d-4e80-a51f-227ceac7a12b", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025006, "uuid": "aefe8e1d-190c-4d53-af7c-6f51e9c23806", "value": "98304:PyPCWkFm5sbtLInk76Wbe02hQsvPDVXl5nJWt+1iYD8QR6nPQ6E3CzhSmHoaxsmS:PiCpm5uINjPDVXDnJ9ik82qPQNEhSmHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689025006, "uuid": "d61f7cb3-9d45-4f15-9e12-ce4190facbcd", "value": 5874456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689025006, "uuid": "1ea480c9-d892-4e8b-89bc-8c40e248e0ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689025006, "uuid": "c4e46fcf-9e44-48f0-a343-b56eff2d18b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e3b2a3-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688971015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971015, "uuid": "e52529d8-e508-4d28-9948-a3535370526f", "comment": "Malware payload (Mirai)", "value": "69babac3ef058dda439080df7e942efe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971015, "uuid": "90ab47a2-c543-4d55-9744-d4e5c4f720dd", "comment": "Malware payload (Mirai)", "value": "f3fc5e87f85d27dab0e06a668089c370ff8650af031135111efc03a20fcae0ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971015, "uuid": "f4634ffa-1ad8-4659-8453-f8fc079ef125", "comment": "Malware payload (Mirai)", "value": "cf897800e9679aa96e755c5ca30b8e89df86c6ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971015, "uuid": "ed4ae3ba-56cd-437d-a5d2-3649fbda37ad", "comment": "Malware payload (Mirai)", "value": "b68bf13923526f3380096c7049a4722fcc1414cba3a63f2340d7f7eee58c6913788c7103c55522393c6f666581ea5016", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971015, "uuid": "a9ab33dd-eeda-414b-99ac-dd965df9d0f9", "value": "T1EE8360197FE11EB3EC6FDC374AE92B4521CD651620987B79BD30D818B24A61F19E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971015, "uuid": "22416319-2b09-452e-b5ff-c6b69a3c1654", "value": "1536:VwjrooP6LS1c/s9knCv413k5azHnZWyFpc:WjrooPyS1cm+Hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971015, "uuid": "9d115f9f-14f2-4fca-ac70-b7a4f5fbd1c7", "value": 88140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971015, "uuid": "1b7b21f4-ea69-4dbf-b76d-b353033be1ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971015, "uuid": "389aed6d-5d0b-4d63-a8e2-beef406e622c", "value": "69babac3ef058dda439080df7e942efe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646dbb9c-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1688981851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981851, "uuid": "55e2dee5-8bd4-47d4-9174-c5f347f7c083", "comment": "Malware payload (DarkCloud)", "value": "7d6c22407e5154b0badcc9308fb04784", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981851, "uuid": "2a37b7fc-c7f2-4d97-9643-2d76d04444d5", "comment": "Malware payload (DarkCloud)", "value": "f40523262bb6a7e11bfeeeb0da1e3f8bcccebf990de9517cbcb9496045121cce", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981851, "uuid": "5f7b18a8-3b96-445a-bd77-723745028dd5", "comment": "Malware payload (DarkCloud)", "value": "1c133eb06ec4831db4b0986389da7f55aeaeeb55", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981851, "uuid": "9dcb86ba-432a-4082-9aa1-a29f6fa862be", "comment": "Malware payload (DarkCloud)", "value": "51e1066d911617b88215282fb9c29e7937001e2d44e2bb86a729f8c4ea14292477cf4d82c6c51defd1cea74f9e71a459", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981851, "uuid": "51724c0e-3b2f-4ed4-b131-9ed745c4a4fa", "value": "T1DA159C3C1CBC5E33C070D6A69F95C061F19885EB32A14F3667C3AA95471EA0229DBE7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981851, "uuid": "ccd11614-8de7-48ed-b856-24889825f06f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981851, "uuid": "6486e821-4791-4e93-bd90-01e01622893c", "value": "24576:cxlrtRahimNGNLi6NRxMDKeA/tzkNWtJzZ:cTP1tLN3FH/iNMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981851, "uuid": "dd4afce6-016f-4675-8876-81df37548f79", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981851, "uuid": "cffa925a-d263-451c-8295-bdafc0fb0677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981851, "uuid": "62c9c40d-8d8b-4c9e-9928-baf1819e3590", "value": "Balance pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdf2258-1efa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688977112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977112, "uuid": "30beab10-24a1-457d-8465-7a739bff76b9", "comment": "Malware payload (AgentTesla)", "value": "8fa0111dbf50f3acd6262d24dd93561b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977112, "uuid": "1e26067a-6e93-4f8f-a31d-0871531340f0", "comment": "Malware payload (AgentTesla)", "value": "f456cc467fb715d5a47451118ad6fe4529a593c31e5ff402cd52934b23a24b2c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977112, "uuid": "def782dd-406e-4444-851d-9aae3e614cd3", "comment": "Malware payload (AgentTesla)", "value": "8673189a203a11b60461da6b751beb2fec383dd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688977112, "uuid": "27ef8231-c2fc-4bd5-b005-7046a59c1764", "comment": "Malware payload (AgentTesla)", "value": "12c99329de514b13c063f2ce1cb1e662650fc68757fbe6a421e73b76a472f31cd69ffa058453a9d821d6f46c01b7971b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977112, "uuid": "732206cf-d4cd-40b4-80e7-9e07a315da37", "value": "T11405623D18CAA567D278EF964424EA59F2C3B38237835BBE75D2C6618002339F6D139D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977112, "uuid": "9925038d-88e3-4cb3-a075-e6a565f2e2d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977112, "uuid": "b5fa8f92-2337-4211-a170-40b3cb9e7aa5", "value": "12288:tyubbHMmNdpHsKrPd4Icw3d1x1s4u1kRyM/6aPqLLtGe:3Rhbs4G9nPLLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688977112, "uuid": "47245497-a61b-4743-a65e-6242bec3f4e6", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688977112, "uuid": "a4010595-b29e-4f5d-9526-02edbbe4d281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688977112, "uuid": "2d11e41b-186c-4b71-b9cb-8d6139d6f72f", "value": "Shipping Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7241e47-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978205, "uuid": "15e5e816-2c73-46dc-a10a-ac53f4289b6f", "comment": "Malware payload (RedLineStealer)", "value": "1a9294108d532f561e2028bfd6e1b08f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978205, "uuid": "b5e44553-66d9-4717-833f-c84597457d3b", "comment": "Malware payload (RedLineStealer)", "value": "f48e8d1209a5df001df84cc163b6a760a7b1043043c6f6b5716b0abac19100c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978205, "uuid": "afb167b4-424b-41fd-a730-44a373cdad2e", "comment": "Malware payload (RedLineStealer)", "value": "261f291f89d33def8073d0c38472e6579da715e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978205, "uuid": "1947f3f4-5231-417b-b933-cc0cdf80bb7c", "comment": "Malware payload (RedLineStealer)", "value": "8a1e1f660b8af59046b2f5a6f82667c4b6d05d2a92f57a76b539bca8cdb9aaea39678ba2d8517434a8c3ef883a57472f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978205, "uuid": "bc5bdfd4-ff47-4fb1-95a5-1e422bca2775", "value": "T16EB40260B1D29623F936117318A0926FBF1FDA360DA45A8793C57A3E47381C14D3EDBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978205, "uuid": "18962a80-f0a3-4114-a5d1-df22aa497e3d", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978205, "uuid": "c8aae6bb-cf22-41ad-a43a-df8abce62671", "value": "6144:DU7/YCVEHBpUCWGYLUz247dogtzTWLZ0XX/6HfmWlVE/mFBKUwDSVXHdaRCuGFTU:DUUv2z47e2zTEZO/6HfmCF9V4+fm/YK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978205, "uuid": "a1ec0f70-6c11-4de8-8292-0bc846ac4852", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978205, "uuid": "ad82b444-5d64-4431-a3cc-67effbe8ebb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978205, "uuid": "66cadc97-2db7-4c88-a7f6-3381eb097d02", "value": "f48e8d1209a5df001df84cc163b6a760a7b1043043c6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86d9a63-1ef7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688976006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976006, "uuid": "8de0c328-ae2d-4db3-b8c3-8b8372421da8", "comment": "Malware payload (Mirai)", "value": "c42320ae2f46763dc5cb64f4ef4a353b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976006, "uuid": "fa63f27d-da9d-4b8d-867c-5492d1152352", "comment": "Malware payload (Mirai)", "value": "f51ad680bbdee56fd654e1b7cc607f36f18763d95bb3ba24aaeffd67f22e3a24", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976006, "uuid": "78a48c46-fefa-4b46-aa45-4a5a0a2da484", "comment": "Malware payload (Mirai)", "value": "c5ed8c5cd98f3d8efc9f69a14c6de2c2dfb78b5a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688976006, "uuid": "463be84b-955a-4e76-b489-2fc52e332e35", "comment": "Malware payload (Mirai)", "value": "1be53d19d2f7dd3eb3f16a3cbb3f55175a9fe72d0b7c03814d4a4df8e673dff9519b1e43f8cdd76c6092f73fbe1eda88", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976006, "uuid": "37b7145f-151a-40bc-aebb-55a663b5121a", "value": "T15A833A47B1C189FDC05AC1740AAEB936F832F2ED123AB1A737D0FF266C4DD10495A966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976006, "uuid": "49295d0c-1357-4709-b4bc-253afa43454b", "value": "1536:0k36B7fq1hwJPwAXa08dLStORqRKn/Mr65waFmDRsg6VZBwbZndt:OB7fCamAXSqEn/p5wvDRsgkwbZndt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688976006, "uuid": "01bf80a8-3176-4542-84f6-56e9d9381143", "value": 84832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688976006, "uuid": "b2231faf-27ed-49b4-b451-05b68c495380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688976006, "uuid": "3ae2c12c-33de-44cb-891e-99b342f08531", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab89a21-1f19-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1688990613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990613, "uuid": "c2ec7e9a-0722-4ff1-b2b9-058b87d44c98", "comment": "Malware payload (DarkTortilla)", "value": "1344dd42f796869f3091e194b0d819da", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990613, "uuid": "f1c58f4b-fea9-4448-b6b9-6f817635c0ad", "comment": "Malware payload (DarkTortilla)", "value": "f52211f91feb402172b2353d628d74922ec8233bffe21cb504634be39560adaf", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990613, "uuid": "83103a36-aba4-4b60-ad40-c3bd0360bc1f", "comment": "Malware payload (DarkTortilla)", "value": "004a6aae43fae2729c82fe22598f54f33ee41fd5", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990613, "uuid": "0f2dc3bd-dd2a-4b4b-871c-f1c7854f2320", "comment": "Malware payload (DarkTortilla)", "value": "384cc6fc30a273d814f9e5da2f2811af1291a8604d12292ef3e3b783f30d42798ae9cdb71046a93a76e9e8975a830c16", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990613, "uuid": "c97c1a01-34fc-4ddd-a4bf-4c47404f8e8b", "value": "T134E53387798C1511CC0DDEFF933C5E7A4F7AE98A8892B699248043E59BF82D448C7DD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990613, "uuid": "17cace55-dbbc-4af2-851e-f769dede06b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990613, "uuid": "d0681f98-2ea6-48bb-b3b9-fb054d52e9c7", "value": "49152:tDm7Xj2PUHTdNcxflE3sBWTTFNeeSMbOSBcd6r+6iQYAtMzoN:iz2P0Tw5S3saFUeSPa+6OyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990613, "uuid": "986ec0f7-5a69-4abf-a18f-7f2cb97142dd", "value": 3020288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990613, "uuid": "cf75e10b-8dd2-482c-911a-ea618cc1d7e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990613, "uuid": "1dec8912-0399-4e25-8a34-c2ac536c246c", "value": "1344dd42f796869f3091e194b0d819da.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54def8a3-1f42-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689008024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008024, "uuid": "a6212e56-be59-4f2a-b270-ea94510e89f0", "comment": "Malware payload (Amadey)", "value": "500fe46e4bda12580c79c27bef49a4da", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008024, "uuid": "610567b4-0ef8-45f5-b4a7-ee8a5b50cd51", "comment": "Malware payload (Amadey)", "value": "f52649fdc876c86a23554276141642d4c7a28501fdcbd95974ca19176af6b55d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008024, "uuid": "4bbab637-eeab-46f0-a354-9ac6a672a412", "comment": "Malware payload (Amadey)", "value": "33176b8f1987ebcb681feab7dfbbe154400756a6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689008024, "uuid": "9f7b1d6e-05e4-415a-9d29-7a9ee00b9557", "comment": "Malware payload (Amadey)", "value": "91c8bc66bd3a5d2db574cea5f2744658b3cfd5af73f4c6e30867e98055cd07ed6ededb295d2ea6e260506d117e1e6116", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008024, "uuid": "0144227e-f7db-4dce-a968-8983c10230b8", "value": "T1B76523B938842337E030607D8490E52FFE0709F296A45783EBC77A396B956AE2D7DC54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008024, "uuid": "ece3c014-15a9-47dc-8ad2-1062ddc9348a", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008024, "uuid": "ae1ebc84-f719-49a5-8ffc-2350886e6568", "value": "24576:PE47kOUEfJvETlpqftmHioiS+yvk3RZAIBbVTb34k30/8dRi9:PEq5PfJvExMftmHzO0khZACykji9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689008024, "uuid": "7a02e66b-f8aa-4aeb-b103-b524d41f0ba5", "value": 1409856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689008024, "uuid": "c149a1ed-7673-46c4-bc01-d2ea3896b4cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689008024, "uuid": "cd8d01ea-30ad-406b-b20d-907b78176fe7", "value": "500fe46e4bda12580c79c27bef49a4da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c2976f-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688971008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971008, "uuid": "92bed7a9-8790-425f-a2cd-3e0ca8741d9a", "comment": "Malware payload (Mirai)", "value": "d6b2c8b33d23e19bc96a429f548244cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971008, "uuid": "0334e219-cb4d-484a-81bf-07848cbd0b4b", "comment": "Malware payload (Mirai)", "value": "f5a69056b756f0862cec650360595bf93d8920e79200fb753fa736e85fd252d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971008, "uuid": "b89d4d47-6b08-4f96-aeaf-693b7afec9a5", "comment": "Malware payload (Mirai)", "value": "f07d70ab1667060778e9cbe924321ea7b11dc9e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971008, "uuid": "bb434020-1f62-46cc-8690-80fc60d405a4", "comment": "Malware payload (Mirai)", "value": "674b8ee5a51f949b8a218e8134d83ef9ac17ae64ce66c453fc57275e6d65d75601f10207c5c6231f305b28495290ec41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971008, "uuid": "128e0c32-56a3-4ed4-9852-932517cfae59", "value": "T1B77319792585F22CDAE680B8F4532AE519120A083FDC81E36887143BFF70B5DB56DE5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971008, "uuid": "918e5a98-33a5-47c4-9be5-74b2025feacb", "value": "1536:0Xr/KCEaJzUuv4++aP9ilVRYJf/VBIVCCfy0K9eB:yKCEmXlC4u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971008, "uuid": "5043fe16-d86b-4a36-8c46-86e54470ae26", "value": 75136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971008, "uuid": "b91cba95-019d-4bd0-aab3-b6e780b8caa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971008, "uuid": "bf0043ea-6b8d-436b-9332-f70c4e375055", "value": "d6b2c8b33d23e19bc96a429f548244cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f754f42f-1f5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1689019034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019034, "uuid": "a8076892-ad8f-4cae-b080-b15e33e529bb", "comment": "Malware payload (Mirai)", "value": "c6016bf977d424f0bd05b68f0ffa15f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019034, "uuid": "f00a6f72-3de9-4781-b958-dd2103c9831a", "comment": "Malware payload (Mirai)", "value": "f5d87ba2a084348d6274acf45937365044d03d19019b6accc221ac9c1f62fb01", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019034, "uuid": "8354b6d2-00fe-417a-8aa7-8f94e50549dc", "comment": "Malware payload (Mirai)", "value": "5c7e7f085eaf56a766949cd775ca9691efb54cf5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019034, "uuid": "2b1a5d2c-cc62-47aa-937d-2ed78114d877", "comment": "Malware payload (Mirai)", "value": "f1cc90869ccaf72cc07124085eb17f7e9d78f767d8d143f238830fb7020bc8e23126f173da661b752959c17740ee6f04", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019034, "uuid": "5c2e580d-87d2-448a-be6f-53cbbdee40cb", "value": "T1BCE32A5697408B13C0D227BAB6DF425533239B64D7EB73069928BFF43F8279A0E26506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019034, "uuid": "bb001837-7167-4465-8103-9d4bdc7e1370", "value": "3072:3EAwqd/qmS35mEab6fYcPhd0ApagYWYutl4DxVBrFmZ:3EfqtqNpfab6fYChfp91Yutl4DxVBrFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689019034, "uuid": "c5c5cc12-ab80-4778-b460-6580b1c6a2e7", "value": 156717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689019034, "uuid": "02d6de3d-dda3-4488-8da9-6ffaac93bc1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019034, "uuid": "4f81c82d-3b6f-4bcf-aa52-ac2903e73b2d", "value": "arm6.nn-20230710-1957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba3f628-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968253, "uuid": "78961595-7d91-4533-80f0-a6e7f358b6b9", "comment": "Malware payload (RedLineStealer)", "value": "5e87ec3f17636bc6122adb7d9df54242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968253, "uuid": "c05f28d3-7749-49d4-92e2-737820f270ad", "comment": "Malware payload (RedLineStealer)", "value": "f618e54fd3c6cdd178a64fa5a61a41f5f58d29edd3fb169683694819211d974b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968253, "uuid": "44f8cb7f-6f04-4184-a923-a5a86260a25d", "comment": "Malware payload (RedLineStealer)", "value": "ecf7998c96c4a769a0581e43bba72867f8260a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968253, "uuid": "65093669-aabf-4ece-9416-c996c2ccb91a", "comment": "Malware payload (RedLineStealer)", "value": "cb320d0cd7d5862f2825ff4aac4e1a0641de2e01a2003cb523fa7918d0adb821a8ddf52fadc0c2dd49fa8e00934019fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968253, "uuid": "29fc5179-c180-4145-9b2f-07985cff7159", "value": "T130C40171B6D14A63E672153719A0826FBE0FEE310D914747A3C53A3D8A3C1C15E3EDAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968253, "uuid": "20c1fc5f-bb46-41bf-8f58-e9b2630be792", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968253, "uuid": "b66d0f0f-0ca6-450b-a331-3f7f6a534577", "value": "6144:JESoUTLNHBVaCWGYLUz247Cepvwaqj2gpvEF21KYFnrWz5F1tGBz6s3GxoN3u46R:JE8Ncz47CgbgpvlKsrWVS6s3N+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968253, "uuid": "a649e76b-7c98-403c-905d-88933f7c71bf", "value": 551072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968253, "uuid": "e85be3c1-c969-498d-a0ab-f98389302fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968253, "uuid": "b498443e-004d-404c-8fd4-499bc3b8cdfc", "value": "5e87ec3f17636bc6122adb7d9df54242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90745d2-1f39-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689004407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004407, "uuid": "a4473e2a-1e55-4170-890e-ba3319cea7aa", "comment": "Malware payload (RedLineStealer)", "value": "10d9e523ef3fa325767733e9b06a5183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004407, "uuid": "819e71a6-b367-4cfa-a245-7872274baf7f", "comment": "Malware payload (RedLineStealer)", "value": "f66a0103e4528b09122b55cb248c3007154afc26e699fa5ddf5d3f200e810a71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004407, "uuid": "287daa9c-3c28-4fdf-8366-9ce365509830", "comment": "Malware payload (RedLineStealer)", "value": "ce932310c4e2ff5db5c2c78b90f69ad2270c08b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004407, "uuid": "887bdfeb-0ccd-45af-b088-3c5edfe5fb15", "comment": "Malware payload (RedLineStealer)", "value": "e096a1c39270928d77a129a8b3ce6c8aa0a245fbdc637a4532179ba2ee1c17387535a07d65c9b4ecf7ca72b98458db45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004407, "uuid": "7d2a6ddb-afb1-49b8-993a-1f9080cbe906", "value": "T1E7152343AAEC4432ECF2177149F742C31A35BDB25DB8676F2606AC9D4CB278858353A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004407, "uuid": "55e57052-2837-4e3e-91a2-7f111ae9cb49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004407, "uuid": "a84eaee9-eaad-46c1-9b48-8dfa261cb5a5", "value": "12288:uMr5y90hl0vLfgTNcWAs5+X7YQaeB42ilLYj18fbo+efG40s+6OuUFLV3sBempko:Hy+0zqxA3LvmSj6jo+A0GUFh3Rm6aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689004407, "uuid": "927be2ec-ee67-45d2-853c-bdc0be066844", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689004407, "uuid": "b6cf3472-cc3b-476c-af1e-c5b02d5c513c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004407, "uuid": "403a01ac-172f-4869-b79c-492e00bf59c8", "value": "10d9e523ef3fa325767733e9b06a5183.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350e6d3a-1eec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1688971034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971034, "uuid": "f0a6d5ca-ad74-439e-8c4d-c9389a550312", "comment": "Malware payload (Mirai)", "value": "9c774d9ee1304757f1bbfac43802b519", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971034, "uuid": "83cfd358-222b-49d1-9293-20fd32767d49", "comment": "Malware payload (Mirai)", "value": "f6ce4f6dfcbb66f9f559e3249bf5e0239385d1c3aaf919b99b14b59e97563f48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971034, "uuid": "18269132-3301-4b4c-a0f6-2403f0dd398f", "comment": "Malware payload (Mirai)", "value": "b02c1a32781ad4f7dfa3a3f78767191f5fbe50b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688971034, "uuid": "3ee0a2aa-5a51-451d-88b5-4555cfd6d729", "comment": "Malware payload (Mirai)", "value": "5b10a99335077511d1c2748f35235b2c01808f0fee040b07ec5dc073566a66a9eab1225e2f58ca201daed03f865b5fc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971034, "uuid": "0c640ab5-5c4e-4e41-b442-ec9e1a07d4f8", "value": "T10D73F946BC818D11C5C91379BA2E21CE33136369F2DEB223DE116F247BC692B0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971034, "uuid": "f5c980d3-5185-426b-b52b-6999b45b548a", "value": "1536:3NnlGf4rpkSi8me+/on6ICZuwqySdOzXImiU+9Nm/u8:TGCWSizD/on6I+D+9Nm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688971034, "uuid": "e8ca4eb0-6ca8-4147-996e-3080a34acd14", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688971034, "uuid": "d4eb96d4-d87f-48f5-9a0b-3b3c193dc7d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688971034, "uuid": "047ab10d-e410-458c-b3c6-ede1af599c68", "value": "9c774d9ee1304757f1bbfac43802b519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65750f09-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1688981853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981853, "uuid": "d1630aec-9408-45fd-9650-e1147904c55f", "comment": "Malware payload", "value": "9e448f625e1238cae66598ac5208d8b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981853, "uuid": "78f1cf8c-9239-4f3a-96df-0533f3e9a2ee", "comment": "Malware payload", "value": "f7042fc5e09ba582d8c7b51c4391fe8e3e9e7c84e67aadba9ce49c64b1a1e0c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981853, "uuid": "081896ac-e6bd-4270-a5ee-acda32f5cddf", "comment": "Malware payload", "value": "2845d2c2c81680165b1ced86477cd9e981904d29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981853, "uuid": "72c1a623-7a79-43c1-8052-44b88b346e0a", "comment": "Malware payload", "value": "17145d0b9271f78a3ff18c56e06dbfc265591aef59c96314ee851369b9085b38d512f9a9917d5619e5c110b2d6d032b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981853, "uuid": "fae5d136-c95e-4d11-b39d-d00530907442", "value": "T1B623FA88FD55A22AC7D162BBF70D03CE373B0768F3DA32129E355B2137C6A615A3A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981853, "uuid": "b86c400f-4a9d-4591-bb74-8995dc38ef06", "value": "768:pK4YbM9Icv6XeRczzG/ACowxMU1pF0POGr12rD32zoUVq+wmTnvbI:SMWtORg/Cq4j0POGrw0d9Tvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981853, "uuid": "778b23a8-a148-4f5b-a1a3-b122a862d70b", "value": 46408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981853, "uuid": "b1f4dd0c-fa93-4853-bd37-e36709b667c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981853, "uuid": "d5dfd40e-7407-4c72-9e85-7b486960c275", "value": "SecuriteInfo.com.Heur.20230710093222289142253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb2f8bc-1f31-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1689000925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000925, "uuid": "6c91de34-4a2b-479e-97c8-4f9ff4af3386", "comment": "Malware payload (Fabookie)", "value": "9eb56cdeda0afc492bf1cc42aef4a737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000925, "uuid": "99baf971-0a27-4242-92cf-0d1227de967d", "comment": "Malware payload (Fabookie)", "value": "f87bd8a08297af331b8ab18c393811d175e5fbc414fec1dec69520c06f32bd33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000925, "uuid": "71da6105-8f82-4046-80cb-42101ca780cf", "comment": "Malware payload (Fabookie)", "value": "512fb9d463aca71af5aace2225f1ef9fa980fc04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689000925, "uuid": "aae4d66f-2864-4c08-af17-b5d896091c8e", "comment": "Malware payload (Fabookie)", "value": "c334438451854a3b83901f65aae935a98dce594a4904015eda6823647437b6dbdcd37c78244633c28e7fa56719a02584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000925, "uuid": "afb518eb-30c0-40f8-b375-c6857ff5a07f", "value": "T1BDF42B56FBBD4272E051C135C9A6E7B5E6B27C855D30970B2346EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000925, "uuid": "13d82dfe-a79c-432c-950a-19ce362d8d66", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000925, "uuid": "186a68d4-64e8-4b7e-9ace-a3cf2546bb33", "value": "6144:XA01NdzQ/xQWQvYYaE57i1bdRxQ7cUBmCUiJbc77ZvfuYuEdGxTC2UWf7xLUnw+V:XdEJQWQG1bIShtdGxTC2U5JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689000925, "uuid": "1d143aec-d382-49cc-a693-a6f718247132", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689000925, "uuid": "2a7be5ab-ef4f-4ca6-9be4-c38244a1e6cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689000925, "uuid": "db3af297-2d68-490a-b60f-dea0cb351719", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d592477-1f2e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688999341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999341, "uuid": "73ad0caa-1c42-4180-b201-b816464f30e5", "comment": "Malware payload (RedLineStealer)", "value": "ff334204bb98c72e559e731b025ec1e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999341, "uuid": "1e35d9c5-e8e5-439e-9c97-54954f9b2ce3", "comment": "Malware payload (RedLineStealer)", "value": "f899a27d31057d13d27cdd08052a74782fefe9c2a62b2badfdeab55407b1cb47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999341, "uuid": "dffd15c9-0db7-4268-b8da-d559a0cf621d", "comment": "Malware payload (RedLineStealer)", "value": "bce1cef1e3525d14c9d50dd952f8f52b9e5600a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688999341, "uuid": "69d56ac9-f874-482f-872a-a51df61c9971", "comment": "Malware payload (RedLineStealer)", "value": "de49684f959c35898794b49b01eda49eb8bc29920c5a6ea6cf9a9c196c90a62f3f7cca1dab773fd22098d20f63a4c759", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999341, "uuid": "edc00098-ed0a-4f82-9235-a7ca7aa042ff", "value": "T1E734063900A254ABC8A99E35FF4BD4C172166EE5017D544F7EB36E386BC20938DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999341, "uuid": "5e24896d-5340-4272-8725-98e11fc07563", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999341, "uuid": "f7d3221d-1057-4ca1-a0fc-6e60a3f5d794", "value": "3072:M7URjyjeyvetS9shE6+4ovQnfzO0jeu2whByRGq9HnFfx:M0yvet5O4ovQnfzPp2Gq9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688999341, "uuid": "3aff895c-7d6a-42f2-a778-f54ea2ae055b", "value": 237728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688999341, "uuid": "b5a1663c-e959-477c-863d-7bb70e6ec2f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688999341, "uuid": "88173c17-654a-4bdf-82de-386d9134513f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4de3a29-1ee5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688968242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968242, "uuid": "3735edc0-b390-4cac-9e6e-0b1235d260ad", "comment": "Malware payload (RedLineStealer)", "value": "22ac7a8faf0c405ab836d2d89d12f79e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968242, "uuid": "f1a09e9b-523f-4d46-a353-7d60cf723672", "comment": "Malware payload (RedLineStealer)", "value": "fb00d3aa3a9a9500239a763673aeaee5611365943716e500e8f4e14166979f7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968242, "uuid": "7da3a8a7-e12d-4da7-8d05-fd115ebf1dc0", "comment": "Malware payload (RedLineStealer)", "value": "60c5a77dc2cce7744484d6c57759e68db8f6bd8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688968242, "uuid": "aeeb6574-84b6-4527-a7a0-594ab71634de", "comment": "Malware payload (RedLineStealer)", "value": "df775e50e8e6057108474c6644fa5395883eaac12c0ab5a0f7203e60504e78e9a70c355dee2c5defca6b13b8c911903a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968242, "uuid": "a084b241-ed49-43fd-88f3-b056c0945b9a", "value": "T193B4016171D25623E576157718A0922FFE1FDE3509A09683A3C9393D4F392C24E3ECEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968242, "uuid": "05001dd1-5f22-45cf-a2f9-57086dfec55d", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968242, "uuid": "5f27c646-ada6-44e3-887d-61f442dd809e", "value": "12288:3GYc8z47+F3yhdAlbo101k2U0Bp11TPpvg:uW47+FihdgBekZNPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688968242, "uuid": "0c4e4f6c-1514-4196-a375-f678b63b1373", "value": 526496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688968242, "uuid": "33cbb4fb-c4bf-4023-9e50-a6e6a02b29ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688968242, "uuid": "b0476371-892b-40f6-8b5c-6b778e957109", "value": "22ac7a8faf0c405ab836d2d89d12f79e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a740e6-1f05-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1688981873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981873, "uuid": "b01f0580-6654-4fea-b317-bdacbe6adff5", "comment": "Malware payload (QuasarRAT)", "value": "ccf6483abcbb488f6c182fd88c857bed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981873, "uuid": "74b78dba-006c-4f0e-bad8-3eae876123a7", "comment": "Malware payload (QuasarRAT)", "value": "fb57d4295e76a22d42f900ab381c9473998244b2517275fe66dfa7661dae6cd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981873, "uuid": "9a565178-24b7-4260-b3b7-6bde020d01b6", "comment": "Malware payload (QuasarRAT)", "value": "81f343de678e238fd9d39aa2020497df2f36c96b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688981873, "uuid": "21e1eb59-0858-49fc-93a3-c473b000c946", "comment": "Malware payload (QuasarRAT)", "value": "d4e001abd4361eeefb77730d97c162b4df49f94270bf2f911054d868cd117c6c331b5fafcedbb754ad47935a7e6ed685", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981873, "uuid": "62368450-8027-4eed-95f9-f0b857a872a2", "value": "T1FC95A707BA4789E3C149573AC697482803B0E9A52323FE1E798F23E559437B76B4DD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981873, "uuid": "c66324ce-959d-4667-813d-77c1492852fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981873, "uuid": "2d4cec2b-32e5-4acd-9ee4-68eff1c5c063", "value": "24576:6OLUInzobl1wkM0xL1PPwcDRbTUYOUvC8N06+S3LisQMO4U/:TLUInzG1FxpdbTUYOUvxV+S7isQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688981873, "uuid": "4c4d9e72-c177-4777-9c8c-6c6bedd8c97d", "value": 2041856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688981873, "uuid": "2f1f02ea-2ade-450f-959c-cad01bb96bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688981873, "uuid": "e3cb5ffa-c149-4164-b45d-b8892d9fb4f1", "value": "PTT-20230703-WA07216.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42884f4-1f5c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1689019458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019458, "uuid": "b131ef59-3db5-4d3e-ae57-6906b844a17f", "comment": "Malware payload (Amadey)", "value": "24ba2636d737248381de4bc14d9dd58f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019458, "uuid": "a7fbcbfb-512b-4cb8-9c9d-428565d67337", "comment": "Malware payload (Amadey)", "value": "fbc50aed6fd93a161c59123ad26862042f1afcf92248507b59e7cc2bc70ae6f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019458, "uuid": "eef44fe7-16e0-4216-ad3c-232ea906995f", "comment": "Malware payload (Amadey)", "value": "1d8c1dc10e210f3ad2942283722b43be22921dda", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689019458, "uuid": "88aec07f-91fb-424b-8fec-25081375889a", "comment": "Malware payload (Amadey)", "value": "7e8182382b54b89dc32f7e578021486321d8c1922541cf7a6109d54ab5b7d551916b1962291eea57e5417e46edddc9c0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019458, "uuid": "0d4ba3de-3da5-48da-bc19-046700b5fd2c", "value": "T19B151223ABD41572DCBA6B700EFA12830735BCE16E38936F239459590CB22D8657773B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019458, "uuid": "91968ff4-5329-419e-857d-abb5f8b68a29", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019458, "uuid": "6c8b31a5-17ce-47d8-ae71-0278ce70b6c5", "value": "12288:9MrXy90P36WmnFrs+YF8hlYXp0rkkL3KPEBAX1cefcFl3mYXKRiW9PuN2sAW:Oy6EnNsT7fP+AbcFlW1h92rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689019458, "uuid": "f10d878c-9e5a-48b6-be26-b4321ef8329c", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689019458, "uuid": "75f2ec07-b70d-4226-b64b-5f86489fac38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689019458, "uuid": "391f51e5-a62f-4e9d-842e-92cee838f4e6", "value": "24ba2636d737248381de4bc14d9dd58f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d103e3bd-1f11-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688987187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987187, "uuid": "120d6599-d841-4445-adbc-8cbc566da626", "comment": "Malware payload (AgentTesla)", "value": "ec869a00fc8616604e0c6dd4041e468c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987187, "uuid": "23c56506-f03d-491a-916f-0ac97d20951c", "comment": "Malware payload (AgentTesla)", "value": "fbf09b46b7511113432fe9561eeb4294e04799f439d675c1c3a309b739fc2f7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987187, "uuid": "1a2884e5-a3a5-45b7-b686-0b241d464376", "comment": "Malware payload (AgentTesla)", "value": "72cb5c2254d65f4e8892fcff3598a49bf02d7caa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688987187, "uuid": "ecdba78a-4ea6-4373-88b5-aeb5ace00227", "comment": "Malware payload (AgentTesla)", "value": "d42d04bb2c71c9bc43dfd986bee7bce14892fec34e9def800fc860f68f67b3ae441caf6ee7d7142c293cd90b64b945f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987187, "uuid": "f0bcb74b-706f-48ff-ae64-01c56e99646b", "value": "T1BBF40116B1FE9B5AC9BAB3FD0418944837F8890D6630F3185C8B51F75976F840A90EEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987187, "uuid": "ebda2812-637c-487e-bb68-e6b5afb2e27b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987187, "uuid": "6b00015c-c4f3-4d36-99da-6563d2a6876c", "value": "12288:4J4agp7tL+N6dSo0309DXTCjxGPa3/N6jDpK9zKm/RE7U:Np5NSo03mDDCjxGyV6jD0Ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688987187, "uuid": "07ce1ded-f479-4fad-9fba-325944be8656", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688987187, "uuid": "471be013-bc85-425a-8963-fe9800770a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688987187, "uuid": "de98d5ff-7678-4340-a41e-98a4a93d469b", "value": "DAILY FUNCTION 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a01836b-1f1a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688990853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990853, "uuid": "59f9b5d8-c389-4ef9-a102-243a55006b36", "comment": "Malware payload (AgentTesla)", "value": "579e7f48b616f70291eef2dd3d4f9f0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990853, "uuid": "98c0b16e-3eae-4c61-94fc-f62dfca8f1ec", "comment": "Malware payload (AgentTesla)", "value": "fc1320764b36b24dacdd145eed82408f63888107bcd1bcb4f4c1e41760f54590", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990853, "uuid": "cc23824d-3164-47fb-a836-8dfa970283dd", "comment": "Malware payload (AgentTesla)", "value": "528d6808dcbdcab7db82c451daec21909b59abe4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688990853, "uuid": "b7c5834e-539e-46b6-9598-f5a55a37436e", "comment": "Malware payload (AgentTesla)", "value": "4176d1e30351e7bec77a1824542589caccc3e4395669b95bd0e985921248a00d1a9d8cd9bfe773b9d7de46fa5d8b1b91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990853, "uuid": "d378c8cf-7e03-475e-98d0-cc38c53828a7", "value": "T1D075E092F345D8A5D80A23F6C96BD9111556BEAD5573822E348F333AABB334310A7D0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990853, "uuid": "0231b70e-c626-4b95-b325-367cccd2c928", "value": "24576:8mKOc0W69AThgTbppD9DjKe390s+a7aerTbU34:8mIXThgfp790la7vrXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688990853, "uuid": "7cd4836f-d3ed-4145-be24-00c0612208f3", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688990853, "uuid": "8a0c91b2-0ac5-4853-a89e-3d58ebae0dd1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688990853, "uuid": "5f9684fa-9414-4810-89ac-b1427ca79359", "value": "nQuotation.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb09296-1ee7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688969171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969171, "uuid": "dc72217c-a6c0-492c-a345-a69f6e9fe167", "comment": "Malware payload (AgentTesla)", "value": "c6b2a3fd39ceffeb0d4124f321aae8cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969171, "uuid": "3859e8f8-e4c4-44f3-95b9-8e4dabb43cdb", "comment": "Malware payload (AgentTesla)", "value": "fc887e3b9f751251d19e139b44768b825879332a0a7419ba038cd758d92db53f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969171, "uuid": "87ccec1e-41d9-422c-8775-bd7570a49e0a", "comment": "Malware payload (AgentTesla)", "value": "ab0687c54735af38d16b1f7ca7de73e0a0f5a064", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688969171, "uuid": "6a1d43a0-7d33-48f4-856e-54b6cca1741d", "comment": "Malware payload (AgentTesla)", "value": "86390c3fccc02303e2576e6cb473ad6ceabaa68f65fd71d39c84eaa72a0da54f1600870ccf431b3b20d32f7c0aa09074", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969171, "uuid": "d6be0922-c65d-4df5-82d1-ca4e3a2a4f35", "value": "T165D4F223E660CB9AE4859FB8140193843359F386813CDE2D35F7F18A58B67F1706AE97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969171, "uuid": "761c930b-98b3-4fc2-ac03-81fa179bce41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969171, "uuid": "32631b66-6b30-4bd7-915e-3b43ea8f9989", "value": "12288:Egjjk95EoRYIVviBESAjOs+UChWliOq33EkiRJp:Egjjk9JRbVK7/UChWliOLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688969171, "uuid": "857ebfb2-b60a-4f3a-8c6d-ae4597df1d53", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688969171, "uuid": "00c14add-9494-41e4-8232-364131b8dc6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688969171, "uuid": "ad99d0ae-1965-4d67-9167-78fb31b561b2", "value": "PO#TY20230428015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9714f19-1efc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688978209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978209, "uuid": "c198fb51-e6d6-498b-9c61-30291d495593", "comment": "Malware payload (RedLineStealer)", "value": "879a4be7e69ec2639277e70963d4c97e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978209, "uuid": "84ec4810-1510-49d6-b23f-60ae14c1396d", "comment": "Malware payload (RedLineStealer)", "value": "fcc3e2d7ecbbfe75cdb4ce0a0ac67e9069854ee1d885f6f1d303396aa933ba9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978209, "uuid": "7fb4b58a-a9e5-44d7-be2c-6b81bbfc9aef", "comment": "Malware payload (RedLineStealer)", "value": "7a5d8f2ffec6f92f161400634b46881099e2852f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688978209, "uuid": "8f966d8e-13e9-43aa-bd58-8956bcfd88ab", "comment": "Malware payload (RedLineStealer)", "value": "14379c9d56f2db57cefb3b71cea9be29a060d4462d74e9a893dcc7caae99f29028b7df60f9a8f0208d61db15d4c0b37e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978209, "uuid": "6b6b37cd-761b-426a-8a76-cda1d3dc81ca", "value": "T184B402A175D25A23F57211721890922FFE1FEF720A914757D3C97A3D8B281C14E3ECAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978209, "uuid": "8a6f9e87-f7b2-46a3-90f9-b5773a2ebe74", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978209, "uuid": "bea5969e-a654-4826-87e3-d0778670f95d", "value": "12288:z0UBQz47jleP/0xaw8fA5ypj1NZi+Ux75C:RC47jcP/0xaw8gKJNhUV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688978209, "uuid": "0ae70620-ac8a-4134-9911-d2e98c0b278e", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688978209, "uuid": "d8fd7683-dfd1-4e87-ad14-e53d50c80b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688978209, "uuid": "ef5fc1e0-056c-485b-9aee-7db1dc97a242", "value": "fcc3e2d7ecbbfe75cdb4ce0a0ac67e9069854ee1d885f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0e3215-1f0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1688985729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985729, "uuid": "be82a692-a32f-40fa-a288-629de22421e5", "comment": "Malware payload (Amadey)", "value": "e34295b8f7fcbfb9aea03a2d6377ed35", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985729, "uuid": "41412945-2ad2-4f7e-9035-1474c9bb3500", "comment": "Malware payload (Amadey)", "value": "fdf7dbd253fbdf6b14fe5c9fd48568d73e7b1339165121dd0dc974e0ef850fa2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985729, "uuid": "42c52a20-4fa4-4af0-9f87-7c21ab5d5a68", "comment": "Malware payload (Amadey)", "value": "b188dd5d32cc86ddb299f6ee27f967aee602a0c8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688985729, "uuid": "d4fd0d8a-8a2d-47f7-8265-c31542e65e42", "comment": "Malware payload (Amadey)", "value": "46f55b33f7a4a0a55dda166d8b6c8762635e657ed6c25111a751981e4e5a3da39e4cf6c03c4396090df07dec2bec96e5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985729, "uuid": "e4d473ab-4229-4789-a49e-7f1d2092e603", "value": "T12BB40260B1D39933E635013319A0926FBE0FDA321A91559793D8BB3E97381C14E7DCAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985729, "uuid": "cefc7a57-2e79-4260-ac87-81ae986a12a3", "value": "d16fc9171842127d5f2d9438e5ae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985729, "uuid": "596f73ff-4d4b-46ca-bf7d-8146be831edd", "value": "6144:ik7/YCVUHBdNCWGYLUz2477pjHbWI68fOzeV040xJL+lvNjbQ5eqM0Xvk+i5rceJ:ikUPNz477tHK1xze8+/3/qMQ1e6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688985729, "uuid": "02aa093a-e66e-449c-bd26-125a435626f6", "value": 525984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688985729, "uuid": "b8159909-5d28-4872-a0a4-34abe34a5210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688985729, "uuid": "f2a70d84-27fd-4268-bf13-a7c8b084252d", "value": "e34295b8f7fcbfb9aea03a2d6377ed35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59c7ecd-1f29-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1688997449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997449, "uuid": "2c26bbd8-12cb-4bf2-938f-01e411ead4a8", "comment": "Malware payload (AgentTesla)", "value": "7a58585362099b271f501e67dfe8e7d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997449, "uuid": "aaab5d07-9042-4632-bc3c-2f0c60de2801", "comment": "Malware payload (AgentTesla)", "value": "fea22e9d19fb68b4e6f6534dfcbb0668a5bf3044ebcff5337f45376ba98b8a40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997449, "uuid": "669d7272-019c-4047-b44a-7f83071c7efa", "comment": "Malware payload (AgentTesla)", "value": "e03def662880d114f95651157e4135628ca9ecb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688997449, "uuid": "82aa389d-835c-4fc5-aec2-fee09053048a", "comment": "Malware payload (AgentTesla)", "value": "b8f7c52d996eb32239e1b44328486c2942944658c5f4a8e8ab3ad44bd2d133f43108c8f7bd4918913b74cb890ceb8210", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997449, "uuid": "59109e9e-e411-4284-a364-81f9832d26bc", "value": "T18AE4231891B96C5ABB838E71F5C68B02CEACFC17A54299405B7DD12F5FF7B10C0116BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997449, "uuid": "a000c709-5c27-4f9c-90f2-d6c9a3b85ad2", "value": "12288:+2/EkpSF5RDBbYDGCnUF8EGagSFNKYYxAtKnZIKhFD+cFmKf4y4wbln5o:+zX5BMDGCU8vGK1C0nGKhFDPHh5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688997449, "uuid": "737b75c0-aeae-4a5d-b045-40fc140549f1", "value": 660768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688997449, "uuid": "b6fb7e86-d50c-4799-8f00-8509a00508c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688997449, "uuid": "8b852130-0a4e-4bb9-8cc6-af082ea49576", "value": "Order Inquiry 8810353690.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c60a894-1f1c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1688991770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991770, "uuid": "5776c123-c41b-4955-9c3d-aa664eacec4d", "comment": "Malware payload (GuLoader)", "value": "f166d6ae311679fb81b13c340d0e7738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991770, "uuid": "d402a61e-61e1-4776-ab3e-6bb1805164d0", "comment": "Malware payload (GuLoader)", "value": "fed0556f87884c7d40eadd3e2f22d432da0b5854edda4404a936f5b66e00b534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991770, "uuid": "1420f198-1d2f-47dc-b327-b33217b835e9", "comment": "Malware payload (GuLoader)", "value": "2692590176abf1deaba1ffe4ce6b2e5255a0af64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688991770, "uuid": "32a3a1cb-58a4-4604-b07d-639bb6482259", "comment": "Malware payload (GuLoader)", "value": "b97a61376c4f40efd47d2e85ba3a653b4222186dad45843e3d81d7f2df6536ba884a4e5343455c2e12695c259ceae876", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991770, "uuid": "c83de2c9-fd73-438c-b831-386f2a76051e", "value": "T17B845A9239D975AFEC2F4678035FEAB22A795CE07381086E5F40760D4C3664A80EDDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991770, "uuid": "fa34c550-7f61-4de0-a6a9-6cf7d20ce844", "value": "b40f29cd171eb54c01b1dd2683c9c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991770, "uuid": "e5a6514c-4fd7-41fa-8575-14e0eba74611", "value": "6144:/oShfEPZVheNA+ff03IvTWR1wHa98hU3DHCMf6rbZX:QqCnhe2e42Czw69kgH3fuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688991770, "uuid": "b16b9148-cd5d-4f84-b9e3-26f285803ce9", "value": 386948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688991770, "uuid": "7f277a7b-da26-48e9-b8f2-633824bba88b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688991770, "uuid": "7942af0b-4d1b-47ad-84c3-99b8b38940ba", "value": "invoice4346.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5017ae-1f3a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689004710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004710, "uuid": "60ccc9a2-2e8a-4b3b-816a-b6c9826f9773", "comment": "Malware payload (RedLineStealer)", "value": "8d12f82b74b2b44f6be66ea315de17f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004710, "uuid": "3c9056c1-3696-4bdb-a122-2cbe779e7e30", "comment": "Malware payload (RedLineStealer)", "value": "ff287555fbb01586cb85d90fd01fd368f5add3bfec916a1e4f929dd7d925f426", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004710, "uuid": "a2da0767-5628-45ff-9797-d1c875c8ba41", "comment": "Malware payload (RedLineStealer)", "value": "75d44dc7d14faf0e486e48797ffabfa0a70100f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689004710, "uuid": "bdaaa3af-6778-4aa9-8c14-7dc4f040e49e", "comment": "Malware payload (RedLineStealer)", "value": "55edcca866fd6c87a54486615287f5b9777c39a0e7bb9cc28d1c459f8b8ac90fcf9e6a7061531193b8559b22d6c4fe48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004710, "uuid": "c28a4b45-d3a4-4119-8610-8670e85e932c", "value": "T19FE4DF3904A144ABC4A9AE39FF4BD4C172162EE4017C954E3EB36E783BD24578DF92E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004710, "uuid": "e28c9dba-a7f9-4d13-8b64-5a55dcd0acf7", "value": "8da5973a84d0980eaf40ac16e606fbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004710, "uuid": "7eec37b7-8316-404b-8463-b69c6a949183", "value": "12288:gw3zk2EriICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:gwDkNrBbVTb34k30/8dRi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689004710, "uuid": "05695383-fc7c-4444-a1c8-8a975740484b", "value": 708929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689004710, "uuid": "7ade112d-4c5a-4db1-9e0d-2b9a1884a93f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689004710, "uuid": "296972a1-66a0-4d58-bba8-f90fa522aaf8", "value": "8d12f82b74b2b44f6be66ea315de17f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d772d9-1f22-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1688994180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994180, "uuid": "a76310cf-e556-42da-b7a8-5eb85cff0ea3", "comment": "Malware payload (RedLineStealer)", "value": "9ee32dc00e6f2d4b84620482a72eea91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994180, "uuid": "320acf2a-6911-4f9f-9247-42bf35eb5ef4", "comment": "Malware payload (RedLineStealer)", "value": "ff3b2c0b18f7eb7ed3d1cfed0ae43b2455a344abb011d12b52ed0f4b05ed1860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994180, "uuid": "938fa660-e6b5-4d58-929e-c7badadd3f1f", "comment": "Malware payload (RedLineStealer)", "value": "3e113edb69bd2113640ade608bb40f69632a1cd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1688994180, "uuid": "c30e7452-ec96-4b33-a094-d1340f620e84", "comment": "Malware payload (RedLineStealer)", "value": "d748a13467a160e71246f793c04eb66a8767f48f34a2f2684b28f6664e74d08da8d8633c7e549b373474de5cb160a20c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994180, "uuid": "72522c7c-1f9c-455f-9e2f-311575b47f17", "value": "T14464CF0362E0EC67E86647729D2AC6F8361EF9114E49775A23187A7F1D713B2F262313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994180, "uuid": "f4429de7-6220-47d1-a96b-bc0e69c80d71", "value": "89580c01d87da774c9ed352344b8ed4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994180, "uuid": "47a6197a-bd1f-42d2-a8f2-c10a9b74a656", "value": "6144:nO37LSHefjG3Pq37Ut03OsoK8iQHfaVY5uxrLi+X:O37GHefjaPHCuTVHfaOuxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1688994180, "uuid": "d41dba1d-43d5-4508-affe-27935b338102", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1688994180, "uuid": "5a29cd1f-1bcb-41e7-90e9-9405f9e405b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1688994180, "uuid": "a8954e76-2c7e-4569-9d48-d8dd46969570", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }