{ "Event": { "published": true, "date": "2022-07-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-07-16", "timestamp": 1658016182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "43cf09ce-201e-4792-a472-52ffe8ebebb0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efb7f4c-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948529, "uuid": "f75d1759-db15-480a-94be-94b0fac080c6", "comment": "Malware payload", "value": "973d723e262773d59e6b5d64bfa28bd5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948529, "uuid": "41ef1913-9dfe-4be4-b5cb-d0479cbc32bd", "comment": "Malware payload", "value": "01d8b62a017414443d921b05380555393ecab19b835e513a430ae6017abc9ad0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948529, "uuid": "9b1540f6-e47f-483b-9b9f-c89937a5b54c", "comment": "Malware payload", "value": "38eb97fe283f418070564198f0066c35b96719fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948529, "uuid": "76f937ee-100c-4e6d-8ae5-82de33bda1bc", "comment": "Malware payload", "value": "08c1e71277240f0217d51f090fa0c96c81d9b0bb5f16342f6f20f9ddc7cdd6819b53e2728339c8d8d76d5fa7763bd642", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948529, "uuid": "6cef6890-1661-45da-a609-b690a9de2961", "value": "T111A1E650112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948529, "uuid": "6f846d33-6f0a-49f1-b1a8-c4f2d4275c95", "value": "96:HRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:HRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948529, "uuid": "80621b7b-2ff8-4111-9c02-f07df0b25b9c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948529, "uuid": "499da0fa-c099-4c83-925b-bd33ef83981d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948529, "uuid": "96554cac-c09e-429b-a411-415beabac144", "value": "01d8b62a017414443d921b05380555393ecab19b835e513a430ae6017abc9ad0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e954ef99-0541-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658001616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001616, "uuid": "e527f860-92e1-4b1b-be45-68cdf991a400", "comment": "Malware payload (RedLineStealer)", "value": "b3158ff7a9151c71ee76f8ee7b14f803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001616, "uuid": "9d88d1f0-764a-4706-86fa-af6024801d11", "comment": "Malware payload (RedLineStealer)", "value": "02368643b60836699bcb411c99e2128e28101dddb0b0abaa50c780472e8ba083", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001616, "uuid": "eaae65fc-4804-4755-afd9-c0fb3e58c76a", "comment": "Malware payload (RedLineStealer)", "value": "159e7b628f7803e16de54524af0126e8593c7527", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001616, "uuid": "1f542f6d-7574-48d6-8984-1fb224839883", "comment": "Malware payload (RedLineStealer)", "value": "f3e4bc3a2d9a56e830eea1eff3d3d61c6c9b0be97467723b9ae0e3b593db968db2442dbef4bb633fc3c718700dfa8480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001616, "uuid": "69477c0b-b7b5-4247-babe-7fc244977474", "value": "T13494B000BB90D435F4F752F486BA9368B93E7EA0A72450CB62D52AEB57386D1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001616, "uuid": "7a609425-21aa-410b-ac00-6b07217aabb1", "value": "67b6405ac99a13af0fddde5923fb8811", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001616, "uuid": "dc1d4c12-93ee-4072-a5f7-16a95697e04d", "value": "6144:ypxdJn3xehvUwFjgjk56QTsGeqree9Z7dru+C5hWM6RozUKM7sJibun3Wt:yLBetd1Gk56QTsGUevdJgJiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658001616, "uuid": "b43c736b-afee-4f52-b9d9-fdbaad3f1fb0", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658001616, "uuid": "8d4d8f0c-1b81-448f-8d93-73b3e69f058e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001616, "uuid": "c1048baa-b189-4248-80f8-748a8d517374", "value": "b3158ff7a9151c71ee76f8ee7b14f803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee4ba4a-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948099, "uuid": "4be73e2b-5860-45e3-acfa-db31c8981da1", "comment": "Malware payload", "value": "f3bd4e7ca8d4cfdb577b2c81f2343b45", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948099, "uuid": "6221f92c-4065-40e2-9f5a-d6e092e8f8a0", "comment": "Malware payload", "value": "027f86b959bc29d33de6f258b61e73db20413b49d6f5473e36f9d70d51e25710", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948099, "uuid": "86508b5b-f713-4e38-808d-9976945d9900", "comment": "Malware payload", "value": "ce4469e75f8acc18980e0247fd442e90e214b1fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948099, "uuid": "9e665f88-6b83-4ecd-976e-94f3852d2926", "comment": "Malware payload", "value": "683c4217ed397455f818cc5e881244e1425a12b1a1762dcef102893af1539b4ad84fef58d44dc901d4bec9ac1a921ade", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948099, "uuid": "40fae80c-9dc4-4ad9-8b41-587883e6bac7", "value": "T176413E86E26149B02E61B8DE32694D8439C0D0E77C899FF41DFCB8E609ACF947C257D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948099, "uuid": "538688f4-db8e-46bc-9930-eb424b19e1a4", "value": "48:vU8b0hEU8oJdelU7kUYPU2LJUIbUQUidU8UNuVUpMJUMUeLUV2UVH0oX:vUwUsU7kUkUkUwUQUcUcUpWUMUeLUV2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948099, "uuid": "8cc10daa-7403-4ba8-bcb9-033e3a079a27", "value": 2302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948099, "uuid": "84b6a384-b0c9-4f75-b138-bb865ac73993", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948099, "uuid": "1ef70673-2d87-471e-a029-37cde917c125", "value": "027f86b959bc29d33de6f258b61e73db20413b49d6f5473e36f9d70d51e25710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d5f17f-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948827, "uuid": "3a32b3f7-4913-479f-b311-14a2b980ee7e", "comment": "Malware payload", "value": "453f57ecc15c7073d5db7f10762ed587", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948827, "uuid": "eb41b5d7-0b99-4351-91e8-c02e1c7980e8", "comment": "Malware payload", "value": "03208a366017b6c54845db747b1c5a86eb7009890a6fbffcaece244a55b69db5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948827, "uuid": "961443a9-0c72-4c47-bdde-1376e9470dc4", "comment": "Malware payload", "value": "644d4de60c71412e19b4d166899342c62f4519d3", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948827, "uuid": "a15a8cd9-fde1-4914-a675-acf7d701471f", "comment": "Malware payload", "value": "9cd4fd91f0bb6805a07e4f8eded2f3cf6c7b9c6a60785900a84de8c7f9b3d80b0ccdae4daafa9ba4f795bd90ba379228", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948827, "uuid": "93e4a156-54b4-4a54-bbad-97c05fd57385", "value": "T12826337DF0E93DFF8358697193EBEF20706A098DB0A1970299B7D54B081633194FB929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948827, "uuid": "18156c7a-894a-4dc6-a47a-6242ff334b79", "value": "98304:tos909Qg6ecEZHyEexmLaI9MY7bxTE8SSvEgP3N2v+KmFL:td69Qg/JFeQ5x7bhE8SSdP8v+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948827, "uuid": "6dca6f18-f488-4e2c-979c-0771709368aa", "value": 4726784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948827, "uuid": "51775eb4-a68c-4d67-a5b1-f6a37b57e2f7", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948827, "uuid": "0c70f154-96d3-4067-abb8-1d2ec1cc007c", "value": "03208a366017b6c54845db747b1c5a86eb7009890a6fbffcaece244a55b69db5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbedceb-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947859, "uuid": "e4140ca2-95cc-4e1d-8ab3-6a4f73f60746", "comment": "Malware payload", "value": "8def26485b7e7453bba6fea348eb1fd2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947859, "uuid": "6c1cb90e-dd88-4387-893e-a316657e4a2c", "comment": "Malware payload", "value": "03ba2982239ed4eb863e6e352a3aab912379a59a6d429166b9a6c055cc4852b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947859, "uuid": "83caabe4-bea9-4a77-b4ff-d2f54c42aae5", "comment": "Malware payload", "value": "05fc55171a6a1ab53928319a4d10bcb06cb58508", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947859, "uuid": "8514fa0e-c682-40bf-9c6e-80cab3f95219", "comment": "Malware payload", "value": "65313c15414abf3ac0852cb07e05a76542383e54a400edb07aca46729041411741fbb0eec4055a1b432c9512cf19916a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947859, "uuid": "44fb6b15-106b-4df3-8c66-0cc47d0746d7", "value": "T1E4A1E750112C1AB17346697ED26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947859, "uuid": "01e194bd-f311-43bd-80d7-9423d2a84cad", "value": "96:bRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:bRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947859, "uuid": "187c2d83-7822-445b-842b-7f7b2fff8111", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947859, "uuid": "accd8817-11a3-4adf-bf70-ddcd451d399b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947859, "uuid": "5bd4ae48-619d-4d47-87f0-7667c2132ccb", "value": "03ba2982239ed4eb863e6e352a3aab912379a59a6d429166b9a6c055cc4852b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b4b9ee-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948411, "uuid": "f64bdab9-a3fa-4afe-8d13-87eaf8884919", "comment": "Malware payload", "value": "4926890afb4a85d9dd003ff33083bf3d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948411, "uuid": "8f4e1f50-963b-4bdb-9b4f-3c7bc8588b13", "comment": "Malware payload", "value": "03f62076b70c4eb24d8c1abfb81c20caa3256ac1d3a32d63ed4e6744a7dbf999", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948411, "uuid": "1c3e8c42-ba3a-4cc1-8057-62ac436dfddc", "comment": "Malware payload", "value": "d690e5a584c820d062172c8f3fd888b4e7337b21", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948411, "uuid": "745c668d-0edd-4e5d-947d-cd6c4925c12a", "comment": "Malware payload", "value": "fb40c84ebbfd3fe873a9f168a69a8fc16317794aba59de4b55f6e03b910a8f2878f9b5dc579c0c3322aba49d985f6b51", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948411, "uuid": "e679bdaf-eeb7-4cdd-bc78-9e6ea6f2ecdc", "value": "T10DA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948411, "uuid": "194cc96e-960c-4722-87f5-ae959d80c00d", "value": "96:dHLRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:drRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948411, "uuid": "ce7a5739-7c3e-424c-9d62-6aaa4c42d527", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948411, "uuid": "b53ac84d-725f-4c9c-8705-cc16d8bda96c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948411, "uuid": "f1ee9ab7-0978-4eaa-857a-886951130e59", "value": "03f62076b70c4eb24d8c1abfb81c20caa3256ac1d3a32d63ed4e6744a7dbf999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3aa8fa-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948286, "uuid": "2e04d93b-6d98-4679-8366-ac626f6ee553", "comment": "Malware payload", "value": "d17b88ef25d084f732e889e73090a882", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948286, "uuid": "578bd50e-f1b4-43cd-b20b-35bd968c55a8", "comment": "Malware payload", "value": "04d53966c6145653d0cb7c434586d75483a5a7168a19ce67d953e4e3bb9cc71e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948286, "uuid": "ec3b2a8c-348a-4b88-b7a6-f15a3175fd17", "comment": "Malware payload", "value": "ce43e172ffb8d9d5f3c7c26b64de74cc34488cbb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948286, "uuid": "57c801c2-0811-45a9-a02d-55ac73f53cea", "comment": "Malware payload", "value": "ee2b0ecfd1a202c58e23e9fa99544a19f45fa78a7b33c98ae657700a9a4116eb488fd6e5c3808c502550979b28f42985", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948286, "uuid": "2b5659e5-6f25-4d8d-aef3-ce9d590c2c48", "value": "T1D0A1F850112C1AB17246597AD26FFA52B40ECC1B09777B358433A63C74F9DB8E0796C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948286, "uuid": "b6646d8e-d551-46c5-8505-6b01048e8692", "value": "96:7RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:7RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948286, "uuid": "a049ef98-7b67-4982-867e-c7427f18a480", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948286, "uuid": "6a21ab4d-3498-4fa9-931f-465bf18815f3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948286, "uuid": "6bb331ba-335c-49c6-80b1-4c33c95b60a4", "value": "04d53966c6145653d0cb7c434586d75483a5a7168a19ce67d953e4e3bb9cc71e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3bd100-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948068, "uuid": "8e1b65cb-1f74-4d41-9fce-bdf3c3833ceb", "comment": "Malware payload", "value": "205c113fbfe016939a5731b8f226c360", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948068, "uuid": "bc98aa9f-3735-4c85-aa49-b5c16e39aad3", "comment": "Malware payload", "value": "04ee0bbb8ba84eeac2f4af133dc8ceff6b5c9159729d937875a89762bc5b6e29", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948068, "uuid": "6928100e-292f-41e4-a40d-7d2b9c7cbb4b", "comment": "Malware payload", "value": "4180c193f366021f1c10890a5bcd2d3ecef47fa7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948068, "uuid": "646306cf-9889-4b16-a24f-e5d77af89605", "comment": "Malware payload", "value": "42cab34234f548159cb30566a5fa0375fb0c9b3552d70c5c8fa080a68ab6afa967ad083873dedb74cbf6db42d90f2784", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948068, "uuid": "5028248d-411c-485e-80c3-9a0909d03b8d", "value": "T16892B53AAF61DCB00954473DF6EE542D5FDC044B0CB645A8B00EDAAD8F6DC5EA98834A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948068, "uuid": "bdbe99f0-a4e2-437d-b298-96868092c3c9", "value": "384:fGosGrHwHsv1TDKzHwMH9OHMbH75UbGcjpo:f3Fv1TDKrwc9eMD75Ubjpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948068, "uuid": "79973948-b092-49a3-a77a-20a2497ca405", "value": 19578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948068, "uuid": "dfe220d7-3f11-4f74-9da3-d0d812cf024f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948068, "uuid": "307c9ba8-3107-4cd9-b731-fe8f06cfd492", "value": "04ee0bbb8ba84eeac2f4af133dc8ceff6b5c9159729d937875a89762bc5b6e29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133b1349-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948429, "uuid": "f57c83b1-6ef7-448b-be0c-f629f58cb5ca", "comment": "Malware payload", "value": "6182256aaa01cf70e7aabc881adc4e78", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948429, "uuid": "528e1f19-b40b-487e-b8ef-663882e22dd7", "comment": "Malware payload", "value": "050902642468236f47ab0ec1ee563dbb55201b239d5ec292ae41db7e0ef762ce", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948429, "uuid": "150af306-22b6-4923-adf7-a77cd0594d6f", "comment": "Malware payload", "value": "41ce7b5adcefc5709824825525ae65cd1c0b21f2", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948429, "uuid": "4f145740-0559-4a3d-9058-7794eaa18c3d", "comment": "Malware payload", "value": "31530adf0e38145dbd9c490dcaad7cbf68c75a8327c1416f950e1d6959f515915ff6aef4b246d56b05cbf1e8b2a42896", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948429, "uuid": "304357d8-2b3b-49e2-bb41-c88392266c64", "value": "T1363423C5236BCCFDEC3DA18B1A82EA1F3151B77E5232469BC51452BD2D1C36A1F287A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948429, "uuid": "b17581a1-9bb5-4e41-8067-ad10ed71c222", "value": "6144:xaKPG1+oXcXpDD+LKZNIiFmdKeqyOmEOUbjvgHel3ofNg2MdK7:q1+oXcXZEQWxn0bjgK3ofSK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948429, "uuid": "41b23bcd-b157-4409-85b4-8e8580d69671", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948429, "uuid": "8c642c1f-2d8e-4c43-8b17-625055b92989", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948429, "uuid": "659c74b2-0a1a-4e20-bd31-17dd3b419162", "value": "050902642468236f47ab0ec1ee563dbb55201b239d5ec292ae41db7e0ef762ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bae1355-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948496, "uuid": "223d0f44-bc31-45b0-b0bd-c9b53c541628", "comment": "Malware payload", "value": "d9396118912f3e97bbbd3ff2ac3603cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948496, "uuid": "98e3d5b3-28b1-4391-bc72-44ef6719d970", "comment": "Malware payload", "value": "0589a939c072a2b8ebb2234ae683a7591c348effa9610da4e5ef1e292b843f09", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948496, "uuid": "6b22633b-bbc3-4fd9-aaaa-a12473a89c50", "comment": "Malware payload", "value": "a2b76db29bbfdb34ec9a69a9087057041505314d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948496, "uuid": "59e31c4b-117d-4177-a1ff-bb264c2d9e0a", "comment": "Malware payload", "value": "6386af053366fcd8e247f91400ad3e9e64cab2711506932cbec3519bf9cfbc3725ae7996cff01cb4e3ee9fdfb5f4448f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948496, "uuid": "78d40c4f-fee7-4efc-8718-7b6757d78d72", "value": "T1D9A1F750112C1AB07246697AD26FFB52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948496, "uuid": "8ed55682-135c-489b-bda2-388287333dfb", "value": "96:+RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:+RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948496, "uuid": "fe6f26dc-fa07-4305-a830-c886a4dd8222", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948496, "uuid": "d8b34b44-e8c8-4902-bb0b-9ea8770caaf4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948496, "uuid": "3bdf2be2-5471-4286-a7ed-7c6a06872f34", "value": "0589a939c072a2b8ebb2234ae683a7591c348effa9610da4e5ef1e292b843f09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6507cdd8-0555-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658009984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009984, "uuid": "1102611d-9cf0-4b10-a580-25d391a33493", "comment": "Malware payload (Mirai)", "value": "1dbb24f0dc00cd4317e84f3f5fa369b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009984, "uuid": "20815782-9725-4233-8372-ba1d6b34d1cd", "comment": "Malware payload (Mirai)", "value": "0619959d0fd5c0c0b75e163011ad559f3943ebf16cb45b31861dc95dfb0decc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009984, "uuid": "82385266-d7e9-42bc-9f58-3956980f2577", "comment": "Malware payload (Mirai)", "value": "a626780501bd2cfc6941a4fe02def9c185ef7382", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009984, "uuid": "5b1a4229-f2c1-4598-aed2-3a58a8d00be0", "comment": "Malware payload (Mirai)", "value": "7c76132927aeb93102ddc4367c0d746791e36e40717de58ff2404d51a2100ec32bd7db9198a31e581de5aacdb4a36485", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658009984, "uuid": "d7066256-fcba-4b69-9f08-f682c25b706b", "value": "T130333BC5D59BECF9DC211579307BAF729AB6E53F2028EA93C399A823DE02542D10335D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658009984, "uuid": "1814a354-3d5f-4166-ae89-ff44c29d194b", "value": "768:lvlxj1SUPVUvAyyhrV3k8t2dySpG3hnk4xijHZMymQ3Yvb2:dj1SUuvAXhmsETmQIvb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658009984, "uuid": "8ea30f53-46fb-46c1-906b-ee44a5f99aae", "value": 54588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658009984, "uuid": "139e642b-0841-4a36-9e03-7ae35038e758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658009984, "uuid": "9409d9a8-4b52-4ef5-8e8b-6428ffa3a9db", "value": "1dbb24f0dc00cd4317e84f3f5fa369b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e7ade2-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948639, "uuid": "58d17c71-dbcb-4d5d-984b-43bd0cf2f734", "comment": "Malware payload", "value": "0bf4235eb5c2954ef4a9fcce5db519ed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948639, "uuid": "f2353ab8-b0bc-4fa0-a4c0-8f9e7475ccbf", "comment": "Malware payload", "value": "06499f473cd34440742309554cd481a902e3141fadd6b6282e60bd5cb3831495", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948639, "uuid": "2c1d094b-40e8-4de3-aa9e-ba13f5026a6f", "comment": "Malware payload", "value": "3a2fd7a63bf53fa602ec9e85d7bc2ac28e69dafc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948639, "uuid": "dcb15729-082c-4178-bfca-782da4d9794f", "comment": "Malware payload", "value": "019030a31d02d0b3f9c5a050262ac2a5a7402f42becd847739a61217a815476f146996411e7eddd4faaec2b9ef29d716", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948639, "uuid": "e5e32819-08a8-47e5-9ccf-41ac668819b1", "value": "T197A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948639, "uuid": "21e3f6a1-0d46-4a4f-909e-73a206341961", "value": "96:9RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:9RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948639, "uuid": "0e6e1353-ee82-4593-a35a-2232082ed5e1", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948639, "uuid": "47a8567b-b4f9-459b-85b8-9364aeb2aacb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948639, "uuid": "58fdfea1-d3e5-421b-9bd4-95e329640569", "value": "06499f473cd34440742309554cd481a902e3141fadd6b6282e60bd5cb3831495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d91f895-04e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1657961116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961116, "uuid": "af890f08-5cd6-402f-85c0-46ce156f1160", "comment": "Malware payload (Formbook)", "value": "1ea88c58d4fb702db98fa5ac0087ed41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961116, "uuid": "8b106f38-a44b-4d7b-aada-8821a245a5fe", "comment": "Malware payload (Formbook)", "value": "0786b5b2a68708b2fca9e23cad8c4db9ce4c3bcb8afc3bb74832fd9e14ff4071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961116, "uuid": "9e2c66ce-5c01-4ec8-9389-5b8fe27a4b9e", "comment": "Malware payload (Formbook)", "value": "07963465296ef0122bf3afae9302461075216528", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961116, "uuid": "44f0594b-82e7-4da6-9afd-eedf74befb5b", "comment": "Malware payload (Formbook)", "value": "956898572c4d4e0b8b93ffa0efd9e468f34dbe56b0d3fb30c048158c1ea6b46f858347667ffddd9120af0027e2b5bf73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961116, "uuid": "6aabee3f-1ccb-4d66-b1cf-63a0be035932", "value": "T1D824C011B7E0C432E1621E304471EBE15737BD23A574A50BFB906BAE2EB338156B6397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961116, "uuid": "59a16b56-1426-4e54-a87f-3873dee2b222", "value": "7c019bfd9cbcb09ec79f787dd811881a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961116, "uuid": "89e3b8cf-add1-4182-9695-7df3d3fe1197", "value": "3072:ypl8UI6Hy5W2/S3a6CFeCZnbpeRnhEroJhZ6/PNjOBXzCp6sxkgaBChcpZa9uD61:8qUI6Hyg275x9pO9Jj1BXzqnigafwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961116, "uuid": "de46ba8b-08e7-4191-9009-1a8d59abc7ab", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961116, "uuid": "12b89062-2ba6-46d1-942a-a9567e5284d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961116, "uuid": "99d1f9c6-2048-4615-ae8a-1ba1eb3ff33c", "value": "1ea88c58d4fb702db98fa5ac0087ed41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61c10cd-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948782, "uuid": "6348bdf8-f069-4be1-a0a0-e7a1954c8cdd", "comment": "Malware payload", "value": "ba7dabe8ffce0a86dc315c4d9353262a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948782, "uuid": "cdb54cc0-380f-4b68-a9ee-2bd08126247f", "comment": "Malware payload", "value": "0901d0f6137b747ba2b7deb2bb7b8f8be1a2f6d70c36d77a6a745aae8b3431b0", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948782, "uuid": "158662fe-c710-4c96-8e5e-b89fc1e7a881", "comment": "Malware payload", "value": "97e011feb07f5b026ea302f8560e7a8670a2a07d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948782, "uuid": "5382a5c4-10a4-4c0d-941c-ac6914c67e99", "comment": "Malware payload", "value": "f03b0149a6680f71d1b3f4cb5364433a242347013f8270011f92cc54941fcbe812558acb133b02f12a554851633e9551", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948782, "uuid": "3cdc268c-830b-41cd-be5d-3b918d71dcfb", "value": "T1C25423B3A2C5714A601577E9490B47C0E9A9C0297ABF3E7B77C878DB94B883C3AF4510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948782, "uuid": "f71f1f8e-e991-43a6-af4b-710d0585070e", "value": "6144:WJl+blcj/mDNgl/I0AcDm2zvVtQae8tmxnwN53qoliI:WNj2Nglg5R88wN53q0iI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948782, "uuid": "f28a6cd9-5aca-4cae-8634-def33eeb3e1b", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948782, "uuid": "e9d3b9a3-a8da-4f05-bb48-4b3881718736", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948782, "uuid": "8a8a8416-ff83-4d34-abc3-db083c63f2b6", "value": "0901d0f6137b747ba2b7deb2bb7b8f8be1a2f6d70c36d77a6a745aae8b3431b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d08dab-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948587, "uuid": "dc4c6b12-b7ab-46a8-8ab3-73327be76e28", "comment": "Malware payload", "value": "136d20cf39f0f617674c36583cea7100", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948587, "uuid": "85f54ec6-540d-4919-b7ca-88d349dfee2b", "comment": "Malware payload", "value": "099e786962e576297888681096d6b3f33ef62b87646442d3d8198149211849e8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948587, "uuid": "fe4e72d3-0f3b-4e90-b86b-4b8593af0074", "comment": "Malware payload", "value": "67bbb99425b2b4e827417333d1148cc849f91466", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948587, "uuid": "4e454e77-f9cb-4a6e-8df4-306388c8a789", "comment": "Malware payload", "value": "346990e08cae203e6f80fc250da7736e8fb28bad19d8de19d5129878661ac029961fcc3911e61ef04666f6d1669ff674", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948587, "uuid": "5b62c6a3-75f3-4bca-862e-0535380f24b9", "value": "T145E0C258109735967E535E50762BBBD135816C45A610443EE3B9AE638CBCF017B0E871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948587, "uuid": "c08cf619-5a91-4459-847b-3c853bd39d88", "value": "6:hdcEp10OXOZYzBqlQXZRlzTjafaqUZtL57bNwb:XHpNOZYzYlE/jaC3THGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948587, "uuid": "dd97e864-8c6b-42d1-99cc-2278ca2bf816", "value": 330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948587, "uuid": "4ab111fa-9f87-4815-af6d-4cf5c1120d84", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948587, "uuid": "6304b6f8-b3d7-4351-87ba-c05fea18eb18", "value": "099e786962e576297888681096d6b3f33ef62b87646442d3d8198149211849e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8533e32d-0504-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1657975249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975249, "uuid": "93f6d8bd-f9cc-41b9-b587-0d39296be556", "comment": "Malware payload (AgentTesla)", "value": "48b5c835b1eff0ee782efcd70f08d7b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975249, "uuid": "fe6490a8-b946-4f65-8153-3d6f61e801e4", "comment": "Malware payload (AgentTesla)", "value": "09afb84ee12db46179acd9cc005ed36e7ba0fdf4eed4eb1dafa27223c74d1fac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975249, "uuid": "4a66d9f9-cdc2-49fe-a6d7-ffdb5f36a88a", "comment": "Malware payload (AgentTesla)", "value": "4b364360fe09cfe570caa140e90e49fc6c256d2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975249, "uuid": "e9376c7f-f8cb-4bd9-9458-bac7adbb90b8", "comment": "Malware payload (AgentTesla)", "value": "27be72d6a6e3dc9ec34748b8e3319e328f536f5e17e9b868891f9eeffdcac0a7f3633917c27680fa842910bd8bf8505f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975249, "uuid": "30c0c87a-417f-4b6a-8f22-332f6c3cdeab", "value": "T1D825F11423E44691F8FF17BAD8B601104B7A7A2AA57FE70E1D80B0ED1D32791C866B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975249, "uuid": "e064c842-457e-47b1-a317-bee16dbdfdba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975249, "uuid": "93d5aecf-49c0-44d0-95a7-ac069d2e49e7", "value": "24576:cyata67/HbrWEx1C6U66h68eIyAY659Y:cLh/7rP1C6MOINYGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657975249, "uuid": "8ff6383e-4717-4da0-a9f1-6791fc6f1ff5", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657975249, "uuid": "e1b81ae2-43bf-4aa2-8437-c3c64b785124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975249, "uuid": "0c76a986-8336-498e-9dbe-a0be19d21313", "value": "SecuriteInfo.com.Trojan.PackedNET.1449.29096.15279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a402299-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948414, "uuid": "83ba78b9-73e8-4d65-a477-a09f93db7cbc", "comment": "Malware payload", "value": "55d23d8eb58249a489b1a2e0334bc125", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948414, "uuid": "83b2a802-0d69-42df-bd40-44c45d0acc52", "comment": "Malware payload", "value": "09f655952d157722cef3a46e87dcdb8fa5a2c9150b7c5a6ff3128fc669d77e53", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948414, "uuid": "470ac8fe-2818-4f66-9f45-2a3c4f3a3f8a", "comment": "Malware payload", "value": "b221c7d85275dc85d5edc9add2d5a025491b4096", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948414, "uuid": "f2e9f176-ddfa-4c8c-ac00-63911b8eeaf8", "comment": "Malware payload", "value": "61b353c759abb77a3c14bc9cbd7eaa713718aa25c93e7b08f0e3c4aa9ba58b0d0be315044fc15d5984c306baba8a7761", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948414, "uuid": "531f129f-d49d-450a-b6cd-21004bd99839", "value": "T110A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948414, "uuid": "e3d9a3d1-fa2e-49d9-9d52-aa0c413b21d7", "value": "96:4fRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:iRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948414, "uuid": "c008e825-2a3e-4f3c-a2e5-3f7aa095463f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948414, "uuid": "08272a61-77bc-49eb-95be-1efacc0ce31c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948414, "uuid": "8f3002e6-114a-4903-b45d-0abf72a0dd82", "value": "09f655952d157722cef3a46e87dcdb8fa5a2c9150b7c5a6ff3128fc669d77e53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c846f5-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948404, "uuid": "4ebc8404-5b0a-4098-b98d-e75b8f70842a", "comment": "Malware payload", "value": "80be3dd1c39c6038bbc32cf619240cd5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948404, "uuid": "5995ec06-897e-4822-bfa5-93de2f8e2c63", "comment": "Malware payload", "value": "0ad445186e050ceff1d850d909838f02edae16015142d0d1ff643b1a02f05ac9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948404, "uuid": "2e795b9a-cd44-44b9-80a1-731d99c8495d", "comment": "Malware payload", "value": "b400d9ebf27355d600b23d6b397832b1f427ff97", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948404, "uuid": "9679d57f-d69f-4366-8e90-2a49c9c7c6f2", "comment": "Malware payload", "value": "7a946dcc955d0f0aaf6d0aef64dd363d700b1f7bf6673bd3a56c1ac6b4cde482342e50f9879096aa618ed6c848fb3ec6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948404, "uuid": "d61affab-4f94-4cdd-9bbf-43ca264f6f2c", "value": "T14C92A43AAF61DCB00954473DF6EE542D5FDC044B0CB645A8B00EDAAD8F6DC5EA98834A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948404, "uuid": "f1cdab7e-0066-4fc7-8ccf-cea0f029041e", "value": "384:fGosGaHFHsv1TDKzHwMH9OHMhH75UbGcjpp:feSv1TDKrwc9eMJ75Ubjpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948404, "uuid": "be205104-5bfa-4c8d-b123-d0a76dea1e2e", "value": 19579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948404, "uuid": "e0a43175-c343-4bbe-97e4-d28558b30723", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948404, "uuid": "8a8107f0-f543-4312-9a9c-c6b6f7895a55", "value": "0ad445186e050ceff1d850d909838f02edae16015142d0d1ff643b1a02f05ac9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017f4915-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948399, "uuid": "d81b10b0-af8d-4216-ad46-73b71fc3c15d", "comment": "Malware payload", "value": "bd09f626b01125e1a90360e91cc36a6b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948399, "uuid": "fd1a7c1d-d192-4819-bfa0-d66cdedc7b55", "comment": "Malware payload", "value": "0ad72941e8ebab616bea5b062c01b1f73fdc630315d5768cd46f8c12c5d788de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948399, "uuid": "3cce821e-c847-405d-a1f7-f76937a18993", "comment": "Malware payload", "value": "3f85415df6e6254d19e0b0bce94e93d962856918", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948399, "uuid": "d06eeccc-d963-43c8-8a18-7baf229ea1c7", "comment": "Malware payload", "value": "575fcf5044e1ff0d1602f3736dda2c589d8e5f6826b83dbdafa246dd2a63d98a648050d4588f390866bbb0b839fef306", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948399, "uuid": "5409976c-242e-4321-89a3-c475190f1cfd", "value": "T11EA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948399, "uuid": "0f7a9a7b-be33-4481-b886-60537ed7373e", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948399, "uuid": "2992a559-b51c-418c-a750-50aac7ab0f74", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948399, "uuid": "44bbe020-4950-4f9b-9eba-0fc0fdee327d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948399, "uuid": "62d83295-08e8-4b5e-aa5f-74f538f8bed6", "value": "0ad72941e8ebab616bea5b062c01b1f73fdc630315d5768cd46f8c12c5d788de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ace154-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948622, "uuid": "6dec5da1-6117-4790-a3c9-ab01abffcf91", "comment": "Malware payload", "value": "470015ee9deeaa8f4cdb816cd54c7e8a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948622, "uuid": "0c7cbc6e-3322-42be-bfb6-9e6039104eea", "comment": "Malware payload", "value": "0b1084b3333453cc37ac18db0d8344f60b187842903292576008037cc55e67e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948622, "uuid": "8e6e4a45-dcef-41cd-9fe8-88ffb5bd3a8a", "comment": "Malware payload", "value": "42971e7224b1b555a4a78f7c42d6509a4b246220", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948622, "uuid": "34756476-9060-4bea-8d11-f1b482b05956", "comment": "Malware payload", "value": "8645de191f7062b6ee1bac3e27dbca0f249dad62604aadbbb2b96ea917d97146fbc349f3e6596be405ad92340eb74cae", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948622, "uuid": "767888a5-276f-41d2-808f-a02259ba69aa", "value": "T177A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948622, "uuid": "d4718394-9aaf-4e69-a623-1cd089745983", "value": "96:pRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:pRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948622, "uuid": "b16abe92-155e-4de5-80ec-46ea6f7dc973", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948622, "uuid": "a338cebc-0212-484a-8007-bf64132a2a34", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948622, "uuid": "7f9144a9-e28c-4ab9-8b78-baca2449b3ca", "value": "0b1084b3333453cc37ac18db0d8344f60b187842903292576008037cc55e67e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8bc0bb-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947854, "uuid": "629c28b6-fa44-4206-8f68-cca66c709909", "comment": "Malware payload", "value": "0c11c417d849d59d2b96be549e7e8a39", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947854, "uuid": "a2870291-8a29-4bf4-977a-26a4e2f8ddff", "comment": "Malware payload", "value": "0bc1e4edb1f94176e61a4a19d4d0508f085aeec41c93ebd1c1cbf292ba818adc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947854, "uuid": "d80de887-1ac9-4784-9c3b-ba54d97fba03", "comment": "Malware payload", "value": "e8c9b8fd924150f80d5a0d99f5d5d695a289c512", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947854, "uuid": "9b0cf030-026a-4a76-8e43-5d208cb38779", "comment": "Malware payload", "value": "c1c8e8336103a812e6cfe57c7d4494909fd5d2e67c65613165d0ca171f454d3827c4e235f78aa00b5e79ec9ef4091f04", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947854, "uuid": "53a18c0c-e9ef-4777-be2b-09393892004a", "value": "T184A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947854, "uuid": "0a01a449-8e5a-40d3-abb7-8d982f8cdcad", "value": "96:OmRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:OmRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947854, "uuid": "cda486da-2d2c-4fc2-8947-9c1e2c49e32c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947854, "uuid": "93f3340e-02fb-4d5e-a813-c66803eb6b0e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947854, "uuid": "39a3ca62-a9be-4f9f-a5b9-07f958a12edf", "value": "0bc1e4edb1f94176e61a4a19d4d0508f085aeec41c93ebd1c1cbf292ba818adc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42da7a91-0533-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1657995324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657995324, "uuid": "2751fbfa-08af-4b51-9daa-eb90476c2e19", "comment": "Malware payload (njrat)", "value": "aa2213c70136bd854a098e121ed2835d", "object_relation": "md5", "Tag": [ { "name": "ad-ware", "colour": "#2DB5F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "pop-up", "colour": "#B59FEF", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "synapse", "colour": "#1A67BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657995324, "uuid": "55b6baf7-8811-4e63-885f-d3af0b3bcfcd", "comment": "Malware payload (njrat)", "value": "0c16eba5e2bf7db79087c0b25d0e8e219514797ff8294bbb8276ae25aac04aa3", "object_relation": "sha256", "Tag": [ { "name": "ad-ware", "colour": "#2DB5F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "pop-up", "colour": "#B59FEF", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "synapse", "colour": "#1A67BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657995324, "uuid": "7c91ec3f-90b8-4338-b082-d92b085b208c", "comment": "Malware payload (njrat)", "value": "702ee3f4eb7a5418ba784a7802c472d35f641b87", "object_relation": "sha1", "Tag": [ { "name": "ad-ware", "colour": "#2DB5F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "pop-up", "colour": "#B59FEF", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "synapse", "colour": "#1A67BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657995324, "uuid": "cb238b22-0428-4438-b7e1-a8dcfb5e40e7", "comment": "Malware payload (njrat)", "value": "f436cdadf6ebda3f35775d4b322a298462561a8b291b212b12209951f384baacdc00a48f1d4f4a33af70ae7dd726b698", "object_relation": "sha3-384", "Tag": [ { "name": "ad-ware", "colour": "#2DB5F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fake", "colour": "#36337B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "pop-up", "colour": "#B59FEF", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "synapse", "colour": "#1A67BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "troll", "colour": "#A0E7E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657995324, "uuid": "acbb6399-8c7f-4c7d-a5d4-a7dd2a75f654", "value": "T14E133ACD7BF4866CD5FD067B05B6D4221776E00F5D23DD0E8EE564AA36332C28B50AA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657995324, "uuid": "8206d8a1-f72e-435c-b2f9-b2e002ed0889", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657995324, "uuid": "06526f4e-7a65-40d4-813c-48328f5fe90e", "value": "768:CKRkkG91twjr5S9eNGhIrM+rMRa8NuRWtt0w:CwkkG91Ojk9eghT+gRJN2M0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657995324, "uuid": "c25d57ee-9f55-4065-9045-1563b55a3a21", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657995324, "uuid": "517fafc9-cb87-4c4d-8413-8d8fe7d6800c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657995324, "uuid": "49817509-813d-4914-b062-ba57eb2ceb87", "value": "Synapse Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d3f899-04af-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657938692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938692, "uuid": "529d68c6-f5c1-46a1-bf8c-f990b79b3dd1", "comment": "Malware payload (Mirai)", "value": "8f7d9c1a26979fb1922b6f1dfbf19089", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938692, "uuid": "f2d46933-5ea5-42a5-bd8e-6a6a1a2dfc3d", "comment": "Malware payload (Mirai)", "value": "0c18b3e4eccb32091d07bf4394bbf92c43856a041a7d389d4d9edbd91ece78bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938692, "uuid": "5dacf067-d9d0-4337-9508-a1cf03de0a09", "comment": "Malware payload (Mirai)", "value": "256b96e4cead2b05d915d5c62b39952ef28a3dd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938692, "uuid": "65be044f-be23-4273-b47f-ccb6597efb26", "comment": "Malware payload (Mirai)", "value": "0e70a8b2f65810cd188bce4afe477f3dcf4e57b0ae51a905a07b4edae0cfb4978f05ec535fd30bcac44d918adf31f881", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938692, "uuid": "d12f9442-d47d-48c7-85b3-6cab5ca5cba7", "value": "T13CC3C605BF601FF7EC6FDC3B0AA92B0524CC681A21A57F757974D818BA4BA5F05E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938692, "uuid": "ce4a588c-fd93-4129-9286-4fa2c5b7f0da", "value": "1536:iStRctVzxMSLjgDlgjvXK9lE+VDgtVJy3aWNZFA2nJMEt13:ibzx/QxjgtVLWNJNt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657938692, "uuid": "0af6d443-698b-4da0-a7ea-e481ea02b7aa", "value": 118740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657938692, "uuid": "1e60dbd6-4362-4693-a56f-2cbba2aeb6a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938692, "uuid": "86f2ce28-1f74-4630-91b5-d5fdd5e2ac6b", "value": "SecuriteInfo.com.Linux.Mirai.198.444.19171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39904df6-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948493, "uuid": "bcff3118-d298-40e4-9ad1-6fe8af3caff1", "comment": "Malware payload", "value": "89b98b6cd0ae69deb3d03055644429bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948493, "uuid": "7135c025-b650-46d9-b279-31391c1dae04", "comment": "Malware payload", "value": "0c792494a9fb33834952f2fca57e64c47672751e84eb2f051f8b62ec522ca083", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948493, "uuid": "78a33924-f700-48cf-91a7-2fb93c5df304", "comment": "Malware payload", "value": "40f9fde9be31add0152fca760e0bca657b702559", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948493, "uuid": "a4308c04-257f-4a7f-987c-c0679254b28d", "comment": "Malware payload", "value": "65c2af5c4f58168a91404dc0828749a0c5825caa22fa60b0a7a16f1789831513e49025153cf22137703efbf709ca5ebd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948493, "uuid": "50b3f540-4f61-47e1-bdec-aeaafa7cb361", "value": "T1FCA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948493, "uuid": "3a24e32b-5720-40b6-827e-7dd585bc803e", "value": "96:VRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:VRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948493, "uuid": "0077716d-2120-46c1-9dc2-125940de47db", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948493, "uuid": "8769f9db-4f68-496e-a1df-86a90622bf43", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948493, "uuid": "940abaae-fb34-4a54-875b-d7355af99ad1", "value": "0c792494a9fb33834952f2fca57e64c47672751e84eb2f051f8b62ec522ca083", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2039a544-04c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657949739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949739, "uuid": "5d35baba-d34e-4b3b-814e-d25c2daad6bb", "comment": "Malware payload (Mirai)", "value": "01e05d0c2d5ee8b49a6a06ff623af7e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949739, "uuid": "d95887a0-f536-481b-91ac-220a741233a4", "comment": "Malware payload (Mirai)", "value": "0d1d3fc439f16f6bfc512156b1e1ccc65bdc2a575812134e0e34b7b6c2d41540", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949739, "uuid": "edcf20d2-3c13-4012-83c3-d4ac70077f8d", "comment": "Malware payload (Mirai)", "value": "0187817be847fba0f7444b0014989c56e2b92b19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949739, "uuid": "c7cc1ae2-24e0-4c8a-82d7-47338d6d29e5", "comment": "Malware payload (Mirai)", "value": "05d5164f2c9be97515ba2400f85c9309059c443ab1a9c0a135bc279c31059e28bd9eac7e62b461452a0a4018bb870d3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949739, "uuid": "51b5e0a4-7616-40c1-8aab-1a0bd7bfac49", "value": "T1AEA33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949739, "uuid": "c739c321-48da-4ead-9c43-c675541a1153", "value": "1536:xfRuqNM5h7t/RiRt4nJphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRuphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657949739, "uuid": "7d888b2f-7c27-4a9c-8a48-8f1c521932ba", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657949739, "uuid": "ca94bec2-0757-4e24-89fc-f344ab3f0cd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949739, "uuid": "3b3efc00-e12d-4261-9e97-909fb2e592aa", "value": "fuckjewishpeople.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0adf1eeb-050e-11ed-93bb-42010a9c0043", "comment": "Malware payload (LockBit)", "timestamp": 1657979338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657979338, "uuid": "c5e0e30f-a557-46e7-997d-e02cd5bb51bc", "comment": "Malware payload (LockBit)", "value": "44e8c23bfb649ecf4cb753ec332899dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "lockbit3", "colour": "#A858FF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657979338, "uuid": "acd95ee3-2fea-4408-887a-387da59610fa", "comment": "Malware payload (LockBit)", "value": "0d38f8bf831f1dbbe9a058930127171f24c3df8dae81e6aa66c430a63cbe0509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "lockbit3", "colour": "#A858FF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657979338, "uuid": "55f162ab-eb20-4407-b303-951dda37b95e", "comment": "Malware payload (LockBit)", "value": "465f5b6de78ee184f1ee3400e4edaa0e85558d9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "lockbit3", "colour": "#A858FF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657979338, "uuid": "f46f26b5-385c-42e7-8035-35ba48070df3", "comment": "Malware payload (LockBit)", "value": "3efe1b486da61a7182c410cf61fc0350786cd7008fae8d3a6209ae0100c8311c53ffaa1c7b3c8a84f42192d871ec582b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "lockbit3", "colour": "#A858FF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657979338, "uuid": "ae727d48-9020-4579-983a-9295b7d89221", "value": "T16DF322E4A9BD08B0CDA2253D3C47EEE01906C03E126617DF441F9255DBD9ADABECF620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657979338, "uuid": "48a7ba4b-f1b4-4bd2-b365-7092f9d559bb", "value": "a50a0d82b9120fc73965c28fea79e1f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657979338, "uuid": "c38f6896-0382-42b3-88b6-983a2f06060f", "value": "3072:NEWBPJgr1sgLFXdJ6Xx7OchgXC6TESq072WHI4nL2knI+eT:N71J4sgLBd0Ocz6TEBmHFnLm+eT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657979338, "uuid": "797cc7f9-f390-4c7f-9dc8-dbe6d255022e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657979338, "uuid": "d0b01579-b2fb-4480-b56f-c7c23b47795f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657979338, "uuid": "839961df-64b8-44c5-885e-ba11ebe4abc0", "value": "LBB_pass.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea44a53-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948636, "uuid": "e1e70ef9-32ba-4a99-8b2f-82bba72291ab", "comment": "Malware payload", "value": "e3c8b2edadff122ea2e06e1ed94048dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948636, "uuid": "465d4ae5-4026-419d-8ecd-b19d11f2451e", "comment": "Malware payload", "value": "0d75252cfa3659c0293d7d2312d54203e4026fdbff33f643746cb33a65924efb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948636, "uuid": "8dff7177-cb36-45f1-a235-1706891d2d17", "comment": "Malware payload", "value": "0a8aaa5f1620a8795af9f6d1a6836782e4493329", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948636, "uuid": "ee3170ab-0d02-4abb-b286-88bd13847890", "comment": "Malware payload", "value": "6e5e3074ec4d13f5c61ea53d6cd61674333ff819e41d367c064fed6809b248eeb58505101e3f304b3162e954c674d09c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948636, "uuid": "56035521-81bb-4d1e-9b8e-16799c33431e", "value": "T140A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948636, "uuid": "5cc260f5-3034-4280-96ea-6d31a523a090", "value": "96:+RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:+RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948636, "uuid": "34f60c20-719e-4040-956d-dd25c2a88f57", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948636, "uuid": "6a2bb336-0b04-4507-8e16-76cd904e2c09", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948636, "uuid": "0758d1be-055f-4768-abb3-e42b912238e0", "value": "0d75252cfa3659c0293d7d2312d54203e4026fdbff33f643746cb33a65924efb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62060e2b-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948561, "uuid": "10cd8541-a945-4781-bc4a-47a69280d0d2", "comment": "Malware payload", "value": "a6abcf8f2920d440c9317192afda53b9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948561, "uuid": "a304cd65-7856-4e73-9e86-edb71de0c7af", "comment": "Malware payload", "value": "0dce7da06da8f7400b2e5b22d4969ffdd8117c5429e319c08a5f4b1b274f001a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948561, "uuid": "26d67c39-b2df-4edc-8015-065d6144b941", "comment": "Malware payload", "value": "5fd5340544a9ea92f09dc8a3e95188e0e5699099", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948561, "uuid": "28ba80b7-759e-4d68-9b5f-279bd55b2c87", "comment": "Malware payload", "value": "de1d5a34da27448244e8b4bd6dad909697abab87645eaa94f80c0af5ad4316b0d92dcd34fdc91f95fdd379e9ec59dccf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948561, "uuid": "47bef242-210d-48fe-977b-0bc7491ab1ea", "value": "T14AA1E850112C1AB17246597AD26FFB92B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948561, "uuid": "3d1fb474-f378-41d9-8b0c-383056302945", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948561, "uuid": "65c41e51-8500-4414-85fe-991b3099a201", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948561, "uuid": "94945b01-8155-4cd6-ac74-391ee06e4328", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948561, "uuid": "16b43488-e415-422e-a358-1e10920fb6bb", "value": "0dce7da06da8f7400b2e5b22d4969ffdd8117c5429e319c08a5f4b1b274f001a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afc87a4-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948146, "uuid": "b0f22fdb-e48a-4c7a-a41f-3e38d121cfb3", "comment": "Malware payload", "value": "d0cfc67c901add557b56e27fb98c0511", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948146, "uuid": "e4a9b2cf-7c75-4ffa-a288-386b0214bcfb", "comment": "Malware payload", "value": "0ed7bef1fac30eb06ffc5b3a94a29ded12d88b5ef35f80a4203865f41b580593", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948146, "uuid": "91a9f034-8023-46e9-93c0-2a23ebb63a6d", "comment": "Malware payload", "value": "5d077b6d576e6d2bc98a6b6f21b4d8d7e6ea4100", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948146, "uuid": "8ca9e758-5f93-45da-bd5a-08609363e650", "comment": "Malware payload", "value": "723c50df9d1b5089fe3b0a02f128648f8f4e9c327f0d74c8b7865d2a43fe838074cd1f9b60a40b8b5d8d3e401c134395", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948146, "uuid": "93d38cff-07e0-4755-8a4b-66e28e8ecec8", "value": "T1A3A1F850112C1AB07346597AD26FFA52B80EC81B0A777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948146, "uuid": "20a844d9-e8cb-4a22-a088-9526943593d8", "value": "96:XRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:XRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948146, "uuid": "d8eeafe2-4f50-4d08-93fd-82df2af74db1", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948146, "uuid": "dddab77d-fc36-45be-b9a1-63674bc437b2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948146, "uuid": "5c035b84-a12e-42be-9fc6-de6e5d132114", "value": "0ed7bef1fac30eb06ffc5b3a94a29ded12d88b5ef35f80a4203865f41b580593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8766ce74-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948194, "uuid": "1da47e5a-5e8d-476e-b961-251dc4c6f34d", "comment": "Malware payload", "value": "db60b3ddb344bc6593d2f40e1d6056e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948194, "uuid": "bc87af21-c8c7-41e9-8e4f-f060dca9e96f", "comment": "Malware payload", "value": "0fb3883ea6d2124ab130476ae7dd38348760373bb326858328a84f2773d817f7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948194, "uuid": "baaa498b-6d35-4a10-9e06-dc4612574ab9", "comment": "Malware payload", "value": "172525f0d2feeb622098ed571be5ee4bc90f19ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948194, "uuid": "3fc3d717-84e8-45fd-bd4f-d6b1a3b23930", "comment": "Malware payload", "value": "30582c1fba8f02671f077c650a57246bd8be5f6230f48a9fd99944effb9bc5819f626151d6ed028ca985fb7bf2a8270c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948194, "uuid": "c80b6479-3d57-4010-8bdb-e654ebddf21b", "value": "T1C4A1F750112C1AB07246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948194, "uuid": "6da450e3-7577-4749-bddd-1941e14d7a73", "value": "96:9RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:9RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948194, "uuid": "a6597e5e-fef7-4c8d-a90f-a6e39818d1bd", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948194, "uuid": "521de022-07fd-4655-ae49-791d5760f13d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948194, "uuid": "70e05a42-d998-4a9e-92a4-676c39f90fa7", "value": "0fb3883ea6d2124ab130476ae7dd38348760373bb326858328a84f2773d817f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f2653b-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948643, "uuid": "1c4ad329-758c-411a-bfbf-5c556f0688e3", "comment": "Malware payload", "value": "25a9dbd280e63b1beb760eb56c8f257d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948643, "uuid": "fdfeb8e0-7d45-467b-a8f1-523f2c7bf9bb", "comment": "Malware payload", "value": "0fb7a838ea1b8dda99615c2ab3e6fd58502c645f198fce78114186499c82002c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948643, "uuid": "5342eedd-5eb1-4832-8140-a8151ef1b2cf", "comment": "Malware payload", "value": "4834ea7ce47ddae5e8a9cae78da247f96f343fcb", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948643, "uuid": "ab302bba-0091-4530-8c81-1f0a01345958", "comment": "Malware payload", "value": "1453024829d06109b353a033de2c33058676cb04d95eaab3a3d88dcfd3e53cff3f950b2a6b97cf14ad5c344251d1e6f8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948643, "uuid": "77531411-4dc5-4f45-ae6f-a5944e16b395", "value": "T1C0E5330C63EAB8FDF8994529372389D1C5E852F1988261F2D67C15980C3F57E1BDFA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948643, "uuid": "54c694aa-2491-43ca-90ab-41b53a789b9e", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwX/:0XSxVJG2fLAqFOfT9sMYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948643, "uuid": "543f9c39-b0d9-4f61-a540-07fd46486878", "value": 3293184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948643, "uuid": "a54f2ad8-0275-4769-a0c0-0c6372f49475", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948643, "uuid": "3dfc7e5b-04c6-449c-8e3a-50be023c235d", "value": "0fb7a838ea1b8dda99615c2ab3e6fd58502c645f198fce78114186499c82002c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f6476e-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948452, "uuid": "e08ce62f-36ca-4602-b602-6ea5a0deee7e", "comment": "Malware payload (Panchan)", "value": "a490b5effa3250cb9e407dabb9e24eab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948452, "uuid": "1a6da87f-2c8f-4e4f-816a-facc54d12120", "comment": "Malware payload (Panchan)", "value": "0fbfa0de71ffae26c2dbe0f681c7d8b910107f055989b2716f162dc78fb3a42d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948452, "uuid": "c872ef01-06e5-44b0-b6b8-95d25281d6ca", "comment": "Malware payload (Panchan)", "value": "4e27be73390feceecee03f037268917aa129b5c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948452, "uuid": "67b271c1-98c6-4af9-836c-35d78489e3de", "comment": "Malware payload (Panchan)", "value": "09b1755ea2aacec7e891d79b14c06bd58b6db6cf7ddbf268a46acc1b8c8e46454456da349b27666d6c50f8797bc77297", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948452, "uuid": "5e6ef554-91fb-4af7-b2d2-b8fa77482bd8", "value": "T19F47DF73910738E9E5A98DB4D01425426DAC38875738A3C7BAC871F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948452, "uuid": "d2f2747f-cd71-49f7-93f1-0a0491fdc4aa", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVna/:sXyWSpV+Wu7rI3JEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948452, "uuid": "f3c709be-ad18-42bc-beb8-ee09def716ad", "value": 25657344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948452, "uuid": "8d63b31b-f87f-428c-8ed2-b91da0dafb87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948452, "uuid": "82756053-41c0-4b21-9508-edc892dce7e1", "value": "0fbfa0de71ffae26c2dbe0f681c7d8b910107f055989b2716f162dc78fb3a42d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24561d6c-0506-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657975945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975945, "uuid": "45b75bc7-6333-406a-a6cf-a5ca0dacbc1c", "comment": "Malware payload", "value": "4d4f10eff23542f267569e6d54c9eaa9", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975945, "uuid": "0a7893ae-14ca-4b4c-83a9-1c2c36d9c79d", "comment": "Malware payload", "value": "0fe82d4c880cd6cb78d15920e50277e15142f327445334bbdc60f9a72c5e97fd", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975945, "uuid": "c44ea53d-1ec9-4d71-a238-9274b1f6fad9", "comment": "Malware payload", "value": "d915ed1d9cd786647bdeb1ad92b0c95e4a37f236", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975945, "uuid": "c04de1f8-5d81-43f9-bb6c-155eed8da8f2", "comment": "Malware payload", "value": "ed7545a5df1f62bd2faf23b1c02ced11df2da23d4035666fb1f76a9e2ddbc485a35f67ccb62bf3753d10cc69d1bdd935", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975945, "uuid": "883f806b-e0fa-4b68-88d5-659f772f2200", "value": "T187547C9AB7A44CF8EC67C13EC9629646E672BC550720C7CF07A4461B2F236D06E3EB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975945, "uuid": "d1da24da-6e79-4b28-ba78-7f7a163b163f", "value": "df7b9a01729a798c535c845ad7078710", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975945, "uuid": "85c147c7-463c-430e-b193-28e1f202a38c", "value": "3072:4Mav/2WP1dhDjf5hUM/9cqlYidO54vxFEO9tKYv4lg3kS81BH8+PaoP+OfuLEd06:D/E1fxhv/9csYj4vxma3onYeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657975945, "uuid": "e706fd76-a4e1-4a9e-9ebd-c5369bd44550", "value": 286104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657975945, "uuid": "06189a28-ada3-479f-91bf-606625f0d2ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975945, "uuid": "d883ff50-5fbc-4af9-848c-08d8c33d043a", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adf2227-0514-11ed-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1657982130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657982130, "uuid": "017e6162-e535-4724-8789-7d15324865a1", "comment": "Malware payload (AveMariaRAT)", "value": "ad2e5277892fae517637953e7bcd127f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657982130, "uuid": "7fec7452-6bd8-48b8-99c5-a6b08dbb8f6a", "comment": "Malware payload (AveMariaRAT)", "value": "107da7685397daf613ecb72d997173b67524dd283294e2e9a7610c58e233282c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657982130, "uuid": "32049014-9174-49e8-a85d-d10306091bb3", "comment": "Malware payload (AveMariaRAT)", "value": "78355206d2dda5525ba63b6957974f7cce8c8212", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657982130, "uuid": "90b30101-5d55-4a86-a933-e84922b154d1", "comment": "Malware payload (AveMariaRAT)", "value": "5b4c2bd89e58bb850c2e4f14ef7eb58e053d04ee4f9e82c698a4850b9297c599c600ffa46cf7545c762cd4f2e20e24f3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657982130, "uuid": "be18c788-5084-41f5-9238-0d53b38a1922", "value": "T111D4CF0DAAE1C90EC5A81636C8D3071C53B1AD4A5112D7DA31CF32E91D3E7EFDB8625A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657982130, "uuid": "00f732f3-adc8-4ad0-a978-00446f4a32ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657982130, "uuid": "30bd828f-a075-421f-82bf-a7f804a1a1cd", "value": "12288:AjgvlI1TEcqObbYK0t70/oRjo1VaR+9iYu:9lW4ZKw0/cjo8QXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657982130, "uuid": "3878c639-86d4-419e-a8fb-f83ebfd08aa4", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657982130, "uuid": "9536c589-8c57-4913-a931-5ded8abbf86e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657982130, "uuid": "c9f4ce61-650c-40ca-bcfe-1cc4c8994063", "value": "ad2e5277892fae517637953e7bcd127f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64c04be-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948246, "uuid": "a9e238cf-2ba7-4b14-9de7-028755d240f4", "comment": "Malware payload", "value": "e917fb05b986a0153fb37192d3dc3408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948246, "uuid": "0ad2606d-913f-4d97-afad-a04fd62304d6", "comment": "Malware payload", "value": "108232843a395b9383d16662de583dbb47c621f81f4380c317d42c623e85aebd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948246, "uuid": "e3b3f047-0ca8-45af-91b3-6fca6f5708f2", "comment": "Malware payload", "value": "91cf8963447c43317a2208a96a415b2a14fe7f61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948246, "uuid": "0efc2ee6-d858-4d22-bed3-685857035d6f", "comment": "Malware payload", "value": "e39b0d06e2bd9f966806e13795776a3744fa81d3df2cebbbd24938090a0c338a2d73cd8d100cb2baeced0e94018b465c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948246, "uuid": "ba652910-066c-4bd4-a588-1d3d4ac9017b", "value": "T13D57DF77810678EDE9B98CB4D01025416DAC78875778A3C7BAC871E6A7EB6E08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948246, "uuid": "3ededf94-cdd8-43e2-92f2-059fe8f9be52", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnas:sXyWSpV+Wu7rI3JEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948246, "uuid": "86837129-3884-4567-a90f-6dd5e63bffdb", "value": 27262976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948246, "uuid": "825eb2bc-f9ee-41f7-8e92-ecf6f2bcd195", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948246, "uuid": "cfbb0efb-06a4-4244-849f-8c61c0bd5df4", "value": "108232843a395b9383d16662de583dbb47c621f81f4380c317d42c623e85aebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603148e4-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948128, "uuid": "35e4600a-9fba-4bea-b123-99cdfe11b735", "comment": "Malware payload", "value": "ce2c0fef639b2dac5b66ec577ee2a042", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948128, "uuid": "22ab6f0c-4fb2-4238-ab48-2dadf7640841", "comment": "Malware payload", "value": "10f8f2573cbb3954d3c0908af9e53daca56ab6db7c5239f92c7cf917549dea6c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948128, "uuid": "0e7f5134-7ac9-4051-9813-2063fd3cbb5b", "comment": "Malware payload", "value": "ea15e7b927edf34269bd1ed59be19314b45ddcdf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948128, "uuid": "b5f5747f-d430-4010-911d-db356e704f9f", "comment": "Malware payload", "value": "f3a6f1ad6c102e622cb8a0af2353586a4dab92e86609bdc3b4a0cda51cf705b32d139f4cebec99fe7a4aff10df3b72b9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948128, "uuid": "607eb608-8f88-4df1-88b2-a1942f319987", "value": "T1CDA1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948128, "uuid": "cd1f6723-2f3f-45a8-a495-a19bf49ce9c3", "value": "96:RRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:RRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948128, "uuid": "5f3a53bf-2a9b-4b41-bcd5-2f1cd3d0be8b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948128, "uuid": "9527d9c0-6b07-4d15-a977-af63904d8686", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948128, "uuid": "d941f64d-0c9f-4f52-b966-c2f5eb1bbff6", "value": "10f8f2573cbb3954d3c0908af9e53daca56ab6db7c5239f92c7cf917549dea6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216f003f-04da-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1657957042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657957042, "uuid": "55d1b7f9-1f79-4b0e-9c77-0d4eb90e532c", "comment": "Malware payload (Formbook)", "value": "38c45d3aa16a3a9632abe283c24f7cd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657957042, "uuid": "297f9c03-bbff-44b8-8566-f23f37747801", "comment": "Malware payload (Formbook)", "value": "112487dbec5b52629742e737dee33e734aaf7f9946c11768d007022e5efbaefa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657957042, "uuid": "80593ba9-fc2a-4dda-b92d-522c14730620", "comment": "Malware payload (Formbook)", "value": "37ba0cc491550070809c5bde0115b0a40c6820a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657957042, "uuid": "8bdbf5fd-8adf-4f72-82c8-342ef0b9e7be", "comment": "Malware payload (Formbook)", "value": "7b42a54cb43d7f3f694c2abf0fcb97bd89b660f2200c367b7261e38026d6c3c184e459113e402e125d0f55e19d9625de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657957042, "uuid": "12ce528c-2ea1-4684-a7fc-1df38b138852", "value": "T16815123232404BAAC4BD47B9E03289E153726DC52557FF626ED839D718737809A0EBDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657957042, "uuid": "202d3734-c714-461d-8640-369378453015", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657957042, "uuid": "b7bc68b3-8c17-47b6-ab84-aeca1fea0535", "value": "24576:mlhLuyyhwrWE9ZOMEnUwB6cCCBFB659Y:uLuyyOr3ZOGCTBGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657957042, "uuid": "406be8b2-ca33-4a59-ad79-ccebc5c75722", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657957042, "uuid": "fc4a340f-e7dc-4a99-8102-b86edbeb7d61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657957042, "uuid": "d136c23b-496a-4c1a-95a2-bfeebc7b1a5d", "value": "q7T1M9j9TQQfIwx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5026a518-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948101, "uuid": "515514e3-ba63-4e31-be12-3ec6536bca8c", "comment": "Malware payload", "value": "9fb0ce0488013748cd6d3299ce7c35aa", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948101, "uuid": "6575634f-7538-40b9-bf0b-36ba4cac9c44", "comment": "Malware payload", "value": "1157a25fc664bc27324c2f91482b8b15978bdee14c31759905fcb37b1300b967", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948101, "uuid": "d9f2b377-7f6e-43e9-8ccc-2c99d0d3fe33", "comment": "Malware payload", "value": "22f5667e3634ae4af061b6968df896aabf399bc4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948101, "uuid": "deeb5e78-aad9-4f17-b3a5-b1cb82b13aa0", "comment": "Malware payload", "value": "fa35c68fcec113222015d42a3f1b13d413129823bce51528209765b28aee3cf95e2978a146d9a6b086e7786c306def77", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948101, "uuid": "d7df3feb-da37-4dde-bdff-8b81e1966511", "value": "T17455339119D01AC8D0D8DD0B3E8C582760BDFF427198FEC351F0B7D6110BB99AEE6A69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948101, "uuid": "5a8c4b18-d747-4a6f-bb73-8464383a4a66", "value": "24576:G1HxKBpxMjuBd5QUP+GDxDQjKS4hoczMEPy0WeTOA/A3l2Ex1hz:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948101, "uuid": "850d8e7c-562c-486a-9034-cfa21b71ff22", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948101, "uuid": "b4919dde-fc9c-4277-a980-71f9575305c1", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948101, "uuid": "42a3949b-f077-4cd6-8232-ac26d900deb2", "value": "1157a25fc664bc27324c2f91482b8b15978bdee14c31759905fcb37b1300b967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97db586-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1657948788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948788, "uuid": "7ee7c4d8-1d85-4bd1-8f0e-e07a29f523f0", "comment": "Malware payload (CoinMiner)", "value": "b6857d204aeb1cc7ccca37a3a103fa1b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948788, "uuid": "4efa0775-a695-436e-bf42-bc9ceabb0c50", "comment": "Malware payload (CoinMiner)", "value": "11e8368331ad8f3598491bc78fee99c66af4e36f72bac98ba3baf1b17edf604d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948788, "uuid": "f786f3c2-1dc7-42a1-9123-54aa25d1722c", "comment": "Malware payload (CoinMiner)", "value": "85015b276c0d243c2e6341190280464a07aba744", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948788, "uuid": "6094fca5-16d2-4827-94d6-5091f363717d", "comment": "Malware payload (CoinMiner)", "value": "b6f81ac5d53f98de9f9c7a990836e492eb5752f1de42f8430e415bf31ab4cb4d141f9d5c526a27dd5893f4b5e76463b1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948788, "uuid": "efa8967c-81e0-4b4f-bd9f-944edd7b6fdf", "value": "T19096339C50F87C6E4144DD7452E7DF02B5BB0ACFF1A2C702E46BD95B1C09335A8BA6A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948788, "uuid": "4e2ebb14-5f46-487d-bb2d-6602884055a1", "value": "196608:td69Qg/JFeQ5x7bhE8SSdP8v+nV2BpA8lOkbnKj6EQiUir:acQ59Gd6P8vIoPwkbnuQibr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948788, "uuid": "3fefd6bf-9cfe-4f5a-9775-2620922efbd3", "value": 8691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948788, "uuid": "0a100891-48de-4c3a-a6d6-e762baca5cc2", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948788, "uuid": "e6fd24c2-c6b3-4638-aad3-fc91398cce7c", "value": "11e8368331ad8f3598491bc78fee99c66af4e36f72bac98ba3baf1b17edf604d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d59a3b-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948002, "uuid": "6472799e-3fb5-438c-97af-8e89d641240a", "comment": "Malware payload", "value": "6c0ceefa706cf7b6d70568d7ed87226e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948002, "uuid": "f0c6c0b6-a998-4ad0-ba69-90dc8014aee9", "comment": "Malware payload", "value": "120f7c477f5ce64cf721f30f102564737aff5e35525218c351630b9998d1e826", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948002, "uuid": "32a8b285-c542-40ef-93d4-3550b768459d", "comment": "Malware payload", "value": "4c341afc787a50a050683474cb7c4a5a895fb626", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948002, "uuid": "7fe18532-bb29-4669-95df-02497cf7fba1", "comment": "Malware payload", "value": "4519f885c717bdfb1cf0e3ad2bc2863994b0ef1e5dd13d917fe2de252a3e8340338e7261bd8695fe994099f0da688f5d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948002, "uuid": "de406767-02f3-41d2-9da4-184b3f99850b", "value": "T11BC5330C037ABCFDFD8D452927638EE4C5F9A1E0F942A092D66459A85C3F17D039FA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948002, "uuid": "3f8df3e3-a377-409c-a2dd-902807b4e9c7", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4D:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948002, "uuid": "71a19181-e505-4521-aa53-5ca2929cfaa4", "value": 2592768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948002, "uuid": "5a90f587-2ebd-40ab-88f2-e0eff9090eda", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948002, "uuid": "56d22c47-bc73-4119-a709-829999052015", "value": "120f7c477f5ce64cf721f30f102564737aff5e35525218c351630b9998d1e826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61bf9b1-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948326, "uuid": "de860c81-4b69-4952-9712-53b37b086c81", "comment": "Malware payload", "value": "626f7f44bcbbc8cdf03ea95ba5a873b9", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948326, "uuid": "3a267fc4-4cb8-4b1c-a4bd-90d8b198e9fe", "comment": "Malware payload", "value": "12ee8b9196e5661e17ae514673d4402458f464fc073bb33f14198be5e6eb8427", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948326, "uuid": "fa55708d-d58d-47bc-8556-d994bc61fa38", "comment": "Malware payload", "value": "333aaf22b0d42fc0acd0723beb6203cc62393a6e", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948326, "uuid": "a3cca5ec-5cb6-48f7-83e8-39f320709d54", "comment": "Malware payload", "value": "11cbd171cc59a725a78e9579f86a3df06332b7cd4546c75298d2e231abe2e189db4910f530d20f79e23b72a21f0d33a4", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948326, "uuid": "1e4a9ab1-873d-4672-b8bd-60db4f572dd6", "value": "T17D06330C229EF8FDB85A062D3B228AF0C5D452F1DD4225F28A791544093F5BE5BDEA63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948326, "uuid": "cfd9229c-6101-4e73-b2c1-57ab115433fa", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSA3:0XSxVJG2fLAqFOfT9sMYNM29SA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948326, "uuid": "a01434c1-dfd5-4e1c-b94a-831238f8e11a", "value": 3907584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948326, "uuid": "01a3c120-a0a0-47e9-8ef3-45e738cb3e4b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948326, "uuid": "7c3d53b9-cb9a-4534-a51d-041110a9313a", "value": "12ee8b9196e5661e17ae514673d4402458f464fc073bb33f14198be5e6eb8427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ea2ff9-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947864, "uuid": "c6fb5fcd-136c-4ab4-ad1c-2899aa358f81", "comment": "Malware payload", "value": "c4ea624752177c14ed4eff2f5ac29679", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947864, "uuid": "878b3daf-6567-4f85-ac9f-32eec5b2c34c", "comment": "Malware payload", "value": "1341f05d629d1a691b6fd2cf684764a4409ac2d3cc49b63b999e722faeaf34d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947864, "uuid": "470c49e1-b8ef-4fb6-a0c5-5dff0efaaaa0", "comment": "Malware payload", "value": "705d5d8763f9df1aff7b5923777f1a976a6b54d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947864, "uuid": "72e21aff-f2f4-4caa-9e48-38f451075946", "comment": "Malware payload", "value": "c415b5b2a9a6bb7cd14d975cd149d9ecc35b714234426ce266fda45e1b07f5212ed59c7842dd7f9a69e6a598ce047411", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947864, "uuid": "108f8cf8-5876-41ca-9759-bc50fe55b1ad", "value": "T1A8A1F750112C1AB07346697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947864, "uuid": "99e8d797-b6cc-4cba-bb5e-e95672599651", "value": "96:5RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:5RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947864, "uuid": "495f561c-72e5-4f78-9adb-57c7972dfebf", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947864, "uuid": "d779bb30-90ba-4679-bd80-e51c0b3f92bc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947864, "uuid": "56ebc554-be88-48e5-8569-b880bd257f17", "value": "1341f05d629d1a691b6fd2cf684764a4409ac2d3cc49b63b999e722faeaf34d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea98d435-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947931, "uuid": "7785e2c2-db04-4c4d-8a4b-fa10be75ad8d", "comment": "Malware payload", "value": "cedde31ed21d30108ebc233531ddf2e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947931, "uuid": "75860d0c-569d-4ad9-9105-ccb42345c6d8", "comment": "Malware payload", "value": "13a60c4a485159ce094a73ea7c55f09d40e38349f6bdfdf1a83312d1fe693ebc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947931, "uuid": "a297f3dd-07c4-4ca5-9ab2-98bc9e3544b3", "comment": "Malware payload", "value": "1b23af9b58a59ec7527c0102f558253fcc020008", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947931, "uuid": "759a099e-799b-4d7c-95c6-e3c56b3ca8ab", "comment": "Malware payload", "value": "c01579393b4b267c8fb625e64ee4c8893858ed0ccb81e797f5c75139cf797dca1430a0627b7b3ea25b0181a5372c61a1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947931, "uuid": "83a4706d-3d86-45a6-bdab-6503dd8237b9", "value": "T1E9A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947931, "uuid": "967cc31b-3783-4ef7-a8f8-7d996503b237", "value": "96:NRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:NRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947931, "uuid": "9843dd12-c950-430c-9bc6-384aad8b239e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947931, "uuid": "4e2d95a5-ea3c-4631-a656-955a8712d95d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947931, "uuid": "fee88cf0-079a-4414-b84e-faa3da98c10a", "value": "13a60c4a485159ce094a73ea7c55f09d40e38349f6bdfdf1a83312d1fe693ebc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92350c6-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947875, "uuid": "e7d0303c-12d8-4b8e-bee6-708b3b9f4934", "comment": "Malware payload", "value": "fd97a09461b3bfcebe66bd337fb7095b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947875, "uuid": "ecc4a97d-7176-4b40-9556-52b3a2ebdcc3", "comment": "Malware payload", "value": "14c8e54b1849d458d5704785816ad3f5c5fe909b5cf12a36092a78bcc7c03189", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947875, "uuid": "146d32f3-f461-4b50-b83e-011c96010de9", "comment": "Malware payload", "value": "efbb7e2e06843b00f5a4fbbcffefb41a548e38a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947875, "uuid": "cd07bd8a-547e-42c0-b37b-ac2247feaa86", "comment": "Malware payload", "value": "c56088bb7f88a0b83d3d7680cf7771db9cb2cd9c012c929f9c4f6da186808dcd09cfcbb364de86d88ebb29b212ea51ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947875, "uuid": "a5b0b576-392a-4487-8612-31bd9f74b39d", "value": "T100A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947875, "uuid": "490db8aa-f46e-4377-a098-c54cbaeb52b3", "value": "96:6RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:6RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947875, "uuid": "9d5b4924-37d0-4ca5-8c21-a7d1544707d3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947875, "uuid": "ac7c00da-f1eb-4e5d-aa93-7030ac33c6e9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947875, "uuid": "32605cef-3c6d-410d-88dc-60d77759c391", "value": "14c8e54b1849d458d5704785816ad3f5c5fe909b5cf12a36092a78bcc7c03189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5993b6-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948204, "uuid": "335f1b71-3a74-4dcd-877b-a93f8fd4d7e9", "comment": "Malware payload", "value": "9bcc2eb374de0c00586ceace8dedaa6a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948204, "uuid": "c3ab3daa-846b-40ab-b0e4-a2dab049cf45", "comment": "Malware payload", "value": "157869cedf55745d9e48e1ed91ee29c42b1cc24c20d0894a23cf9bac8982206f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948204, "uuid": "4ad069b8-d5fb-4e44-a3d7-9cd2b90e5a89", "comment": "Malware payload", "value": "bfad52589931e558f08d26fda723087bd375a7f2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948204, "uuid": "ddde1338-c06b-4e06-9f62-41117873cc45", "comment": "Malware payload", "value": "9dd95ecefb969dc9ad7ad6a64692475b9516778a1760cc66fc50319c1b6dd90f1b7674e5371be266a49516adada79fe6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948204, "uuid": "9754f155-ee3c-4ea6-803d-fa531b571cb1", "value": "T1B0A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948204, "uuid": "28cb4714-3de6-4d32-aca7-7a9a848198fb", "value": "96:oRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:oRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948204, "uuid": "f3805181-6671-4f5d-8861-e8ce41c0774f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948204, "uuid": "a3487903-b5d3-42ce-84e6-ba2d876fc83e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948204, "uuid": "063f468a-f295-42b2-9631-cfd79ef8fb50", "value": "157869cedf55745d9e48e1ed91ee29c42b1cc24c20d0894a23cf9bac8982206f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e751d9d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947991, "uuid": "eeaebf2f-7af7-4f66-ac6d-fac008b0cd11", "comment": "Malware payload", "value": "b65f1d7a4f2c290c1e9aa812afc2829b", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947991, "uuid": "62f0058d-76b2-46ee-b965-ef06d71d7969", "comment": "Malware payload", "value": "15c1d205cfe4a3dcaa500b1916e4e9caa79d4ce12a1da66440d80525f30035d8", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947991, "uuid": "a754af9f-3e8b-478b-93ea-f6202cafcf98", "comment": "Malware payload", "value": "ec663aa7ca7244e25dbc1323201300a24fcce644", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947991, "uuid": "17bd497f-12ad-40e7-ae2a-cd0a58ec4fca", "comment": "Malware payload", "value": "dd2fe55cc9f07e796a6a9e3ca4cc23488c8e3d4002d80351c019829f1ec56d004df3ab86af9fb28e51f084ddc26dabe1", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947991, "uuid": "4486b6c2-8b14-42b0-81a0-6ae03f419b49", "value": "T180F5330C62EDB8FDB89A46383B6384E1C5E512F1988224F2D77815580C3F57E5BDFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947991, "uuid": "0f43abcc-a4fb-4573-84cd-c9eb8506efdf", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGMS:0XSxVJG2fLAqFOfT9sMYNMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947991, "uuid": "97d52c2a-ca96-418d-9a1c-332161f53c55", "value": 3543040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947991, "uuid": "43c2fe5a-d8d2-44ef-95a0-d85f4b0bc10c", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947991, "uuid": "5d1810bb-7b08-44bc-8550-4ab7d9264dd4", "value": "15c1d205cfe4a3dcaa500b1916e4e9caa79d4ce12a1da66440d80525f30035d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15182643-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948861, "uuid": "cde262d9-f14e-43ef-b89b-2c9e5bc68730", "comment": "Malware payload", "value": "eda9c600c0dae900834c36f56ab14cfd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948861, "uuid": "537188a4-5cf6-4b44-a961-603ebae3ff1d", "comment": "Malware payload", "value": "163786261cd7341146222d5125e689d04926419ecc550ef899ab1420746c9148", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948861, "uuid": "2d0240e3-eb25-40d2-8bdc-33fa1d46877c", "comment": "Malware payload", "value": "cb19c75526c28a154a0f28857cd7346642957acf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948861, "uuid": "96bf70ae-acb9-4c69-9aa6-861dd9e1dd58", "comment": "Malware payload", "value": "220391d0d0135c6c4f23703468a522d0945a533b945a780bd0bef1337b9064b900d94f23546b86f847080ee282ccee62", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948861, "uuid": "66d93bef-6043-4e3b-94bf-c6af00c4bf29", "value": "T144A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948861, "uuid": "e36e5238-0e10-4d91-b033-84336d96b70c", "value": "96:jRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:jRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948861, "uuid": "cc76e87e-5c4c-4012-841f-19b6c8b68e22", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948861, "uuid": "77af6acd-05a2-4321-97cf-8a257068368a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948861, "uuid": "be02ece7-56d1-4f0f-9586-9771f9ddc461", "value": "163786261cd7341146222d5125e689d04926419ecc550ef899ab1420746c9148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d0b290-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload (XorDDoS)", "timestamp": 1657947968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947968, "uuid": "9db1ac0c-d81e-484e-9fb7-bf4b5c110110", "comment": "Malware payload (XorDDoS)", "value": "22ac78b8d8dacd0470837f4a65e5552e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947968, "uuid": "e1a99244-d982-42eb-a802-3903d67c446c", "comment": "Malware payload (XorDDoS)", "value": "1694323e184fc25268e3897e000ede1e3de84aef1fd239ddd8ffacc5c8fea737", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947968, "uuid": "bc261628-635f-4ef5-b8fd-c1e4d8b22a5b", "comment": "Malware payload (XorDDoS)", "value": "c859d02e90dce1d3cd248f0b0835a527104daf40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947968, "uuid": "3e07619e-c39e-4ffd-a378-80b944ad73c5", "comment": "Malware payload (XorDDoS)", "value": "dcb7bc0e2babcae2158a34b080ecca0d066f7668148872a2acc73d5413b309017b0b2d7ee103257cea49c5b27182d830", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947968, "uuid": "787bd1e7-89a9-4b59-882c-b998687cf0b4", "value": "T103944B46E243D0F7D42705B12387F7FF4620B235D420DD9AEB94AE5AA9338E2664D363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947968, "uuid": "bfe28094-bfe2-4625-8a59-e18aeb4b62f2", "value": "12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG92:VIv/qiVNHNDEfJKHZ8mG92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947968, "uuid": "09c18196-a804-4cbb-b0b8-bb51438e8cb3", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947968, "uuid": "e7d1dc70-3f12-4e7d-8460-ce02dad68678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947968, "uuid": "e7f019a9-7345-406a-8f9b-02b61108fd1b", "value": "1694323e184fc25268e3897e000ede1e3de84aef1fd239ddd8ffacc5c8fea737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15908eaf-0541-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658001261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001261, "uuid": "bc2e3a3c-2bed-4bba-aa70-db0df37e7205", "comment": "Malware payload (Mirai)", "value": "c4dfa503d8e31bf19d24767ea9695df5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001261, "uuid": "5b476403-c362-4167-a4e4-3ef79b5f5f0a", "comment": "Malware payload (Mirai)", "value": "16a3e3c14799c7c31730b7cf2e81a68fa16dc57f82d93fd3dd89a8d5924cbea2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001261, "uuid": "93287838-5e70-498b-821f-66ecb000fc24", "comment": "Malware payload (Mirai)", "value": "8b54cff351df5fba3430b57e7fa5c14387f421f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001261, "uuid": "b907798d-83a9-4ead-9325-408b14891258", "comment": "Malware payload (Mirai)", "value": "58c960a18ca02a720138278e475233820f2040c3090a3cfef0a71355a4fd5bcf64984b7b4ded8c80b2fcfc9620264875", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001261, "uuid": "0eb48c33-0e16-4f48-8738-2192cdf0781a", "value": "T10A133A85BCD29A6AC6C0277AF62E108E3321B3E9D1CF320BCD255F01778962F0D67656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001261, "uuid": "e66707c9-49b7-473a-bd12-606b32200ff6", "value": "768:Mapnf6mv4EvEgw9mOUTe46jtpKur0sKh7SqborYzbTBNdf3:FymvtvxXXa46jtpKJ/h7Syy0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658001261, "uuid": "138c60b4-c699-46cb-b7a3-9f27ae2d2a90", "value": 42668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658001261, "uuid": "e1362d28-f893-44e3-bb3d-e2e2208694d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001261, "uuid": "4a9a9f0f-af70-4ff3-ab72-7047888fcf64", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29c7351-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947918, "uuid": "8312a4ea-e8b7-4c3b-b55e-505f5d762c4e", "comment": "Malware payload", "value": "b98462d6fc650f55f6bc6d5483d1af72", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947918, "uuid": "0e7838f4-c423-4b39-91ea-90ab0b9874c2", "comment": "Malware payload", "value": "16ffb371ddb3c9005dd26753fc0a93ec67729f288aa6835a3ae26e427a1deea9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947918, "uuid": "8de8eb35-4cbe-44b2-81e9-7dfdde17ad0c", "comment": "Malware payload", "value": "fc825db22c2a6eead66dbbf4bf33e3c89e1e6129", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947918, "uuid": "6f308bdc-b83b-4c63-8563-ec337ecd115a", "comment": "Malware payload", "value": "85a8c91099b0df0da29e712360974be55cabed97e130fe15b00ea8f682a7e1ea0e253db7ac8529fc22afa22d6bbfeecb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947918, "uuid": "f1747ce8-b637-4615-ba13-dd1ba3a2168b", "value": "T1D701008880211C7591138F5EF143C15C1AB492CAE2FB399373BA112D4C4A5123FFC364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947918, "uuid": "7c01965c-f4ca-455c-83fc-224c5efcd36a", "value": "12:jWKmgNpRh+wYfvUgNpRO4wYfvJLgNpRSswYfvrnBgNpRt8wYfvygNpRTwYfv4eLN:KAfYfrOfYfE6YfzYtYfNkYfgeOnYfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947918, "uuid": "0ce89572-6237-43c2-bc8a-6414688c6183", "value": 747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947918, "uuid": "7270ea14-855c-4cce-ab23-f475f9ddb69a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947918, "uuid": "2611c545-1d38-435a-8da6-d31b630e50ef", "value": "16ffb371ddb3c9005dd26753fc0a93ec67729f288aa6835a3ae26e427a1deea9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b1fd49-0509-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657977209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657977209, "uuid": "43668ef5-29ca-45b4-8d69-c58d3db733bb", "comment": "Malware payload", "value": "5092fcee4491fc571124a3855d90edad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rasnsom", "colour": "#D80B63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657977209, "uuid": "a2907776-59b3-4c28-8f55-1dd7cdc52bd4", "comment": "Malware payload", "value": "1705f87120df7419c983a18c843ffb3012e7b257e3004621514c30aa631f7009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rasnsom", "colour": "#D80B63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657977209, "uuid": "8b02b87a-5cbc-4da4-a765-301a958f7337", "comment": "Malware payload", "value": "5c16401c6e9ca736d502d59f55402dc5d67ae7ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rasnsom", "colour": "#D80B63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657977209, "uuid": "78fbd383-4265-4a72-91f6-4d338ce3c717", "comment": "Malware payload", "value": "4ddba24fe419ceeeefa7e9dcb0223c4218aa905dea890a0172ec4168794ce23717e32a4a6a6b78fb946d915a679a52e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rasnsom", "colour": "#D80B63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657977209, "uuid": "2e7f1e41-df79-44ed-8547-ad8a19f527d9", "value": "T1B0635B53A9E0CC72D5704F789D28EA50A57FB9763D244216BF7C960D0F165C384A8FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657977209, "uuid": "4f68823d-4422-40d4-9670-fe62f1ecfb07", "value": "c4831ccf6e98eede3bbbee112609ba11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657977209, "uuid": "7b288db7-0ece-4d20-9f0e-687fb13dfcbd", "value": "768:Uv3mq1oJQpwvZlXhVkcDsaoi9P9TJKvaoStYARRQwfwiyy34BtIl82+hE8x:YmqMQoXhVN4aooJhDCSQyMel82WNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657977209, "uuid": "a47ba9cd-6c5a-43af-b4e9-53a32754e02e", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657977209, "uuid": "af132d96-9e0e-42f1-9f42-a0b206e0a6b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657977209, "uuid": "8581e7a0-794a-491d-9d19-4f5daf30971a", "value": "Misha.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb56649-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948502, "uuid": "0ebf3b33-e63e-43c0-b994-c7fcd43d3726", "comment": "Malware payload", "value": "eba4e579260aa655ee0471c74590affc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948502, "uuid": "1d4afd51-8717-4396-90ca-7017e9b04618", "comment": "Malware payload", "value": "174f4e4b795f63ee84a5d10de4293317737b5f0abd95ec03d6701ac21f5248d6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948502, "uuid": "2d9e1fbd-97e6-4bda-9ca2-c4c8d3d13821", "comment": "Malware payload", "value": "af40a77bf5c187b5252dbdc3d22ca02e3df2a338", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948502, "uuid": "115c0a69-abbf-4d07-ad78-7de2927831e0", "comment": "Malware payload", "value": "d57703c2e317faa17b114296e174d3711b80925530cd8f53191affe1a8cac879204734725e23d505a41a223fcca30d6c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948502, "uuid": "17368066-4ff3-4c29-a67c-02fc385f8ab0", "value": "T17AA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948502, "uuid": "18e397ed-9dcd-4bdf-a29d-477a7cedd2d1", "value": "96:hRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:hRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948502, "uuid": "9c370b18-e694-456c-823b-61af53a737e6", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948502, "uuid": "84f12296-a42d-4774-aa89-ff0e6be2b77f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948502, "uuid": "8ba08386-a4fb-4cd3-a7d8-7736a258d524", "value": "174f4e4b795f63ee84a5d10de4293317737b5f0abd95ec03d6701ac21f5248d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4302d04-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947866, "uuid": "c1966b52-4af9-4cc4-8938-b815b63d6285", "comment": "Malware payload", "value": "ea5e03f909b5d7e8b1eb14b782751acc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947866, "uuid": "ef2651d5-d571-42c4-8360-106011fd5a56", "comment": "Malware payload", "value": "17936cbedf6c8970f9c251d29e92cdc3f43c679def2e3232acec5eb647472a57", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947866, "uuid": "e0b47535-423c-4bff-9569-85728f806a4a", "comment": "Malware payload", "value": "7e8036dcbf9fe2e61c3eef8198757444edd0876b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947866, "uuid": "30664558-2f78-427c-96ec-68e7dcc8bbff", "comment": "Malware payload", "value": "372193b1c179b3cf3cb416b2f97472c074783f432b5086b7676c4b9e0ec8c0249071c2e1cde58f814d149ca6d27aa21a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947866, "uuid": "a261f59e-3858-4001-83e6-50579fe47c7c", "value": "T19BA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947866, "uuid": "aa10df45-8e15-4e8e-971e-30a3874ae41e", "value": "96:8RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947866, "uuid": "b4d257d8-a246-4bdb-bfe3-9b04aa039b8d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947866, "uuid": "301729e8-bbbf-4bcb-bf6e-b32d2bc3509b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947866, "uuid": "75c96d83-9570-4fe6-995c-6c985678ad73", "value": "17936cbedf6c8970f9c251d29e92cdc3f43c679def2e3232acec5eb647472a57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b155f3dc-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947835, "uuid": "b74cffec-f7a3-48e0-93ca-d1fdbe62df0c", "comment": "Malware payload", "value": "7ff9a88fdd658a65ac225b99324ed3f5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947835, "uuid": "ec097dec-3f20-4c8c-9289-ecb6cea9f121", "comment": "Malware payload", "value": "17a1ad31bc398044c9f7630fbba967b6686d0a7a37444e650ac0c0d933190225", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947835, "uuid": "9863d8d3-9317-4336-a6e8-938d488bf34c", "comment": "Malware payload", "value": "2b266736f3e332e34ca57d0ff8a14b33097a16d4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947835, "uuid": "b86a0a13-0510-4b2d-aab9-810e63683eae", "comment": "Malware payload", "value": "6953f03cdd41a126892974b6dc14258e0b61952bd4278d198b001fd2225b27a35514859048fb72587496d514a7a07625", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947835, "uuid": "afe0c45c-2e31-4d14-9a1a-2304d8d64cfe", "value": "T1F601C88880752D7591139F5DF287D06C19B082CAE2FB3A9277B9212D8C4A9153FFC2A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947835, "uuid": "d8c61f80-2418-4edb-86dc-bb968978e000", "value": "12:jWKmgNpRh+wYfxEgNpRO4wYfxFgNpRSswYfkgNpRt8wYfQgNpRTwYfxIeLgNpRgt:KAfYfxzOfYfxc6YfTtYf/kYfxIeOnYf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947835, "uuid": "49064bcb-bb9f-4815-9ed2-1cc5cc3d6bb7", "value": 698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947835, "uuid": "e4179196-615c-433c-bc45-51694e6c55e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947835, "uuid": "1d006634-9bf6-412a-b18c-28707d9a51a8", "value": "17a1ad31bc398044c9f7630fbba967b6686d0a7a37444e650ac0c0d933190225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bafea045-0520-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1657987365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987365, "uuid": "bf24208a-33dc-42c8-af2f-a14a48b72a65", "comment": "Malware payload (Formbook)", "value": "ae3e5bbd227bf463146e6fb4f9870557", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987365, "uuid": "54364dd5-942b-48b2-a11c-4d5eb8572422", "comment": "Malware payload (Formbook)", "value": "1884157c40c3b403fb72cbf146d6efc48e58fa23dc43584bd82a40d2b8f01a7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987365, "uuid": "03e44ed7-5e3f-49a1-ac7f-c8cf3ab1351b", "comment": "Malware payload (Formbook)", "value": "f48a152987f23dd5cf363fa9b65f79dd932fcf3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987365, "uuid": "50912e8a-8b8d-4f85-90ea-23798b712414", "comment": "Malware payload (Formbook)", "value": "f1fae00442ad6ac2ce95869856af6cd531ecf1c65ae5bba9750273714b8acf8e066d8bb29da81fcfd652f6659a4037f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987365, "uuid": "f709c182-e257-45ce-bc1f-b111bd7ddc94", "value": "T1C0C51A135A8B0E75DDC23BB4A1CB633AA734ED30CA3A9B7FB608C53559532C56C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987365, "uuid": "ebf763cb-59c7-44df-b285-35529df7650c", "value": "e1888d3e3e34368cefc07e8f747b2817", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987365, "uuid": "dec5f1f3-d2cf-4a9e-b8ad-c00551c4365c", "value": "24576:vSdOboo+bQYLY4qwCIGAMvedBidOb4b/TKtYalddQaiudLGIl3RuQ55313U4:KdObr+hwxrqdQaiudKIl3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657987365, "uuid": "89d8a9fe-73b1-4840-b042-8746cf86ea74", "value": 2594379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657987365, "uuid": "f5de0e85-84d7-447a-a810-2f19e46d0026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987365, "uuid": "1512f3ad-b4d3-4d0d-a76f-4d425c637a07", "value": "ae3e5bbd227bf463146e6fb4f9870557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ad45d3-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948809, "uuid": "c01fc1c9-029d-42eb-8db7-4a475bc66c44", "comment": "Malware payload", "value": "ed0e4c7dac109b4723bb920e649fb513", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948809, "uuid": "d2391a0f-ed4a-494c-a5e2-f0d81d24ca47", "comment": "Malware payload", "value": "18db71d8f5104788fa74fef53d2d9998af9001a21cd653c699f475c072942263", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948809, "uuid": "1db9d41b-ddba-4b52-b3c3-c5abb60722fc", "comment": "Malware payload", "value": "e459d047ba9bbb76ad908767110c93d288c3bab6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948809, "uuid": "b9f7864f-091d-4605-86f9-2f06b00b5ed3", "comment": "Malware payload", "value": "8b519750d4a640ef9d84695397745f2dd6f3e2e689a4a55e9fe5154e0b5221abcd8cba9b11246b02226e4b48a2242e7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948809, "uuid": "4df18776-4f8d-4099-b59e-3eb1a3567144", "value": "T162A1E850112C1AB17346597AD26FFA52B50EC81B0A777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948809, "uuid": "9995dc75-b0e2-43bd-a3e3-2b02d648b9c0", "value": "96:URYZxQOBpLyxIcymLKY8M991wuIaQPYPW:URJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948809, "uuid": "526e8467-9b32-4156-8352-cd05b617911a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948809, "uuid": "d43bebf7-6317-4094-8d2b-61aa43bfdc5b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948809, "uuid": "0afe42fa-e36b-4124-ba31-c6f1fb5e9a42", "value": "18db71d8f5104788fa74fef53d2d9998af9001a21cd653c699f475c072942263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25e4301-0520-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657987431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987431, "uuid": "93866eb2-16d5-43a8-9cb7-9d584c7b054b", "comment": "Malware payload (Mirai)", "value": "32d0344ade99fc7fc0498680b5269cb7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987431, "uuid": "92a31bac-23a9-4ef0-9a39-ce1ecd8a6ec2", "comment": "Malware payload (Mirai)", "value": "18eb17502991b494470bdad9e7c832ed05236d59152911da2bce9bf1e3b8fca3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987431, "uuid": "063c318f-bf1d-4bf7-8a41-13ff075264dd", "comment": "Malware payload (Mirai)", "value": "6d5ef0692b2dfc031f7bd8a44892890bd761c0a6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987431, "uuid": "caf274ff-78ea-4520-9a16-e33ad6359337", "comment": "Malware payload (Mirai)", "value": "908dd645dfb238f27a03838247f9dfbfbf74b9777ba10bb86e1fe35f1ce308459ce946d840f5bfbee6a245c204cf60b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987431, "uuid": "8bda4291-d0fb-44d4-8643-fbb258e8aa4d", "value": "T149C2D0E0B726EA31C4206C3DE53B4D8A3A510A7C81FF393664258D398EC165A67F48F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987431, "uuid": "d2258a1a-ddb4-4169-8381-1b5643432a98", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwr9f9q3UELuR:NKy4qfqoeJdXWg4L4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657987431, "uuid": "9b36d6f3-6e8f-4f6b-9ee3-6f04970d32f7", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657987431, "uuid": "0cebcced-65e1-4b7a-8cd9-795acf8bf838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987431, "uuid": "3fb05160-ed8c-49f9-a447-245b6ed68d36", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c0a3ed-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948272, "uuid": "a392ff84-8306-4ee7-b72c-1100d13d3199", "comment": "Malware payload", "value": "408a8326366c8464156ab5d2984c407c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948272, "uuid": "74ca501d-ee96-4706-bcf4-3076806e1898", "comment": "Malware payload", "value": "192bb4ac9e8904858fc1453b5d381c9cab72b58c89ec1b48312353459cc41bc4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948272, "uuid": "3f60056a-2c6c-40ef-a699-dc9a832fb18b", "comment": "Malware payload", "value": "f6d689339d32a1ab2fda8cc4efae851199b95522", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948272, "uuid": "3037470d-9ed5-445a-b657-e04d015dd703", "comment": "Malware payload", "value": "aa1119e2266fa2f63c5937aca8d52c82b5db50f81d48cbf34e5916f6ead3765204f1527791735bfe541e7e019f215d91", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948272, "uuid": "04a0ab6b-167e-4056-8d08-e7b71d57eed7", "value": "T15651B7D807D8C4BE2B66D62661FBC580329961B626E07B15C8DD3CE3B18CD8872D56C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948272, "uuid": "6cad9916-bcbb-4bd1-89e6-a4b75fa92d61", "value": "12:q0FaNGm94NGmrN0FaNGo4NGVSH0FaNGAi4NGzaH0FaNGp4NG20FaNGIL4NGkGE0C:vk0rm+Z28aczcQrcSEC9IVufPf4Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948272, "uuid": "bf0cccb8-d7a4-40f2-9922-ec0096b2a673", "value": 2736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948272, "uuid": "096a1a55-a0de-4007-b3c3-82d494e28a7b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948272, "uuid": "ef80ff6c-5463-47f7-93c5-e40bb713fdc6", "value": "192bb4ac9e8904858fc1453b5d381c9cab72b58c89ec1b48312353459cc41bc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b33ace8-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948549, "uuid": "7595ceea-d486-46eb-925f-d2d5c92d4368", "comment": "Malware payload", "value": "608f9ad4ab0ff8952f3c40a78eb9fc1f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948549, "uuid": "4027cde4-c365-4c5a-8eac-8ff5247272f1", "comment": "Malware payload", "value": "197cd0349e3f5cc9207f7730ee297d437aa5d272168177086daffb50fde4474e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948549, "uuid": "7fd79e8a-f3d2-4d91-bf31-7edde801fd75", "comment": "Malware payload", "value": "5010bf27fcd2b9c3b6e63dcac8cadcaebfe07c41", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948549, "uuid": "23c2c64a-a90c-4240-9d3a-ace82bc3adee", "comment": "Malware payload", "value": "735ba6a4193ef7967f240c2e1553aeffaaddd942603586a33c462e6e6e56ce3898f12841633ffcc35e9c0d82d6318672", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948549, "uuid": "fa6ec62b-1760-4b2b-b5b1-7e748ef6a36f", "value": "T1FFA1E650112C1AB17246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948549, "uuid": "ba1b58c8-3649-4a3d-8a6f-863a0eb5ca54", "value": "96:bRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:bRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948549, "uuid": "74e8b002-a23c-40cf-ac5a-32065cc26321", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948549, "uuid": "5ad2e135-c848-4e5e-97aa-6806087204f1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948549, "uuid": "e5bac5e3-1adc-4690-957b-4c07d29afc33", "value": "197cd0349e3f5cc9207f7730ee297d437aa5d272168177086daffb50fde4474e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b40474-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948028, "uuid": "7b9d50ea-1311-48b3-ae92-369f2360d248", "comment": "Malware payload", "value": "b8e3a420ad077182e073d51dc46342c7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948028, "uuid": "9e4c6f55-ee64-4a47-9f34-b9bb171ed927", "comment": "Malware payload", "value": "19e32b8472883761b87f81054446ebe81e348e94f3a30eaee3ac31afdd46997a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948028, "uuid": "2caa3fe8-7339-4b5b-bf9d-0c0dd8df8f7b", "comment": "Malware payload", "value": "9b855ae9f596a5b7df345080d1ae87063de319c2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948028, "uuid": "4d00626b-cf58-4ca0-86e8-669e8eb38df8", "comment": "Malware payload", "value": "439d035b7862938d745d5f2d75f9568ae145fb0304272596df3474e043c3ef7d60963d332f1bad39f2d6a1ea2d7a5284", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948028, "uuid": "2f342d22-9adb-401f-80ba-3476eb5a4c66", "value": "T19EA1F750112C1AB07746697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948028, "uuid": "9f2cef03-7c6d-44cd-9da6-aa04c3e7bef6", "value": "96:ARYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ARJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948028, "uuid": "1b9344ef-d3ff-491e-b92d-058e8bf2d175", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948028, "uuid": "e2944a1d-d023-4146-a017-2d7461e31e6b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948028, "uuid": "b799c6f8-56d5-45a7-8502-4623fc23ce5f", "value": "19e32b8472883761b87f81054446ebe81e348e94f3a30eaee3ac31afdd46997a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8980a240-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948198, "uuid": "8bf0fdfc-df76-4cd8-9685-73e168b70421", "comment": "Malware payload", "value": "afd266d12cad998532f510f25ba2ca60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948198, "uuid": "d2d221bb-c043-46a7-a828-b98777258aab", "comment": "Malware payload", "value": "1a1c9e898fc5cce338ae753eaaa4b4eb30fdb0b76d89ffd414f2d46c92a76903", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948198, "uuid": "7426b63f-8259-4392-a4fd-df394bb29dda", "comment": "Malware payload", "value": "b0020a7128e7d5dfa5c741af6bd691347e2b83b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948198, "uuid": "9a38b92c-948e-4ccf-8763-cdc6d225141e", "comment": "Malware payload", "value": "225f160cd0614e78350e521d32b1e9da8f61e3d60638dc05d7ffb126668c2d8edc71bdae4cf723bbd9981f0fb9e31e05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948198, "uuid": "12c69084-e1a0-40f4-964e-a3a68c38fac3", "value": "T12AE2D69B699560E9C5BEE234C7169216BEB170D5073427E72A2246F10F26FFC2E7C318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948198, "uuid": "3a81fe62-38e7-418d-ba16-fe38dc9f3439", "value": "384:Had3bVP2i5Uz911Ux1jaKJMwbWYlDj+ke9xl1DDaiirg:0ZP2wMbSxp7MwbPrMFHafg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948198, "uuid": "922d6008-3536-4994-adb3-b33ad63092b0", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948198, "uuid": "90bf8ab5-4d5e-4fe0-9177-75eb165fe922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948198, "uuid": "a85b8130-7bbb-4fe8-b719-8e7369b7655d", "value": "1a1c9e898fc5cce338ae753eaaa4b4eb30fdb0b76d89ffd414f2d46c92a76903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3634a28-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948778, "uuid": "ffd9b43a-efa9-4a5c-a471-240aafed6f7c", "comment": "Malware payload", "value": "a80e936c863515099e89a8f196ac7dd5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948778, "uuid": "83b5f00d-b9ca-429b-8ff2-ee90559c4e67", "comment": "Malware payload", "value": "1a56c1395364975bb40005de70fb75c6f5d5c4c649428db568f2fb8fa3efd7c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948778, "uuid": "e2c69c26-376b-44ac-ac00-0f32dc70a2b8", "comment": "Malware payload", "value": "cbce2614e9700a66bf409801aa6ad9b59d414596", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948778, "uuid": "b5c182b4-f53c-4e04-ab64-678f3b6c1bf6", "comment": "Malware payload", "value": "d70bcb5a27b8e0f70a5c3aa504c56978886bbc34a83495a75e048a408c53bb8734c1a3d9cbb3751a956ce7dbfbbc5716", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948778, "uuid": "b9f8dac9-0bcc-4d79-a158-61091f05039c", "value": "T1BBA1F750112C1AB07246697AD26FFB52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948778, "uuid": "62df16c2-ad2c-41b2-acb7-92cb70835c48", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948778, "uuid": "54ccc6c4-39a8-49c0-a8da-9a2a22c2bb37", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948778, "uuid": "40f8598f-3b28-4268-9f6e-5f7efeb28ae3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948778, "uuid": "22a468d0-a0ee-46b5-9523-56f90219d611", "value": "1a56c1395364975bb40005de70fb75c6f5d5c4c649428db568f2fb8fa3efd7c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5788a1-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948469, "uuid": "3e0b8035-7245-495f-bd02-7069e3e0d537", "comment": "Malware payload", "value": "361f2b608bebcb3b4dddd2fa4ad8d910", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948469, "uuid": "622ab4fa-e9a2-405f-aee6-1f8ce8d86a67", "comment": "Malware payload", "value": "1abd1deb7ace6785507595660d9cd2d05006cadba2171e988990a266f11d041c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948469, "uuid": "38d9650a-c499-4dfc-a856-9a54d137c25f", "comment": "Malware payload", "value": "ee720d50840629b3f1d96517de1ae7f9b57997cf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948469, "uuid": "c61d2310-157f-4e43-b07f-9be9a84491ac", "comment": "Malware payload", "value": "184652704eabaf9e5f2e8de69fa20167ee4c24ac178ca554e6ac39b71792dfffc9db826d5bfc18945495ff16e9f420fd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948469, "uuid": "1a26659c-2408-4b78-a6eb-2992baf20656", "value": "T168A1E750112C1AB07246697AD26FFA52B80EC81B097B7B358473A63C74F5DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948469, "uuid": "1f13f6e9-3600-47f1-b375-e1ba1b9b2bbc", "value": "96:NRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:NRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948469, "uuid": "0bbcf274-97e4-4a51-af82-c559aa47e1b8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948469, "uuid": "7ca8a450-1207-49bd-847e-7f7ffaf6840b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948469, "uuid": "b6fd1200-2cc4-4143-869f-479168f006ec", "value": "1abd1deb7ace6785507595660d9cd2d05006cadba2171e988990a266f11d041c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b8c4e6-04f3-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1657968008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657968008, "uuid": "5e93f04b-fe81-4eed-95fd-2d27ce6fc7b7", "comment": "Malware payload (DCRat)", "value": "a5e743f773c50d45a13dac5ed61c7caa", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657968008, "uuid": "f64c9578-e42e-4ab1-81de-d44045b1ab39", "comment": "Malware payload (DCRat)", "value": "1af4ee801fa3a5c5c227a70ec9c38e5ba6baf82c801ddfbe355cfd1a16757588", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657968008, "uuid": "543fcefb-ea96-4205-86be-afe34f068c7d", "comment": "Malware payload (DCRat)", "value": "bd85044e5e8707a0cb0b654b90cc649035091dba", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657968008, "uuid": "f7b5c1f6-be13-4e13-9a0e-e724675579e6", "comment": "Malware payload (DCRat)", "value": "ea8def5df9ffcdd3f1fe15bcad7f97d3355d6c585aa4016133c28008149e43313fd92feade75c8591496900d56636c5a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657968008, "uuid": "bb2d0ae6-9276-4146-b9a0-9828a67beec2", "value": "T1A6758C027E44CE12F00816B3C2EF455847B0E9516BA6E32B7DBA776D55123A7BC0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657968008, "uuid": "23ab1e55-eb7f-4e1e-8e39-228e1ef038fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657968008, "uuid": "df895b74-5b02-4c10-a7ad-edce275f86bc", "value": "24576:G04y/31kWwKXYI6RRq1ljo2gQkaUiMnUeiIqAHplKUv:G0f3aWwrI6RAk2gQ0iFxIqAJlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657968008, "uuid": "18492912-ebe2-451d-a957-17126b684f0e", "value": 1570816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657968008, "uuid": "7cebdd8b-f7f7-4781-925e-8e3ddb654922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657968008, "uuid": "85aa9f16-3526-41d2-81a0-e0b4fd382b1d", "value": "a5e743f773c50d45a13dac5ed61c7caa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98201fa5-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948652, "uuid": "04d51338-b088-4895-b016-99c6b21a51db", "comment": "Malware payload", "value": "90bd71c3898d2685de17a049cfcf5651", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948652, "uuid": "a504e4a0-4d89-44ad-8040-70d8b19ddaab", "comment": "Malware payload", "value": "1b8bf1221f94a4d408734466d2bf8aa41eb4b2f8f3cf5ded14e2dd1f670b3d88", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948652, "uuid": "1195766c-6199-4532-ad1a-a753e7474f35", "comment": "Malware payload", "value": "db1185408e938a59ca208b6589c351a529b97b5a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948652, "uuid": "e9c417f0-3340-419b-ba15-13e22eb9e18f", "comment": "Malware payload", "value": "5f6fd70cef20237f0f346efb011fef25ffaa1e0eb7bc791d60ac3d6608b8411883f773a5a2798cac5543903f3d4e0c2c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948652, "uuid": "47dc9f38-db03-4843-b685-4a0be26ae40d", "value": "T14E3192C908EA82BE2C667D57F5B5098E358A905670E17F0D5BE838E544CFF147CC0742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948652, "uuid": "b39c940c-919c-4249-a29b-8e01e3746615", "value": "48:vetTUeIVUeP3lKWUebkXAUeGZUelVUeARUekRUevxUeYBn:v4UVUTWUFAUzUcUBU/UGUzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948652, "uuid": "6efa3af3-cc52-4698-9473-f66d5fd9a973", "value": 1673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948652, "uuid": "53619c64-159d-43e3-a0ed-755d33e78155", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948652, "uuid": "e7e0cfb6-b64d-4ff1-ac05-6a20917a141a", "value": "1b8bf1221f94a4d408734466d2bf8aa41eb4b2f8f3cf5ded14e2dd1f670b3d88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af34c95c-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948261, "uuid": "dedc2178-0d90-4d15-a15f-eefb5ac1dc14", "comment": "Malware payload", "value": "2077e2bb4a00aebd48e39c626d81198a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948261, "uuid": "6f62459a-c2e0-42ae-8e84-0fcfb19f391f", "comment": "Malware payload", "value": "1c3bab6ad9540cb408c4b8852b3a91742df8bde4033eb7a9f5b94cfcf97f9cbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948261, "uuid": "957de4db-6bcc-4775-9f62-d64c3c0d3251", "comment": "Malware payload", "value": "0cbb7c47efd4ff40289107b9c6b4d5826d295fa9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948261, "uuid": "fc49ab21-24cf-42e1-9265-c9dd41a15c4c", "comment": "Malware payload", "value": "06b4b55c085b9957fbfea7e5aba0f3250e788d69998f0c281f0b13b224796b6071abf0c1b9c1a276959865405ad6fecc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948261, "uuid": "672dfb36-4004-410f-9c1d-b43274801ab1", "value": "T151C68C73905338E9E5A98CB4D11415426DAC388B5738A3C7BAC471F667BABE48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948261, "uuid": "561f0eac-f65b-4af9-bd85-071b04a7fb76", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaA:sXyWSpV+Wu7rI3JE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948261, "uuid": "ed0839cc-bf12-4c57-90fd-967bdb7d01f2", "value": 12124160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948261, "uuid": "ea12e89f-39e4-4239-9aa2-23089d3d717d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948261, "uuid": "cd4061ea-a3be-458a-931a-aede67dc2108", "value": "1c3bab6ad9540cb408c4b8852b3a91742df8bde4033eb7a9f5b94cfcf97f9cbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e19c76-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948431, "uuid": "bf0a1279-eafa-4a5f-95cc-c6ef485a62c6", "comment": "Malware payload", "value": "e45af87b204d171b57ce4f60cecb8201", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948431, "uuid": "1586f82a-ddca-4937-95fe-7af6cda77425", "comment": "Malware payload", "value": "1c67430b7e5d4d76d8ca9030f9b0d70936342d8b5948230ae1fd62450544a3fa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948431, "uuid": "d5001847-b6d3-4e62-8f1c-433e864b02dd", "comment": "Malware payload", "value": "0e717dca034a3b4c778e7b29f29b1c4a0efb5639", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948431, "uuid": "2151152d-12a2-4f1c-828b-3c85238b7181", "comment": "Malware payload", "value": "222c219005dec51e6bdc391e802f9e66006369b955783144826a5540807ea176e4f4e5a497aa3bed6aeb61de4eccd9a5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948431, "uuid": "aeed16ef-3d22-4ab0-877b-3827424bbe41", "value": "T1AEA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948431, "uuid": "e1325b6c-0e45-4dd4-b24c-d18635d85415", "value": "96:sRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:sRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948431, "uuid": "0bd8b673-55ad-4f13-b829-a8f8c4684669", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948431, "uuid": "ca7df7e9-1c08-436b-bad8-7add97af5554", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948431, "uuid": "0e42631f-7113-43e6-b525-2e77a4addfa9", "value": "1c67430b7e5d4d76d8ca9030f9b0d70936342d8b5948230ae1fd62450544a3fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2535cea0-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948029, "uuid": "a12e7e3a-859b-4324-82c3-c5e24714795c", "comment": "Malware payload", "value": "058ecab652cb9bb35f60c980f45d4693", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948029, "uuid": "68bb270a-501f-4d4c-900b-db5d5c889528", "comment": "Malware payload", "value": "1cc32f21167030833a0ffa110f41094acb85f357511355753e45227b4d7a5c4b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948029, "uuid": "b5107098-9169-4e32-b87e-bc0b9bf425c8", "comment": "Malware payload", "value": "a4c1ff7145b1e0b1388562af1fa032b474e87cc6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948029, "uuid": "317a1026-f6e3-4e94-b9a7-0eb50de989e3", "comment": "Malware payload", "value": "f7bc80578bac4f12f73c8dcdad6e2cbfc36b1aac417b42385cc10f7a1ab612a189eed6e78da3a65d4ecf6109b34b8a91", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948029, "uuid": "d96a16be-5c96-4aa8-ad1f-8949c5ba5fc2", "value": "T1D9A1E850112C1AB17246597AD26FFA52B90EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948029, "uuid": "5fd78928-733c-49c0-9d2a-2baa2da32e50", "value": "96:JRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:JRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948029, "uuid": "48a6b48f-d24a-435d-9f8e-d5a74fd71c6c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948029, "uuid": "ebebc747-921e-4c4f-8377-6e5f98704fcb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948029, "uuid": "84141dec-9449-4338-85bf-ca992a2ab515", "value": "1cc32f21167030833a0ffa110f41094acb85f357511355753e45227b4d7a5c4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4a9e7c-04b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657942406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942406, "uuid": "70143a3b-804f-4768-bc7c-4e249c85ed3d", "comment": "Malware payload (Mirai)", "value": "81b3dfe6dca1b7efdf889e39054f7b9e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942406, "uuid": "e3163f23-7a56-4dc7-a3e8-c2684bba50e4", "comment": "Malware payload (Mirai)", "value": "1cd79ba429fd27a45390998fa947984a37d8c8f67df340b8d61e1a266da78960", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942406, "uuid": "c1edf33f-8a3e-4299-b02a-ac180ae6f81b", "comment": "Malware payload (Mirai)", "value": "5aecc5bb489e402229013c884eb48db4e30e67e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942406, "uuid": "96aa581e-f098-424b-b9f6-68e3ab1e0db7", "comment": "Malware payload (Mirai)", "value": "eb3cefd31a4322e897a13c2419a96a23b941a28f6956ab189258665e2ae5aaf56a410199da222b33e3bc83e5329d35d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942406, "uuid": "36292699-b3cb-4723-b3b8-d6881dbfaac1", "value": "T13363C70AAF624FF7E8AFED3759E91B05358D540721A87B79B930D418F24B24F09E3861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942406, "uuid": "692c5cee-34e9-4a11-8545-0a1af599c316", "value": "1536:odYiwovpaJ9+e3FgnQzQWZfG4wL+0/vDInZ1hIgdKjX:odHwovpaJ916nqgDInDeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657942406, "uuid": "4aebbae6-4845-4bbd-9eee-a6a188d85a8e", "value": 72864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657942406, "uuid": "e9e11d1f-6e82-4cdf-87e3-7e322039af24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942406, "uuid": "16f0f19a-8ff4-4d4d-bbc2-59fbc3ef9c88", "value": "Ares.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f0e633-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948000, "uuid": "dba976b4-71a9-4124-9d32-31e22ca66c0d", "comment": "Malware payload", "value": "6a7c640e99b1a90af85eacd263aecfb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948000, "uuid": "1b5c51bc-5ee7-4300-af7b-46aa8e5642a2", "comment": "Malware payload", "value": "1e43678757b884398655597b7c7144688efee238b137783be8cd0301a795c252", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948000, "uuid": "798774e4-4751-4587-bf18-6202ee040fb1", "comment": "Malware payload", "value": "bf1c3b44a156c5fae53180c720180e930739acfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948000, "uuid": "07c6d363-bf49-43fc-9821-6095af8d500d", "comment": "Malware payload", "value": "be07a7c3954e4d027a2c81709b3cb08b934f3618b804d305ca2c97c046550223cd464aa3a3c1fb55251f4dceb7253a98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948000, "uuid": "12ebec79-faa1-43e8-b52b-8ce7d44bff4f", "value": "T1D107AD77910338E9E5A98CB4D11425426DAC38875738A3C7BAC871F667FA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948000, "uuid": "13ad11be-623e-409d-9dd7-21d0a14804d7", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVna4:sXyWSpV+Wu7rI3JEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948000, "uuid": "a21977f8-03fa-4026-9ce8-fbc64a5caad1", "value": 17334272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948000, "uuid": "f8f88539-4b6d-48d8-8b53-d3225d7995f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948000, "uuid": "ab9a2296-bd2e-4b2f-8223-75054bf8cc57", "value": "1e43678757b884398655597b7c7144688efee238b137783be8cd0301a795c252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0c3bd8-04d4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1657954782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954782, "uuid": "efad09fd-1608-4ef6-8d40-4cd833d1be97", "comment": "Malware payload (Formbook)", "value": "8177b3e8332ef8d65f459500f25b6555", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954782, "uuid": "50088990-17ab-4ccd-961b-4273f82ea692", "comment": "Malware payload (Formbook)", "value": "1ea26bd7c1c3d8ab317a3f2cfe29ac5271f0a289c81d6144307e3ae138863e12", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954782, "uuid": "76d08bd0-8725-4b4a-b0f1-a85cff0a0d22", "comment": "Malware payload (Formbook)", "value": "9049c392fa14544dd45f96d4f1b22cb74daaa84b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954782, "uuid": "94d25f9c-b4d9-490f-9baf-34d7041c1cbb", "comment": "Malware payload (Formbook)", "value": "36dc5c3ddfdc9b8520505836c117f265ad5168692163681ea16ea04ff5d658cd804d58c1daa91f70cdd1bed0bbb03762", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954782, "uuid": "a2c7b92f-2c13-473b-b530-c8c92934a8d9", "value": "T17C3412573E7873E5E34989BF0962BC36D84DCE1969A1169C655EFA2EEE3001000E1FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954782, "uuid": "3861a97b-88f3-4a3a-8505-7be9339aa747", "value": "6144:gI1GOpFgiByH1/7ZaMY1O6XNEiXBQ5ljpyno1:DNpiG+1/7f0LNE8Qzdz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657954782, "uuid": "b2499c84-a82c-4027-a675-a3365b765b4e", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657954782, "uuid": "c2e64419-9d0c-4698-82a3-0c06fafa8e56", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954782, "uuid": "4e689baf-3cb8-4953-b9ac-bb65e66a1afc", "value": "IRD-N. 9900.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837c717c-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948617, "uuid": "d69635d2-fd57-49ca-a252-10944e39a886", "comment": "Malware payload (Panchan)", "value": "e97429508be27bf042732e8220eb8fcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948617, "uuid": "e253c716-8c27-4834-a7bb-f593375d31b6", "comment": "Malware payload (Panchan)", "value": "1eeabf460ddc4e2011b8f0971ce4ba3c2b9f3bb16918f2d3726f00d75a02de07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948617, "uuid": "a1ed3b31-10e2-42f4-b70a-38108c7a2538", "comment": "Malware payload (Panchan)", "value": "646486593914876a53a8a8b0cf45c2b008262b8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948617, "uuid": "a97aec98-4a0e-4f17-a125-b8a4b78e7229", "comment": "Malware payload (Panchan)", "value": "0922c62acd5acbb4960f95389d7798368231a8bb497c6fa8513950b96ef9efc7e1bb47eef9e4ef31c335808addcc9bda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948617, "uuid": "441c9e0f-64b0-4352-9103-45285034c55b", "value": "T1DE47DF73910738E9E5A98DB4D01425426DAC38875738A3C7BAC871F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948617, "uuid": "6554dc5e-d630-4391-bbdb-fcb1d3d00448", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaX:sXyWSpV+Wu7rI3JER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948617, "uuid": "5cd8959f-37f2-4d76-9e7f-3da790314eeb", "value": 25067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948617, "uuid": "9c96564c-7f53-4bc5-b434-8ef135d7de3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948617, "uuid": "8ac12903-6f87-4a28-8ef5-c663ed861f13", "value": "1eeabf460ddc4e2011b8f0971ce4ba3c2b9f3bb16918f2d3726f00d75a02de07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4abd447-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947867, "uuid": "894bf656-8a23-4070-b892-3c92c27c1964", "comment": "Malware payload", "value": "498b17f5819131f3c21142ae287aea44", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947867, "uuid": "cfa4823a-221d-4f57-aa7b-ed737a7910e8", "comment": "Malware payload", "value": "1f64ff21b24595604fdb5322da6f2ce4188e0355df251c7a318f779fc1e9f94c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947867, "uuid": "3e37fdbb-e5b9-4ab7-9ac8-7969d7a6b566", "comment": "Malware payload", "value": "793b5199cf78a97b3b80ea8863dce7be234eb416", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947867, "uuid": "d54cb1cf-d3ac-409f-b25b-490ba2d8e78a", "comment": "Malware payload", "value": "4e9a0bec674ca2309a9a060519d1ef61449ca79c2719885e81048ef36670f664948e542cab54844754331d293ca55689", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947867, "uuid": "91cfa277-4e4a-4593-af65-6ce1e679f29a", "value": "T169A1F750112C1AB07346697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947867, "uuid": "64ecf7a1-cd54-49dd-ba42-46ca41191c1f", "value": "96:3RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:3RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947867, "uuid": "1b5b18f6-534e-4671-9d79-d1c5bc182f8c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947867, "uuid": "a54f31df-f842-44ed-a47f-30e37431f322", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947867, "uuid": "4b5be2d2-ea98-4b68-b0fb-e08495130cce", "value": "1f64ff21b24595604fdb5322da6f2ce4188e0355df251c7a318f779fc1e9f94c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62a0d46-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947950, "uuid": "d733b9f2-baf0-4c21-a1e8-0a32d0a837e2", "comment": "Malware payload", "value": "a01e09f617cf19b44ca5f7aa8f5805bf", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947950, "uuid": "525ba074-a678-40a6-9c12-11a7b12ffcc7", "comment": "Malware payload", "value": "1f66d1d29c6f2d27da243ccb59c47b392876686af1f9e1e614489fe197b2240e", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947950, "uuid": "0d27e777-381c-46a6-982a-77acf0a9fa36", "comment": "Malware payload", "value": "534e11daaea874304d3fd5ce59120c01b1e0e777", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947950, "uuid": "2dd6643e-d411-45d1-992a-69d7f1d9d690", "comment": "Malware payload", "value": "5883a14495b266419ce792763b9282ffec21b198268bb0b7ffee7b7a2800760024e8a7a802519a37b52e554779204203", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947950, "uuid": "0f96dec2-a38f-48dd-b403-66c92b05431a", "value": "T109D5330C03BAFCFDF89D062837238DE1C5A955F0E58251A2DA2819985C3F5BE17DF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947950, "uuid": "e1aa7ca5-e742-45bf-bac0-2075b24e1255", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4X:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947950, "uuid": "bcb835fc-2c75-4c47-9fec-ae51abeec750", "value": 2863104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947950, "uuid": "3df55304-af93-4136-a362-f1b10275d134", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947950, "uuid": "018759ff-5fb3-4436-9f71-7f9da6367047", "value": "1f66d1d29c6f2d27da243ccb59c47b392876686af1f9e1e614489fe197b2240e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52085de-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947949, "uuid": "6dbb3f2d-f414-499a-b7a6-e75c3048dfa7", "comment": "Malware payload", "value": "cef7404fda85b91879ad845599c1764f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947949, "uuid": "d68160a4-ed18-45c9-b6d2-f9f3ad891d8e", "comment": "Malware payload", "value": "1f8ab7ab991efb5b8785c6606089ad1053dcd9e2aee2a8446f18aedd45b6e2d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947949, "uuid": "73a5cf63-8621-4469-992d-20bf780fe4ad", "comment": "Malware payload", "value": "5b5caf3812e2a9d4419c3a23fb36f3ab7ed2dcb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947949, "uuid": "9e71f889-4a10-45fa-8448-be461ef86849", "comment": "Malware payload", "value": "32e249e704a596e53344095dcbd1af78111b56945e08b5fe2ee10f6cfbf85e15da9ce8a74206ee9a0e6a15c88b8e36b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947949, "uuid": "b1878158-42ae-4464-b448-736af9547a10", "value": "T1B337CF73910738E9E5B98DB4D01425426DAC38875738A3C7BAC871F667EA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947949, "uuid": "a2e0c6d0-de63-4a43-baa9-55a9e8a99988", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaJ:sXyWSpV+Wu7rI3JE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947949, "uuid": "f48d616e-637d-4652-94fb-7babe63e554e", "value": 23396352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947949, "uuid": "d423f849-d159-4e0c-9092-b6e3ed8ee654", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947949, "uuid": "ef6599ee-d581-4860-8903-3f113626d348", "value": "1f8ab7ab991efb5b8785c6606089ad1053dcd9e2aee2a8446f18aedd45b6e2d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9b9b49-04e2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Pony)", "timestamp": 1657960818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657960818, "uuid": "8cb31844-031e-497a-9cae-0819368669b7", "comment": "Malware payload (Pony)", "value": "2feb3bbda4bd06d4d6352034f8a6ce75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657960818, "uuid": "ae46ad90-e376-4f5e-b269-bc33fc5d3ff0", "comment": "Malware payload (Pony)", "value": "21274eead550a1f647b42a5cd1c96df57eb77ca8922ab749130ea4253c63f03b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657960818, "uuid": "49f6625f-a614-46f5-b9b7-f71616cbaec8", "comment": "Malware payload (Pony)", "value": "606783099308bdd6e7e6777b4bf069501da423ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657960818, "uuid": "83a8d43d-dbce-4f38-a9a4-66414b95742e", "comment": "Malware payload (Pony)", "value": "04e599a4916268d8daa65a7a9fff1a3dc7810b54e4359a2d01f071e9cd261e63f039c55bbcf172cd2d64e079e693f19c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657960818, "uuid": "badd44cd-ca5f-4cd5-82f9-b5b9e6c5ed11", "value": "T110F2E19573500C35C7400EB7661BA8325ACEE4A688D9C74A69AD7D2C33C3F5BEC4D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657960818, "uuid": "3290b8ae-3145-4dea-aa12-9bd4ad4a1a6f", "value": "fd3adc5077b3a19a8142a087013e6a1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657960818, "uuid": "2a796c8b-fed8-43ea-a254-61772f5fb5d4", "value": "768:Z9qEtF0Q9yIE8jp7ANjLhKsGUBPvKoPREvQFzzgj+pqfxa1h8K9e+U6:LqkWQHE8jpANJ/GU9pEoFzz74UDek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657960818, "uuid": "20c6d6ad-5afd-409f-8348-dbbdfeb6bc92", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657960818, "uuid": "6e6d6b82-7ee0-4278-b886-390bd7714db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657960818, "uuid": "e8c195f8-5c25-4f8f-98d6-9c94b52a6781", "value": "2feb3bbda4bd06d4d6352034f8a6ce75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4bea86-04f0-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657966696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657966696, "uuid": "b2693d3d-cd0d-487a-b582-9352ef81bc9c", "comment": "Malware payload", "value": "2f21a4e144856309ce5db3bcc183cf9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657966696, "uuid": "e922a070-311e-4e27-b430-5242aa9e51c4", "comment": "Malware payload", "value": "215aaab2d2257c3ee840a51f8dc2cb6cb46816a2ed1176e04d6ad7091cdf558f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657966696, "uuid": "fbfb153b-ab84-4a34-bb8d-a4e5fdd7ba5b", "comment": "Malware payload", "value": "804b143d4a16110d2a1ddfb76222d2fac8c839b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657966696, "uuid": "a48cbc04-4140-4b90-983d-89c9fb62eb5e", "comment": "Malware payload", "value": "d7c89791ae89c001750bef7743b146942e6abdfcd2dfd71d9a428206109f002185acfd97ad2da498f0c3fa3183db0178", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657966696, "uuid": "b9d02b6f-6fee-413d-8c4f-2ea91900ff5d", "value": "T153F25E0B22CEBD95C0BA1AB03BB363C1C72EDE555903E62E49D4712AD93E6437D027D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657966696, "uuid": "5efa00de-467e-4146-a050-94ab9a1648ce", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657966696, "uuid": "6109d4ed-308b-48cb-b6bc-e7395cf7288f", "value": "384:/XOIkIYJ/ohqcjSIVB8MXwlpBIx6BPxzZeUGHgaKhuPjbQrm:/XPhO/YjSIVBNo7qga9jbwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657966696, "uuid": "04b16210-5da6-4316-b360-528ca936318f", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657966696, "uuid": "55d24acd-fc83-4eca-af25-821ce6d92b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657966696, "uuid": "47cd4e0d-d125-4124-b4ec-0b44668a19b5", "value": "2f21a4e144856309ce5db3bcc183cf9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0939d4dd-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948412, "uuid": "876c4cd4-e776-4123-8aaa-e010db0fac28", "comment": "Malware payload", "value": "82ab1b586fac6c87e01512dae05a9450", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948412, "uuid": "3f011660-e8e4-4fa3-9a83-577afb9eef12", "comment": "Malware payload", "value": "21718ce333d60565906f9ff4561f0aba0d26c91d6b03d0324cef1a4444318e4f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948412, "uuid": "2c060aaf-e51c-44b1-a697-53ff6c265742", "comment": "Malware payload", "value": "0c7ae0238385b0c932483987135f2888ab78f4b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948412, "uuid": "1039cd74-045f-4565-a239-b9eb0daf6cd4", "comment": "Malware payload", "value": "e32165a9c0a7966dd2f8797fa5e62d3ad4f3e4d89c4a0444df7782be7b305c2ada2941faa88097eadf92b7dceda7e623", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948412, "uuid": "2c3a7fdb-5585-4c0a-a9c1-05057c392bf8", "value": "T147A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948412, "uuid": "156bc13a-9e9e-45b8-ad68-04a1d6f367ab", "value": "96:6RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:6RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948412, "uuid": "582c4fd0-b831-433d-b481-b4dce8a9fcaf", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948412, "uuid": "5f6ad0e9-be1c-4747-a3ac-68ad5170c432", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948412, "uuid": "26687230-0a16-4b1c-98bf-b43f99bbbb3d", "value": "21718ce333d60565906f9ff4561f0aba0d26c91d6b03d0324cef1a4444318e4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131075bb-053c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657999109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657999109, "uuid": "dfd2aae1-3365-4f17-b424-dc88aba5ee51", "comment": "Malware payload", "value": "433d78295b917843aedea5b7164546d0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657999109, "uuid": "d689294e-8706-47f4-b168-a1c6b3b29cf5", "comment": "Malware payload", "value": "221ad4c97a6fd1a051c623f68de21a4ce67a46d543fdaf4f9ab5e5ffade3efc9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657999109, "uuid": "d6eda6e4-092c-46cc-9b8c-5fcaa50844f8", "comment": "Malware payload", "value": "d41d9e10c8da4e64b81c05f1479d2efa40f21a9c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657999109, "uuid": "a4350aa3-6753-4a07-9722-8326b4627302", "comment": "Malware payload", "value": "7c0ba938a51fd275a531d9f2bc7306a8d4856b8759f2fa70584d306b1710cdd4a8bc8c18214d77e345f24389579f9789", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657999109, "uuid": "4826d4f0-ea8b-469e-8a3d-7ba96e16fd2b", "value": "T101B5F082F7E95D2FCC77C0320BAA533512569E16C653E74B644837BD287BAE80E85BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657999109, "uuid": "1e6b989a-1b80-4ff0-89e4-6504cad56501", "value": "49152:onTNnHNhrC5MUsrKMzddmT/7YwUbvTrgXXgsp3OWtDJpVGnYamb9Yp5LXHNA:CTNnzC5MzKMzfmTh8brgXjtDJpgn5XNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657999109, "uuid": "5d616cd9-61e6-4872-af8d-6d43a2152189", "value": 2410046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657999109, "uuid": "74f72a8c-25ba-49bf-9ebc-acd152c5ae5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657999109, "uuid": "7a78cdae-ed87-4825-ab1f-ccf659d199ac", "value": "divar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1351b9c-0518-11ed-93bb-42010a9c0043", "comment": "Malware payload (Sality)", "timestamp": 1657983939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657983939, "uuid": "ef6980ca-4beb-44ed-9906-e46e6d2ff29b", "comment": "Malware payload (Sality)", "value": "70bff3f4d233bacd4970bdcc2d9c1922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657983939, "uuid": "58c1503f-e150-41d5-adc9-cfa727bbde9e", "comment": "Malware payload (Sality)", "value": "22c96890feb3ba58ca20a314d560e38f419f2eb2629b3c039b32815ec9539916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657983939, "uuid": "e03a267e-238d-4e55-9977-382777d1f114", "comment": "Malware payload (Sality)", "value": "1c12235447ded3e5909da1a54286ccc7e044eff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657983939, "uuid": "6247fce2-b2cd-446d-a9b1-0906f6d002f9", "comment": "Malware payload (Sality)", "value": "bd32e3d39d6ef85d69bfb13784ab50710026c157c52759d6b632f7e9fa3e345c72144cad8a3190dda8a966e619ad308c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657983939, "uuid": "49b37a46-3053-43f5-a8fd-13a5e04ae9f2", "value": "T19883F221D4739CA3E9BF0D7406F9E270AA76B9E31DB1866CFF6C68053F40764E58A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657983939, "uuid": "8e4d75e7-6a65-44b1-9d70-aee1d6cf0833", "value": "fde3f1d7292eb89c31b6106cea74acec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657983939, "uuid": "e0b8bedd-0489-459d-8cf7-5dd4c5902ab2", "value": "1536:39yK3JNwAN76YAUgg5MUTKi6Kzi6Hql23ZPJCq7egGt/n:3b5bN7cDhi6Ai+ZP8gGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657983939, "uuid": "d18fc3ef-08d3-4b16-8d54-d3b2b74a8dcb", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657983939, "uuid": "62110cb9-ff68-403d-ad56-e833c4788230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657983939, "uuid": "5f0d4a5c-ae18-4293-ab5a-b93c87e2338a", "value": "bootsvc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a83bc7-04af-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657938690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938690, "uuid": "96f38b8b-31ae-4c9e-ac79-b37927e31359", "comment": "Malware payload (Mirai)", "value": "93c17e12a23be1303a6acf58ec81eea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938690, "uuid": "7cd86982-d2ea-438c-ac49-c0f7ae19d0d2", "comment": "Malware payload (Mirai)", "value": "2337dc4c7d81bd812e88f79e4e130b0b6e8f93e547d11249d90034295d64b17e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938690, "uuid": "3fc7fef4-5e50-4383-b905-1437f1a661d4", "comment": "Malware payload (Mirai)", "value": "37df13902c61491775a45e8d81f1f1f6e3f737da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938690, "uuid": "2382c609-9e53-44f3-901d-c408d10cdaa9", "comment": "Malware payload (Mirai)", "value": "ed00c0c66d8772a16f19aea81a0db56d5c9745a81c4869b504b2f944f6be804f52257bfe0bfa1451c63521a9332c9099", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938690, "uuid": "77c05ac7-0060-497b-aeb2-44f27c739c92", "value": "T1EAB3D71FAE259FBCFB99C23547B78F20A669338227E1D545D15CEA001E7034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938690, "uuid": "5e2a810c-836d-4c8f-b930-362090db2c3c", "value": "1536:ylSo3HHxgDudY3XCoesbjstaduX893MDkLV/IJ3OefFS2:+D3HRgDdnCof4aduX893MDkB/IJ3jS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657938690, "uuid": "50652b78-8efb-4dec-84e3-9946911963b7", "value": 116100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657938690, "uuid": "df78a1c3-e8fe-4ef3-8b37-9db699d656e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938690, "uuid": "ca87995f-a71a-494c-bdcd-e492bb3d3010", "value": "SecuriteInfo.com.Linux.Mirai.1288.4996.18756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbad9c8-0510-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1657980601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980601, "uuid": "5d052de1-5654-4baf-8c78-ea77a1973735", "comment": "Malware payload (NetWire)", "value": "1ff3931b973f49044b0721f73ac067f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980601, "uuid": "925e7927-f7bd-45d7-a241-af2d95bc554a", "comment": "Malware payload (NetWire)", "value": "24093405b5488debd355b39f704bfc4beddc4c60ebec6d56e0c7b25e29a7758a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980601, "uuid": "ed1c13e3-8195-486b-861e-fc021fc779ad", "comment": "Malware payload (NetWire)", "value": "97bfeed429c997b3a254fae324e68cfed9cd8d22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980601, "uuid": "fde7633f-3d1f-429c-b2e6-98b08a90a881", "comment": "Malware payload (NetWire)", "value": "5c7cedec51f9ca7527a30a2ba0a712ff7a01e7ade5fecd84e3bd81c6f080854192dfa9ad596656616b129e99e89bc9a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980601, "uuid": "1cb0be30-40ce-4ab0-b52a-18e56413c870", "value": "T11F25F12827E84755F5FE5BBED0B6025087B9B21BA57FE30E188064ED1D32790CC56BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980601, "uuid": "13911f07-79c6-4757-8cd8-7f598ed2ac9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980601, "uuid": "1f1b5ef8-afcc-4205-ad83-d26c43041d0b", "value": "24576:iyaLf8N/uArWEr6fmHZbeYpuvZLOlGXSEfW9Y:ita/Frt8m5HpuZZ30Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657980601, "uuid": "bd767c9b-1020-479d-98a7-161b8c909ab3", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657980601, "uuid": "c86f26dd-08b5-4202-8e22-87caaf299975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980601, "uuid": "8dd19c8d-3b2a-43df-a542-0090c8ee2765", "value": "Invoice #08 1232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad577c1-04f8-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657969916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969916, "uuid": "89912c46-0f1a-4bda-a792-e23dd1fa34be", "comment": "Malware payload", "value": "0d5f5eacabe415c43ea0d15aee42e8c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969916, "uuid": "5a50961c-b4e5-47ad-a539-7121a707fdbf", "comment": "Malware payload", "value": "247d71c8442b75448ed9097c4522d4b015af6468992281f595965d877de2edac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969916, "uuid": "d466ecdc-cb2e-48e0-aa8e-b4e24dbf4044", "comment": "Malware payload", "value": "7190c77302fe8cfc77744f587c7e85cb485688aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969916, "uuid": "735ba9ad-a513-447e-8605-67838f408e81", "comment": "Malware payload", "value": "50caea7aada933f77dfdb88a9b6ce08179b3eb3451d1ddab73bc4cd8e54f8170fcd6848fb1fde620c7233580e94cb966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969916, "uuid": "4c54a466-eb73-4b4e-a983-0208f6e40227", "value": "T1FC25025F35558599ECCE8070CAE1AFB4F0E5A6703DA8E36E2FD3869C2711926C623353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969916, "uuid": "24feba7a-e8c1-4802-920d-188898b1d7f2", "value": "7a195ad20dd0c44e24aea9fff812861b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969916, "uuid": "37a339f0-3bf2-4e83-9453-00a94da28fdc", "value": "24576:QC0FMBxw00XY8r0v5dzOxFZARM8w6eFWcO/zz8dZ13SW:ZLwjoe0hd0ARMvWR/zWkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969916, "uuid": "424d0dea-1438-4a63-a831-3c8511ed3044", "value": 969360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969916, "uuid": "5a449470-d5c0-4a70-afab-ec22c024b7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969916, "uuid": "fe175311-133a-4965-aad2-d3ee429bf24d", "value": "virussign.com_0d5f5eacabe415c43ea0d15aee42e8c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ea1dd5-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948215, "uuid": "dcbbc86e-948c-4754-94ab-94932ab854c9", "comment": "Malware payload", "value": "b537f11d8c13a39931f2a3a924625a17", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948215, "uuid": "8c841baf-ee34-40cc-8b73-4033eac40d0f", "comment": "Malware payload", "value": "24a7687890ea64c843570c5a0fb294aa8c33faf8261e4106af1074775bee6d3a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948215, "uuid": "4d54a937-2d9c-4c9b-a3a3-67a69371d084", "comment": "Malware payload", "value": "7847294353c5bb92776836007433cff8fcd7ef06", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948215, "uuid": "3a33cbbb-5861-48b8-8740-e9aa6fab60a8", "comment": "Malware payload", "value": "577dd8bfb098d71496a31cc307aa11502d9e1f5edada2b49814c82af607d6520449338a320d9705dcfd95d59ac063dd1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948215, "uuid": "b8d449ad-a587-4197-8f92-dc57f60a798f", "value": "T129A1E850112C1AB17246697AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948215, "uuid": "ac4d1f36-07eb-4669-a699-3b527f7ada71", "value": "96:oRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:oRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948215, "uuid": "e1d57480-9797-4a07-b53f-f663ddeff101", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948215, "uuid": "17838543-3aa5-4622-ad9e-b03fbf3edc90", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948215, "uuid": "c27bdb1c-c2f8-453d-8d07-e1bb2bbfea27", "value": "24a7687890ea64c843570c5a0fb294aa8c33faf8261e4106af1074775bee6d3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2667b59-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947837, "uuid": "c96c6b4e-b28d-4d13-8a95-c682a1e6be19", "comment": "Malware payload", "value": "5cbc383a042ae78df4b1f49d1764d3aa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947837, "uuid": "3a20ecba-9ecf-474a-b63a-725b6f01c381", "comment": "Malware payload", "value": "24e348e7416c6a38805dd5f148a962ca5a1c1786347fd27005fc20e50cab9cb2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947837, "uuid": "06f05c94-345e-4296-a3bb-4e461fd7c8e1", "comment": "Malware payload", "value": "26213c39b85876f3d38cc2992c720f226b192d42", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947837, "uuid": "1d02cc03-d95b-474d-8384-d4d031d0527e", "comment": "Malware payload", "value": "305977f8a867bcbe42e44a4d9de60a50cdfd9ba99799532099f8dc55fc919ad6b838543336cbfb5accab0bc398d9414b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947837, "uuid": "a7a956fc-dcdd-4d14-ad05-f4ebc1695dde", "value": "T178A1F850112C1AB07246597AD26FFA52B40EC81B09777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947837, "uuid": "8dc0d73b-a89f-4d6e-ad84-896293a53d74", "value": "96:PRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:PRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947837, "uuid": "be5302ab-4f2a-46b9-bf38-4493d5149ce6", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947837, "uuid": "8d5cbc57-37f2-41af-b91a-60cbaf4ac507", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947837, "uuid": "13decf7c-8f6b-422d-870d-24d8140cd86f", "value": "24e348e7416c6a38805dd5f148a962ca5a1c1786347fd27005fc20e50cab9cb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24832347-04f6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657969073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969073, "uuid": "bfbd1bdd-ccd2-46d1-a3ac-a98042160390", "comment": "Malware payload (Mirai)", "value": "7485f0f13ba81c045b676498577108ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969073, "uuid": "1b557ef5-4493-4f76-b6cd-754aa5203a49", "comment": "Malware payload (Mirai)", "value": "24fb5ca15b504b798a5d6f7bb46ecc80f6b06f791893e00144d27b1bbf9a270d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969073, "uuid": "79b8545e-8882-463b-ace9-4fe12ec24349", "comment": "Malware payload (Mirai)", "value": "76825a426b100203c97f4a62d61a868508b32981", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969073, "uuid": "81743497-5ef5-457f-b7c5-2010a3ccf72a", "comment": "Malware payload (Mirai)", "value": "47239833c8db9593cfbf497dffbee5217f14f78cfea1706c2147d7fc83acd4ade16f46799303455334b26178291824a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969073, "uuid": "4de0e448-be19-43be-b9f0-514147f104b6", "value": "T1E1234BC5A453D8F8EC160AB03072EB336BBAF53F2158D983D3A9D933D951702E14626E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969073, "uuid": "c78df8a9-1953-4067-9b44-449c4545067e", "value": "768:4cFOLWW9wA483Amu0hqb5669QYcsom+MMdrgrMN2LDkA187/UxkW:44lAj3Amu0hqb5jrBB1MdrgrMoLDZ1k9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969073, "uuid": "0dd831bc-82c8-46ae-922b-1571ba18948a", "value": 45840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969073, "uuid": "f48bcb29-f0af-42cf-b290-896e7d1c5c88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969073, "uuid": "3fc10135-e5f7-4aed-9f39-ea2d99a14ee0", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd83939-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948071, "uuid": "94e84583-ce34-4f0d-8c64-1afde74002a2", "comment": "Malware payload", "value": "9a134d8551c4e18ae60cbf9aae98ef4b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948071, "uuid": "edcb8750-3f0b-48fd-a2c4-0026d9a8e374", "comment": "Malware payload", "value": "25087247d25375ef9bc9e3af600b260f2e91f19f2e9f0d2ce4ac8a21c06d53f5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948071, "uuid": "9258ce4e-a0ab-4202-b673-3b80f2dc113a", "comment": "Malware payload", "value": "9ccc2bb6a1fc19a8728effb0774a61702c80ac06", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948071, "uuid": "9e64a14a-e848-4e4a-baf2-fed074c52fa3", "comment": "Malware payload", "value": "47d947fbd0892354927e99084b39e3c92e03c92e6413e01024d002849ae40faeeb7c28d64f867c3185992d511bbcae53", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948071, "uuid": "5cbcb52d-dd40-4f9b-a5f1-de92da1e6434", "value": "T1FCA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948071, "uuid": "eaf0e85a-e22b-4b56-8f95-f1e29e5f6779", "value": "96:0SRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:HRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948071, "uuid": "8c801a39-4d1f-4374-a7c6-41bbdd56284d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948071, "uuid": "f69cf32e-a19c-46bc-b486-a6169969dcdf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948071, "uuid": "c60e2cce-ee8b-4b26-b8f2-7a59313065d4", "value": "25087247d25375ef9bc9e3af600b260f2e91f19f2e9f0d2ce4ac8a21c06d53f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7279b93c-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948588, "uuid": "5a574e3b-5e5c-438d-91db-7b0e48beb098", "comment": "Malware payload", "value": "19569ad8a29c2bd6e8675a95b4ea8d2c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948588, "uuid": "eab35302-9975-4b17-9c09-bcf519342635", "comment": "Malware payload", "value": "26055e5ce8200f2e0cb42b1c887841b2d016f5ba6fc350a4d0091a4ce753ae10", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948588, "uuid": "71ab2de3-d860-416b-a04a-27575b225218", "comment": "Malware payload", "value": "7ed3daba376624bfa14c149d09c424dea19d3150", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948588, "uuid": "cfc712b3-ebc6-4b8e-a792-f8b350b0a8e1", "comment": "Malware payload", "value": "60915897d99e4ee676a4a766e006c1fda35680a256ca3643dbc317064b1da8dce96e5173effc0713c8a071d1498ebf14", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948588, "uuid": "5c6f4f62-9fbf-4827-b793-6f638767fe45", "value": "T1FDA1E850112C1AB17246597AD26FFB52B50EC81B097B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948588, "uuid": "310914c5-ae39-4b47-8c4b-3c40005b8e39", "value": "96:JARYZxQOBpLyxIcymLKY8M991wuIaQPYPW:JARJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948588, "uuid": "300e530e-5bc9-4ecb-8d73-1f81f04e9d81", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948588, "uuid": "8a0e5178-48e7-47b2-89ba-485a78476672", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948588, "uuid": "0f0b5f2c-29fe-47ba-b446-47f31777309d", "value": "26055e5ce8200f2e0cb42b1c887841b2d016f5ba6fc350a4d0091a4ce753ae10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82129f5-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948759, "uuid": "059b11a4-be0a-49e5-92a0-bb2602179126", "comment": "Malware payload", "value": "7c810974359fd5c83d22e71f258087a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948759, "uuid": "91215681-cf80-4cd1-a488-7c13bd759979", "comment": "Malware payload", "value": "265c3abd89510cf657e735193f0ba50a5956363c90bfa3b54e9e1310aaeb8346", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948759, "uuid": "51b39e1f-e479-4968-979b-efa3224354d4", "comment": "Malware payload", "value": "2054e67cb5bda481d82002538fc74961fb10bb77", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948759, "uuid": "58a21819-a08b-4bec-bcec-0c3b25c6a673", "comment": "Malware payload", "value": "6037ff979df13f55b3a189b655bc0013b5d7251371b1a2b1a8f2ce38141671ccb578549b679fba3533756d4a5f94f0ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948759, "uuid": "9cac94b6-bb23-4fe5-8207-25e14fa4639d", "value": "T1CCA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948759, "uuid": "7b86e11e-f3e2-451d-8254-717e73998484", "value": "96:URYZxQOBpLyxIcymLKY8M991wuIaQPYPW:URJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948759, "uuid": "50c1f569-2f0b-4c70-b61e-cce19c79f22a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948759, "uuid": "45acb944-2833-4791-b0b6-12b717653b48", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948759, "uuid": "b7ed4c07-d25e-4454-926f-ee9898994a0f", "value": "265c3abd89510cf657e735193f0ba50a5956363c90bfa3b54e9e1310aaeb8346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7254086d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948159, "uuid": "bfebbdc4-9797-4566-b745-812c1e972c81", "comment": "Malware payload", "value": "7f033da424b3f2221665205bb032cbd6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948159, "uuid": "5d05b5ac-97b9-4f3e-80a6-816d3102ba9e", "comment": "Malware payload", "value": "268a7585625642e85c2fc3a669a5091f13d86400aa15c7ebccf8b612f0fa1b73", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948159, "uuid": "471c0477-fb5a-48ee-bfbb-4d857bfebb0c", "comment": "Malware payload", "value": "ebcab7cbf838f8c922b5721bcbbc2738fc52d54b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948159, "uuid": "92bfb8f1-30a3-4d27-a5be-b1afe80448ce", "comment": "Malware payload", "value": "dd2e452ee776008ea5a862e565add2b00328cd356828139d66d4b64a851bd787cf05f36fafd9db213322809885b686cf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948159, "uuid": "436a452a-ca92-4276-b56c-71e961350437", "value": "T18AA1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948159, "uuid": "1598a1e2-77fb-45d5-953e-637cc9601eb3", "value": "96:MRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:MRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948159, "uuid": "bc370b3a-0b38-484a-a454-56a15eb150d8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948159, "uuid": "985aa362-6509-4b0a-a2ab-96dec542e786", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948159, "uuid": "bac483b9-335d-4b6d-bd9f-b9a23909117b", "value": "268a7585625642e85c2fc3a669a5091f13d86400aa15c7ebccf8b612f0fa1b73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c7ed48-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657971389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971389, "uuid": "4e855f96-ec18-440c-aea6-242545e4104a", "comment": "Malware payload", "value": "c9ec8286a9adca5a052b36898f2f1aaa", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971389, "uuid": "dca6a50b-6296-405e-a019-50728699716a", "comment": "Malware payload", "value": "27c3e9895486cdce1c95dc80435fb75302bf079c928888e542d8d93c7762404c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971389, "uuid": "380cc967-3aa5-441c-8d1c-83cb6fc0b16d", "comment": "Malware payload", "value": "f750182d8f3ce938c5d8e2f6bf9a09afc6b1623a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971389, "uuid": "7983f4f0-1033-46ce-93d8-3ad06545e84d", "comment": "Malware payload", "value": "2a32081e44b58d64fa9413469551f5a8bc77ed8cb26b16f42544953c50834f719240615fad0a03e3d93b10062be08cb5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971389, "uuid": "eb9dd52e-a478-4dbe-8ecd-62ba90ff7975", "value": "T130248188870BD29F185F20BFFC4A5D6313D91E26DAFD958593E8601D12FE22E64E058F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971389, "uuid": "e70a5997-a8dc-4159-a8df-d346cab9a310", "value": "3072:6ruf+NsVR+p4rz0vWJ5Xjqf9pfnyVDD6xGVSHDoX8r06HfZnBpE:bGybe430vWJ5XjCpfqGGVSssj/ZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971389, "uuid": "76c3f0e0-1de6-462f-bdf7-530c33d4aa28", "value": 221625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971389, "uuid": "56b46dd3-f1f9-4660-bb01-d80fb54e06b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971389, "uuid": "e0cfa820-e1b1-4516-99b0-be06cdf71bac", "value": "NvidiaDriverUpdate.PS11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3908db04-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948063, "uuid": "6c4f0bf3-23aa-4654-af07-dc8f68923bbd", "comment": "Malware payload", "value": "824456c66c667a57d4232174c0049d93", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948063, "uuid": "dcf8dc2c-0519-452f-b681-fbcc376d2bad", "comment": "Malware payload", "value": "28b08336244da3bf7f38445a9f52007e0e5e69091edd4bec89ccaa4ff2938983", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948063, "uuid": "2569d3a7-c013-421e-a2df-3c2c41c69cf3", "comment": "Malware payload", "value": "5f57a937482258cd51758569794a9644208d92fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948063, "uuid": "c2ee05e4-b860-4470-86a0-a714ef57b20b", "comment": "Malware payload", "value": "f1bd4bf93cbd54b5bd7a36a0842cc2ba58ac70dba3ead01a6a2187d5703ccc8bfb3a9404efa95949b83d94016eaefb7a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948063, "uuid": "dd2ba077-dedf-4ec9-88c9-de1abf9d248c", "value": "T133A1E850112C1AB17246597AD26FFA52B50EC81B0A777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948063, "uuid": "b61c99f9-9ce7-4b98-b762-3a7908d40b32", "value": "96:ORYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ORJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948063, "uuid": "706f5ce5-b6be-4507-8425-d3af8522eaad", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948063, "uuid": "b711568d-082d-49c4-9cde-2e59e6bf0668", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948063, "uuid": "8b8a6ced-ded3-47a3-832b-82bb978125be", "value": "28b08336244da3bf7f38445a9f52007e0e5e69091edd4bec89ccaa4ff2938983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d518a5-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948188, "uuid": "3fb4fad0-6d51-4556-b84b-3cefcda3ccc7", "comment": "Malware payload", "value": "afb02e3caff73f4fa5b900848ce6b0bf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948188, "uuid": "5cb8bc43-6a93-42d8-b070-3dfdedb074d6", "comment": "Malware payload", "value": "28f97ca2f6119b9633d85802aa38ac231e821009cca430a124a9c5aaf41a82b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948188, "uuid": "120433a1-4ae8-4ce0-9ea3-5eed9b2ebfd5", "comment": "Malware payload", "value": "8c1fb23f80f40fe36d02e3e16f9231ee18f51aeb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948188, "uuid": "134a69df-cb63-4d10-ac93-22cb65dbc9d5", "comment": "Malware payload", "value": "8a8317f6a8e2661ba0d1b4a9c380f02fe9961a2c1e424787b489d29990b38e25f832c48fea70787564090fa9a4b24fa7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948188, "uuid": "c30ae1ac-2020-4498-a6e1-13102fa6fa00", "value": "T192A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948188, "uuid": "b39ae980-c804-4e48-acb9-61c2f64085a6", "value": "96:zRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:zRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948188, "uuid": "5d1bc31b-7b10-44f1-a600-3251bd7c02ee", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948188, "uuid": "ce3168b4-fa94-4e52-9dcd-e87f7eddde74", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948188, "uuid": "eeb9e8d9-a9bf-4954-9d66-a9f1c412e9db", "value": "28f97ca2f6119b9633d85802aa38ac231e821009cca430a124a9c5aaf41a82b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdadb26-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948228, "uuid": "9986f40e-b861-4da7-9736-2768c06dc7c5", "comment": "Malware payload", "value": "500ec56fca51b3bb13feb11be3eae683", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948228, "uuid": "4817d274-ae82-49da-9bc0-164713a941ae", "comment": "Malware payload", "value": "29daec5e74ca77647e3496a6cc39774a46184413cdf5af0c111982ba88b5e0ae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948228, "uuid": "43ece335-5097-4016-a932-6deff8498ecc", "comment": "Malware payload", "value": "5a08246680b55e9ff3f18ae722353b5d8ba1d24d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948228, "uuid": "6f2055a8-6ac6-4258-9a67-fd9a3c8c4ef1", "comment": "Malware payload", "value": "d5a1e5b08778e00d14319e950a8b2e88da911d5177ea3f25a49ea126253af76caa42d3a31d8899d660b3b56081462199", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948228, "uuid": "2c3fc7bc-c60f-46da-b891-41d5e09a9924", "value": "T17501E8CA8034297050138F5DF187C56C18B082CAE3FB3A963BBA223E4C4A8113FFC694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948228, "uuid": "48e67b8a-3eb8-4802-b1a3-167f6f41d513", "value": "24:KlYYfxaOofYfxB9Yf66Yf2DYfxIebQYfLk7WlYYfLD:9YfnofYfdYfPYfIYfiYfzWYf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948228, "uuid": "1f1e4d60-2fd7-434e-95a9-a5ec41bd9bf7", "value": 842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948228, "uuid": "33ec0910-896a-43f3-883e-b67685a111d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948228, "uuid": "0067fa06-b25d-44aa-aab4-94ea863d58fb", "value": "29daec5e74ca77647e3496a6cc39774a46184413cdf5af0c111982ba88b5e0ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339f476d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948053, "uuid": "0848b66f-58bb-41d3-9fc1-8970a7f8cabc", "comment": "Malware payload", "value": "396e6c8e165c53b859216e147235b011", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948053, "uuid": "150d67a6-59e3-436a-964d-fa56d5697e8a", "comment": "Malware payload", "value": "2a526eebe3ec0919ec2654c1c16b0efbc63efb0e0fe9846d8caf1cdc3435980e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948053, "uuid": "c1479e03-3858-4859-9286-55e4b306923c", "comment": "Malware payload", "value": "15b3357275560d67738241dee5e874a0a514a989", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948053, "uuid": "533fc388-9a7a-4e3d-bfc8-80af725e25f6", "comment": "Malware payload", "value": "1d5dbb3c98bb7c43d38a2d93759b3f750d1d2e63887c90c62d8bb65dcbed57b2c3f7a0cc8a2ffb0d38bf3512f7d092a1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948053, "uuid": "e3035d80-151c-4537-a65f-8d5c70601be1", "value": "T180A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948053, "uuid": "f0ae7bc6-4b86-4da8-8591-f4028eca998b", "value": "96:BRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:BRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948053, "uuid": "7d68b02e-6fb6-46d4-8cef-9514e1bfe99e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948053, "uuid": "960343ce-6c91-4cfb-93a2-4b5926fd2289", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948053, "uuid": "2329fc0f-f61d-4ea2-8f54-0e7846eab7e5", "value": "2a526eebe3ec0919ec2654c1c16b0efbc63efb0e0fe9846d8caf1cdc3435980e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30533bc9-04ca-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657950195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657950195, "uuid": "36985b1b-e339-477a-917a-f97a7ef12a5f", "comment": "Malware payload (RedLineStealer)", "value": "bc9a0d1f26663750ef3802c19e89937b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657950195, "uuid": "ba21e189-a914-4697-8a80-ba764d8c96d0", "comment": "Malware payload (RedLineStealer)", "value": "2a5d48c192a37c4c5bfba8d0908b793563d81a6554826fb0945ad09dac212bda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657950195, "uuid": "015ed73e-4d53-43fd-9a3b-93b718a0dd3a", "comment": "Malware payload (RedLineStealer)", "value": "60b6e8eb7ebb57a64b18dfd0f29119d184c0c47f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657950195, "uuid": "eb733d1b-c03b-4f30-9e3f-e0202ec07ef6", "comment": "Malware payload (RedLineStealer)", "value": "78fd341ffc0d41afc872ad6f1e257b5fa38625cf49b5922a8fdca0971e8427189172e6d906ce869d9cebfc37a5b90353", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657950195, "uuid": "9d3d35f4-7105-4ba3-b237-1fe58879be9b", "value": "T1C694BE00BF91C434F5B752F456BA9368B52A7AA19B3450CF62D56BEE17386E1EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657950195, "uuid": "9bd3321c-f027-4e48-b20c-712ab4463987", "value": "149733ffc6fb8cb84df8287483828e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657950195, "uuid": "754bc983-2989-4354-85d5-3faa433cc9fd", "value": "6144:uleDYUq8520Y6NxAUaQpD66qcI0b1jUhxcdkNdz4l:uUUUtI05NGUaQpD6qY/NB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657950195, "uuid": "6e640e49-25a7-4449-908c-4f11eba7e55a", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657950195, "uuid": "ea83afab-dd66-440c-8203-85e1e9db9118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657950195, "uuid": "6bd66056-44ef-4064-9b4c-db9715e5440f", "value": "bc9a0d1f26663750ef3802c19e89937b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4249f7-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947909, "uuid": "b38ffde8-178b-460c-acbe-07b87b5b154b", "comment": "Malware payload", "value": "e289ee3cabcf8d8045191af447f69ba1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947909, "uuid": "634d8178-4428-4790-976b-f355270a581f", "comment": "Malware payload", "value": "2ab5ca6bbe34bb9f880cf6fc05c4aa42d3a55bd4ae5786cf8fbee19f076995a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947909, "uuid": "77bea373-1580-4b90-8698-bbac3172a238", "comment": "Malware payload", "value": "1894b6c93b938b70076a3b98bc5afa26e24f7d2f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947909, "uuid": "e5d217ce-40f4-477f-b76c-1f654132d975", "comment": "Malware payload", "value": "155463931339dc5d6d00864e83224625102bf6779f662c7bd62e8834bd5e2b68c6b3589ac5eab7605ff40ce0c1a07614", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947909, "uuid": "1ebe764b-2318-41ed-8f9d-d0c8128f57f0", "value": "T1F9A1F750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947909, "uuid": "a1dbdb3f-9aa8-44e2-8a5a-26ff4c7c3816", "value": "96:QRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:QRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947909, "uuid": "7005ce85-23fa-420e-8078-2f06fb6d7519", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947909, "uuid": "b6a6cbd1-9ab2-4ca6-8068-b92545078f04", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947909, "uuid": "821b6053-6e16-4aa6-bf5f-7e3adc186c09", "value": "2ab5ca6bbe34bb9f880cf6fc05c4aa42d3a55bd4ae5786cf8fbee19f076995a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33449d5-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948697, "uuid": "c62defba-0084-4889-8197-d2fcd739b49e", "comment": "Malware payload", "value": "f84f8dabeb80f186fe492f66eaf6b47d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948697, "uuid": "61086569-9002-4c86-99f5-b29d1a748ae8", "comment": "Malware payload", "value": "2b1558ef3f3dcd2cc3b94f51764e61e0f815a990624e32730fdb5f50896e27db", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948697, "uuid": "2dd02793-abd9-46c9-abb1-1eaea9e10177", "comment": "Malware payload", "value": "da4ad942da3790b7449d221fea51ab92c59db22b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948697, "uuid": "f0115fbb-2df5-4fb6-bbe6-4793485a937e", "comment": "Malware payload", "value": "eb49e8f52a8927b57352748835c23c711c2f14ad415c67779542fc4dbf3fb87e8353fc2f27e43e522a25c7b9d0967f0a", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948697, "uuid": "fa53bc04-0827-45d2-9635-23a0def49178", "value": "T1DE16336CB0E939FF83946A72A2DBEF30205A5DCDB06253515DBBE18A0819271D4FB91C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948697, "uuid": "6c162a5e-9369-4716-96f9-37ceccc8654a", "value": "98304:tos909Qg6ecEZHyEexmLaI9MY7bxTE8SSvEgP3E:td69Qg/JFeQ5x7bhE8SSdPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948697, "uuid": "e22b15f4-fc8a-4951-bf06-64480de95fc7", "value": 4259840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948697, "uuid": "61972330-e55f-486e-a524-2f48e0f38473", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948697, "uuid": "eec9862d-4a63-4342-9dc7-e866889ef0a4", "value": "2b1558ef3f3dcd2cc3b94f51764e61e0f815a990624e32730fdb5f50896e27db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67330bc2-04af-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657938691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938691, "uuid": "cebfb82b-c494-4f80-aeeb-eb20e5e8b3f9", "comment": "Malware payload (Mirai)", "value": "d2b0558d5d89b6e95ad5ccb5876d4786", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938691, "uuid": "4e258209-3c36-4f0c-84f5-064d2de5741d", "comment": "Malware payload (Mirai)", "value": "2b28b9c2da99b73ba27c79024303cf56ae8b2f2b4f73337b16160b65c6e63594", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938691, "uuid": "d9194bd5-531b-40c2-a16b-69a56c3a50eb", "comment": "Malware payload (Mirai)", "value": "111da6aae7185df11f2380676f666e41563bc808", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938691, "uuid": "8a8a02a9-276d-4242-ba2c-22c3076d8642", "comment": "Malware payload (Mirai)", "value": "f39bf50bea1d1440e86bb2480c43abefe7d08f782702b8a3fdde0bb00e11b6e84fe106a5d35becfe6b7c88d39e01a204", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938691, "uuid": "f15ef25d-7373-4da1-9326-fb67868c4afa", "value": "T1AB934B917C819A22C6D4227AFA6E01CC372663E8D2DE721BCD219F1237CA56F0DB7751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938691, "uuid": "1390979e-6e9e-4cea-a71a-20cc2ddaef8f", "value": "1536:ZT18H0hwe1yb3hTrEgGKYOBpwTP3asuQ91mQ3l9XT3eOA4m9WesSMv7:ZTmEwe1ybxT6FcQ9j3l9jqAec7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657938691, "uuid": "30c7c82b-4875-468c-84bb-9af1948261a0", "value": 93300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657938691, "uuid": "69769d38-bde6-4bf6-af40-e99320c1b369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938691, "uuid": "fa2d0ecb-af5f-4ecd-bfd4-a020916c8479", "value": "SecuriteInfo.com.Linux.Mirai.1232.7271.16541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8a44c0-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948313, "uuid": "61c10879-3f38-4929-8b0e-30fc674fded4", "comment": "Malware payload", "value": "538494b74d7c1d05b16f98660bf2e982", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948313, "uuid": "34c78bcc-4df1-42f4-abe6-8903b4892ee9", "comment": "Malware payload", "value": "2bc9ceac0c48d03a2a11155ac1c64c910a533f4112fc30c14ce08faac6644ce3", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948313, "uuid": "9e699cf1-b150-4c77-95c5-6af74e9e9456", "comment": "Malware payload", "value": "d8ad39b7cfe618c514257e850f98cac2c9d3d64a", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948313, "uuid": "541abcf1-fc6b-49d8-8817-dc42270736fb", "comment": "Malware payload", "value": "e469ca80d967e0f4de768739dc1aa2deb26b7e307722e4e6ebcdd822a92d937f56f20cb9333b3ca6592f67d1d521a03d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948313, "uuid": "3c3485bc-0552-4bc8-944a-69e68a180f0e", "value": "T114E5330C53EAB8FCF8A94529376389E1C5E852F1988265F2D67C15980C3F47E1BDFA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948313, "uuid": "d7eaab29-b016-4668-bbd7-1801dc87d9e9", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwr:0XSxVJG2fLAqFOfT9sMYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948313, "uuid": "60c5d2d4-acb0-47da-9c3d-26eb22177601", "value": 3248128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948313, "uuid": "674fb533-5e4a-4d86-9404-49cbec4cd449", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948313, "uuid": "f9234441-cd09-4535-8f07-fc0b19369798", "value": "2bc9ceac0c48d03a2a11155ac1c64c910a533f4112fc30c14ce08faac6644ce3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802d97b4-0504-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1657975240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975240, "uuid": "fdc55c07-8274-4733-b57b-1d91403f24dd", "comment": "Malware payload (DCRat)", "value": "ad8319cc3c104fab9a49cdee283f981b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975240, "uuid": "acb90233-4463-4053-a9c2-fb28dc28211f", "comment": "Malware payload (DCRat)", "value": "2bd34d100c1877e8d0add42811f7b0d5a6529dd48fe950093c39b57a32359ab8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975240, "uuid": "e4204df5-337d-4247-95de-450d36f729f9", "comment": "Malware payload (DCRat)", "value": "c022ed9e5c69fbcbd0744115ba5add67a68d7070", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975240, "uuid": "a3f25960-c80d-4746-b1b4-ca5341488191", "comment": "Malware payload (DCRat)", "value": "47c393cb2dfdeb8d6a96fae3fce60b888de761e0089f13955d12a73910f1c38b98bc0bcd6ee8d91fcd591075c43368b5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975240, "uuid": "381c4b93-8efd-4c9a-9d74-c172dd18e5ca", "value": "T163455A027E48CA92F4181677C3FF45044BB4AC502AA6E32B7EB9376D56163937D0CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975240, "uuid": "abacca05-5ab2-42f2-9a33-c6920a70fcb9", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975240, "uuid": "ae4ee27b-cac5-475b-80ca-afb033b57a2b", "value": "24576:U2G/nvxW3Ww0tAOp4Cqj7KtGJrpm72cJKwRyU7moAZH:UbA30AOadKt6VWJKMop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657975240, "uuid": "34788e86-3df1-4c9e-af8d-ece603c7ca47", "value": 1164874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657975240, "uuid": "6d666eb7-5ab3-482a-9294-d4bdbcf0f587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975240, "uuid": "7f610b40-01aa-4975-bdbe-15a58d0a34a2", "value": "ad8319cc3c104fab9a49cdee283f981b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c8c59c-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948327, "uuid": "5fd54f8c-93bb-4cb2-9693-c24ccfc8ac96", "comment": "Malware payload", "value": "ff30e16861455c934fae84ea4111e16c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948327, "uuid": "b6ea3725-2429-4337-bfae-de43b90800fe", "comment": "Malware payload", "value": "2be8e08c4042edf6301d47375896032a8d0632e8d9eb025d84fa04256eb72495", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948327, "uuid": "80a5972a-4d91-4fb1-9ba5-8885edb472d9", "comment": "Malware payload", "value": "8befffad725c6897e311c6aaf667966e070a890a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948327, "uuid": "3c034813-42b0-4d62-8f12-48ea54e57821", "comment": "Malware payload", "value": "c64b15d3f7f9275298c74b8d23ad39ba8574366e351dc11066d9895683973e92085a92c015482a4b0b74bfdefe4529e2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948327, "uuid": "b31b518d-5c2b-4eea-9ce8-64fc38170858", "value": "T12CA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948327, "uuid": "fb675a24-2871-46c8-8ce6-918597745969", "value": "96:dRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:dRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948327, "uuid": "7fb4ee52-98d7-4548-befb-a422f9a344ff", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948327, "uuid": "c26c08b4-1dbe-444c-961c-be8a4146d247", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948327, "uuid": "2a168f8b-f26b-4995-b033-c0c51c8ccc88", "value": "2be8e08c4042edf6301d47375896032a8d0632e8d9eb025d84fa04256eb72495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74af712-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947845, "uuid": "d5e79b8c-93c4-4a95-9c13-604507b99b61", "comment": "Malware payload", "value": "756d4fc18a48705ad80bb4a4e1087557", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947845, "uuid": "029492ea-9285-44c0-bc15-a7e490b219ee", "comment": "Malware payload", "value": "2bf094b06d80fc58c570a513724c6436740ee5902a0ae4a822ea130348c2e1a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947845, "uuid": "203a922d-d226-49b1-bcd5-fee4cd1e9eba", "comment": "Malware payload", "value": "93b9db311a4fe398793a7d46028309b488bcf591", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947845, "uuid": "d17c360e-f155-418f-ae0d-590390e59a10", "comment": "Malware payload", "value": "f1d628b1e980957cfc42e407f6aee93b39f156e2a89f96028e6814a49ea63763b67fe48bcd56d31bae999f93c80f8d6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947845, "uuid": "8ca9e96d-c8b6-4647-9be4-8f1dcd05e413", "value": "T1C237CF73910738E9E5B98CB4D41425426DAC38875738A3C7BAC871F667EA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947845, "uuid": "25ef3808-de82-45fd-9d65-26899ac12d26", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnae:sXyWSpV+Wu7rI3JEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947845, "uuid": "81627310-c99d-4361-ae33-983266e86b90", "value": 22347776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947845, "uuid": "68962f4a-285b-4104-916b-dc85da6a1d18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947845, "uuid": "e3242be2-9ed2-43a3-aa12-5523f3cb04ae", "value": "2bf094b06d80fc58c570a513724c6436740ee5902a0ae4a822ea130348c2e1a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d49138-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947888, "uuid": "24e8d027-4ab2-4d48-bfde-1ffacd082758", "comment": "Malware payload", "value": "24d3832961ba000cf91030b144fa1ddf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947888, "uuid": "bbd57861-380b-4e0a-a8fc-30e707349b35", "comment": "Malware payload", "value": "2d139cfbb868ac0e0517d1b92bf0b0ad2937230bcdeca78f7ac471f4cd0f40ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947888, "uuid": "7508f483-2901-4456-a4fc-2ea7ffa6699f", "comment": "Malware payload", "value": "b106201da8e41d29c2ca88dd5591799ca8a1bc50", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947888, "uuid": "44d58b51-936f-4288-b211-12d840f9fed0", "comment": "Malware payload", "value": "d9a142d84d5ecd5754d2802569f5aef2beece8a4ec860208f351aa8aaf6370eed1ac3d78855e6fb5897aa43416ffa482", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947888, "uuid": "37b21dd7-8ee4-46f6-a48f-c9ee61e5e389", "value": "T136A1F750112C1AB17246697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947888, "uuid": "9bb28949-1cd1-492c-9ecf-5005703319fe", "value": "96:nRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:nRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947888, "uuid": "d5d49d94-3304-4a85-bf3c-6d46fb507143", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947888, "uuid": "a129b6f2-0137-450a-8162-8c5e5bbbfd61", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947888, "uuid": "2eda49ec-eed3-4820-b662-8ef20761dc61", "value": "2d139cfbb868ac0e0517d1b92bf0b0ad2937230bcdeca78f7ac471f4cd0f40ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64532de3-04af-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657938686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938686, "uuid": "5055de62-23f6-46da-bf4e-9feb24e9468a", "comment": "Malware payload (Mirai)", "value": "1ec8f8fb34f7822406c989735b143dbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938686, "uuid": "2d967c55-48a3-4b6d-af6f-d106794260c7", "comment": "Malware payload (Mirai)", "value": "2d65963025955df9a27d95f143b04c19c554aca16714a27fd6782e76e5da97e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938686, "uuid": "46bc07da-62f0-42c4-96d0-2d14c407457e", "comment": "Malware payload (Mirai)", "value": "7aad039cc559fc6b85b6ffd7833bfb5fafeaa87d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938686, "uuid": "b98b260b-64da-43a2-8b39-8dbf2d1faba8", "comment": "Malware payload (Mirai)", "value": "61b680c5bdae75d190cd7937b8a817af086e336db16b92f04e5f0e1ef15592b6ee06ef29459bc13709a87ed1f5068daf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938686, "uuid": "915dec4a-c4f9-43ff-8ee1-fdb09eef421e", "value": "T1825318917C829A2AC6E4237EF67E118C336173E8C1DE761BCD248B157BC961F0DA6781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938686, "uuid": "6bf0f8c6-0e1a-490d-a723-8d8869bf35a9", "value": "1536:vqcvdoNjhdpa6uyyGqJxBQNnOx+d40SsRdpSSfo:Scva7dpaTyyGUQAYvdp/fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657938686, "uuid": "3258725c-1b22-4d3b-872a-f628a1a357da", "value": 64876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657938686, "uuid": "f3e1f33c-3e51-4f9a-8f05-5d23e1716cfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938686, "uuid": "1e9bd984-857f-4123-90bf-ccd80330b831", "value": "SecuriteInfo.com.Linux.Mirai.1232.5041.5267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9795ec35-04e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1657961106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961106, "uuid": "7e60f9ac-d219-4950-8c34-088a248a1e42", "comment": "Malware payload (DCRat)", "value": "c4dbc9344895b9239988bedd275b26c6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961106, "uuid": "208e11c1-150a-4d99-b1ce-7e3df0e8c963", "comment": "Malware payload (DCRat)", "value": "2d8725f006b338282b13ddbd00d6c49e93e9f2c7d3d2b27cecfd91a0018032b7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961106, "uuid": "467231de-7e2c-4fab-9cdb-80d73d39577b", "comment": "Malware payload (DCRat)", "value": "cdc29efe8f20f0ff01917fcfd7e0206664b850d9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961106, "uuid": "f0ea6839-d7bd-4fcd-8e90-874b9a041379", "comment": "Malware payload (DCRat)", "value": "bfebb8d6668492a15b70a24a919e1b8f9a2433644e2c377a898fec71e71817fca6020d0e1161f54f25b22b71c55fcab6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961106, "uuid": "191c8cd7-f531-4319-b189-7fa40e18e757", "value": "T1FD74A8D832147B9EC867CEBD89B45C65AE607C67831B4103A15336DD9A3E9C7CF21CA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961106, "uuid": "03ae685c-ab91-45c4-8b1d-60d6333a936c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961106, "uuid": "1f06b1d6-9842-4a49-91b2-a4fcf2267ab2", "value": "3072:TSzKn21B9I9D/aZ74I7Bsuxthb0PTvSlpY:ezJI9D/aZ74I7BsuxTbk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961106, "uuid": "7f6b5cb1-9de7-4e83-8cad-b65143976b33", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961106, "uuid": "6151478b-e240-44da-8c95-7443d9f431b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961106, "uuid": "3304e4ab-4773-4880-b534-82aec23e4453", "value": "c4dbc9344895b9239988bedd275b26c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a821a6-0507-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1657976434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976434, "uuid": "d51c5144-c5c1-4a71-b008-732860aab93e", "comment": "Malware payload (AsyncRAT)", "value": "a879d301f62e2d8266bcd8529f27a27b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976434, "uuid": "695683b7-2a52-4158-bd57-962c8fcca63d", "comment": "Malware payload (AsyncRAT)", "value": "2dc5fed97dbfc626b8c515cd52ae6d35ec9910a026981938b98ae428338e50b7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976434, "uuid": "c0f20eee-f65f-4d1f-90f0-e76ed53028a6", "comment": "Malware payload (AsyncRAT)", "value": "1d8db774ad666b70360244af02199b028a08768e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976434, "uuid": "d11b317f-96bd-42bc-be6f-d39e68b03a85", "comment": "Malware payload (AsyncRAT)", "value": "e0181c5a6e9809e4cc333b3d814b0bdad7cef95cbe0094b376770a1c4034f5daade6e295f262e95063e0b7810855647a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976434, "uuid": "915b932d-cb08-4e25-a1e8-f7d661e7aa20", "value": "T11C245B1073ECA322E73F9B70F6F58511A57171822A46EF3F89C402EE19537809E6666F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976434, "uuid": "1fadacf8-9422-4828-9a90-5a6963418646", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976434, "uuid": "d56326b3-d245-4622-87a0-cd40d3474681", "value": "3072:vd4w7oE+tErUYYYmip8kPwc8F47dDuIB3vGsx9vO3vGXO2v+PPnWm3e+XefevWH4:1T+tCUMmkPwPF473E+ZmI/8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657976434, "uuid": "43e51f82-29bc-4f78-94b3-4525e7fcb2c7", "value": 225472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657976434, "uuid": "7817cab1-e6a2-407e-b330-b4b80c04db53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976434, "uuid": "0320ea59-17a7-40e2-a10a-97c07086f65f", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ad8015-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948456, "uuid": "b16917e1-9307-4513-84d6-e8646382ca27", "comment": "Malware payload", "value": "b718e22746be4d2beff69dc900a82f87", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948456, "uuid": "ccb3700a-700a-4ab4-9bf8-623e3ef1f8b7", "comment": "Malware payload", "value": "2ec7bed6a9faa7fd68315fdf30286bdda30ff55ef191118b259ce6fabb4f95b4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948456, "uuid": "af6fb49e-b44c-4e41-92de-e86cc14b20f5", "comment": "Malware payload", "value": "883b2e5367b0b32616878a2aff5050b3b881d67d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948456, "uuid": "f7110c63-ae8b-4df8-8b0f-f3918b307aff", "comment": "Malware payload", "value": "0889c1e2474e9b4e4692a3c1599e726a4a44953c226550f98d5a08611f0101ae2676a651c58ce4b4eb0dba198de6cbc2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948456, "uuid": "5aac27b9-e7ef-4e11-8c02-fb0fa317fdf7", "value": "T1193186C722964D743DF1B927326D4501B5C8E1C656CBAF9AB8ED3CE865CDD087444E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948456, "uuid": "4316f8e8-977a-46dc-9eb7-7f3bfff803c1", "value": "12:q0F2M0FF1X0FPfX0Fay3dX0FYdkX0F7xfVFqSp0FLbznX0FGU0Fv1cKX0FAzKX07:vMFuMaOGYdks7draL/nsGd/sAvxuYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948456, "uuid": "f3d801af-842e-4298-905e-24a4f13846af", "value": 1645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948456, "uuid": "91ebdf24-8d3e-4ef7-9e7b-ff7ee7fb6246", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948456, "uuid": "9474bdb6-a4b9-4927-af23-007fe5890e2d", "value": "2ec7bed6a9faa7fd68315fdf30286bdda30ff55ef191118b259ce6fabb4f95b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4e2d5a-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948206, "uuid": "a4f556fa-7e30-4392-857d-863790c47374", "comment": "Malware payload", "value": "cbbbaa03dbbf1368086f290fbb115f8b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948206, "uuid": "7856f17d-dcef-460a-a5d9-7491d33a7a1f", "comment": "Malware payload", "value": "2efda858a5122efd2ef8d3314c7633b1358da07fe83ccd46673bb0ba98cdf007", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948206, "uuid": "9cef13b0-b9d6-48d5-85a4-81d22bea2218", "comment": "Malware payload", "value": "d28e2b267c9ba0d2602f75865ed429832231b26f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948206, "uuid": "cf0e5a2c-38c7-4ef5-a606-95b6a8a2fd9c", "comment": "Malware payload", "value": "ba49fa4b1ebfb4030a137fc3c49a3978fca93ca0ed1733f7138bfeb5685ebb73fbf84ef45638413e60c39f244121fca1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948206, "uuid": "1fdc90da-74c0-432a-82d4-219a3a731939", "value": "T11701A8CA8035297450138F5DF197C56819B482CAE3FB3A967BBA223E4C4A9113FFC695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948206, "uuid": "973eec4e-8b3d-4d99-8f51-7996a5d3fb56", "value": "24:KlYYfxaOofYfxB9Yf66Yf2DYfdbQYfLk7WlYYfLD:9YfnofYfdYfPYfIYfWYfzWYf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948206, "uuid": "0d10d07b-68f7-48b6-b2a9-2d76321aea08", "value": 841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948206, "uuid": "0350e8a0-f161-4de3-9c74-def2b12de0a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948206, "uuid": "81b3c736-f702-4074-a5de-37c727cc66d5", "value": "2efda858a5122efd2ef8d3314c7633b1358da07fe83ccd46673bb0ba98cdf007", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24bea98-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948373, "uuid": "3a10b8df-7214-42f8-8022-ed88ecc9d848", "comment": "Malware payload", "value": "33adc89ba66ecad94ec02ad1b602b89e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948373, "uuid": "2d5406d8-f8a9-4326-b739-6b3acc3721bd", "comment": "Malware payload", "value": "2fa328394a620c8504329d685bf426e2ad1ae50a975d18ba0037840d29c715ef", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948373, "uuid": "bace1941-4195-4307-bea9-975ce0c991ce", "comment": "Malware payload", "value": "c314d8e46c7823563d7a0c8fa6c76c0b64dee129", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948373, "uuid": "14c9562b-0c54-473d-9b6a-0638f38c1f63", "comment": "Malware payload", "value": "d19984be9f65f2d006c7269bc6188417922bd132b025498de0825e262db8114b477e08c9d0e666334f31f9e202f504fc", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948373, "uuid": "225b866a-6072-44b0-9377-a589fcf76b4d", "value": "T15C65330821FA7CC4F9AB453926631C94C3B932F2D4157099378C08A656772FE63DEAF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948373, "uuid": "88e6a897-0b07-426c-be73-712721f7d14e", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLLT1mtPQwNDk2XD1h2VYRflg:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948373, "uuid": "9d3ac32c-95b3-4741-b8fe-afe35518c767", "value": 1409024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948373, "uuid": "85102a96-0743-4752-9e4f-9ecc5ba414b6", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948373, "uuid": "54be13f9-7519-45e4-836c-d498f65a9c8e", "value": "2fa328394a620c8504329d685bf426e2ad1ae50a975d18ba0037840d29c715ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b93615-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948049, "uuid": "a884d70e-0b7c-46de-be8f-0dd3ef4e9cf2", "comment": "Malware payload", "value": "c253cec4f6cebf183f33b1430ffd292d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948049, "uuid": "11a8c20a-1030-4873-bdc7-4b8a82524f76", "comment": "Malware payload", "value": "303ea996a7d031a7a817c2bb19c0d712d77615ef96f0166133666ee772b6010c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948049, "uuid": "310687c0-4547-4a62-89cb-bdb14078f50d", "comment": "Malware payload", "value": "c38856f0206d0c8f3fe79148a5f0ffcffb5211cd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948049, "uuid": "bf4ec811-e516-4956-bd5b-dfa82a3422a7", "comment": "Malware payload", "value": "b28323b9e41f48a7a1e10e0464f9cfdbd0664d7e17220ec6ef2d97373bbdcb752d62247aa83d60599e356da8c15df5fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948049, "uuid": "6cac2092-f909-481e-ace7-cf8a7acda329", "value": "T1F5A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948049, "uuid": "35cfa9a7-655a-4bff-83bd-614d3d34a834", "value": "96:sfRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:sfRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948049, "uuid": "7c19d7fc-6dd7-4cc1-8f16-51f440ceff68", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948049, "uuid": "1bf4d6bf-6014-49c5-a66a-45eff41450cb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948049, "uuid": "a7d2bada-67ed-498e-a73d-b9a2bb76fbbb", "value": "303ea996a7d031a7a817c2bb19c0d712d77615ef96f0166133666ee772b6010c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc84474-04d9-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1657956712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956712, "uuid": "84777ce2-82ef-461f-8629-f3c5ba5ce3e0", "comment": "Malware payload (RemcosRAT)", "value": "12785bec495b5f7e1ec3fbbcb7698e8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956712, "uuid": "2b690b11-62f0-4d48-a13d-9dbb28992dce", "comment": "Malware payload (RemcosRAT)", "value": "3057379eba331db590b3215082fd564dbb9a649a68aafa1b7c529475fa510337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956712, "uuid": "738fff62-5dc7-4a47-9dbe-5b3ddf5cf93b", "comment": "Malware payload (RemcosRAT)", "value": "8f0833f216394ba43b2e60865351bd1999fc21cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956712, "uuid": "c8d04a36-155b-44cd-a90c-0d765bc66c41", "comment": "Malware payload (RemcosRAT)", "value": "8318956338ca264bfd3384f870d3734cfa6376f74611241fb2115cad69c10d47dba45d3bf3f31f30b22891cfd95d63ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956712, "uuid": "6e5eedd4-66a4-45da-9278-0bfc94406165", "value": "T1F6056C55E2E084F3DD6A063C8E1782E4E86ABD102C2CD9476BE83DC96FF869134275D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956712, "uuid": "0ab81e69-0108-4538-a246-7797ec00bb30", "value": "077780b656ccb18d86eb00528cd56a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956712, "uuid": "dee19854-b0ea-4ca6-b1ed-abcb200da507", "value": "12288:wmgi3VtzPY+ji70/Gm23P+SraklRm9Q266cY4s6JBCbRJDT:wvuPY+h+hP+KaklRm9stY4s6JBCbR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657956712, "uuid": "73643b0a-72cd-4694-a023-588e06270cda", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657956712, "uuid": "7cf8e98e-f91f-4d0d-87e2-b41d6fd742b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956712, "uuid": "34865e9a-4400-41a3-a421-aeeabaa77c01", "value": "ALSHAMALI AUTO43378,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20533346-04f6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657969066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969066, "uuid": "1449d79a-c7fd-4410-946e-19fcbb9b267d", "comment": "Malware payload (Mirai)", "value": "916c6fc2384414c5171429394a07e671", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969066, "uuid": "34f6e2b8-52a4-44c5-87aa-50faacf646ee", "comment": "Malware payload (Mirai)", "value": "30995bf43c0422742551055ad99e4d74149960fc37a80984ba8a89d3b59798e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969066, "uuid": "34993662-76da-4704-8d29-c244c7553d4e", "comment": "Malware payload (Mirai)", "value": "cd357009d7e631b7c25b7a03c9319cbd2025486c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969066, "uuid": "76deb948-b957-434c-92e4-1f01729eadb2", "comment": "Malware payload (Mirai)", "value": "1ee0cc2d671b03116a826bde56e951578cb532064c2dff2af066c7728f5c99c880210a6ffc0adcd5f3bb4b3127eae5b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969066, "uuid": "5e8ecca7-712b-47c8-ac15-7c1ec65c475e", "value": "T192C33C46EA408B13C4D51775BADF42493323E754E3DB73069918AFB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969066, "uuid": "64215651-e721-4bad-ae36-34ca5fa9395e", "value": "3072:d8waJxrSMpaAgswpNB2uicE+8fCM/9ggC:d8DxrSMQAgswpNouC+86M/9ggC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969066, "uuid": "cda9d0ca-282a-4eff-8b84-265610f3914f", "value": 124912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969066, "uuid": "4d7ade10-3730-460f-8eb4-f32f3282ab7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969066, "uuid": "b3dc3ab6-9497-4117-b650-e8c1e4aa4e90", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef87f3c-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947992, "uuid": "4f0560dd-88fb-4103-b1a4-93d395724eb2", "comment": "Malware payload", "value": "7d501fe43fac2e3135aeeebb0dbc642f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947992, "uuid": "7ab04079-aa57-4be1-a899-6c57b81466c6", "comment": "Malware payload", "value": "3213b75fc4fac68a9dc5f14c0c9add3b91366b14d87b7bf5ee80325d0099eb92", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947992, "uuid": "5b461f1b-246b-46d5-a337-1a61f9b9b6c2", "comment": "Malware payload", "value": "199d86baaa41d1c6e5ac56dcde21bdbdc70d2d4b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947992, "uuid": "96176e72-bf75-4ac0-999e-001d55aff9fe", "comment": "Malware payload", "value": "7dfb725545848cd9e4b607092a7d83e08c89e17ce848579ef99cb5aa4245e3fa34186a7e77da74bff5b91411647dadf5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947992, "uuid": "d6089113-1928-456c-9469-ba2e994b5b61", "value": "T18FA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947992, "uuid": "f18c86e1-4ad8-49f2-a702-616039b27a08", "value": "96:8RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947992, "uuid": "6d327a28-0beb-4859-b4cd-53aef52e9134", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947992, "uuid": "3815fdf2-ed9a-4b51-bb8f-5ec8be3d5ce4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947992, "uuid": "1213dab0-e253-40c5-b2c5-f9fa1372421e", "value": "3213b75fc4fac68a9dc5f14c0c9add3b91366b14d87b7bf5ee80325d0099eb92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01ade66-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947913, "uuid": "3a45ea8c-2b34-477a-984b-f636a54c3f37", "comment": "Malware payload", "value": "cdcf8198adf500a803ed93c9103fff5a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947913, "uuid": "e6471e3a-c257-456e-ba9d-f97eb20bd8af", "comment": "Malware payload", "value": "32256b94ae1f0d2e4cc7efb7608aa16a8c4445a067416828846553137dac7aef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947913, "uuid": "57c47970-2638-4541-a16e-594acbccb05c", "comment": "Malware payload", "value": "a647909ef9d3e606e1bfb7a604d7e6ed4eef85d2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947913, "uuid": "d7e64708-ee8a-4d69-b1f7-2d37009a8695", "comment": "Malware payload", "value": "978a223ce8ca0c94f1a1ffd2adc2ca48e401136728e88597af422d67ecc76b2eb8815dfd6e78d2eece40e409c1a402cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947913, "uuid": "0e4aecd0-9f04-46e9-a346-9946ed9f6867", "value": "T13D418B8672A148B46EA0B8EFB26A4C8436C0D0967CC95FF45DFCBCE549ADE9474307C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947913, "uuid": "44c3fb2f-2510-490a-a0b9-4d7971e25ba6", "value": "48:v+b0hE+oJdelFkKPwLJKbK8d+UNuVLMJW4LT2nH0oX:vaGFkG+6KGWLWW4LT2nH06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947913, "uuid": "c21d3d83-a248-495e-acb4-71d99434cd56", "value": 2302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947913, "uuid": "a1620ddb-0608-47f3-a551-d04c7bfc6371", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947913, "uuid": "da6318ad-0244-4d52-a816-05b3bb0d1396", "value": "32256b94ae1f0d2e4cc7efb7608aa16a8c4445a067416828846553137dac7aef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54192c01-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948108, "uuid": "7be57ffb-0751-4bd3-b36a-9eb2ba389da9", "comment": "Malware payload", "value": "03c49c7c5e363837d253911e8634db6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948108, "uuid": "a7401b96-50c6-4766-a376-55d26dab4112", "comment": "Malware payload", "value": "32567a04fded9c89d15c31114d1e3358a25f4d3b439696283df24e8642b6d5cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948108, "uuid": "8972cd0b-6d55-4eef-8db0-775c3159d25e", "comment": "Malware payload", "value": "39f931917c796f80844db40f7ee578fddf462220", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948108, "uuid": "37188a78-95cd-4abf-b4b4-e65ca737579d", "comment": "Malware payload", "value": "da210dc76c70d48439001ed103785a474e04f2e3690d98b7aa0351f95901a0bd382ac1996cf398f8da8b669f15711479", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948108, "uuid": "a7286105-41be-4270-9295-af06cc3c8ee3", "value": "T19567DF7791067CEDE9B94CB4801015816DA87C875B78A3C7BAC871EA66FB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948108, "uuid": "1e91aecd-ff9d-4df7-917c-bd6c1e7cd794", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaZ:sXyWSpV+Wu7rI3JEPfR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948108, "uuid": "cac66b29-f459-4171-ae89-ec368efe353e", "value": 29786112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948108, "uuid": "4127570e-2ef7-4533-a224-38ee883a6053", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948108, "uuid": "f3b6c974-7bc0-4e7f-a12d-b97d0ba4a514", "value": "32567a04fded9c89d15c31114d1e3358a25f4d3b439696283df24e8642b6d5cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95778f26-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1657971410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971410, "uuid": "277cc460-e2f1-4971-823f-a1fab554214f", "comment": "Malware payload (njrat)", "value": "7f068ae324d0578616c287469a9436e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971410, "uuid": "68fc8347-50f7-44ba-bba4-dff7ac1ce90c", "comment": "Malware payload (njrat)", "value": "3291ba9ffd2a48aacbbf745828466c4d0b087e8f2680bd0b43edc1e613bf2d58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971410, "uuid": "a4069ebe-ba0d-48f0-b754-7ab618f00139", "comment": "Malware payload (njrat)", "value": "524809a62eb126ca160fb221afcad6ef78d20883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971410, "uuid": "daf9d24f-aacf-49bb-a8a0-1be7a07dd89d", "comment": "Malware payload (njrat)", "value": "9590d6699818ea62bf14e336ef04e63d2a610dac9f63e5f9afb8a05ca1a7bd68961eaf62857e66671ee70290132943f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971410, "uuid": "79c44999-e66f-4091-a2ee-96ee6ef6fe9a", "value": "T1D8033A4D7FE181B8C5FD067B05B2D41207BAE04B6E23DD0E8EE564AA37636C18B54AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971410, "uuid": "0c7c2228-8911-4bda-a12c-d0c98ce94b32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971410, "uuid": "83eed36e-1e6f-4568-9c36-3e4ba2a35d37", "value": "384:dVgYIiejrCVLO309QmykrtyCNEKZf8v+WPYcrAF+rMRTyN/0L+EcoinblneHQM3r:PBdGdkrM8F8GWAcrM+rMRa8NuoRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971410, "uuid": "9523c73a-de7e-4811-bc35-18b5ab3ed426", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971410, "uuid": "5b180c93-22c3-43a4-a02b-daa105be09b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971410, "uuid": "f421726e-05cf-4206-b41e-5697a0634cba", "value": "Server.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dee3a42-04da-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1657957036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657957036, "uuid": "8ab98341-94a1-4b64-a4f0-2aed2d50ee97", "comment": "Malware payload (Formbook)", "value": "e58af2a6066de23eefd0e3ad1bad837b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657957036, "uuid": "ec9e9ff7-c3ee-4f31-bd4a-8b44e75a9ede", "comment": "Malware payload (Formbook)", "value": "32da92eae98332ce43ab78ea434dca4d13c950384bc75055e76fa6a51c3eaee4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657957036, "uuid": "780dab5d-1acb-4c5e-8141-8617d3ddb081", "comment": "Malware payload (Formbook)", "value": "73a405d8881f939c2a64be06b181eb283cf98772", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657957036, "uuid": "f3c6fbca-13b5-4f15-9c20-d2ee44853285", "comment": "Malware payload (Formbook)", "value": "95ba9af8b1c17bfb8ac9666acd9c67690f322e51458827703c20a6007b2204114f719a32da783c83abc680bec429ed4e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657957036, "uuid": "42427c9a-1553-45fb-bb02-ea2c09c9802c", "value": "T1DE05337063110E45A6FF17F9D4C7E8E5D1631AC130A629F36A383D9A8A0F34CDE4AA5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657957036, "uuid": "fb031304-461b-4ecc-a74d-daa8c18c63ca", "value": "12288:BCTVki3ph7wgduWhyb3ZyDC/cAx4des6o1GwGuWo/w2RCCiYFN6pl6CI3eHpXBMW:2l3H8VWQrZy2EDAwFwCCCpFeI3KYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657957036, "uuid": "8b7760f0-88fb-4cd0-b90a-8bd5ec58b04c", "value": 811432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657957036, "uuid": "8b8e0ab1-225a-4acc-b9d5-259db2812b8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657957036, "uuid": "c5c95d20-c25e-45ca-a3ae-a53978f65c96", "value": "PRO-FORMA INVOICE CONFRMATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2438f56-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948320, "uuid": "e4c507f3-0415-452a-b518-6df9247d2297", "comment": "Malware payload", "value": "cf4787e72ad718d96cd7109c8a2f5b60", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948320, "uuid": "88a264c2-80de-47a0-a64b-6290a7019c9c", "comment": "Malware payload", "value": "32f132f711519c25fcae8a356874eec52f87390fa94357b4511d19b46c095aab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948320, "uuid": "1ff8f27c-3efc-4fc1-86f2-f28ba1409122", "comment": "Malware payload", "value": "811ff4cfc35b89deeef40912e3af75ca4276d6bd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948320, "uuid": "4b9d59d7-ae18-4790-afd8-7f44fbc1351a", "comment": "Malware payload", "value": "51e3fe5ddb348f3e5a1d80c708ee479b5f1c392e71b41a6378ab3771f5e911ce187a5672aeb5bd6378b3ceea4775b54c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948320, "uuid": "7c47ae3c-ea40-4e9b-b619-25fae70ef4c7", "value": "T130A1F750112C1AB17246697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948320, "uuid": "bef933aa-9d93-4e40-b6fa-c55556ae9c3c", "value": "96:aRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:aRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948320, "uuid": "2782731b-72c2-4551-b548-f75d62b738ad", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948320, "uuid": "c05f6fca-a44f-4b23-abd5-d24be0fac526", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948320, "uuid": "5fde7e70-cb4e-4629-ace2-df5df52a814f", "value": "32f132f711519c25fcae8a356874eec52f87390fa94357b4511d19b46c095aab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fbf09c-04c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657949744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949744, "uuid": "5f3d8a09-9fe6-47bf-96fd-b7f25d4fe00e", "comment": "Malware payload (Mirai)", "value": "dadb59e0a365c7cb04d9c88002a48e80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949744, "uuid": "1e8cc56a-6c5a-4792-85de-420522b54ec8", "comment": "Malware payload (Mirai)", "value": "33e816236b29e0d71e9cd32febdd3e74d6ed6bd0eb2a09b13e2e34269e2d1e7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949744, "uuid": "c69ff68f-73a6-44aa-9e82-baa76f8ad345", "comment": "Malware payload (Mirai)", "value": "4446f3fb09d1b4b04acee9fb3be4c021fc712d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949744, "uuid": "7a949c5e-5f12-4e20-9d70-ac7c8e185dd0", "comment": "Malware payload (Mirai)", "value": "9fcbf61ca43fa3433d7d758cb65ebd589c0006f84d1833506da379aa626a51eb6ae32e811d4038a469b256dc58270ffc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949744, "uuid": "7cd012f9-7511-4767-ba37-137ac6f3ba28", "value": "T100934C06F8419753C1C327B6B7CF47093B3667B957EB330266386FB02BC67991A25A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949744, "uuid": "3594a422-d9f7-4106-99f1-c6042d0aacb4", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZye5hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjjq5hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657949744, "uuid": "313c3dc3-b849-441f-a06b-614e8b0d5847", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657949744, "uuid": "2b6a5854-acb6-47a3-b7ab-bd51027e21a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949744, "uuid": "64cc255d-c969-4673-8406-34431926353b", "value": "fuckjewishpeople.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596f13ab-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948117, "uuid": "278a32ea-2be3-408b-943b-a1009700392b", "comment": "Malware payload", "value": "8ea3d4005b57065e0fdcc59f58b2891e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948117, "uuid": "98b2f530-1e2d-48e6-820b-67a1127e4298", "comment": "Malware payload", "value": "352945ee3a066e3fcd2b9bdd42eeb06af35c368f7adb36a0fe4872338eebcff0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948117, "uuid": "4ba9af85-4157-48c4-b594-5962990fe084", "comment": "Malware payload", "value": "f92242f79e3daa5b4cf0cb44b37667725e43e05b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948117, "uuid": "4d2a349f-035d-40fa-9f1e-764ae68ac7a5", "comment": "Malware payload", "value": "21f5f30732a03bbe9060464b8536f41ff77d9d72fa002fadd48be832ef1087b12d039461f6bb54d2b8d00d3d927d7f4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948117, "uuid": "b1b6373b-e102-4423-9d30-a02553ee0cf2", "value": "T1B133F640F5DEC0B0CC62BEBA109D7796AAA97D2A403C9A7FE7F4A650DED7501F09910C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948117, "uuid": "f700a0e9-9d7b-4959-b527-06312782fd39", "value": "1536:CxglGVFdh5ZM/HCj8F9+BC90u2ru3PIfNH4qOB06GrZ9gBD:CyQdhXM/28F9+Bru2ru/cNHDOB06s9wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948117, "uuid": "c2c16d8e-24cf-4bc9-9375-6d89f97dffc0", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948117, "uuid": "d2383639-5937-4eb7-8154-e0b929563b06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948117, "uuid": "15039279-9c69-434e-af19-58eba404d3ff", "value": "352945ee3a066e3fcd2b9bdd42eeb06af35c368f7adb36a0fe4872338eebcff0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449eed60-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948511, "uuid": "b99953d8-0d93-4cb2-96de-f6a8c42f684a", "comment": "Malware payload", "value": "2290c8ca49da9c6049e2df4ac9126586", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948511, "uuid": "2d9dea17-ec0b-441d-8e90-2e647857dcef", "comment": "Malware payload", "value": "3533bb18cf1cd61a9d16ba42d321f5e765b7bd54d23480c69fbffddcf583f681", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948511, "uuid": "319a3f60-b5e6-4bf7-8e1c-dc25fbea4584", "comment": "Malware payload", "value": "fcbbe382563e824bce3e52a2f5885aff78c33b6e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948511, "uuid": "11a4ae5f-3108-4f96-aafe-369e6622e103", "comment": "Malware payload", "value": "b799bbaf5f4ee6dff690822d035b46bbf79b0b708446f03c260a843a1223b89730014ea365081a5cebc64544d7d08110", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948511, "uuid": "4d6893d5-2648-4f37-acc9-0f646ad0a906", "value": "T12CA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948511, "uuid": "fc3fa307-0e8c-47c6-87d1-d9a0fdc3475c", "value": "96:VRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:VRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948511, "uuid": "0d0091ed-ca81-438f-9bb2-f69dcff1a8d1", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948511, "uuid": "f04b5493-b3b9-442c-8aad-4424d106ee2b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948511, "uuid": "8d56f59a-3c37-4432-883c-e3899a101a4a", "value": "3533bb18cf1cd61a9d16ba42d321f5e765b7bd54d23480c69fbffddcf583f681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5029c5c2-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948531, "uuid": "9f9ae1b4-0f31-4bb4-8c98-0de27d1615cc", "comment": "Malware payload", "value": "e3f305a400a3962812365c9e6fa371cf", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948531, "uuid": "97c38587-9d08-41cb-84e2-f2c82e70b294", "comment": "Malware payload", "value": "355ec0e6ff14321e0cad308b14e72aea7d28a2dc67cf95e84ddb8395a0efc872", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948531, "uuid": "4cc8e4ea-9d17-4c71-a627-3eaddeaf087a", "comment": "Malware payload", "value": "48f1e8bf6ae412d5c6c032b33874716f1c1b5602", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948531, "uuid": "25288fe1-e5a3-4743-bad9-8a25d2444af1", "comment": "Malware payload", "value": "bc674978610322aa801fb151505ed4e9efe156aa27def865d9ee654d545d385479e5b1080fa2c5e7040d9289605b9be4", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948531, "uuid": "926af6ab-ea9e-4f4a-8c16-84d122f439db", "value": "T11ED5330C03BAB8FCF89A062927638DD1C5E921F1A58255F2D67C19980C3F97E17DFA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948531, "uuid": "f200cbaa-6363-4a0e-b7ba-b89423d26f5b", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4k:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948531, "uuid": "116d39fd-6678-4172-a387-d6ef23b1e4e5", "value": 2977792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948531, "uuid": "648dd116-4d7c-4109-bb05-ecfa2a3cdbfa", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948531, "uuid": "f51ce30f-f93f-45fc-951d-f043a7707b45", "value": "355ec0e6ff14321e0cad308b14e72aea7d28a2dc67cf95e84ddb8395a0efc872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b4fcc7-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948438, "uuid": "2eb112c8-90cc-4455-98d3-442be965f812", "comment": "Malware payload", "value": "f52253d60ca6d50be234f05fa95f325f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948438, "uuid": "be5652ff-37fd-4459-97d8-e315e546c745", "comment": "Malware payload", "value": "35ae9238d266c9eb1e19cebecd560764a4b5bb5a567b1c2fdb6ada74d03466d8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948438, "uuid": "eb987018-2fb5-4b9c-8549-48b803666814", "comment": "Malware payload", "value": "c5474d3c647951f8f26afd6ed054a18b95966405", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948438, "uuid": "39f7986a-f150-4541-b91b-45bf86a18727", "comment": "Malware payload", "value": "7328f1a3e6f1c89b9eab31160a9d30757cb1054e839f113994e6490ed507370ad0c2cd2dfb64e0f67d8a3d5f8e388cec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948438, "uuid": "f528baaf-60cc-46cf-957b-d27c8fb6c1f3", "value": "T14CA1E850112C1AB17346597AD26FFA52B50EC81B097B7B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948438, "uuid": "6e35de72-1c96-439c-8f6f-8f3c721bb207", "value": "96:jRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:jRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948438, "uuid": "a995bf6d-0d13-48e8-8567-87e257ac4862", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948438, "uuid": "6114d07d-559d-4740-92b8-ac53550f8871", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948438, "uuid": "89db6ba5-2efd-459a-bdf3-ab2fa2b9e4d5", "value": "35ae9238d266c9eb1e19cebecd560764a4b5bb5a567b1c2fdb6ada74d03466d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c081396a-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948719, "uuid": "07ca2a84-dbb8-48ec-b24f-4a6a3fa4d39f", "comment": "Malware payload", "value": "fbcafbc413b43e660c6a55895ad95f47", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948719, "uuid": "32f6cdac-e54b-4433-9a48-4b318f499442", "comment": "Malware payload", "value": "36070f44cda0764e42f46c19aa5753e68ca10f7ae1d9dd19cf3399c6c00e4783", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948719, "uuid": "1460f074-a725-4a11-81cf-33a4cd70bf6c", "comment": "Malware payload", "value": "6f5a9ff36ce8cd242dcedce243471c22e371f952", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948719, "uuid": "36da9f6d-d854-446c-a32b-e9d300d2e807", "comment": "Malware payload", "value": "e4c97c180a80b345d11e7e3e127b1f79f4035418b357846d805468dfd6bfafb4d0fc818ed211b239c1fde631896d238f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948719, "uuid": "5d0d2ab9-9069-4739-b638-34f7aed84d77", "value": "T167F5330C53AEB8FDF89946293B6348E0C5E852F1988261F2D77C19980C3F57D1B9FA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948719, "uuid": "6ed7d4a5-d383-419c-92f0-6f3018efba10", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXT:0XSxVJG2fLAqFOfT9sMY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948719, "uuid": "5122ce0e-6748-473a-888d-f57caede46ae", "value": 3342336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948719, "uuid": "2dce6dc5-81a6-4dc2-b161-a936e2245243", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948719, "uuid": "9cbe6b3c-7034-4186-aee9-42576b22c767", "value": "36070f44cda0764e42f46c19aa5753e68ca10f7ae1d9dd19cf3399c6c00e4783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4406532d-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948510, "uuid": "3be11dd2-d5b3-4e8f-a19a-449569a021c7", "comment": "Malware payload (Panchan)", "value": "547a140c3022fffce277cb59505694a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948510, "uuid": "5727baa5-742a-4457-8e63-176993de57dd", "comment": "Malware payload (Panchan)", "value": "36ba96ef595a7a6c8a7010f44f51751231fc521279f6d5715cab8584075efe9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948510, "uuid": "e6389330-0381-47e2-a4cf-bf977e4b20eb", "comment": "Malware payload (Panchan)", "value": "955c5e04701d99e6ac8439d449034f21b7827c12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948510, "uuid": "a431e20b-5d29-49ad-b50e-46bdbc438cbf", "comment": "Malware payload (Panchan)", "value": "2210c0bf1540171274ebe6fde677d21a3d249e11f4bc8bd4f356db55ff5831f5b9491bf9e8ef9fe107d9b7929072a0a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948510, "uuid": "43219a69-e5c7-4714-8347-a6227029c40c", "value": "T19927CF73910338E9E5A98CB4D51425426DAC38875738A3C7BAC871F667FA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948510, "uuid": "d8953c68-ed8c-4126-a6b4-e2de37127846", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaD:sXyWSpV+Wu7rI3JEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948510, "uuid": "04b9c74c-c3a4-4a3b-b4e5-0fa588d30e65", "value": 21528576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948510, "uuid": "4338e3d6-27b1-4bc7-9835-a1cb151291d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948510, "uuid": "36ffebbc-0ad3-47cf-965e-fc8b41b0f842", "value": "36ba96ef595a7a6c8a7010f44f51751231fc521279f6d5715cab8584075efe9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f33999-04e5-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657962018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657962018, "uuid": "9d4591b2-8ae4-477f-b011-239034fe161c", "comment": "Malware payload (RedLineStealer)", "value": "0a7b2d9e0b68786b932ddccc23f2046e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657962018, "uuid": "b08840ae-6293-4c0c-bd99-bf878bffe889", "comment": "Malware payload (RedLineStealer)", "value": "3767f79cd6257b3e746fd6b5d251932676a28d958f19334661c4db8113a140bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657962018, "uuid": "dce02ef1-5f1c-4e3b-9109-36ca7dfb84f9", "comment": "Malware payload (RedLineStealer)", "value": "c15199d4a6543d23e31f55d440acc8fc763cda29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657962018, "uuid": "837f92f8-d3d7-47b8-b3b0-4d85bcbe627a", "comment": "Malware payload (RedLineStealer)", "value": "1fb9a7777a867695c9cbcbd49acaa2f7d19e92ad31c8e360f6fc769e42eb9cdb562d9d47b0a1cbffab5b8d733e1192c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657962018, "uuid": "6caa0312-30f3-442a-95ba-efc71c81afee", "value": "T1BC94BF10BF90D434F5F752F489BA8368B52E3AA15B2551CB62D52BEE1B346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657962018, "uuid": "88b19005-14cd-4279-930e-4d91c2c24f20", "value": "149733ffc6fb8cb84df8287483828e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657962018, "uuid": "591b08b0-98ed-4b34-8747-38f101dba6ae", "value": "6144:4GyLWvy8ZFUHzNx/BrIJjH6nKIpcj9xKyM7Jtbu8K87060rwOpofVtE:4v6vV3UTNFBrIJjH6dErMNRuA50ML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657962018, "uuid": "200ed656-a53b-4199-9ba3-5aab6b255b4e", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657962018, "uuid": "a960c094-10cf-4d36-ba6e-a13651c92e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657962018, "uuid": "5c0e948d-dc60-4e50-8bf6-9201d788a4a4", "value": "3767f79cd6257b3e746fd6b5d251932676a28d958f193.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e619a8a-0515-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1657982431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657982431, "uuid": "d3654c27-d162-4334-87a1-e3e0118b4c13", "comment": "Malware payload (DCRat)", "value": "b17e4b7c723cb371a2105c92d794f1dc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657982431, "uuid": "a1165943-d93d-4d7e-bb67-0c84f4908b3a", "comment": "Malware payload (DCRat)", "value": "379d308f95e7962dab8ca1e639e31d9c6ac4bcd823fc150968dd296241b4729c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657982431, "uuid": "c31b7035-58d9-464d-a0d4-25833c2446b4", "comment": "Malware payload (DCRat)", "value": "3544ec36a1f75b4a127b4ebcdf0c3bbb1f83beae", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657982431, "uuid": "c535c4e2-7fba-4b79-a62d-aaaf9fe9dd9d", "comment": "Malware payload (DCRat)", "value": "084ebb1c6ebe5826ca6c718efded016c48da1aee09f64d2fee72677c8c70830a65ca945349de9419615594452f177b5f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657982431, "uuid": "5fb8579b-44dc-45c8-806b-e833ed7f3228", "value": "T17B0508027E48CE91F8081277C3FF45484BB0A95166A6E32B7DBA376D16163A73C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657982431, "uuid": "ea2f7133-8dc6-48d4-a1ea-c54ffd944ea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657982431, "uuid": "271c10eb-31da-41d6-a6d7-43e5d3503976", "value": "12288:wlonOp40dqj7KtIltlRrpm72cDsZC/75yuQM0ktRPXKruQS7moUU6Z:5Op4Cqj7KtGJrpm72cJKwRyU7moAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657982431, "uuid": "2f9be6c2-519f-43d2-b906-9604f0041490", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657982431, "uuid": "9684f3ab-cc65-4148-905f-d1beb9ecf5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657982431, "uuid": "4073e41c-a662-40ac-b2e4-049841bb27f0", "value": "b17e4b7c723cb371a2105c92d794f1dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a438fe8-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948440, "uuid": "0e6fd88d-237d-4810-8007-a12642102d5c", "comment": "Malware payload", "value": "ba342870c1eb3379476c38788d8f874c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948440, "uuid": "3d72bbb4-7367-4564-b705-3baac8239931", "comment": "Malware payload", "value": "37efba3ebc1b55e4af16c7934a393436cf8904ebd0a2321c3265b66dc4e6c61c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948440, "uuid": "df70e446-6b3a-4dd9-b04d-a9f2f93b8687", "comment": "Malware payload", "value": "d34c9e4b1a53b631c496a5c7d2edc406bb7622bb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948440, "uuid": "7d33b3ce-a5b0-4f6f-ad64-0d7b59baccdd", "comment": "Malware payload", "value": "7e2e662fac4d474b3e9d1d598fb10ee11e24d00581f76231ca4ec034c15b8ee4091f01ed392e008f56e6c516f7f03782", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948440, "uuid": "6c307ed2-eed1-4510-a937-63eb2afe6413", "value": "T130A1E850112C1AB17246597AD26FFA52B50EC81B0A777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948440, "uuid": "b77320e7-bd8a-4328-b9fc-6715db005255", "value": "96:PURYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948440, "uuid": "8f92728d-35c0-4601-aa94-40e544bbbc06", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948440, "uuid": "4b6434f6-fafd-4df2-9cb5-71a8cfd1a6a5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948440, "uuid": "f9e7a8b3-f688-43b3-8542-d21a8af96773", "value": "37efba3ebc1b55e4af16c7934a393436cf8904ebd0a2321c3265b66dc4e6c61c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e126f2e-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948500, "uuid": "b774fc10-d016-4474-a4a7-3e02b4d84f6a", "comment": "Malware payload", "value": "b08826ba1123c92a48b807d57e72384b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948500, "uuid": "6ed41419-bb30-4f02-b8ac-9aedda26bbad", "comment": "Malware payload", "value": "38736e7d69412990cde8a507adf4978b3556d89567e92281fbc6f756c16dfdbc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948500, "uuid": "17fbcaad-a709-4685-9e9b-918da280086f", "comment": "Malware payload", "value": "5baf7abf138705dc34d488cd6d2a4f1980469209", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948500, "uuid": "cab4cabe-b6b2-4ad1-a46d-49c4474cdfe0", "comment": "Malware payload", "value": "8b982f733aa651a5ee5eba285c6235719d29e879fb3c5ff84dfeeeb4f52f52ac1d81a6792c93e6a31a15f85f299529b3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948500, "uuid": "924c6d40-436b-4d48-9a14-e02cccf00d74", "value": "T1DBA1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948500, "uuid": "ecb0ef08-8ce6-4949-9913-605025adbd98", "value": "96:tRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:tRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948500, "uuid": "9d5889e4-5ea5-40b8-a0b9-ebc764c51edf", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948500, "uuid": "fddab005-b22a-45ca-b044-8d00c62717b4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948500, "uuid": "d57936b9-6d62-432b-9052-e59a86962ccc", "value": "38736e7d69412990cde8a507adf4978b3556d89567e92281fbc6f756c16dfdbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7b88ed-0527-11ed-93bb-42010a9c0043", "comment": "Malware payload (Babuk)", "timestamp": 1657990345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657990345, "uuid": "ffdf791a-6c5d-46d5-a9fd-650527adfb34", "comment": "Malware payload (Babuk)", "value": "7cdc8057b3fe13b069b8db93fdde1764", "object_relation": "md5", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "Darky Lock", "colour": "#10BF2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657990345, "uuid": "1cf888fe-eafb-47dc-b52c-92f35957683a", "comment": "Malware payload (Babuk)", "value": "393a7a313548a4edc025fb47c6c8e614ecc2b41db880ecb59f20cf238e9a864c", "object_relation": "sha256", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "Darky Lock", "colour": "#10BF2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657990345, "uuid": "6be9253b-8305-4a06-aa05-08f25a80ef2c", "comment": "Malware payload (Babuk)", "value": "8ddd3c69fe3935e4903a2b397bc6f0de772a1bcb", "object_relation": "sha1", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "Darky Lock", "colour": "#10BF2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657990345, "uuid": "34c786fd-8b24-4ebd-b6d7-d3fb8bae75ae", "comment": "Malware payload (Babuk)", "value": "8fadb4f0f466db449854233c3f2b0cb0ac3956522b5e4908a1ca72dd0ba84c23c6d432ca20aa47c552115c0ee27942fe", "object_relation": "sha3-384", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "Darky Lock", "colour": "#10BF2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657990345, "uuid": "4e97ea9b-6064-41c6-a462-87ed871997f2", "value": "T1C4933C10D884E2F3D9E629355697F19EC43923310335A687A7C0276DF7902EAF629F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657990345, "uuid": "94d9b355-aff6-4a7e-8114-d012b4edc526", "value": "202fa14f574c71c2f95878e40a79322d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657990345, "uuid": "8a8ca06d-fd0b-4749-9e39-b9870e0f570d", "value": "1536:y8JknEUnj2zfGN2/PEiTsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2XsfzK7g:ynlnj2S+hTsrQLOJgY8Zp8LHD4XWaNHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657990345, "uuid": "d6a46277-110b-4524-8847-4e613180e345", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657990345, "uuid": "dfd07b9f-10ce-4a61-99ff-7fa2ebd568c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657990345, "uuid": "b1dc7acf-b59e-4785-9de8-38207cdfca80", "value": "393a7a313548a4edc025fb47c6c8e614ecc2b41db880ecb59f20cf238e9a864c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff9063b-04c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657949953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949953, "uuid": "8afbbfb0-ba22-4339-aac4-895de5221437", "comment": "Malware payload (Mirai)", "value": "dd5489b6e8938d8ce36dd9f60a276a31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949953, "uuid": "4242c927-9d32-4974-873a-a35c84c4f083", "comment": "Malware payload (Mirai)", "value": "395e48fb8803dc63b93a0b1c44fe3cebbe6bcaaaf68daa1d9ac622d56710f5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949953, "uuid": "4f34eb28-375c-489b-b1ec-56be043a08d0", "comment": "Malware payload (Mirai)", "value": "ff31ba4133d3e3906500f15156a7a4ec9d2f050c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949953, "uuid": "ef648f32-9a26-4b31-b2ca-0b918853b873", "comment": "Malware payload (Mirai)", "value": "173334f72b4a8a456ff88c5a099b9a1178b0d0c1605e1164932b1d55ebc6cbba2ef6632502c3b4cd75eec5a9e26906b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949953, "uuid": "85734717-a160-4982-b08e-437ab80a0673", "value": "T1F7234CC5A447D9FCEC190A752177EF319AF6E93F109CD983C398AD72E942602E5072AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949953, "uuid": "1e108932-8a90-49ac-bcf3-f4ab39c88e4d", "value": "768:Ii+liNWE5NttVEi4Ws5BkbVTco8UxfIWfd/0I6SDZkEAo:IiK25NttVEi4WszsVTcewWV/0I6OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657949953, "uuid": "52a2f340-6c78-4d4e-b18d-7ac97b723738", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657949953, "uuid": "d945cecd-0d1d-4f9a-8a79-be426464b377", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949953, "uuid": "23be00cc-d5f2-43c4-b4fb-f511fbd13e7c", "value": "miraint.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d0c1c9-0500-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657973715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657973715, "uuid": "7e107077-eb20-4ded-9bb1-359d2f3d645f", "comment": "Malware payload (RedLineStealer)", "value": "597e181a98d14ef1fcb13ca23ed7a0f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657973715, "uuid": "79f54504-9f17-4106-b4bf-bedad3f6eb53", "comment": "Malware payload (RedLineStealer)", "value": "39eaab17f5339d91f09c2cf49512fbab9d14ed45914af5e7f417ff8c1410ae26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657973715, "uuid": "146456ac-fd33-419c-ae72-4cde94831e02", "comment": "Malware payload (RedLineStealer)", "value": "c857e5103e883e7740c455e41fade89e2015d1af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657973715, "uuid": "2e7fd500-9485-4bca-ab7c-a7091ca8f0ed", "comment": "Malware payload (RedLineStealer)", "value": "829db054d1d1e4f301061324b9e8ad777c2199532f5d8018421a9179b2678d7091f454e7d1fe9bf191fe307a4729f0ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657973715, "uuid": "7768a173-c6e2-4a2a-bb3f-286ecca54c9d", "value": "T18794BF00BB90D435F5B752F44ABA8368B92E7AA1572454CF63D52BFE5A346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657973715, "uuid": "8ef13fca-329c-4fb7-bfce-2a4c65aad336", "value": "3892984e5e028f5bdbdaa78cf9025ca8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657973715, "uuid": "5a64ebf9-57b7-4193-8499-1646d4a0fcf5", "value": "6144:y97Xp0hvQZzJdbp2gjobLPftRzKtODOL7j/YON8ciSUkpmHm01adu:ydZiQdTbM6obLPftO577YaLWkAta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657973715, "uuid": "455675f9-afa5-4df4-abc4-10df96751917", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657973715, "uuid": "ee29b9fb-8b68-46f9-80b4-399925aa0ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657973715, "uuid": "a9287ba1-0886-4bbf-89b3-19c0fb6ff6b2", "value": "597e181a98d14ef1fcb13ca23ed7a0f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da447ef4-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948333, "uuid": "78565980-75b3-4aec-85ef-0769bf488fea", "comment": "Malware payload", "value": "52db783deb7c5b3f6d378736cfa14212", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948333, "uuid": "cc73b674-49af-4089-9420-c11e8c3219ea", "comment": "Malware payload", "value": "3a5b2d5835981e349daac0f5fd18bc26a6b033ec28bfacff628a6ad868a04cc7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948333, "uuid": "939d1bf9-d53a-4529-9530-ae445f3ab69d", "comment": "Malware payload", "value": "6049dd87c26e55a212436ea1e6af05ce1659c958", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948333, "uuid": "b4dfa498-7a76-4443-88b7-7e5a548d6177", "comment": "Malware payload", "value": "8a5c85e65c73f0c953757ad1917eeb226bc04f1ff27926837c886fdf0d11cc481f41cbf849038a38f1fcad92e116745b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948333, "uuid": "603e8b92-341e-46b4-b215-3ca3a4945e75", "value": "T1FE416DD4227237F27DFA16532329481731C66039B996FEB45CD878F45C8FE4722841EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948333, "uuid": "5a7c6671-7841-4a23-b35a-05dcde643d47", "value": "24:Ij1kk6cKxP9ZJMe9Ajr9ROJU9qFNE5o1kf:p5j8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948333, "uuid": "bf9f0c53-11db-4d91-88a7-c0401e6491a0", "value": 2047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948333, "uuid": "d423915f-19db-4733-b433-af433d441943", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948333, "uuid": "5f2ae18c-e5e5-41f5-a297-bdc6e35d04a3", "value": "3a5b2d5835981e349daac0f5fd18bc26a6b033ec28bfacff628a6ad868a04cc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e1d989-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947837, "uuid": "c9470b7a-4c5f-4ec5-ba1c-fb4cdf71bac6", "comment": "Malware payload", "value": "a8a6ecc032ffbf484a892b1b7c2ffa1e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947837, "uuid": "e1dbd0f3-1570-4d65-96a1-cc0c0bbb317f", "comment": "Malware payload", "value": "3a84fc07007f5d44529c96e30b78f3961a6a63c1ea886f747a75973a9732df49", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947837, "uuid": "891e7632-d43d-4f30-8bac-406ea2786c62", "comment": "Malware payload", "value": "f7e31bcfc9fb05a969864c7bdf322e296e6d70e2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947837, "uuid": "fe3a5534-5bc1-4bb0-bf9f-d961bb8ee962", "comment": "Malware payload", "value": "dabb73ea4d81f6c73bd58b5fad0d076b2c88ebd494f960fe2d66382ddc0c1ce31e6adbfb80b48f8f7ec3fd7054809a3b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947837, "uuid": "3d4e57d4-3fb9-47b7-9c07-dcc77cf33f79", "value": "T142A1E750112C1AB17246697AD26FFB52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947837, "uuid": "cbe1b707-c7ed-45af-8254-7b4645966a50", "value": "96:HRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:HRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947837, "uuid": "157f8d1e-270d-4420-8981-b1bdb7ea59c3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947837, "uuid": "9852ecb0-f51f-4207-b2e7-478dbf66ffd4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947837, "uuid": "14b77595-9187-4cc2-a549-e0105430a3ad", "value": "3a84fc07007f5d44529c96e30b78f3961a6a63c1ea886f747a75973a9732df49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b35fa1c-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1657971340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971340, "uuid": "194786bb-1b87-41a2-958a-3065b7bb7aac", "comment": "Malware payload (XFilesStealer)", "value": "9a06f45dca4a7b2a33d8396668b24a9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971340, "uuid": "8d2a2c59-7363-49ce-85a9-07a2d84947d2", "comment": "Malware payload (XFilesStealer)", "value": "3aa99c37e500da2e0bb7ab879c1f50839f10c101a3ae1c735da0e52e7601e01d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971340, "uuid": "a544f5bb-1034-4928-8ef6-8f0e78023a48", "comment": "Malware payload (XFilesStealer)", "value": "934d183b91bae0f72af53aea48afed15016507c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971340, "uuid": "b2083ffe-126a-4b79-a1fe-0a37dde08049", "comment": "Malware payload (XFilesStealer)", "value": "a6ea60d702c7bd16cd86980bcc760570b7888c0eecdc3f9f8f65b463e3ccdbb9398b6a6fafb1c4d55f91edd4a48767f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971340, "uuid": "7c0e3c44-ba19-4126-83c1-76679e1a54ef", "value": "T1D4364C741148E20DC9BDADB7CDF1C8A5BAFF90C220159CAB91B3446785B6D3734398EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971340, "uuid": "e656f997-259b-410d-9d43-0f9d994b4dcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971340, "uuid": "7dd4c7f4-6da5-4287-8d22-adc4820f8ebf", "value": "98304:tnrHztkv8r41Ndr5FCAAa0PqmqQhNTBA+OTLzrxCr:RrJkv/3kdqmqmjA+OJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971340, "uuid": "8d42abb1-76a0-4d26-84d3-671fa4226e61", "value": 4938240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971340, "uuid": "aeae875a-072d-4940-bee2-58dff9f24c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971340, "uuid": "137e70b6-961a-4bc2-9564-8020617078f9", "value": "558957d6-9173-471a-9d5b-39453e677d3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1f2cca-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948496, "uuid": "00869eb9-a796-4ac9-9053-957ad1e1e42e", "comment": "Malware payload", "value": "a1d88c178e247170679e5373022ecd2e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948496, "uuid": "398242ce-9d97-41db-a949-d3ad5c664eb8", "comment": "Malware payload", "value": "3b7673232c616a8778976288e872bd27a101d141e56eef8590287ed8f7fef26f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948496, "uuid": "f4729dde-df86-4ff5-9e3d-46e2952f3f29", "comment": "Malware payload", "value": "d2c857ed5fffadc69384c44a85f93c5e712ee9c2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948496, "uuid": "7c793047-9b1a-4ee6-97f6-2b8d948daf5a", "comment": "Malware payload", "value": "edc8d134f205f19ef23408d734d2e5fa53927bbd8036e3211656b281e8e2a18603b09cba10ab3b6a96a5e5bdde8463d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948496, "uuid": "be80a9c7-7d6c-4450-b6f9-8cc5ea62588d", "value": "T14AA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948496, "uuid": "80a65f15-5653-4652-b4c7-351e035e45b3", "value": "96:iRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:iRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948496, "uuid": "9893a2f3-948a-4dd5-b70f-9975034ec94c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948496, "uuid": "ec186f8e-619a-4b17-a960-6a13637071dd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948496, "uuid": "d5c3944a-48b7-46de-a8c3-fbeb54c0ad55", "value": "3b7673232c616a8778976288e872bd27a101d141e56eef8590287ed8f7fef26f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbed851-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948309, "uuid": "b8d83020-2639-4e5e-9168-a95b2b8d834f", "comment": "Malware payload", "value": "92d3bfcef0b87711657678a2bc6f670a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948309, "uuid": "fd4e9778-7466-4f63-a0e5-e3056c89c49d", "comment": "Malware payload", "value": "3caf56456acc2dbc5cbad8b0302c21d1711abfe939c6466b129d15338919ac0e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948309, "uuid": "1ae874c8-77f4-46e4-b48a-1546902c8994", "comment": "Malware payload", "value": "8b734c57c5c1cc5a89814e5c7e98fc787498a37a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948309, "uuid": "a98cd056-487f-413c-9d4f-cf2723b8424f", "comment": "Malware payload", "value": "8e2ad1eee57a73a4bf0cedc569eb73927a76be17f9325bfb9f9a78f76b34c68dea34a715cc61c9bd57a829a009f3c7ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948309, "uuid": "c20234f7-f540-4ef0-b8eb-3835493d892b", "value": "T14AA1E750112C1AB17346697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948309, "uuid": "ff1b4b07-036b-4ba6-aa2c-3b02b6660524", "value": "96:ILRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:cRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948309, "uuid": "09ac2141-6809-4a6e-b87e-17f8a40ab054", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948309, "uuid": "826381f0-8518-4fce-83b5-00aad1edc64a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948309, "uuid": "183166c2-1b58-42d6-8b4a-cd805082eef4", "value": "3caf56456acc2dbc5cbad8b0302c21d1711abfe939c6466b129d15338919ac0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6265f67-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948756, "uuid": "47dee123-4e3f-4315-b634-2d6d6413d243", "comment": "Malware payload (Panchan)", "value": "87307f489f179d58326261d18ef8034c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948756, "uuid": "315ab16a-3df1-4169-94af-f7f4ae8daa2d", "comment": "Malware payload (Panchan)", "value": "3cbadddb305fc13ef3ba2b52c9f4bf9be086afd0785b2fc87e0539abf6930a4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948756, "uuid": "2248561e-5ad6-4372-a3d7-02f12415d7fe", "comment": "Malware payload (Panchan)", "value": "7824b15754e5b4d3924e5adbaa0fa345cd64711c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948756, "uuid": "fa2e432c-45d2-4d8c-841f-ee808f3fd7c9", "comment": "Malware payload (Panchan)", "value": "85784683d72ed458e442cfc8a790bb06de78c16fe2c4f0763156dc0ea0c32bbf47d5e812a0f03208eeb239136030df35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948756, "uuid": "5ef727a8-b0f9-4817-8f99-73f2afb7957c", "value": "T1E937CF73910738E9E5B98CB4D41425426DAC38875738A3C7BAC871F667EA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948756, "uuid": "408738c2-f23a-4205-bc14-06110d4581f0", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaN:sXyWSpV+Wu7rI3JED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948756, "uuid": "c9af11dd-cc56-4262-951e-0dbe8b772bbc", "value": 22675456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948756, "uuid": "4b159b7d-6ab0-4d65-854f-443269302c97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948756, "uuid": "bb501bde-87db-4ebd-94be-4ee828b08987", "value": "3cbadddb305fc13ef3ba2b52c9f4bf9be086afd0785b2fc87e0539abf6930a4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fbb3d5-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948593, "uuid": "db708528-151a-4504-b711-01e5946ec9d4", "comment": "Malware payload", "value": "550d7fc47226ee525be8677d6901a18c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948593, "uuid": "a002bf3d-ac04-4847-a2d2-466f788269a5", "comment": "Malware payload", "value": "3d1f17bb5c23983e19d65a2a0167fd0ded4b26feccb5c1d81ff8b78df99245fe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948593, "uuid": "6e5caf64-d18a-4a6a-a5dc-ea0e2393fb2b", "comment": "Malware payload", "value": "565339f50ef0b22ced9408ce3a20c981216b0f6b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948593, "uuid": "27607163-25c9-4325-9548-c3bd5c10d0af", "comment": "Malware payload", "value": "d73a75701148791e53f826dd0361acc59eada6f7b9cdd17e856fcc4430c45182c37fd013f31b7fc7bd64351cb3a9dc55", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948593, "uuid": "cdd0e57b-9576-4533-9f4e-d59f9181b5a5", "value": "T1C5A1E850112C1AB17246597AD26FFA52B50EC81B09777B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948593, "uuid": "d7f1b58f-e34b-49ef-ada4-a37c1e27f815", "value": "96:pRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:pRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948593, "uuid": "03257dab-d8c2-4972-b71a-5e6824d6f6ab", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948593, "uuid": "5845fe3d-4b41-4cdd-a82f-8988d2dc5d5e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948593, "uuid": "899b348a-13f1-44ed-b7d5-85c4a5194550", "value": "3d1f17bb5c23983e19d65a2a0167fd0ded4b26feccb5c1d81ff8b78df99245fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9347c23b-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948214, "uuid": "d21209b2-40b7-4095-b6f4-4d67ade5ebef", "comment": "Malware payload", "value": "27a298f5bd2c4f69e04ef9def9809c93", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948214, "uuid": "6eff9c3f-8982-448c-b6d1-d8e6790fb94c", "comment": "Malware payload", "value": "3d3855a9f1f7d6edfbd0627db6e49ddb8ada50e2d5bf8b6ef704bf51f8f06cd4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948214, "uuid": "fb0f4f7e-0c0f-4e13-9231-17c74104dcc2", "comment": "Malware payload", "value": "b00d3376dbd8d9524cbab3ad52378b597d6b6c75", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948214, "uuid": "24e75d16-e3c2-44ec-a3a0-0115e4a1388a", "comment": "Malware payload", "value": "aee29b367f1df16a69e44b22889e0c7dabf516f32d0eaedbe1b82a25e1d34c9b7bec3efc4454a091e8e3fbbaf99fa03f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948214, "uuid": "d301daa4-163c-4a03-88b4-86a45bdb14d6", "value": "T10C42D8AEBA20DE311D11D9B70795611C6866908B04A3B99C7B0F783C7B5BF9870784DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948214, "uuid": "06d7b8fe-3e3a-4429-b704-f746d0e4b828", "value": "192:f2Bi6PgM8PvaA0Rj1veSS79YtGrwck3Pkfzh16zPE7AvZSzgVgIbcd7vjjB4C1v8:f2Bi6PgM8PvaA0Rj1vy7CmKwUUIgXdjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948214, "uuid": "3453b757-6f66-4143-adfb-5da5885bfac5", "value": 12003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948214, "uuid": "f18a20fc-33b0-40b4-a5f6-451f5a7dcbb4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948214, "uuid": "06bd1940-8e95-4073-a73a-f10c1335d8e7", "value": "3d3855a9f1f7d6edfbd0627db6e49ddb8ada50e2d5bf8b6ef704bf51f8f06cd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cf1b1b-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948076, "uuid": "6ec81f2f-e26b-4995-97ea-5a2303aa230d", "comment": "Malware payload", "value": "4345ec695c1faf963290eb9fb1fe26ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948076, "uuid": "33b08dd3-133e-4edc-83ea-6b05e77b9d99", "comment": "Malware payload", "value": "3da95f29c4fcb47e91ebf73d4c61e33c2df52f55eff9690dc6d5042deae5f8df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948076, "uuid": "a471b506-291b-4a50-82e3-05194e3ef12d", "comment": "Malware payload", "value": "d98744c408720cf394faf7a6f447edd94f0c9f91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948076, "uuid": "c5d4c370-65f0-48cc-a0dc-c8e85cedcf75", "comment": "Malware payload", "value": "8d9e27b202b0120396ef14fd962bbb2ff1139c95096b197ef94a151232a9edfcd40124a871acf378c4478a2d54af7288", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948076, "uuid": "4ba7e996-0b7f-4ce5-8d0d-113a19da0acf", "value": "T181E69D73910638E9E5A98CB4D11425426DAC38875738A3C7BAC871F667FA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948076, "uuid": "69b0db63-6fc3-475b-b220-f02231c7f87e", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaq:sXyWSpV+Wu7rI3JE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948076, "uuid": "99e820ba-c64c-40e1-9f59-e812c715cf8d", "value": 14811136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948076, "uuid": "f1843746-520a-4fb8-a20e-c0b29bd19add", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948076, "uuid": "ef77e15e-c32b-48af-bff6-31199b5e9722", "value": "3da95f29c4fcb47e91ebf73d4c61e33c2df52f55eff9690dc6d5042deae5f8df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca745110-052f-11ed-93bb-42010a9c0043", "comment": "Malware payload (DanaBot)", "timestamp": 1657993833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657993833, "uuid": "c84a5603-829a-4a17-9027-7ae16875dd87", "comment": "Malware payload (DanaBot)", "value": "0148d6c2e66d6bbe2fba2d3a8519062d", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657993833, "uuid": "c67ee23e-d577-419d-aba6-f6a038a0e5ca", "comment": "Malware payload (DanaBot)", "value": "3db3fa9c6911d2585a4de4aee63a9755639f20ebdd7322ace60326b2ea04cb23", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657993833, "uuid": "1444d7a0-72b8-41aa-bd84-977073b02f65", "comment": "Malware payload (DanaBot)", "value": "065ec47b9e8d70f1b9bcf8059243821015cc2d5e", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657993833, "uuid": "c49aa610-1c13-44b8-8831-66b10ec683b6", "comment": "Malware payload (DanaBot)", "value": "766f2a4a6d525121bdfc869b8a8392aa1c94edf4d56f5cab9a360d9d634a395caa9e617ef00135a1ee0816895d6aebe9", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657993833, "uuid": "a3b3ef24-70ea-4ed7-91b6-f3244f5a4433", "value": "T1E2563314A9B1A034E4E5D6B4C4EEC395FAB2BDE12B7294CF61D413E81F70BD0A871782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657993833, "uuid": "3860b15a-70c8-4f3f-8694-7b18e5e701b3", "value": "e40d187c9305b8e1a4c2b8b45c147ade", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657993833, "uuid": "0877c562-2912-4a56-be5f-64831a4873c1", "value": "98304:R8obcorLkFNxZa+rjsW1kbyBMAOfnUrr/CpYNk/Hq948ZyehPVcHQKFv8y:jbhrCTrjjidU//6/qPVcwKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657993833, "uuid": "8a123df3-c57f-4c7e-8b89-1959890109ca", "value": 6216704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657993833, "uuid": "087d5b1c-afc1-4ac3-a043-027c375b3cd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657993833, "uuid": "2d4a4514-9109-49b3-8997-9a8bac736a69", "value": "3DB3FA9C6911D2585A4DE4AEE63A9755639F20EBDD732.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe73de84-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948823, "uuid": "fe463728-7b3a-4748-8fb6-6822743255df", "comment": "Malware payload", "value": "d7c69e65245b9228b67a821e502d341c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948823, "uuid": "2515af24-9758-419b-9131-dd65a8747b20", "comment": "Malware payload", "value": "3e9780af85d35bda20e78c302af3f95606b6bee38d71444c10b0db2777f1fc25", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948823, "uuid": "fa7ef00a-fdaf-4c6c-a837-f85a8eac0718", "comment": "Malware payload", "value": "facf623db9d13d349a2eb18898e5b2863f761f3c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948823, "uuid": "915b23b9-4561-4f42-93dc-5734447353bf", "comment": "Malware payload", "value": "d6efc0bde166aa4016a9091118d7e149cb1a47e28215be869ad88acc865f9aabbfb24b36d8b3e28c050e9f72a62a6331", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948823, "uuid": "61053025-60c5-477b-8870-edad01203e51", "value": "T14F5151E8356136B43CAF98AB7F6918153280D0F5ACD16E4574E8BCF479CEF0562841EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948823, "uuid": "d939e312-3bdb-48b4-8e84-62db80fe3470", "value": "24:Ij1GcNWic8iEKWcZvScdXc76bcgY5c9VcLkcflxcdgcBUc/lPcVXcOCJcvXeole8:zIzKWUau5UOTSfbuak+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948823, "uuid": "f53bd582-287e-4256-9ab0-e644e2d1259d", "value": 2875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948823, "uuid": "39cab879-03aa-4db3-bafa-d6a342a8b89a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948823, "uuid": "9b8d4d52-d22d-407b-8486-1f0e1d01aa79", "value": "3e9780af85d35bda20e78c302af3f95606b6bee38d71444c10b0db2777f1fc25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0620c6be-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947977, "uuid": "64782e2e-f7a9-4b0a-88fb-0f2a81cfaee8", "comment": "Malware payload", "value": "78868ef4525799174ba190d8f8868235", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947977, "uuid": "c858a928-a423-4295-83c6-22e46fc90b55", "comment": "Malware payload", "value": "3ec69443a21c691089cc6bf212ac71edce717be2111156e93df1469475a48a6e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947977, "uuid": "f549c1b7-eb45-4bec-b059-d48f081b5430", "comment": "Malware payload", "value": "a9e8ead5f4b085f5329045769460f1aea38e0c04", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947977, "uuid": "00adcd79-0a94-420b-b66f-3052deceea2b", "comment": "Malware payload", "value": "6d35ce74e362f16ab6476dc0d48dd1cd96534a739b818bc96ca39fd56a388f9c1ec2b91fec131ee3668c767ffd7e285d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947977, "uuid": "1da426bc-aa79-4938-8140-892af0889753", "value": "T1B6A1E750112C1AB17346697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947977, "uuid": "15a3d42f-9b9e-4f44-a140-50908bed77c5", "value": "96:RRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:RRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947977, "uuid": "5388271f-febd-4bdf-be8d-327e1a8eee74", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947977, "uuid": "1947d90d-cf93-4977-9681-e72616dc3c50", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947977, "uuid": "743de50c-654a-48cc-aeb6-ab3428bce09f", "value": "3ec69443a21c691089cc6bf212ac71edce717be2111156e93df1469475a48a6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63504fe1-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948563, "uuid": "50628455-189f-4779-983a-3327cdff85ba", "comment": "Malware payload", "value": "f649f0cf73a443ce7c7a1273d7491239", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948563, "uuid": "1cb4310a-cd10-4c1c-99b8-08b35a1cb62e", "comment": "Malware payload", "value": "3f2f7a11717199040735c6b95f15ad461d48ef54d7df16d77d3ad43db1ebba62", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948563, "uuid": "75fbf8bd-dc60-43f1-a36b-e51774331bfe", "comment": "Malware payload", "value": "8f415523b61bbaf5578839eb9156f53f3d21d636", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948563, "uuid": "b899b38c-617e-4306-8e2b-9c4eeb898d7a", "comment": "Malware payload", "value": "c714f43ec7ee7ae0a61ad94a54e3a84afee549382c937aa5271b923edcb3cb6357a719db5f8fac946f9b57a1cae85bf0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948563, "uuid": "aee7ceca-769f-4f32-af91-5c1bf6d842d0", "value": "T100515D80B1617A743E66A4DF23241CC076C0D0A67C859FF42DF8F8A449ADF9579A43EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948563, "uuid": "68098251-07d5-4dc0-9b61-bf407991f98d", "value": "48:prwObxh5rwLpoJeeirTZr0rlurfrvBrQrwFUOuyrf+urKr4Ar9rKJoX:9NG3TNOCTvl6Mf1c4KBKJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948563, "uuid": "19a4ec15-1d55-4475-b739-4ec04b44ca24", "value": 2908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948563, "uuid": "307388bf-6ba5-48a9-92be-546c146c9dfa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948563, "uuid": "ebd6fc0f-3fa7-4892-98d1-6fb687c16ca4", "value": "3f2f7a11717199040735c6b95f15ad461d48ef54d7df16d77d3ad43db1ebba62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164459ae-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948004, "uuid": "9d77a692-b911-468d-a984-5ab61fea2275", "comment": "Malware payload", "value": "3e52d3f86d3dbe4edb6dbeafe21379cd", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948004, "uuid": "1abe898f-ffef-4522-9744-da427f4ca48f", "comment": "Malware payload", "value": "3fb377c30d7b9791b67515613c5be9f09c5054c621c93e62a8a54d91cd7205ed", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948004, "uuid": "9cd398c1-552f-4f24-b8a5-8fca53ec3395", "comment": "Malware payload", "value": "01b5933ea0c0460155d468dc8bc92568ef094ada", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948004, "uuid": "8b6f5b37-9d7f-44fc-a7eb-df8dcb4cd8ba", "comment": "Malware payload", "value": "d48d0ba8ef2e9b5617e28525293662d96b0e0fea497a197122ced19a5413efd98e6623ec7c7e9572aa78b01c722e75e9", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948004, "uuid": "f30b0573-cf99-40a2-85d8-7bd518250ee5", "value": "T1EB95333AB0FBB9B83545B7F64940DA3476F6C34A75FA37222FF89CC6A124106B671058", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948004, "uuid": "2abcdef2-531d-4c69-b61b-2c7c7b885df1", "value": "49152:ijoGN5J3sAs+aa8d6q3RKNhvqa87NXcHnSySdkOFOd+Lx:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948004, "uuid": "991b33a6-e738-461b-8e5f-eff259037d05", "value": 1966080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948004, "uuid": "51a2fe21-e82c-4151-844e-c3105c0b6ee5", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948004, "uuid": "6e312e37-a1f1-49e4-b90c-7374e2002d90", "value": "3fb377c30d7b9791b67515613c5be9f09c5054c621c93e62a8a54d91cd7205ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc4fa1c-050f-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657980014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980014, "uuid": "98bf7fae-287f-496c-b3d4-6c26d5490d6b", "comment": "Malware payload (RedLineStealer)", "value": "1bd4a186401f0a61f50c99e64a3d6089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980014, "uuid": "30d6655a-d202-4367-91e2-175e44d2195c", "comment": "Malware payload (RedLineStealer)", "value": "40a676f5a87835f162a613a2b072cc6c9067ecd7d661564c7e31982ec82d360b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980014, "uuid": "759a489e-f272-48fb-abad-678719b94900", "comment": "Malware payload (RedLineStealer)", "value": "17e97f10328c6cdebf8c0aa726f449f47073fbc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980014, "uuid": "03d94b0c-5f8f-4e16-b8fc-38dae4a11339", "comment": "Malware payload (RedLineStealer)", "value": "642269e11a6aa9098cde115dc96c0d6a3283ab1712c253aa24c31d952c4f377d48130af34dbf97ac320d45d872daa9e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980014, "uuid": "9f1dca89-c7ca-4fea-ad9a-e8d631397440", "value": "T1E8648C10BB90C035F4F712F44ABE9378B52E7AA0572854CBA2D52AEE56347E0EC3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980014, "uuid": "4f418323-14c2-428c-86e2-059697f36877", "value": "363debf0ff85eb6df1e94b75eacd8b61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980014, "uuid": "a0c26cdc-ae3d-43b2-97b1-ccfd270bd929", "value": "6144:ws/EWZoYx+zOIbO8wgRWwTR/1gxtc00jyG2l3uS15Z1mPc:wYnzeFbcEfTR/1gxtCyG2l3R15Zmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657980014, "uuid": "9d7dbf27-4854-4f3f-b4f1-94e617d2cee3", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657980014, "uuid": "ca3c45aa-5da1-4824-b6fc-d5ab84271aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980014, "uuid": "1efe96d3-c35f-4dee-83fe-00c927f64a31", "value": "1bd4a186401f0a61f50c99e64a3d6089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8b7327-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948444, "uuid": "29d3c8c8-ab8a-4392-95f2-db1289387207", "comment": "Malware payload", "value": "65957f39b59b19888ee94f117c14280d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948444, "uuid": "06027f73-cdc3-4455-87ce-69eb903e4dc7", "comment": "Malware payload", "value": "40e826169563cd43fceb518e69e24f41ab3ac91f84af6fe4d42b1e02ef37b1f6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948444, "uuid": "b0ea8c7b-051b-48cd-9f9d-8302b790a80b", "comment": "Malware payload", "value": "38f2f5cd70fc7927e1d7c7442d60211cf17ac7a0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948444, "uuid": "ec228dc1-57e8-4932-9cd8-04ed8e6c5f42", "comment": "Malware payload", "value": "1caac79a1e4487759b78040624263f5bbb88e480784dbe6a791f0e8eb364c523c1a1d9bd3dfdd6ef2e3f5873b15bb73a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948444, "uuid": "42c88b8f-8f73-44cf-9099-6498790c8669", "value": "T15DA1F850112C1AB17246597AD26FFA52B40EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948444, "uuid": "3be84cc1-7660-428c-b83b-784921586c34", "value": "96:IRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:IRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948444, "uuid": "c7d8e6c4-3844-4992-b406-79b6b11ff73c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948444, "uuid": "7ad489aa-8060-487c-8f19-eac83e4a3212", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948444, "uuid": "2292c5ed-f77d-4788-af8f-71f9fab85c27", "value": "40e826169563cd43fceb518e69e24f41ab3ac91f84af6fe4d42b1e02ef37b1f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1731a4ef-04ee-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657965615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657965615, "uuid": "cc44607f-480d-4189-984d-92bcb6ff17fe", "comment": "Malware payload (RedLineStealer)", "value": "a90a18fc77fa135ccb4afbbbf619c2c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657965615, "uuid": "9c9d7623-224d-4b4c-bca2-a4940ff1f95a", "comment": "Malware payload (RedLineStealer)", "value": "41205d7c73b7acf02f1d87b0f8ecd5d2da0b5430b369d6631d2e34463106c7b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657965615, "uuid": "74837a3d-dfd1-4391-82c3-64333f0e23ed", "comment": "Malware payload (RedLineStealer)", "value": "d5b475b2c422c9e917ed8c729f41487a555ef09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657965615, "uuid": "701b2868-164a-4480-b828-5d490d4b9b3f", "comment": "Malware payload (RedLineStealer)", "value": "d63b070a0cdbbc71d56b0940b56bdde4ef9e872341ea42477f1b84117df4ac19faaec16eea176c3e309efc511a974cb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657965615, "uuid": "6ae6fdbb-8ccc-44df-8a8b-989aa29dbfc0", "value": "T18494BF10BB90C434F5B312F48A7A936DB92E7EA15B2450CB62D16BEE57346E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657965615, "uuid": "32387795-ef03-47c7-8a08-27fd59be1311", "value": "19b703097c4f74d6bb1c823ff614186e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657965615, "uuid": "87403ce4-8115-4836-9dee-0c97c1092e90", "value": "6144:a1jqZeivmzGMbHTrg59vUSStg8g6VSNlrTjt886RMeCs+yV:a1WZvmdbzrU9vUSStXVaJKoaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657965615, "uuid": "ce3c2c96-b4a8-4169-b4f6-20ad1f3bec68", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657965615, "uuid": "4c59e820-6bd7-4050-95ac-0c0d2d94101f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657965615, "uuid": "0e0e8b96-64bb-43e1-ab7e-903ee686e25b", "value": "a90a18fc77fa135ccb4afbbbf619c2c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c5295d-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948594, "uuid": "aab61152-c890-432a-b8bc-eec97cb2f190", "comment": "Malware payload", "value": "a44be0d66567396ba4245643e52688de", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948594, "uuid": "28af4fa4-7080-4c80-9504-97a391e86b68", "comment": "Malware payload", "value": "41ac944c69594e25f3e41956621b15eabccfcdd77ca586026b5a7c3c4ff9c112", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948594, "uuid": "11db886e-af9b-4ef2-953a-81575e755908", "comment": "Malware payload", "value": "0b06a2577b430d5a56323fa7adcb483494b0479f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948594, "uuid": "57d18271-ab35-4b0f-9000-76151e078af2", "comment": "Malware payload", "value": "6c78ce0397c3f7f535e4d9ca5f0040679a254448ed3723d2689970b8204f23d84b105bb4c39eec859ae671346781b665", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948594, "uuid": "a0f3f659-a9de-4d39-ae2d-bf24154b3d69", "value": "T16A3192C9215740785DFA9813A4F6860671EAA3B959E52F4DEEFC3DF4304DE047A085D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948594, "uuid": "b593be5b-83e5-4544-98ef-8b2a5b59d9c8", "value": "24:vdqffdqNdqfNdqD9dqJbdqi8NIodqVdqm8dqBdqT+:v6C6N09qfOSZ8Gw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948594, "uuid": "5593cc32-de2f-47d6-83f8-b13155cb989b", "value": 1506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948594, "uuid": "a1fdc7c1-9edf-4c91-a65f-8c6c8e9a75d5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948594, "uuid": "b0185fb2-9162-46e8-858e-3f1997b07ac4", "value": "41ac944c69594e25f3e41956621b15eabccfcdd77ca586026b5a7c3c4ff9c112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1aba1ae-04d0-11ed-93bb-42010a9c0043", "comment": "Malware payload (DBatLoader)", "timestamp": 1657953070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657953070, "uuid": "9255bbbe-bf78-47da-a51a-8d3577ffbc22", "comment": "Malware payload (DBatLoader)", "value": "af3c7998cb1f82022026ef5a0240439b", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657953070, "uuid": "7f1e87be-7108-4c3e-b618-752c784e351b", "comment": "Malware payload (DBatLoader)", "value": "41dbd50dec8697c71e8feea9912873500ae7061955e1331ac9e657041b7b57f8", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657953070, "uuid": "ef5ed265-f117-4afd-9c85-66e73c61a33c", "comment": "Malware payload (DBatLoader)", "value": "406c1c668a6ebbb078bcb9d4916735481f3ca874", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657953070, "uuid": "80406398-b0cf-4dd1-8151-20f4a9b6eb82", "comment": "Malware payload (DBatLoader)", "value": "6a21b91161740b639994901d5d89258503438476fa4d4cc62c3b791f103ea6eed65bb2c7369ed6da879aec59bb959570", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657953070, "uuid": "9ce23a2f-4713-4a35-8237-2a8a7760efed", "value": "T110056C25E2A085F2ED6B163C8D1B87A4D425BD506D2CD8836BE93DCD6FF868034272D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657953070, "uuid": "b7b079ac-6257-44a3-a480-a7c08bc77156", "value": "077780b656ccb18d86eb00528cd56a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657953070, "uuid": "212ee08b-fe8b-47f8-9838-376292f153ed", "value": "12288:wmgi3VtzPY+ji70/Gm23P+SraklRm9Q266cY4s6JBCbRJBT:wvuPY+h+hP+KaklRm9stY4s6JBCbRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657953070, "uuid": "7a14c414-b2c6-4777-8194-8bec18cad81f", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657953070, "uuid": "a4d405d1-a658-43c3-a7cd-e8fcd1d97b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657953070, "uuid": "3890014a-f6ba-4904-84f6-d837a2d41e92", "value": "SecuriteInfo.com.W32.AIDetect.malware2.6397.30975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda87b20-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948741, "uuid": "0dd4c9a3-86e4-4689-8e5f-a0cdffea268a", "comment": "Malware payload", "value": "4e4040ceb5d9275e761c9658d882592c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948741, "uuid": "82a66ce6-81e6-4539-885c-6ba8089ba830", "comment": "Malware payload", "value": "41f0c12f02518a428911ae94513e86ff36dfae7bb00ff829a6f1aec32f53a516", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948741, "uuid": "aceaf902-0f2b-408a-8fb2-319209acf8c2", "comment": "Malware payload", "value": "01e0ea2a74c970adb3190843a6d945747bbc7f2f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948741, "uuid": "66623be4-0204-47a7-acae-6aea6634e291", "comment": "Malware payload", "value": "e7db1bbbafdb6beec574b6d6ede8edaebf75ef38106034fb02103eeb42bcb1f81bd061f3e6998b0e6a2447779174e373", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948741, "uuid": "b308d65e-2744-43e5-a768-59a623b5fc63", "value": "T18DA1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0397C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948741, "uuid": "38ee5860-f5c1-4fbb-8e6c-1ba46b38d0bd", "value": "96:NRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:NRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948741, "uuid": "ed95b71a-0829-41b7-856a-9990ba8ba2bc", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948741, "uuid": "2ed0fa00-be43-45bc-a56c-b48479ce8499", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948741, "uuid": "84555fbd-9738-4915-8d0b-1394219f4a06", "value": "41f0c12f02518a428911ae94513e86ff36dfae7bb00ff829a6f1aec32f53a516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f945bc2e-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947956, "uuid": "53f5a15a-64ab-48ef-9acc-9c2062a7167d", "comment": "Malware payload", "value": "165ec051a93aa50f083baac2eff464b6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947956, "uuid": "6b30382b-d24b-44b5-b944-854d6b473a94", "comment": "Malware payload", "value": "41f2bd9673effca628d0a26529535096932921714da720574dea6012b0a4e546", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947956, "uuid": "5c1cf95e-0a4c-4987-9d00-2f19830ff66b", "comment": "Malware payload", "value": "a17f727c9f1b2a8d95244715609f2074da5b5b96", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947956, "uuid": "f73f5b7a-8f13-4d1b-9087-7b33e8003916", "comment": "Malware payload", "value": "5345ac6923b78ee2367d814548daf9e37826f1310f511a422d41676cb07570d44a0693797068916f89efa32e7b489b62", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947956, "uuid": "27269601-1029-475f-879c-96f8364697e3", "value": "T10906330C229EF8FDB85A066D3B2289B0C5E452F5DC4225F38A781544093F5BE5BDFA63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947956, "uuid": "9205b182-6432-4cab-b09e-90dc53823f81", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAc:0XSxVJG2fLAqFOfT9sMYNM29SAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947956, "uuid": "7a22cc29-cce5-4535-9dc0-2ded69c804e5", "value": 3891200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947956, "uuid": "8e2a0960-ef63-4ba4-b4e5-09521a4a7d2f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947956, "uuid": "2885842e-4293-4fc8-b831-184990129e2a", "value": "41f2bd9673effca628d0a26529535096932921714da720574dea6012b0a4e546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3945d18-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947892, "uuid": "3e402340-da69-49c3-bc71-8c79bf572c61", "comment": "Malware payload", "value": "e9b24a2c43a1c5d428455f0c3faa5031", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947892, "uuid": "9257f9f3-94a4-476e-b4fc-4dafde51b275", "comment": "Malware payload", "value": "420f7cf4dde1fc16e39134041fa9dd142d399781124c6503ea75271cae94438e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947892, "uuid": "b22f3780-df94-4374-b799-39e64cda5390", "comment": "Malware payload", "value": "c8c2a897966add52f24b29f8a8a68365cc3d8cf5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947892, "uuid": "789e1fa3-bf3a-4beb-8d55-902e931a6b7e", "comment": "Malware payload", "value": "fc1a23dc281cf9b8fd14a7535f642542d8f8e9f02408f78f185a36c765388172fb089aab116b1ef04a9a649e71e6cb96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947892, "uuid": "4c09a958-5f95-4b2a-87a7-8726bae3af25", "value": "T1B347DF73810738E9E5B98DB4D41425426DAC38875738A3C7BAC871F6A7EA6E48D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947892, "uuid": "f139b2fa-a898-4528-ae1d-76fb0cc26c92", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaI:sXyWSpV+Wu7rI3JE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947892, "uuid": "d1f47840-19f3-47bc-a3b7-89fb98a80aea", "value": 26214400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947892, "uuid": "a410db38-850c-4ae5-8b19-6c4fd6c606b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947892, "uuid": "e07c8042-787c-4310-8a93-8ba714609ab9", "value": "420f7cf4dde1fc16e39134041fa9dd142d399781124c6503ea75271cae94438e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210af64e-04f6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657969068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969068, "uuid": "41cae8d7-4c3a-4c92-a4a2-555887bfae50", "comment": "Malware payload (Mirai)", "value": "02be51fbd3ec5df0886b3e56c6b2c9df", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969068, "uuid": "4c0ff1cf-011d-458c-8bc1-07d99e5f4907", "comment": "Malware payload (Mirai)", "value": "42163b20ba3e3bda73622b08fb950c2252365bea1cc5cb117e490910d0d7cad2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969068, "uuid": "ed8b5468-3217-4778-a2ef-f7a9205e1dfc", "comment": "Malware payload (Mirai)", "value": "4dae2329d191ebdd43eab90e519d69657d3909a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969068, "uuid": "f9364885-0857-4318-9ded-e77798cfcdb4", "comment": "Malware payload (Mirai)", "value": "e173ff444bd58af823543cca42de007545d291ee048d4a94f3a648becc388ac4993a00a7fa07edf8fd0349aeb38f8183", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969068, "uuid": "0dce3cea-8336-490a-8e6c-4636bce50503", "value": "T1B3C33B46EA408B13C4D51776BADF42493323E754E3DB73069918AFB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969068, "uuid": "94a3daf2-fc96-4ee4-8001-fcfc2653cdc7", "value": "1536:1tnPV8EGQnaMNt4x0iSRWpaAgswpNcF4dNlHFiRuiPkf5pm3+Xrpd7JMu2VlyKsF:d8waJxrSMpaAgswpNB2uicE+XjSxVggC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969068, "uuid": "e8c53d4e-87b6-4e49-bab3-2cda8c8eae00", "value": 124912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969068, "uuid": "88465f93-8955-4057-a8f4-147740781306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969068, "uuid": "103f610c-b6e7-4039-bd56-14f042f690e5", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38672c6d-04c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657947202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947202, "uuid": "e7015a35-18dc-455e-adf2-da2d6c38f170", "comment": "Malware payload (Mirai)", "value": "bcdfe46a55bc87fbf481f54f3988f4d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947202, "uuid": "872cf602-2464-474d-a735-0a91c7cdf407", "comment": "Malware payload (Mirai)", "value": "4227c60ddbb323140d8df98fac82271e3856424ba4335429905c66c3845dc147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947202, "uuid": "9966c47a-3d6c-43bb-b212-9704cd270d3e", "comment": "Malware payload (Mirai)", "value": "2ea98c6adc211fd3c2964556b71e5e6a0ec28039", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947202, "uuid": "13738a1c-3041-4b9b-8983-11c2818844cb", "comment": "Malware payload (Mirai)", "value": "3e581d306d058da9b18e57f040d4ba46e7ee43763f8ab633b433dab29c5c6f77a70d134fda6c3614ef8b269dc0927f20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947202, "uuid": "df7d1ba2-1a36-4d03-aecc-d4bfb9ee83dd", "value": "T1CBC34C4AFB408B13C4D61775BADF460937239BA4A3DB730699185FF43F8679A0E27806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947202, "uuid": "2421f3d9-31b3-4615-835e-6d9d9958992f", "value": "1536:DCnVTCoECOR5xLkPVyROel/3mUiNqR4YNlbEisZmUIWia10xbjrZUZUPu2VTIWWY:cCyVCOel/3mUiN86ZmlWXWbj6sxVTU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947202, "uuid": "172f22e1-95b9-4089-9ead-3fe4978c7cdd", "value": 129551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947202, "uuid": "d78b4f5c-9ad0-4ffd-91f0-ad827dc93b4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947202, "uuid": "ca065068-1a8e-4330-abbb-98e0ca8171f4", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b10dea-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948116, "uuid": "3fd3da05-4dd2-4df9-941e-23ab0c16a0bb", "comment": "Malware payload", "value": "fc96c0b774c01a18d5bb6a47366b386a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948116, "uuid": "2876c08a-3cb1-4634-91b6-50a03b413b00", "comment": "Malware payload", "value": "425e005a5a519c54abe4e697d4560e78f5ca671a6dd31808d20d0638d6511b39", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948116, "uuid": "0d6da4c8-1629-4811-9daa-cec071e2aa2d", "comment": "Malware payload", "value": "25c0886867b78aa86fbc54ea9401756378515c3b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948116, "uuid": "b8e253d5-5572-444d-b589-b8b7622704af", "comment": "Malware payload", "value": "9a6313509fc0521fb34a6b11066762abf408d7796d094630218933c7c63ab50b520146553e1c6b2d623d36c8b61e10c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948116, "uuid": "e63df44f-4207-4f58-b3fd-dc634f9d3c23", "value": "T159A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948116, "uuid": "9a7378fe-9c62-422a-9a12-fa7315e2d0f4", "value": "96:mRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:mRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948116, "uuid": "e0a1d9bf-5ad5-47b0-9f58-65909fc52646", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948116, "uuid": "1422cfb1-102a-4d4f-ab5c-47b3ed5bca98", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948116, "uuid": "4f65e5e4-517a-4762-be12-5b36dfd69f5e", "value": "425e005a5a519c54abe4e697d4560e78f5ca671a6dd31808d20d0638d6511b39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285de1ff-04e4-11ed-93bb-42010a9c0043", "comment": "Malware payload (SystemBC)", "timestamp": 1657961349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961349, "uuid": "68a952cb-afd3-42a6-aee7-8d1ba87e83c5", "comment": "Malware payload (SystemBC)", "value": "17f161fa336f084079dd715cf02cfcc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961349, "uuid": "0eb5fd43-a400-47ef-9c01-3a5ddfe655f7", "comment": "Malware payload (SystemBC)", "value": "42922679f1b1e35f810a82fe3c9554adc522e25a6b8458942c556a7f52983b07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961349, "uuid": "737bcb61-4f35-4b40-bc6b-ff6442416e4a", "comment": "Malware payload (SystemBC)", "value": "baf15cdb5b7b6f345934ee79b72fd253e479c732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961349, "uuid": "d1f7152b-fd75-4364-b7b5-9ce4690b1b10", "comment": "Malware payload (SystemBC)", "value": "a352a682e03641bad7dfa5a7835836e9a53ac9c93cf946a3b23e8ef7987529649ab6c593b9f9a8423a14ddcae808bec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961349, "uuid": "6ce8ede3-2209-4704-a62a-113effb77b1d", "value": "T19354CF5F6A0C4444DE8C07F2D6B2839C7B546B68F5B7834714B61AE8880BBCF3D569E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961349, "uuid": "be2aa75d-ff9b-4507-b501-d0e5d02c2656", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961349, "uuid": "5466b9af-c47f-4a4f-89cc-e6410e14204b", "value": "6144:0W+ZX/idRaeNQynzigbEQhLT0evOfu76:ucR3nzigboeWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961349, "uuid": "0876b4b8-5410-4156-a9b0-717636300982", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961349, "uuid": "50858efc-fdf3-4d00-9dab-4dc24bf35148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961349, "uuid": "ffd172c6-15db-4cae-a825-5a4e854e7676", "value": "17f161fa336f084079dd715cf02cfcc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360c5c4c-04c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657947199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947199, "uuid": "40dde1b0-3d9a-4d5d-aab8-ff5e89d4b4e2", "comment": "Malware payload (Mirai)", "value": "c902152bf6f0d5ce881a7c70d1514e1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947199, "uuid": "df4390d0-b9a4-4c09-99cc-f048ec4c819b", "comment": "Malware payload (Mirai)", "value": "42c344a7f1af874b17bc355261af97b5519dc59acc180983dd5aa20fbc0c0e44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947199, "uuid": "a72db0be-c31e-41cd-b4c8-538473a5d6eb", "comment": "Malware payload (Mirai)", "value": "ac70a0237e716ce2d18ecd9c28244e4cfe32aa90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947199, "uuid": "c39b053c-753f-4603-94c6-5bfa2c09519c", "comment": "Malware payload (Mirai)", "value": "83b87b9fecf00c1cbefb46344e228957080a773e73d9fc5530022f4622ffa66bcca87a56ba2583466e6ce4344f45c0cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947199, "uuid": "989089e6-f6e8-44e1-b906-b94c01e9f590", "value": "T1AD234B93FC51962AC5C12371773E995E3722E3E4D2DB3613DE144B22378A01B1FA6E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947199, "uuid": "333c937e-7798-4a67-9cec-120b941b0f3c", "value": "768:5ae8i+2FAnzW90K8vPy1kgg1BUTkw/q7i2pS1TRBYIVo51SrBNHs2ZY10Uv:53snzW9vya1SOG7hpS3BYIN7a10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947199, "uuid": "c791aa41-47f9-4328-97c3-a44c4f7f4124", "value": 46820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947199, "uuid": "0c544a8f-31db-45f2-ad70-d13544ffc134", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947199, "uuid": "201e26bc-de5a-4d39-8a7a-a584457b5f77", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cd68a8-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (DarkComet)", "timestamp": 1657971351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971351, "uuid": "1cf0631c-e3da-40ce-ad89-c5b8f44152c8", "comment": "Malware payload (DarkComet)", "value": "c005eb7f7944cbcd4d9d51ae29ef65d8", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971351, "uuid": "3e4645f9-a37f-4a6e-984f-48ad8df25b78", "comment": "Malware payload (DarkComet)", "value": "42cadb98f1c11097d4225b2362e6401fe0f824a252f678cc56f7f8ccc3aa864a", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971351, "uuid": "cda9cee6-af8d-4958-b53a-a68f1cc33c2f", "comment": "Malware payload (DarkComet)", "value": "b242d76d29366b738f7b440f3eb605da0fbad953", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971351, "uuid": "4a8ace42-9d46-4b48-91ea-9214f9a20a0e", "comment": "Malware payload (DarkComet)", "value": "d39280fe5661cd11eb67c6f06667c93d0ac0c2d8ade977262b0eeb75e3f4802d742dcea02beddb6ebd7b2a0ca931b2fc", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971351, "uuid": "108ea9a4-3ffb-4fbd-b4d6-51b3baeb7319", "value": "T1BF4422A5BFC59C43FAB9AEFC065C4B145B0533DB1EEE83629F20034831A5A96139363D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971351, "uuid": "539b1aff-e422-42c5-b96d-e7701c90949a", "value": "a38ad86d74cafc45094a5085e33419e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971351, "uuid": "7c07f7a6-d242-4141-a1d1-bcd028e59f90", "value": "6144:ecNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37iy:ecW7KEZlPzCy37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971351, "uuid": "7534278e-79b3-425f-a5c3-b5e69ff7dc66", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971351, "uuid": "32f60c50-06bf-4775-a718-02748547629b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971351, "uuid": "4ad5b2ae-8a3e-43f4-b672-0dd61afbc806", "value": "csgocheats.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57446983-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948113, "uuid": "db2675c1-1e9a-4e1b-909b-ef19873c42a6", "comment": "Malware payload", "value": "c3f291376b46c0c19df257c3f22a37ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948113, "uuid": "debac54a-29e5-4342-9ba4-5c897a00dc7d", "comment": "Malware payload", "value": "431734ba4542528ad7ac556489affecb9257674755a11aca6109268e098cf026", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948113, "uuid": "d69911a7-3091-400c-b9c9-e467a42a5c99", "comment": "Malware payload", "value": "7bf1f863c662351751acba5ba549a343d10ded95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948113, "uuid": "7ff964b4-840a-4fb5-94fc-36f1e32af9af", "comment": "Malware payload", "value": "1f7b190d63f9d0f19840835ec3f87022f6bf635310f42553725c03218cd36f3490bf265196196e79a794443cbc08365d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948113, "uuid": "4333f03a-4c67-4fcd-8fa4-1a0ebd38e516", "value": "T11E37CF73910738E9E5B98CB4D41425426DAC38875738A3C7BAC871F667EA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948113, "uuid": "4e299d96-2c9e-4cee-a68d-30c8046659e2", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaz:sXyWSpV+Wu7rI3JEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948113, "uuid": "a2b86422-c0c6-46ab-9d54-ace21b070f4a", "value": 23232512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948113, "uuid": "4e201407-35ba-4f60-ad61-d0934f8452c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948113, "uuid": "f8f79318-279e-40dd-9e0e-b541c45fdca9", "value": "431734ba4542528ad7ac556489affecb9257674755a11aca6109268e098cf026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f3c60a-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1657948839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948839, "uuid": "4045f760-fcbd-47ac-aaf4-32c6bbcf2623", "comment": "Malware payload (CoinMiner)", "value": "b7973c991c3de91cf37a626ac5e84c29", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948839, "uuid": "262008ac-5834-4953-87c4-3b34dbf864c4", "comment": "Malware payload (CoinMiner)", "value": "4380d5ccae16ac81d05be6b6be20754cb1bbe421929fa8fcefa629ff5878518a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948839, "uuid": "9b56f3e8-a108-4621-8f62-49b866373387", "comment": "Malware payload (CoinMiner)", "value": "a7d691df3b4a4f6986eba9b773baed0e7cdaaa73", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948839, "uuid": "d975b5e2-1a86-4137-ae79-5592ddd56827", "comment": "Malware payload (CoinMiner)", "value": "c346293d2793cdd9627ad01d956f71b8c1749965eb53cf6a9331128de965f2b2e90aa494a4f7de8cf167520dea10a152", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948839, "uuid": "6cc08a06-c1be-4d4f-b01e-6fdf4140365d", "value": "T1EB67CF7791067CE9E9B949B4841015816E787C874B78A3C7BAC871FA66FB2D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948839, "uuid": "d91ac98a-b074-4b0b-9123-dfb41c430c4e", "value": "49152:A7s2SRJT/Krb/T4vO90dL3BmAFd4A64nsfJg6+W8bGw0kfRz8S/4bbJQ/VXBVdpa:A7HWh6ubGqfMHNET+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948839, "uuid": "23a0455f-ea97-45d1-b644-650f5f8e284f", "value": 30308728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948839, "uuid": "823a6ac1-d955-4a7a-9650-3a5895ac6b2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948839, "uuid": "23ccd9c3-179b-4eb6-84eb-06d7539248e8", "value": "4380d5ccae16ac81d05be6b6be20754cb1bbe421929fa8fcefa629ff5878518a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e14391-0520-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657987428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987428, "uuid": "ae659d14-5013-40d5-b634-98ef33afa1c1", "comment": "Malware payload (Mirai)", "value": "d361c92ca89e9539ec022edcff83f133", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987428, "uuid": "2dd118fe-6953-4fb5-82ec-9c49cc81b597", "comment": "Malware payload (Mirai)", "value": "43ab51decf2e9b88d2b94fb21b6fad48a95d67708f95ae7fe1771519fb416c2c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987428, "uuid": "182041b3-5adf-4aff-9cb2-0642b273cc11", "comment": "Malware payload (Mirai)", "value": "1a8897239492a59e1a474374ff4bbb044f599c6d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987428, "uuid": "b5fe0976-7e3a-4dea-a2fb-4016c83d0104", "comment": "Malware payload (Mirai)", "value": "c7b76bb4df1afccdc3bda05195685493f07b7d2ee67b6714ffe91614f1bf882487b76b6eab0e0be4ebffeeb2b44f184d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987428, "uuid": "4306fbf4-c0e6-4133-b011-199683f4b7da", "value": "T12CA2D1AFA4DA4997DDA9A03B010C14D614BB5C5013B783D22F6175F389BB4E4FC36680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987428, "uuid": "3499897c-e1a6-46b2-918f-754a54887af6", "value": "384:MzcDqRfKUWFH39z+/49EThvIruI8qB+eANnlBQpMr/7DNflW+v1RpO:OMkKJFH39CBhgy7qsZoMTppO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657987428, "uuid": "3c4c3b57-8d86-4a11-9f80-857c2f94fcfc", "value": 22440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657987428, "uuid": "c8088905-72ea-4ab8-8544-ae82b1cedc06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987428, "uuid": "be86fd46-07d9-4c0c-baa0-ff36f2504ef0", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ac820d-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948619, "uuid": "9c794b77-555d-47b6-a20a-7857b2a21eb1", "comment": "Malware payload", "value": "d1db0fd912a4cac0fcfbf5d76563628b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948619, "uuid": "cda2d849-710b-4d61-bdcf-a3128c2feec2", "comment": "Malware payload", "value": "43d8927a1396e261c4b6335f80091c8a0519a4b135a853d8f907a939aa95f303", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948619, "uuid": "9a19733e-07f3-4638-91cd-dbd1aeef6a66", "comment": "Malware payload", "value": "6e6732de62764097957c58e8b62faeaef96e801c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948619, "uuid": "1eb49336-1c5f-4d8d-ab47-7ef2dc9880ea", "comment": "Malware payload", "value": "fadc45e728b52f52fa4139e82a40f150c297f6b279f22472c3a9327fb487ba0907211ef50a69a12e74b0ae433533c1ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948619, "uuid": "d00ae84c-b8d3-4a84-ba54-654b98865df7", "value": "T116A1F850112C1AB07246597AD26FFB52B40EC81B0A777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948619, "uuid": "07198af3-c57a-471e-9a68-6ca188a18bf8", "value": "96:iRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:iRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948619, "uuid": "b0ae7f39-2884-4856-807d-68325e752793", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948619, "uuid": "23c4a3d1-f95e-4b1f-90a8-91159f54a58c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948619, "uuid": "252c9be7-e355-458d-90be-965b29f77d14", "value": "43d8927a1396e261c4b6335f80091c8a0519a4b135a853d8f907a939aa95f303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71901f3-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948704, "uuid": "b81efdc0-a2d4-46ed-9e9a-ea4236b011cc", "comment": "Malware payload", "value": "404a2ec0051424a91e0086bb0baa08f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948704, "uuid": "c1adb0d6-084d-46bf-963b-20ace2106fd3", "comment": "Malware payload", "value": "447a860503ec0abb8d55a911d987de485659a2ca98e8cc402c3e2b553c66cb78", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948704, "uuid": "ff31f912-5cdc-419b-8483-0f602de38aa8", "comment": "Malware payload", "value": "1d6f008dd2025d01ad3de3457cb43e702c211e36", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948704, "uuid": "f31484ca-a48c-43ce-9a0b-e429805d335b", "comment": "Malware payload", "value": "092ac37b599c4897f4a064824c95eb7e6f7109679088ff0d2b1eff772af142c91d0e5a79c9fb8bf284adf38741070163", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948704, "uuid": "cc5d4f77-81f7-4002-9f75-d0e1b2adc80f", "value": "T171A1E850112C1AB17246597AD26FFA52B50ECC1B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948704, "uuid": "cfab318c-3a3e-43b5-826c-2f0d56dd33d5", "value": "96:SRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:SRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948704, "uuid": "efbc2ebb-4c66-4534-8899-496699bd26fb", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948704, "uuid": "92129e37-20c5-465a-b9d3-9143126bd2cf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948704, "uuid": "58b84950-9d71-4a7a-9d1e-4dd85a19f8db", "value": "447a860503ec0abb8d55a911d987de485659a2ca98e8cc402c3e2b553c66cb78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a88c20-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947822, "uuid": "f3cda9f7-b9ef-47ed-a724-48814c031d4d", "comment": "Malware payload", "value": "bb86a333fe663dfa84aa161ba5b0002f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947822, "uuid": "231e3aaa-6981-455e-af3a-20f10e10bdfe", "comment": "Malware payload", "value": "45b79ee57d2b64bb6e67f4e7c0b46cc2f0cfaeb2b27141636f0641f1669bdac5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947822, "uuid": "772e23f9-bc80-41cc-a09e-f479bc263f13", "comment": "Malware payload", "value": "07e0bba3efb5f804f52d5b59ce71118bc99d09f4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947822, "uuid": "19deb81f-057b-454b-9598-98043b2ce350", "comment": "Malware payload", "value": "09d572562be6250e2870df0db70bca4903ff2eb1e68592dd65f13ae4ddbff4e8a001e65aa6907419c3eea070a6b65e48", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947822, "uuid": "c67a8a44-2d7c-4d79-9928-0fa8cfe6bef7", "value": "T12FC53336F4BB79783641E7E24604C9357BBAC3863ABB37160FB89CCDA12414B756D098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947822, "uuid": "e6365355-0c27-4294-8466-ac763f6ec4ff", "value": "49152:ijoGN5J3sAs+aa8d6q3RKNhvqa87NXcHnSySdkOFOd+LgEBHVCjzr1/:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6HG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947822, "uuid": "41a5b3a9-9120-4edc-8a95-aeef62427e16", "value": 2584576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947822, "uuid": "e5ef957a-4438-4499-b54b-2d3cbf204af5", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947822, "uuid": "c524a9bb-ae20-40ae-a88d-4d3fac830696", "value": "45b79ee57d2b64bb6e67f4e7c0b46cc2f0cfaeb2b27141636f0641f1669bdac5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3b10fd-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948848, "uuid": "c2b21617-f5eb-4b12-ba5a-c7119aea2768", "comment": "Malware payload", "value": "3f15b8e71ca4bc2cafb96eef9562da91", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948848, "uuid": "79778e0a-ed59-4ff7-8074-c7719d6b04fd", "comment": "Malware payload", "value": "460947db97f7467e8e185a0ff7a6df3d24d9eb957da72cb41124d2115d1b5c48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948848, "uuid": "8a4ad119-0b61-4254-9eb1-2d463c4a1bee", "comment": "Malware payload", "value": "2d96281fe57db83aeccaa57e59e54b91dead11b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948848, "uuid": "f225a648-e0f6-4e5e-9199-abf38159cb02", "comment": "Malware payload", "value": "ff77c50dad378cf93f9df7cc38b0ca92cffc419603ae7e9523b74bd48bcda75a3f5f634322f7491d2080640b5413930a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948848, "uuid": "70acb340-0c70-46f1-81e0-b8cc4f1e7e40", "value": "T15CA1F750112C1AB17346697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948848, "uuid": "1ff973ba-8971-479e-be38-16fce6108dc1", "value": "96:wRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:wRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948848, "uuid": "228aca68-a19d-4130-a1f6-75c960d668d2", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948848, "uuid": "80c3d15f-cd85-4670-a503-882d4ae08078", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948848, "uuid": "f260e7c4-c783-46f6-a9e9-82d68ed9b624", "value": "460947db97f7467e8e185a0ff7a6df3d24d9eb957da72cb41124d2115d1b5c48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af346fe5-04e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1657961146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961146, "uuid": "aecda876-7069-4644-b9b8-117530e641b1", "comment": "Malware payload (Formbook)", "value": "c61fb14a834875c9f3d7f70bcb09028f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961146, "uuid": "700d93fe-49f7-4834-89b6-b8a63c37adc8", "comment": "Malware payload (Formbook)", "value": "462f9e9c5c6c26c66ed6da23e7ff02e9a3210a9fb557292cc438c6e8562d6cdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961146, "uuid": "b39632ea-474d-4ba6-8796-bb5879d69c92", "comment": "Malware payload (Formbook)", "value": "b43d31e94411f46f3a07652db956563ef0e6fb2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961146, "uuid": "4003e7ba-e87e-4666-9674-1dcea2a18d4a", "comment": "Malware payload (Formbook)", "value": "7572ab12a9a272758b5ee6e7a6f9c6b675677ebc8d8a075e41727a04263cb49de256116f7fb114524242bb768e03220b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961146, "uuid": "1e29c6ab-63e3-489a-86af-5e92fea4706e", "value": "T11724AE10BBE1DC76E0621D30447583A1973BBCF2A474A547F744BB6E2E733806AB6356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961146, "uuid": "8b394c94-3eb0-458b-ab65-a3f31ef0a249", "value": "1249004256d2e1603a517a4396f395f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961146, "uuid": "19439e9c-7ca8-470e-855f-388f05c97651", "value": "3072:FAk/lE/jWZetHyvG4n28snKL6TzhBY/GFoLtsxkgaBChcpZa9uD6Vdyhkv:v/lE/aUHyO9Zdzz/oLSigafwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961146, "uuid": "043e8cb8-68e0-4b16-91e9-bc469f25c970", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961146, "uuid": "3d8e00c1-c346-43de-aa97-8393724fc95f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961146, "uuid": "a9107498-866b-4d76-94a3-698812a822b0", "value": "c61fb14a834875c9f3d7f70bcb09028f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d227c1e-04c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657947210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947210, "uuid": "61db5748-e12c-4fa2-8377-2e1fc3a525be", "comment": "Malware payload (Mirai)", "value": "b33253e5d409fbc91b49b81631a03bc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947210, "uuid": "4921f10b-7523-4cac-8724-5521d3b1c24a", "comment": "Malware payload (Mirai)", "value": "46502a79fb68091343934e740acf3c9cf2c9ad66b423647c35cc3c6391568d53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947210, "uuid": "6b5fca37-2eec-4257-a4de-3c5c66e491c6", "comment": "Malware payload (Mirai)", "value": "91f40cd96777a383655886fc27914ec0efb412f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947210, "uuid": "6d6591f7-1a20-4b8d-b5b1-9069ed7f8077", "comment": "Malware payload (Mirai)", "value": "fa46b91de325fa8f71f0e82b773fcc39eac1f876a548beb01c9164f859b2c1f57994bc67fbd2ad18bd868ba6bc637f35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947210, "uuid": "270b0c64-6fc6-4b81-bd74-c23d8210e470", "value": "T146332AC8F153EAF5E85609302076EF365E77D7BB2278AD03C3A59572E842603A506E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947210, "uuid": "6a3af175-1624-4e5d-a44f-d8fc290923cb", "value": "768:YFWgWIuwQthVk6LnEMKuXKgNAOt46AqE4+5Ut+lCyWKsioQLDZ:YFHShVBEMKuXFOOtdp+2tqCyWKvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947210, "uuid": "1a78ddc7-636e-45a6-b456-8ba596eb8832", "value": 50704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947210, "uuid": "ffd886b4-87a4-4669-9436-11b3b4b62f7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947210, "uuid": "d84094e7-3c5b-45e6-91cf-17bcd1f457f5", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7381e33-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948757, "uuid": "d3fa5b10-b7d7-4148-9aa5-4280af91fe50", "comment": "Malware payload", "value": "02868564f4295f494ff8e40c3663dbf5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948757, "uuid": "dfb0e967-58ba-47de-9f96-4055ae1e4b58", "comment": "Malware payload", "value": "465eb19355fbfdbf8a1354fdb04d70754f36cdbb7330f883668d8a04786c1f0a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948757, "uuid": "b8751cca-2aab-4a71-8982-aaa70a964d01", "comment": "Malware payload", "value": "163e93f8b842b8ac0d12c67836286bddc806b27e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948757, "uuid": "85572e91-9b90-428b-aea5-ed679727b925", "comment": "Malware payload", "value": "3a2340cb550f7f0ea5bd6f0e2c0925f8a5e56c5c1d67c7ad4d536cf85d686692ee58dc7d8b93c585ba7e35cea90472ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948757, "uuid": "b0f868c9-03d9-42a5-8c08-481e07ab7610", "value": "T18C31A3D806A505357C7359F7BAF489073284E4E6ECE16B066EE93DF88CCCF183688656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948757, "uuid": "acb0ed82-824f-4235-ac45-53cfd374f1b9", "value": "24:vNZnUNu5ubiUNwaD3zKWUNlx8AUNWRUNmanbUND0Ds8UNG7UNl3UNwfDn:vDUMAmU6ezKWUF8AUgUdUNys8U6UXUmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948757, "uuid": "e4639ca2-5073-482d-9073-fd5147cfa189", "value": 1743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948757, "uuid": "62c79c7b-e444-45a7-81ed-b754004caaa7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948757, "uuid": "606c8678-e156-45a9-87f0-eab22c8e65df", "value": "465eb19355fbfdbf8a1354fdb04d70754f36cdbb7330f883668d8a04786c1f0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e90faf-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948134, "uuid": "e07c723e-8d63-4724-9868-06c7d6a0338d", "comment": "Malware payload", "value": "7d89785d67210dde320d8e736cd5b216", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948134, "uuid": "1027fcb7-42c7-44fb-8625-04aadfb82112", "comment": "Malware payload", "value": "467b1308db382abac41f6b697c0498b06f8fe6ae314db5e91018b60b76ab8861", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948134, "uuid": "e688f986-8182-4afb-8aae-e744f57e3de1", "comment": "Malware payload", "value": "2c8fdef00b12872347f7087fc91b4e7907c67638", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948134, "uuid": "df885ccc-8e14-40fc-b76a-f2a34b65acbd", "comment": "Malware payload", "value": "1d2e3d1593949fbc66937cd8c88ed365bf1c7da4f1c32c2d7ca5c901c87d05d6be2b4da0c3f831ef62258eb4b86d4c91", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948134, "uuid": "96b7da63-a624-435f-ab6b-84f12657c6d5", "value": "T1E0A1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948134, "uuid": "4bd767c9-4d2c-4859-af55-8e61a875887d", "value": "96:MRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:MRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948134, "uuid": "f8d1b284-239c-475d-b2d6-a7240dd879e8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948134, "uuid": "3fe549ad-e65a-4968-8e7c-3359e94fcebd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948134, "uuid": "5a832207-586c-44da-b8c0-8f83ebace88e", "value": "467b1308db382abac41f6b697c0498b06f8fe6ae314db5e91018b60b76ab8861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0690fde8-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948407, "uuid": "f7ec10d6-3210-4af2-b1e6-90888305fe1c", "comment": "Malware payload", "value": "bf9c6eff93d75bcaf4ae16127ac94e68", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948407, "uuid": "c77d66bf-55b9-4444-88ab-e50057d037e9", "comment": "Malware payload", "value": "4693ee978489e6ced49fec81163e0d8497cb5eecdbfdfff59148faa7090edb20", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948407, "uuid": "e1e96679-c0d6-4c1d-bebe-5547d46377bf", "comment": "Malware payload", "value": "faee10f422f76c3da723c02a751d51a770d96b9d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948407, "uuid": "b0df698f-ff99-4671-a4d6-dd7ee14c3bff", "comment": "Malware payload", "value": "af786e86cadf72128b79a577b1fa7914d87eac5dd34bd8585b828276fcb3a57ef00549194cabd021e702740ccab2fdd8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948407, "uuid": "30075bf2-062c-4d97-be67-4aa66f919262", "value": "T166A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948407, "uuid": "1875e465-f6bf-4d57-b072-1d694c89bf68", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948407, "uuid": "5954ad56-7dd7-42b8-9efe-ff559886c5b4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948407, "uuid": "ef6bdfca-a0f8-46fc-9bd0-ed5ec2f5c7af", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948407, "uuid": "7563c877-b55e-4b8a-a73b-a64278ad746d", "value": "4693ee978489e6ced49fec81163e0d8497cb5eecdbfdfff59148faa7090edb20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed74a807-04b7-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1657942352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942352, "uuid": "39da7f64-f21a-47a8-bd7b-317b53a39578", "comment": "Malware payload (RemcosRAT)", "value": "9db17f5c4f116e2a55b6a96447288d90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942352, "uuid": "cf443b75-2de3-43e8-af83-493dae8c1271", "comment": "Malware payload (RemcosRAT)", "value": "46ba35607f476bf379debecfe8a0dcf235b15d30010fc1cd6af769e232a7192a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942352, "uuid": "67b90476-3964-4167-a328-541b459b4998", "comment": "Malware payload (RemcosRAT)", "value": "f06223fbf7921512117af52083b2321fe1efc70a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942352, "uuid": "ade869d6-bf8f-4a64-903e-259a8ec11e3c", "comment": "Malware payload (RemcosRAT)", "value": "7620ff33d0762852cb051b54ad66f5c4085a70b7b15b53bda4cc92a3d8f83ec2a33293a47fbc0166fed5855a85a1363a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942352, "uuid": "1693b8b9-514e-4e4f-9b4f-7d007e691632", "value": "T1AE057D65E2E0C5F6DC66163D8A0B96A0D829BE106D2CC98767E83DCD5FF878035272D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942352, "uuid": "bdb65963-82f8-474e-ab59-470d1a5e3173", "value": "077780b656ccb18d86eb00528cd56a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942352, "uuid": "964b4b86-beae-46a4-99f8-4e0b2ff054dd", "value": "12288:wmgi3VtzPY+ji70/Gm23P+SraklRm9Q266cY4s6JBCbRJzT:wvuPY+h+hP+KaklRm9stY4s6JBCbR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657942352, "uuid": "9fda49a8-6ad8-44fe-a98d-b6752869ce68", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657942352, "uuid": "3bb2c16b-71a0-46cd-b257-672fc9753d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942352, "uuid": "53969aee-d488-4411-b2de-65ff83771639", "value": "SecuriteInfo.com.W32.AIDetect.malware2.4033.28115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4df35d5-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948270, "uuid": "dd89fee1-53b0-4541-bf28-2f139dc50dd1", "comment": "Malware payload", "value": "1e74ea2ebc9921638d114fbccbab2a1b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948270, "uuid": "469a84a9-5368-4f0e-9891-b1447597fd26", "comment": "Malware payload", "value": "48ee98ddffff279b95b580928c28cc0c51c510dc89eb395ce129b9b23ff0017c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948270, "uuid": "82acf22a-9afe-4e0f-ba11-ccfd584146f8", "comment": "Malware payload", "value": "16764c3a89223df9343b2b36fb0eb2771a91addc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948270, "uuid": "f32277bc-2806-4e37-bc44-b209d32178e6", "comment": "Malware payload", "value": "0a2d71fa56710113950cf0f0bcf0b10660c8c69daee9bcb761143adbe3fb304690d795b210b8734696cbc2aa96bbf16e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948270, "uuid": "3dcd6c86-9c6f-4baa-8b3a-d83f2c0ba6c2", "value": "T16CA1F750112C1AB07246697AD26FFA52B80ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948270, "uuid": "bab6b44d-59e9-4239-a62b-5704275c7585", "value": "96:1RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:1RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948270, "uuid": "e917e7de-a513-4cbb-a151-9a8541e90ff4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948270, "uuid": "581b0b0b-e266-4bd2-bb8d-323f68db862f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948270, "uuid": "b038b912-7df7-43c6-8921-b7835ed231b8", "value": "48ee98ddffff279b95b580928c28cc0c51c510dc89eb395ce129b9b23ff0017c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a42a26-0541-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658001264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001264, "uuid": "c042dd47-74bf-4c88-9159-23a6593a8976", "comment": "Malware payload (Mirai)", "value": "ff8c64b9f2ed6e32d4925108ba7c82b8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001264, "uuid": "9a61c1cc-d83b-4176-81ee-98b8870c9b73", "comment": "Malware payload (Mirai)", "value": "49114a2bba5ba804ae0c2b8be116a71171ed96677c7aded32008315d94cb9c04", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001264, "uuid": "c1cbdcf4-1304-4809-b361-926498f57074", "comment": "Malware payload (Mirai)", "value": "0ec620f9d1333d11332b395691825cb60b405c94", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001264, "uuid": "8a92bffe-4e70-40e0-b892-d21f0c357a12", "comment": "Malware payload (Mirai)", "value": "d9dbd0372220ad18438b0f15a5a1902f88c54b0319cc40b71a61591ba23c45e0d26a3041057f5d20ac68066fa0e2a76d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001264, "uuid": "f57e7dec-3155-4f64-b23c-0658d8c14191", "value": "T18A332AC4FA8B85F6D90B883040A7F53FCF32D9798070966DEF9AAE35DA33542D215249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001264, "uuid": "f334a965-fe1a-4f61-b74b-d7b87d7f5f69", "value": "1536:hLCn0/kOMJQxgfmCcxjOMG9YkN1GkLQYWJJn4:hLCnfOMJQxgfm9i9Y2GkUFJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658001264, "uuid": "ece694ad-a912-4a01-abb6-66f2cb84a551", "value": 51024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658001264, "uuid": "fadcb71e-816c-4b74-a5a1-e034aac849f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001264, "uuid": "a188b9bc-74f5-4258-a0ea-488b897f6b41", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7db1942-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948275, "uuid": "8fc12d33-49be-4433-8528-9d068b3fcedb", "comment": "Malware payload", "value": "392c1b7bc49a195f109fae4e48ac741c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948275, "uuid": "b9910d10-5463-4f1e-a534-fed99faba5e3", "comment": "Malware payload", "value": "4929789a07cd044e43830b440145dbffd83095b580c765aee331457862695dcd", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948275, "uuid": "abeaf564-94b1-4b52-9fd7-4a9d2a0f7db9", "comment": "Malware payload", "value": "6b94a38702f59989ef25748849415901b00d29c4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948275, "uuid": "322d7cba-3d3e-4ffe-b09b-c42091bdebb2", "comment": "Malware payload", "value": "691b92c24910e9e9b9611412bfd97a9758f738b31be345ce97e6c95eafad1fb676f5a282854dc840a46202d260ae4315", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948275, "uuid": "bf1d66f6-08e4-4854-8825-506550ecb40f", "value": "T1DFE5330C53FAB8FCF89D0529376389D1C6E821F0A58265F2D6781998083F5BD1BDFA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948275, "uuid": "cab91295-bd31-4fd9-a685-03bb6f736971", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4a:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948275, "uuid": "0e7356fb-3bbf-4196-93dc-587ab89702a6", "value": 3096576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948275, "uuid": "77131fc8-36e5-4a4e-850b-2126b39cbf27", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948275, "uuid": "af5a4829-abb3-42fc-b618-298daaa3dbe9", "value": "4929789a07cd044e43830b440145dbffd83095b580c765aee331457862695dcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7874d914-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948169, "uuid": "ef08196e-2db0-4428-b2cd-1434bfc03146", "comment": "Malware payload", "value": "de1d6f132bd35d968fbd0f72ea6057b7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948169, "uuid": "62aa4d98-f1e6-423d-b7b5-9a5d2440fa23", "comment": "Malware payload", "value": "49791691581c3eda56adf5a0e9ac035f60eb6ddeb15ad6ccbe03fba3de681597", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948169, "uuid": "45ebeb93-d6d6-484b-a357-b14a1a1f2efd", "comment": "Malware payload", "value": "63f1dc06c2d27238112fe35202671fabf9f37e68", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948169, "uuid": "daed0a4b-b110-42fd-b02d-e314487bb8f3", "comment": "Malware payload", "value": "3df74044c3ca489756f31861eb7c7cc5399a98bdcdd88f5a00212f651ddfd94da786ed9fa85050d1bbff1a6b27f7216a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948169, "uuid": "83c29cd7-da07-46e1-ad85-232ee0ba706c", "value": "T1CAA1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948169, "uuid": "b062c1e3-bc2e-4c15-8e06-1698dd87bb07", "value": "96:cRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:cRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948169, "uuid": "a5207cef-0c60-4bc3-94e6-341037a5b0b7", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948169, "uuid": "12c5423b-ecea-483a-939e-01f118e2eb1e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948169, "uuid": "7762e4e0-8c55-46e0-a350-d10b6b646e02", "value": "49791691581c3eda56adf5a0e9ac035f60eb6ddeb15ad6ccbe03fba3de681597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faed189a-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948388, "uuid": "9771d07d-5c82-442e-9cb9-0e07c0a54ced", "comment": "Malware payload", "value": "9b2d3a16fe82e3a02edc63084c96a454", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948388, "uuid": "e9e31bb1-0805-4e69-a687-968ae37e2185", "comment": "Malware payload", "value": "49b5a3b23e9ef3de7c5dfdecd6eb0253878c778cece77abec6e404fd712d109d", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948388, "uuid": "4f09fda9-0cc2-432e-9ea8-eb724cf364a3", "comment": "Malware payload", "value": "0acec918d29e2714f3a5dda3ca635464590bbfd5", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948388, "uuid": "5dbefe44-9abd-4e35-a84a-e13bf7a7a994", "comment": "Malware payload", "value": "e5da06867f6a7f2fb0efad5304e6ef1668fc2d354b2fa346eeb9a899bd51252d7fb807c6c0e0dc284c58c3d759940564", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948388, "uuid": "91ed5ac7-3877-4f31-abdd-bc66544399f2", "value": "T1A745330921FBBCC8F9AF057936531848C3BD62F2D429B09A61884C9106776FD53DEABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948388, "uuid": "ea41c5ed-ac2e-453c-b6c8-5c27b0cc8158", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLLT1mtPQwNDk2g:IDSOgOhntWID2I0WkAfMtjNA2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948388, "uuid": "c992dc63-9e73-4527-beef-e5f898bd82aa", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948388, "uuid": "602252c9-aa17-4dca-aa02-e6dfb098701f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948388, "uuid": "c37c0311-d5b6-471e-9d92-c8c8cd482fa5", "value": "49b5a3b23e9ef3de7c5dfdecd6eb0253878c778cece77abec6e404fd712d109d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3df565-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948709, "uuid": "94ce3332-d20a-4927-9f5c-ab6746654a85", "comment": "Malware payload", "value": "2800d3e55fcd4c2c392d3dd28f69178d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948709, "uuid": "077e264e-5a66-4567-8472-99b9f1e93eab", "comment": "Malware payload", "value": "49e27a86027e2d14abef1484efa26069a5dce35155ef622c9388c2f36f1e25be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948709, "uuid": "74810a6d-0e66-42fa-88a4-27341179d916", "comment": "Malware payload", "value": "e43d40c39a94d9f03106b829426c6a898030e79b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948709, "uuid": "5e6eddf7-52fb-4c2f-92ed-4b431a793098", "comment": "Malware payload", "value": "4f37ef079309b6d9c5ac7121d2cbca4c382aa3020356fa8df8cb1c109c4525463d9b45dc5c82dbb156b5add899618af5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948709, "uuid": "fc9c1ed1-03cb-4d15-9f58-1e0f3f982569", "value": "T162A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948709, "uuid": "d56925a6-b3ca-409f-853c-a693574f2632", "value": "96:pRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:pRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948709, "uuid": "c4f06795-3dc5-4f55-b90c-a2cff01d4018", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948709, "uuid": "33a1af75-7a42-4f32-a896-ebe6b1855c02", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948709, "uuid": "bb818b1b-7394-464f-b4d2-12cba63c6592", "value": "49e27a86027e2d14abef1484efa26069a5dce35155ef622c9388c2f36f1e25be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034f7742-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947972, "uuid": "01846333-e6ba-4743-ad1a-66370a0713ed", "comment": "Malware payload", "value": "4baf974d1186ce7b15bbb4f22a8827b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947972, "uuid": "00c1f949-0a0c-427a-9a42-05bb4b597595", "comment": "Malware payload", "value": "4a101c33832148459f47467d65724fe6405694ce872dd1387dc86b6575c14659", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947972, "uuid": "aad6a584-50fc-4336-90b1-247757ee5d9d", "comment": "Malware payload", "value": "47bf152509da99d1ad069cccab85d3dc633b0323", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947972, "uuid": "57060b66-dded-4cd5-8b56-b0f511d47678", "comment": "Malware payload", "value": "ab63dfebd05771fd15245048c3462338bcf2d4adb7a21d04e038f1c21bbba0380da22f55d6e028799f9fbac48a4b4d31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947972, "uuid": "9e2e4c8f-8b18-4283-8ef4-ad099b337df5", "value": "T176A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947972, "uuid": "269a544a-9944-4050-93b8-7cc5eeb77f24", "value": "96:QRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:QRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947972, "uuid": "a21dfdc4-7552-41d2-adab-8ffc57ad5f0d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947972, "uuid": "727bead4-81c8-4a2e-a69f-13922728d77c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947972, "uuid": "861cc0df-cf6b-4412-b5a7-44c7ad744e84", "value": "4a101c33832148459f47467d65724fe6405694ce872dd1387dc86b6575c14659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707ce0df-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948585, "uuid": "ce85d8fd-b26d-43ab-95b6-ca81a2378ca0", "comment": "Malware payload", "value": "5de314b32db1976c2cb1e604dc26cb6e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948585, "uuid": "d1d24af4-6d49-4427-9c05-1d3d1741163f", "comment": "Malware payload", "value": "4a9259963725d03d06b3205907704501cfdb3b4bef228b1bb6eb46481506a2eb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948585, "uuid": "176b4d34-8278-4444-8dcd-55e46452a112", "comment": "Malware payload", "value": "40b9c83e573acffbc0f23a830f1ac07458a7b724", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948585, "uuid": "3b55f98f-0b3a-4fed-8c9f-c1222f69a51c", "comment": "Malware payload", "value": "e1a26406690508340ffa9f376959ebb1d60dc9b682eed15c26982ce25817df715e0ef6766323e0351f5e4a6df59e488d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948585, "uuid": "7b5b4972-f6d3-4460-b95a-fb8104134385", "value": "T160A1E650112C1AB07246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948585, "uuid": "ee5ec55e-2c6a-42a7-98ce-ce8cc7a41ffc", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948585, "uuid": "c663163a-a64a-4c4d-ba16-6f9abd25d478", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948585, "uuid": "f659b295-1ec8-484a-8a41-3d1770de6197", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948585, "uuid": "cef241d7-3eaa-459f-83fc-504aa79cb85b", "value": "4a9259963725d03d06b3205907704501cfdb3b4bef228b1bb6eb46481506a2eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ee8417-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947921, "uuid": "04a00e04-00f5-403b-9f6d-acb225b913f3", "comment": "Malware payload", "value": "9e8338b25904224a8d3110f896346e1e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947921, "uuid": "91e9dd70-78c1-4f16-a9ca-99a86eca2fd0", "comment": "Malware payload", "value": "4ac01bf2e711ee91a699f0eacd8387403222eaf92afe9ed21eeea5be58bc4a17", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947921, "uuid": "c64dccba-c1bf-4e99-ab94-fd148e378a0c", "comment": "Malware payload", "value": "aefc15a583aad5841971dec09381c26c7097e806", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947921, "uuid": "e54155a0-6f1e-4d19-8379-8c4036406d85", "comment": "Malware payload", "value": "7aeab783687c911b72890f0e2a6416545289139f1b584bad26360b2915d4b80ed0ddd5d8fb0a33f12c25175f67e82e69", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947921, "uuid": "d4530174-a171-4853-858a-411879f091cc", "value": "T196413CE432713BF13CBA14577325185631C5606EBCA6BE646DECBCF44D8DD4622842EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947921, "uuid": "6e6b5f64-f3e0-4af5-ba5b-7667e3d589b3", "value": "12:JCkm4eFJv3cKSrEJlquEO4w7ENRklkEGlhd0wsjLCSZpx8kD:Ij4eFJv3cKSrIHJXWXL8H6kD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947921, "uuid": "9afb6b08-4bb4-45c1-915f-57324e34eb0e", "value": 1918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947921, "uuid": "171a03e9-6c01-472c-89c8-500ffd747f82", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947921, "uuid": "1aca9aec-295c-4974-96ae-cb7012b86dd5", "value": "4ac01bf2e711ee91a699f0eacd8387403222eaf92afe9ed21eeea5be58bc4a17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1187b560-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947996, "uuid": "0949f92f-1da6-4b05-8bc2-dfe5b3bd9174", "comment": "Malware payload", "value": "50a7d01358c7883b1a1e8be394f41e5e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947996, "uuid": "d9d15d3a-ef22-4e24-86d4-3087d8c8d8f2", "comment": "Malware payload", "value": "4ac92bd6749ee29ff69f26b8850df8c338a3351227f36b942d44f4eac1aea53b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947996, "uuid": "34a83092-aadf-4103-b2c6-c0b6fb8a7673", "comment": "Malware payload", "value": "a95b1a30d749f995c7f906ba8cf0faf066a5a5a7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947996, "uuid": "b6cee835-55af-4e89-8ee6-bcefb9350772", "comment": "Malware payload", "value": "a516e14bcaf19c9aecfddc4213ca1d6d664f4845bdecffb909e2224a86a660de7bc8a5c2fcd1f4b75ea6c7d946dc12e5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947996, "uuid": "d52506bd-4509-42d3-ba2d-1b0e52f6a30d", "value": "T19FE0A2CD8029986091029FDDF053855099B5A3C8E2F33A2976E556AD4C4C9007FEDA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947996, "uuid": "26c55d42-e1cb-48b4-9cf4-7b21bfb6902e", "value": "6:ebB3w5/KRgCYxqfEQXsC5fQzTvKDdxqfSsC5fQzTukxqfIMLbXsC5fQzTGxqfIMO:iWKyFtwYfiJOwYf7JK4wYfGJEW8wYfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947996, "uuid": "36eccbaf-ea2e-4ae3-b45a-6da3d6a90f38", "value": 431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947996, "uuid": "5845ad3f-5fb5-4a79-81b4-899bdbe3fdde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947996, "uuid": "937f9d8f-5a32-45a5-a126-5bcd08488654", "value": "4ac92bd6749ee29ff69f26b8850df8c338a3351227f36b942d44f4eac1aea53b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cc334f-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948862, "uuid": "dc0da24d-c19c-4bd5-8cfe-786a8aa063e7", "comment": "Malware payload", "value": "bd0d29470ec79d800274d027a462f436", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948862, "uuid": "3bd98ad4-ddc4-4d47-9460-192a3d5c18a6", "comment": "Malware payload", "value": "4adc268e1659361acda0cdbeca373f351f0bf786a4d8dba538003e1c7a4a2af9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948862, "uuid": "7ff926ca-369e-401f-babe-a0173b34b928", "comment": "Malware payload", "value": "875e4c668a4671362e03cc7b4f8d7ded5841408d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948862, "uuid": "bc005db5-1af9-42ec-846f-d9ab684ff7cd", "comment": "Malware payload", "value": "a52365c1b4046926b85fafec1b26af9b9f4f7db356f4a5b5abe0cef36a58b6d46d1d1a31b62b21baa1fb0ef084817a1a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948862, "uuid": "26497259-1988-47ca-9d72-3804dedf8131", "value": "T1C1A1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948862, "uuid": "c99c93a8-52a8-454b-9643-b695a9f2caeb", "value": "96:ORYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ORJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948862, "uuid": "6407039d-ca62-41a4-870c-19187a34e6a7", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948862, "uuid": "7df59708-7552-427f-9aa7-6ab0e533a449", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948862, "uuid": "caf73475-cc22-4779-8934-8776fed784da", "value": "4adc268e1659361acda0cdbeca373f351f0bf786a4d8dba538003e1c7a4a2af9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac64d622-050c-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657978750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657978750, "uuid": "08683a58-f3b1-480e-8680-5389d221d79d", "comment": "Malware payload", "value": "7e364f0c53ab47d2dfc68ef2cbc628ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657978750, "uuid": "4077f2d9-7646-4a04-917a-23feca774c3e", "comment": "Malware payload", "value": "4b0b811922ef54485f8bb75aaadeedf70f173d56d958d5b980b8abcaaefb6540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657978750, "uuid": "0175b890-761a-4f98-aca2-38b082086e9e", "comment": "Malware payload", "value": "b88dc4a65d09e641dd8d1cf07ef1741d146cd686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657978750, "uuid": "d3510abe-00e3-4ceb-a5c0-7aa07d2291e2", "comment": "Malware payload", "value": "e0282116c4a6960e771b3c947a6bca25239307835735b45552400df6aa73852dfdf1b405c4f1c9e79c986624df004b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657978750, "uuid": "29fb0a87-b93d-46ba-938b-c2d027e00bf0", "value": "T107544F5263E90664F1F77F30D97906226E377C859E3CC24E025095AE1EB2B94EC78B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657978750, "uuid": "20cbab7b-5db0-4268-879a-449ead905ed3", "value": "e14388498639688dc750895bc5ef963a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657978750, "uuid": "89f69ba6-e8bd-4ce6-a8e6-94d2ebbf2f34", "value": "3072:yFbF3Otaxatj0Q5QCD6DZTRBW4FQ9NAabGErvXmlQJJxoUDbgyu5OhclqOivN/TV:yejl5QCuDlXW4+DiErv2yKU9pclqfNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657978750, "uuid": "fd9094a4-63f3-477e-a202-eebe212a742e", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657978750, "uuid": "94779158-e2be-4f0e-af7d-7942f5b623c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657978750, "uuid": "99b923a3-fa9a-4c12-b1f0-6c3c153e9a18", "value": "lsass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2212c05f-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948454, "uuid": "f8b13dd6-9234-43ac-9797-ac0eac3c5662", "comment": "Malware payload", "value": "798a309ef777191e453abfd578c21986", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948454, "uuid": "37803c2b-056d-42af-ae5b-d9eb86574fb7", "comment": "Malware payload", "value": "4bae00ec51c80e6699731a2b77852c6bff3cd1bad238daddd8151df011f3ff13", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948454, "uuid": "7c4fb752-fa49-4f99-98b2-7a47a9f5dbd4", "comment": "Malware payload", "value": "6593f8404afa29404a334750301f38b84c622444", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948454, "uuid": "0904e076-3cfb-4ece-8de7-acbfb4dc4eae", "comment": "Malware payload", "value": "0ce113dd70f821e654d513baed488d5cc066343e2ff548784705845a2adada63a111c84c742842f53e83cbd90738eb2f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948454, "uuid": "651099ff-e72a-4b46-a6a4-5bc6283e6aa1", "value": "T1C5A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948454, "uuid": "5814b27b-d14b-410f-a337-e61694cbc658", "value": "96:pRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:pRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948454, "uuid": "120d29a7-da01-4f71-8522-a8f61ff9601c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948454, "uuid": "214c1701-d9c1-445a-a65f-a120dad3a297", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948454, "uuid": "db6282ef-6ca4-43a4-aa27-fccbdc2ea4b7", "value": "4bae00ec51c80e6699731a2b77852c6bff3cd1bad238daddd8151df011f3ff13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67f7b64-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947870, "uuid": "9613ffd0-8c2f-4f96-9ea4-0682af6f0001", "comment": "Malware payload", "value": "8239a210886eceadc92095f08dac8266", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947870, "uuid": "2254429d-88d1-437a-9742-965176a636a4", "comment": "Malware payload", "value": "4c6d4614cccd892ffd940cc1ab17210fc19615e7ed897d55557d92f2237c598a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947870, "uuid": "614d657d-13b8-4efd-bdae-de3e12332894", "comment": "Malware payload", "value": "cc178892e6b8d23f06862216480949edd6fcec43", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947870, "uuid": "05dcebc5-b1e3-4f36-980b-48a16065b06b", "comment": "Malware payload", "value": "5fcf95c495032869d7ae33f91a09a6f591e27419a3a271cd147a16fd6b614cd6dc1711f317cefd31dbd92ad3be021cf2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947870, "uuid": "f1956e9b-24b3-4a04-8d1e-63d8d8f315f6", "value": "T135A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947870, "uuid": "18fb2fa3-d10b-453c-a7af-24c63d3eb1b8", "value": "96:aRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:aRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947870, "uuid": "ad93287c-becb-4d9a-9d6e-22af39e4b2cd", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947870, "uuid": "ae097d25-3668-486b-993f-b7a263042528", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947870, "uuid": "a65b109a-0b94-4a0a-97bd-7c9ce51ffd0b", "value": "4c6d4614cccd892ffd940cc1ab17210fc19615e7ed897d55557d92f2237c598a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a73044-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948023, "uuid": "d2f81de4-2e7d-4f7f-8920-0ce6552145cd", "comment": "Malware payload", "value": "8fc26688b7e7882da6258ece4b5d9028", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948023, "uuid": "66a39bda-f810-4e8f-a296-3478beb05306", "comment": "Malware payload", "value": "4d6bc7ffd93cf6d6dcfabbfed745f5867c3f44ca28a94e92160ba2994ed82950", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948023, "uuid": "cf2d9b61-2116-459c-9fc8-daffd3abcbfd", "comment": "Malware payload", "value": "80c2801b9b36c6a53007de19896f99ae998bc2f3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948023, "uuid": "7d2f1bfc-3053-4167-b2de-aa5ff50788ec", "comment": "Malware payload", "value": "ad7bf55699d2ad3849ef640c70123651ab6883318e1bab3c7ef16df6582df5daebeadb3ce746b516c1755d7c68802016", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948023, "uuid": "debe35fd-8de4-4112-8478-504e203db8f9", "value": "T193314FE556721C443CD80DA932BFCC8125CBEBD918DA9FBAE49A35308CDC442BC64F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948023, "uuid": "35b68d84-ac76-4118-9e8b-3eca0a2d6cc6", "value": "12:HdloZotfmZCdbIfH2mq1CdXf8DZ8Dt8Em/Cd2FpkmsCdh60Tm5PCdotz7SEamqDB:HTBIVEDeDiOUH9EWuwj6dJ5e5yvV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948023, "uuid": "29d40d05-8289-4e3e-a892-2137f074d933", "value": 1655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948023, "uuid": "5a9f62fa-ca28-441e-9258-5b4ba9ba7220", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948023, "uuid": "66ad5dbd-2429-48a9-92e4-41d92ff5b653", "value": "4d6bc7ffd93cf6d6dcfabbfed745f5867c3f44ca28a94e92160ba2994ed82950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b63457-04f6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657969069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969069, "uuid": "8ddb4db2-fc17-487d-9654-52f78481c9c6", "comment": "Malware payload (Mirai)", "value": "bc4d828d4aa2d88405e971b76119e69b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969069, "uuid": "e2126e25-7e4b-4f36-894c-5f41089d86ef", "comment": "Malware payload (Mirai)", "value": "4da5a2c7e1acc701608306669057c2d808d4de311bd0a266e528e5bb4d975c3a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969069, "uuid": "aba560b6-0e56-44fb-9145-6d84cc171b3d", "comment": "Malware payload (Mirai)", "value": "7371d94139ebe2bdbd22a5e3284d9035b3565540", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969069, "uuid": "2d501a48-8173-4780-af80-e8cda1f3b32b", "comment": "Malware payload (Mirai)", "value": "2df2dcdf181aacb4273f1d6088dfdc7e6d59d3e964e7f42f67d843db42e0e10c3e0709a4dcb1f922fb1d0467072d1098", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969069, "uuid": "47ed582f-7f63-4d7a-b391-5dfcf07def41", "value": "T1B5133A85BCD29A6AC6C0277AF62E108E3321B3E9D1CF320BCD255F01778962F0D67656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969069, "uuid": "2f1c0d19-ef32-4ff4-9f8b-4cc673fa0245", "value": "768:Mapnf6mv4EvEgw9mOUTe46jtpKur0sKhcSqborYzbTBNdf3:FymvtvxXXa46jtpKJ/hcSyy0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969069, "uuid": "3f669bf7-ea12-45ad-8c54-118c407285ea", "value": 42668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969069, "uuid": "5b521004-e28d-494f-98f3-e951a01e2ed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969069, "uuid": "a7db0481-7265-4d8a-8540-3e67aabff139", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73d2b30-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947818, "uuid": "4509d67f-8f35-4a3d-b973-07c836dbf9d9", "comment": "Malware payload", "value": "a2ec77dd2e2a0272c31d6ed955cca231", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947818, "uuid": "d16fb94f-54e3-4f0f-9298-d333e12f7a75", "comment": "Malware payload", "value": "4e0f603b24a4b7a2642aaff44ba1a957383c394ac6748034c39a255e9b9cabfa", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947818, "uuid": "a80ced00-c809-45f3-a26e-1264ac5d5e67", "comment": "Malware payload", "value": "411a16d437f099b533c2da31e00e6e41ccd71ec1", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947818, "uuid": "dc7b7821-d17a-4730-9f28-d44f543e9f68", "comment": "Malware payload", "value": "ae7f170468054e35b9e502910da31d870a2e554e985e0935eebb4c4835cfb12355f83c91b1f1aa9a75ec3f32944bf038", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947818, "uuid": "5afae604-4a2e-439e-88dd-70f6df94364b", "value": "T15BB53326343C2CEC69EF52E738F771D976DC7F6201B2C526D2E48E4519B222869B70C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947818, "uuid": "271c3aa0-dfae-4319-a6bd-7cc530bc0b9c", "value": "49152:mRhdchYOzk7//AtL2w0tALKTaH1SNzoZnL4+rUFve+Hmsh22Co:mmakkDotN06KTaHE2Z0qonh28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947818, "uuid": "2d1a1fa1-1b11-4c7d-ba94-037e7e5db1e6", "value": 2392064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947818, "uuid": "6c4b129a-1248-449b-9c0f-23062b933440", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947818, "uuid": "7037d1e5-72ae-48d8-a5f3-5d020a82b572", "value": "4e0f603b24a4b7a2642aaff44ba1a957383c394ac6748034c39a255e9b9cabfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d558c6a-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948070, "uuid": "a78c978c-535b-4739-9975-88e843189b0d", "comment": "Malware payload", "value": "64f33c8a72358629fc678ba504474fc6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948070, "uuid": "eb9d3880-aa5b-41e1-a8d6-c722bf1c0b28", "comment": "Malware payload", "value": "4e16f62ae5e09d17c3aba20f7297bf81516d7f08c2e635c6417bee15e00b9ae7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948070, "uuid": "b44783d2-6d0d-4659-8e5e-11e4a2fff2cd", "comment": "Malware payload", "value": "24bee51bee1de1da31dd9f6ec2d8c00fa83377eb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948070, "uuid": "8ec642ea-fb87-4589-85a5-da29b0d2b60d", "comment": "Malware payload", "value": "f997e434cb8056c1546a8443386dbd0a01b27f8b7f348ed691c37acb6d9ec02dd47a97ddbcb0c8c16aba52920df3a3a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948070, "uuid": "2f5deb67-0046-4e34-af0f-326bf600e536", "value": "T106A1F850112C1AB07346597AD26FFA52B40EC81B09777B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948070, "uuid": "dc849ac2-b472-49c9-8acc-61b93c3ff137", "value": "96:k+RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:k+RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948070, "uuid": "8002d7a2-88be-4e9e-b5db-ed8e13c3f95b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948070, "uuid": "e115371c-1114-446c-a73e-b57f8db83073", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948070, "uuid": "7e6ee12c-157a-478f-b76b-68b59ecaad75", "value": "4e16f62ae5e09d17c3aba20f7297bf81516d7f08c2e635c6417bee15e00b9ae7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61efbc2-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947816, "uuid": "a07039d4-3d06-4582-bd6d-752b7e297beb", "comment": "Malware payload", "value": "8b0eff0f3190974a5c9d31720bcc9025", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947816, "uuid": "6b68ef33-4339-409c-84f1-782ef87c5300", "comment": "Malware payload", "value": "4e38deb076d3c09618a34b434a6af8a33d7e60718aceba54f4facab00ce57a49", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947816, "uuid": "7c1de8e0-738f-4ff6-8941-def938227d67", "comment": "Malware payload", "value": "be4f994f0f687ae78ef5d760f30a3124bd49e3f1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947816, "uuid": "32baca2f-f29e-438d-b680-4a01d7391216", "comment": "Malware payload", "value": "57057760c74fb0e8fe18046287e97a586b34d35e446fc236c176fe408c14839fa9b43e9119c0c6b28f4355dccd841e1f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947816, "uuid": "0f506cf2-6531-445a-92d4-5c995932a59c", "value": "T18EA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947816, "uuid": "61e44c25-8376-4c38-809d-9a3576baf788", "value": "96:VRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:VRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947816, "uuid": "9438037a-b74f-4080-9e26-caecec1d597f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947816, "uuid": "03a542ff-fa20-4442-8a82-cede3d88641d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947816, "uuid": "d80bc164-deeb-41fa-b5df-920ff622e18e", "value": "4e38deb076d3c09618a34b434a6af8a33d7e60718aceba54f4facab00ce57a49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01b105a-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948745, "uuid": "a2f99eb6-4e1b-4ae7-b718-7ce1f7e75568", "comment": "Malware payload", "value": "a4070b679b3ba62c725ccd58c917469b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948745, "uuid": "5ca75633-3b13-4f18-ae83-9e4bc30aadd2", "comment": "Malware payload", "value": "4ea566528d358025d36c9b8bab3afaabc7527fbb689d1733022ded56031f6723", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948745, "uuid": "3dd3fa5a-8822-44d0-ab69-d90c752f7568", "comment": "Malware payload", "value": "186d5d5d7278ab445d3bbfb14e07f4f1125ae666", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948745, "uuid": "98221619-0a1c-413f-87dc-2929eb30e33a", "comment": "Malware payload", "value": "111b2810ba92477c8b642820aa397737a44c51acb414c3356079addc95fae61ec3c6eb768aa25d17eb4da050fb665481", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948745, "uuid": "43059c8a-f4d2-4962-ba37-d625ea792050", "value": "T116A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948745, "uuid": "0551594e-adda-4429-88ed-e03babd9b733", "value": "96:SURYZxQOBpLyxIcymLKY8M991wuIaQPYPW:SURJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948745, "uuid": "700ddbfc-915a-41ee-8781-e7084c54da29", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948745, "uuid": "ac4f561d-cb29-4195-bbc0-f83068fd5a55", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948745, "uuid": "a04c8662-b1c4-4fe4-ad42-f9f9f0b0e637", "value": "4ea566528d358025d36c9b8bab3afaabc7527fbb689d1733022ded56031f6723", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab23983-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948038, "uuid": "c5398dec-c10e-488a-82bc-52ccf66edc60", "comment": "Malware payload", "value": "352bf6a089881a525fac47b5fba9373b", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948038, "uuid": "2c74b4fb-c78d-441d-94d3-9a31796a4ba1", "comment": "Malware payload", "value": "4ee46bf10691ab32be994f2c006c579af98ea4b9f9c064a0f7dcc50c38fdd234", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948038, "uuid": "3da1b8cc-47cd-4cd0-a37a-6039cec25ab6", "comment": "Malware payload", "value": "46b6180b1827090324d382ba39db5d733f2d8d92", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948038, "uuid": "75247e5f-105c-4482-b15c-354e205584a8", "comment": "Malware payload", "value": "2fc9621de2d2a9dff3fd84c9ef043c552667594b94645119e9aff0ff335ab5b8d940fe0ae54e667572e8a40407c8eba8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948038, "uuid": "27aec150-2c7d-4c36-a71e-3fc56ae0e271", "value": "T1FED5330C43BAF8FCF89A0629276389D1C5ED21F0A58254B2D76C19981C3F5BE17DFA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948038, "uuid": "76a88262-273d-4fc4-94ee-ed324e33aa5c", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4m:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948038, "uuid": "c729b67a-f615-4d09-86a6-1394d83ae9cc", "value": 2940928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948038, "uuid": "e9e516a1-8f72-4eba-80d4-5b5cdf6c2688", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948038, "uuid": "6fe1defe-1a11-4449-9444-3c974846685e", "value": "4ee46bf10691ab32be994f2c006c579af98ea4b9f9c064a0f7dcc50c38fdd234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e337601c-04d9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Joker)", "timestamp": 1657956938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956938, "uuid": "7b0873f5-de40-4e66-90f4-d453fd7b0b6a", "comment": "Malware payload (Joker)", "value": "f5e1cfb9cab483bc6238e8c23a4c5fed", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956938, "uuid": "b7b130f0-f9b0-485f-b33a-be549396c7fd", "comment": "Malware payload (Joker)", "value": "4efd21ae2758250105ae95fd2de9eadea9fa26e33f1882ef84fdf5616806228c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956938, "uuid": "c09c57f1-27c7-41dd-83a5-7958eb6a08f0", "comment": "Malware payload (Joker)", "value": "126ed847542bcf6f25f19c14659279d1fa82abac", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956938, "uuid": "25c7578c-4d69-43da-af1c-04d63a32b3f0", "comment": "Malware payload (Joker)", "value": "558d5868ef119f4ec7b6e617de322f2177114addddff2605f05a0cee35a933cdc08dddc3b8ae790cf354597705a5fedc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956938, "uuid": "8cb5431b-68b6-4887-aa87-2eb3eed464ee", "value": "T1FF861247E36998AAC9F601B24DBED236C3630D964503ABD35E40F22C15B71E49F9CF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956938, "uuid": "2cfa39b6-9c28-46f3-ba54-46e120f21ae9", "value": "196608:SZoG9lYSYTx4x/k9nxgIFHqrGipLvgm5GlrtRO:S6GL0u/k9jhiFou2rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657956938, "uuid": "7aa8f4af-9882-4e28-8b15-f9b15a8b6e8c", "value": 8172180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657956938, "uuid": "699c690e-3686-44bb-b920-ff0cb61a5f38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956938, "uuid": "1398e037-5880-45de-9f00-70a682c7e22d", "value": "com.messenger.great.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb0cc6e-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948208, "uuid": "2c93299f-21dc-4172-ad33-950a1c49c82c", "comment": "Malware payload", "value": "95a22b94b61b2a10a254b3d18a823300", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948208, "uuid": "0f348955-25cc-4a1d-905f-cfb2b5acffa7", "comment": "Malware payload", "value": "4f09f5d7a69d70066e1ee5d25c74cbf37b76e8a924ab044e35490bd42be577fe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948208, "uuid": "7ac766f3-95e0-4453-a11e-b966044fa085", "comment": "Malware payload", "value": "6b6d3332a25c0b85056f5637403aa588b8f69fbe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948208, "uuid": "6c302331-d1c5-4e70-81ee-01332715b4f2", "comment": "Malware payload", "value": "4de3ba21919074c1d5ed492a4761e3a5fb20acf93bca9ba0bb4707f2661d41c1516a981b99d110b004aef92e2369b1db", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948208, "uuid": "760e2d9d-dfd6-4f2e-9f76-ce112c157c2a", "value": "T12AA1F750112C1AB07246697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948208, "uuid": "8129e5c2-0f0b-46be-bab4-10e2187c6822", "value": "96:6RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:6RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948208, "uuid": "0e56203f-5645-46f3-88af-40addb989bd5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948208, "uuid": "13254b16-f6d5-4ad6-ae5c-a21f98ee375f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948208, "uuid": "22e35412-7bdc-4b89-8e76-4925bae21594", "value": "4f09f5d7a69d70066e1ee5d25c74cbf37b76e8a924ab044e35490bd42be577fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c416b3c-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948095, "uuid": "17d7b644-b55c-45ab-83d2-f7654acd3879", "comment": "Malware payload", "value": "60d75af04ba9873fb276b1b16984c887", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948095, "uuid": "b949ef8c-fba1-45f0-bf5a-e47ffee4efa4", "comment": "Malware payload", "value": "4f4e5ca4f4e975398ee56178023bd50ea59808f739280784a654b44d87eb443a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948095, "uuid": "bfa580c9-b57e-4e7f-a13b-971c93dfa5b8", "comment": "Malware payload", "value": "d6f3f0b30058c74a1ec20424e44376f6b576caac", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948095, "uuid": "74948ddd-747f-4bc2-840c-dd1eacdbf6f2", "comment": "Malware payload", "value": "b829bd06b8dd767b1910e1d2ac2e52bf114bc788fbf5bb03a2eec720f4d6ae1a520e38fc9b8c8cfec1ad5701b4e56604", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948095, "uuid": "bd0b5fa3-e609-4a0b-93ba-234b4bf0a30e", "value": "T1FBC53336F4FB79743642E7E24608C9366BBAC34A3ABB37164EF89CCD512450B766C048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948095, "uuid": "43e610e6-e103-4b95-be0d-e0907738193c", "value": "49152:ijoGN5J3sAs+aa8d6q3RKNhvqa87NXcHnSySdkOFOd+LgEBHVCjzr1UEDw:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6HD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948095, "uuid": "97a14fbd-49f2-4a2c-b7a6-26e557de7c9a", "value": 2711552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948095, "uuid": "53202d5b-2b5d-4470-a674-b18c713c72dc", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948095, "uuid": "15c2907c-6443-4502-aec3-d461c9d4a63c", "value": "4f4e5ca4f4e975398ee56178023bd50ea59808f739280784a654b44d87eb443a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d597e03-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948123, "uuid": "f1b06f81-315a-4b83-8165-b36eb61bec66", "comment": "Malware payload", "value": "b137d6c2057aa654877c7896cccbdb96", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948123, "uuid": "35d327fe-dfed-4d3d-a7c4-2e12da7c45cb", "comment": "Malware payload", "value": "5005a84b179ba505a9384ab077b5c89c13aba14e2e21ec1f563ab66babcf18bd", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948123, "uuid": "5f2c1ede-103e-4ee3-8912-d3724a12cd59", "comment": "Malware payload", "value": "a5e9ee006ed5ca936e68318f4c5fa93c3fb42e23", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948123, "uuid": "60c80af9-3586-400e-8f67-43e18d61c84d", "comment": "Malware payload", "value": "f93207dde400fe323187123cde6b33557c3016135a359aae25208e8856d71e1eeca833ebe9e528e7e7272296d342d826", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948123, "uuid": "9da7ba2e-6b7f-4e12-b68e-352c45ad1e68", "value": "T12E06330C13AEF8FDE499463C3B6385A0C9E512F5D88225F2DA7814540C3F67E5BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948123, "uuid": "8d30961c-44a5-4cce-9463-f6f405ee8098", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKR:0XSxVJG2fLAqFOfT9sMYNM29R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948123, "uuid": "383c6043-7579-403e-b31e-ece2fe02f79f", "value": 3715072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948123, "uuid": "f8716892-7ca5-4a77-bb44-183219361c83", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948123, "uuid": "16dbc4bd-112b-4d2a-9e65-3cdbea898d08", "value": "5005a84b179ba505a9384ab077b5c89c13aba14e2e21ec1f563ab66babcf18bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b29f8c-0557-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010878, "uuid": "ce9ead89-5e48-4422-a1c8-eb28e84837e6", "comment": "Malware payload (Mirai)", "value": "c79db9ebd23a0de8ed6a86c7c5a1679f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010878, "uuid": "3b1eb8c6-349b-490d-b821-da109d99ed21", "comment": "Malware payload (Mirai)", "value": "50424aef93daab2b9e0a431011063551fbd2247c3346225427ee95f8ee18a28c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010878, "uuid": "ee478897-3988-4630-a5bb-1823d84fd238", "comment": "Malware payload (Mirai)", "value": "2a066795b1e286b74de7ccc30cd7c9ebecc8d4cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010878, "uuid": "e73a1ef7-054a-4098-ba37-0a59b7e7b5e0", "comment": "Malware payload (Mirai)", "value": "e96ecd2fbf25836906b61eb5698154b366945858db6fad5ae4cd7cb877087d5ce0fd3a9d153236f9c0b4c5dfdc937104", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010878, "uuid": "6049d297-8d4c-4b64-86e1-4f3f43bb1b98", "value": "T1B4634BC5E802DE3CF94BD6BE84160A05F931635456930F2BE6A6FCD33CB30689E56E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010878, "uuid": "efff4fc6-0b26-4cfb-99ca-66c974223530", "value": "1536:JrsL/1rt4F6Ns+ub5ez65xlUxK2kolQ8t5:mL/H0TVb4WHik+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010878, "uuid": "539cc817-1507-4b61-ae3b-9ec3d3a30ac2", "value": 69660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010878, "uuid": "1c9c94f6-fd0e-4147-a634-a22b63c1a970", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010878, "uuid": "9b8a9d92-0204-4c6a-8914-c3468c54e885", "value": "c79db9ebd23a0de8ed6a86c7c5a1679f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3868c06c-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948491, "uuid": "c7c70a77-fb8a-4044-b806-3377e42049a5", "comment": "Malware payload (Panchan)", "value": "aa2f02f7cc584df2ecd91c5b2898448d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948491, "uuid": "d2fd5477-7fd9-40a6-8f13-4f3ea234d321", "comment": "Malware payload (Panchan)", "value": "507faa4f21b49dfe3f16bd5265054848c99e3417a4caf96fa1e8c6dfa7521925", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948491, "uuid": "8bdd0d19-95fb-4127-b89a-ed7afefee612", "comment": "Malware payload (Panchan)", "value": "a4548a24b8a70d2b4e3631bb9c86d64abf31c503", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948491, "uuid": "5e5f4541-4af2-4ab9-8793-046eacd66e42", "comment": "Malware payload (Panchan)", "value": "ef3bae694432bb57869b5d9306719cd3934f04355af6b3d3154039d9f19bb1848389b0312d11a71b4b9b6eed9b916b27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948491, "uuid": "1e2a58d0-003d-494c-b7ce-ec53e81d3fcc", "value": "T11927CE73910338E9E5A98CB4D51425426DAC38875738A3C7BAC871F667FA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948491, "uuid": "e03a18be-e35b-4341-b402-9aa55ae8ccf4", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaz:sXyWSpV+Wu7rI3JE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948491, "uuid": "31ae8a3d-3eb4-4377-b2c1-b6bd3a09354e", "value": 21233664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948491, "uuid": "c26db95b-f092-40b7-9a56-17ee7699c5c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948491, "uuid": "cf036dbd-6060-4fea-9357-7ed987f747bd", "value": "507faa4f21b49dfe3f16bd5265054848c99e3417a4caf96fa1e8c6dfa7521925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ceebfa-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948371, "uuid": "d4674df6-4f53-4007-8bdd-08e06d5836c3", "comment": "Malware payload", "value": "7d61305cb9c88bfe4e75d8fc43cc71fb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948371, "uuid": "a3728694-3c35-4779-9a9b-ce629b811e91", "comment": "Malware payload", "value": "513f290ec31637fa92c344cdf3ba356fa251ae24c9d4585531a40240e7dcabcc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948371, "uuid": "5241399e-758f-4ff8-9adc-ff78e0b8f150", "comment": "Malware payload", "value": "35fc718e5ef72d5a27a81fd2a44f0dff7c2a49dd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948371, "uuid": "6af015bb-c3b1-4bcb-9448-ff035de51654", "comment": "Malware payload", "value": "e715c9a703c75674b9ef048a3d577f80be1d377d7b84167cbbea2f60576402172554baec92bbeca132897fc2ed7d3002", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948371, "uuid": "aad58c37-54a3-42e0-b26b-0c99bc86390a", "value": "T1CE512BC5A17136343CE798BB23361901359150121C95AE4A6ADEF8BF88CEECE7B541EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948371, "uuid": "b0102bfc-3645-4fe8-b4c3-4d4d71a10073", "value": "24:crUeYc1bcaRg+OacFqsIP4cbcWzcOc6+8caocwsc6+8clc4n:c/Yebn4qpz/XsVsXkpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948371, "uuid": "3f5b588b-909f-4fa6-a7f4-440ed4ba6a10", "value": 2679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948371, "uuid": "8f431c7f-ec35-4eff-8fa9-bc9d5abd4c18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948371, "uuid": "ce7f7540-5a4f-45e3-9c9e-57ddc5a04d95", "value": "513f290ec31637fa92c344cdf3ba356fa251ae24c9d4585531a40240e7dcabcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0e608e-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948445, "uuid": "b50999ba-4576-4f8c-8276-2374125fbee1", "comment": "Malware payload", "value": "8e5c6e6b6cb670d83748bdbaf978b445", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948445, "uuid": "eb8b29e8-2847-4a74-90b6-92b4dc340382", "comment": "Malware payload", "value": "515256efbde84c53a4e581631421d71dbb974ca00d93134b68cafd12c32131bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948445, "uuid": "1b07e153-9c7a-418a-a841-5964d7cefd7f", "comment": "Malware payload", "value": "a2f8d3a98c4747333400fd1395990c32849c34e4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948445, "uuid": "51803300-9fdf-43da-9093-da7ebbc4af65", "comment": "Malware payload", "value": "bdda09f62786241476cae0eb85c9982ffe9202504a6e70d18b78d79e7b26f49d9812986a1385b591548304c1cb905bea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948445, "uuid": "60229c5f-89bd-4c31-9102-b2acbeca62d7", "value": "T1F4A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948445, "uuid": "7da2acd4-55e2-4a2f-91be-6682630481e7", "value": "96:WRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:WRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948445, "uuid": "70b6323f-790d-4a61-9d73-775e6bcd3fe7", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948445, "uuid": "818f4473-8db1-4f18-9503-4c9585628bdd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948445, "uuid": "1ae55665-503c-4b59-a0c2-b6ccc75fb33e", "value": "515256efbde84c53a4e581631421d71dbb974ca00d93134b68cafd12c32131bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fc4297-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948351, "uuid": "8b82ff86-4716-414b-a8d8-3c20624167c8", "comment": "Malware payload", "value": "d93132aa2d00ffeb8f06c79b6a3d8ae1", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948351, "uuid": "b929c2a4-781a-4052-ba63-8b4fda162f28", "comment": "Malware payload", "value": "51a40aef31667e0474462b44912a0712e579a6ff7e8090d8f88aab8bd93918b4", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948351, "uuid": "3784d9a0-f09c-400f-b410-3e0ceefd4d29", "comment": "Malware payload", "value": "48bedbe5de0aa4cfc8f5387fd260c0cd5cc54f30", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948351, "uuid": "0f3f8464-30c9-4c87-a1a9-bf9bfea73419", "comment": "Malware payload", "value": "435cb7051375e8929ef469bf95e1722bb78bfd650fa9a5f9495d3c9d7624bb4306fbbab20a8af37f7fb1dacd7b0a2250", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948351, "uuid": "4364054f-358d-4777-b185-5c09b5622bb8", "value": "T1CA16330C2256F8FDA886195C37624DF0C1E44AF5AA8155E2CAFD5088493F6FF07DE9A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948351, "uuid": "445516ff-84e1-45ee-be4b-1185f1b23ed9", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAFE225K/g+7y:0XSxVJG2fLAqFOfT9sMYNM29SAFN25K2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948351, "uuid": "874eda81-e478-4b17-a0be-719fb8096b37", "value": 4341760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948351, "uuid": "197708f9-ec32-4dab-8c2b-797be8a4fd5f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948351, "uuid": "99734011-464d-4606-8329-ee2c8643deeb", "value": "51a40aef31667e0474462b44912a0712e579a6ff7e8090d8f88aab8bd93918b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be443374-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947857, "uuid": "83b464b0-a916-4e69-b8d2-9c704a18044e", "comment": "Malware payload", "value": "690e5d3c41a911086cc5a8450f7acc78", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947857, "uuid": "88a8c008-7a12-4537-a592-67d353218fdd", "comment": "Malware payload", "value": "524b2f11d743aed89667fbed0ad82aa2dad5f98dd3df9abfae161cdfb1fc5be3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947857, "uuid": "2e3c7ae6-de7d-47ee-9144-88c9032dcc70", "comment": "Malware payload", "value": "60d4bf558556f695fe8ebc51f874735368941f16", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947857, "uuid": "42a4b89c-504d-4f2b-a5e9-a05c516c5a6b", "comment": "Malware payload", "value": "b6785854c353f1012f5fa28d542c33c283394f49898e92285d899ab53eb2a91916bf1ef717cef0c5742eeeef11b6ab4a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947857, "uuid": "389d0111-605f-4d30-a945-b44ccb7cef52", "value": "T1CD2163EE8C22EA7B1F031EF0BB2370AC97718E8B7CE3DD295BB0816870468515314381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947857, "uuid": "0e24b0d1-70aa-460e-8783-d1b19b7281a3", "value": "24:KWPan94bMGmQIEfSyNnumVPRO0VYExuEYpMqyAk9GfdaMGIutdfv:KWPa9wzSFmJU0Vf8l6qO4dh8tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947857, "uuid": "8848b623-dcfe-4ed5-aea5-aa6253aa9f29", "value": 1130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947857, "uuid": "cfc95a06-060c-46ef-9314-ca891a1a6511", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947857, "uuid": "f0f573dc-5774-4bde-a35c-108c2ddef946", "value": "524b2f11d743aed89667fbed0ad82aa2dad5f98dd3df9abfae161cdfb1fc5be3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14532f34-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (XorDDoS)", "timestamp": 1657948430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948430, "uuid": "23e7857c-371d-4929-b463-131cb8cd5e40", "comment": "Malware payload (XorDDoS)", "value": "3e88818ab86fecb3e27e086181f3def3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948430, "uuid": "3d68674d-d4b0-4154-9a1d-b691be1dfa3a", "comment": "Malware payload (XorDDoS)", "value": "52d0b5ff6f6609558e016ce118c869c91c627a6741929ea833aba06843aa6d52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948430, "uuid": "d4f7bbd4-8432-4d54-b95b-d08f13257d56", "comment": "Malware payload (XorDDoS)", "value": "db2f7722a869bbd42b1e286256ce5ce220659453", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948430, "uuid": "c71e8102-919d-45c3-be7d-84a7a0437007", "comment": "Malware payload (XorDDoS)", "value": "621ed218458508662d2e3b6323d9b2afd1bdfff58f912136291f207710156268bf81a341821431e0ff75867f37e0912f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948430, "uuid": "5b01c077-40c4-40a3-b173-fe71633804e1", "value": "T1A181930AD10381F2DC3B0272176BE6FF67380135E8658E60D794EE55B673D9A3898730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948430, "uuid": "46d73048-7264-4435-9d6f-a1a5cc8097dc", "value": "96:flQ92E0iVOP0S8tEGMVjuaviVulCA6fvcI:fG9IQtEGIE2CAQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948430, "uuid": "eb0559f5-fb14-4f7a-b186-cf3a6851c4c1", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948430, "uuid": "543c511e-29f4-4f4e-a2a8-5a66d9b97b97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948430, "uuid": "732e99e8-c583-4ec9-9dee-9faf953ae6ee", "value": "52d0b5ff6f6609558e016ce118c869c91c627a6741929ea833aba06843aa6d52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e86994d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948072, "uuid": "3d8536ae-8a5d-4718-9547-4542d1d854f9", "comment": "Malware payload", "value": "a81f428ebe026d403185858fe7a900c1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948072, "uuid": "638d57bc-333b-4fea-8520-b092ae8a06a5", "comment": "Malware payload", "value": "53183876690176aa12e2efb48ad30944f542904d206684bfe5ae2dc9743274c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948072, "uuid": "bcdb0769-c39b-410d-aea6-e4c3bb8e6ad9", "comment": "Malware payload", "value": "7b80034e8673917a016d917053dcc5901c694314", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948072, "uuid": "12e86454-4958-4650-bd74-080d460c7b9e", "comment": "Malware payload", "value": "192c50bdc936c12b65b4f1570be1a2e6cfe34ad37d9a1cff647dfb586934b7e0a67a9ff2a7fd53cc8e12bbd9cb0a715c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948072, "uuid": "6040943e-259d-4561-b012-44001408656b", "value": "T122A1E650112C1AB07246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948072, "uuid": "a4101368-9044-4479-b69f-9ebbce1544ac", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948072, "uuid": "cfbbae6e-b648-4e07-b55f-06a32d8dec86", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948072, "uuid": "eaa6cce9-4fbf-433d-bae3-8c35dcca2925", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948072, "uuid": "0f2d87e1-11c8-4808-8525-900e74ef2077", "value": "53183876690176aa12e2efb48ad30944f542904d206684bfe5ae2dc9743274c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3f8210-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948789, "uuid": "4c7b8974-84aa-4495-b27a-3467852e5ec5", "comment": "Malware payload", "value": "017e20da1b01fac221dbb7c8e8101cf9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948789, "uuid": "a55b9e3c-720d-4ab2-8b36-d02173161d4f", "comment": "Malware payload", "value": "534f62e75abcbb088a215f58a4a90edd734e77cdbea3029c53ffa1306708f61c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948789, "uuid": "04fd5913-1563-45d2-b5f1-0403d0e9558d", "comment": "Malware payload", "value": "1793a5d4c73d8882ebab49bc6b778f1d3ef15f7f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948789, "uuid": "cfa1d834-f479-4761-9156-fe87d2b1e976", "comment": "Malware payload", "value": "eeb1fe7770ea01a10a61b0440b9faf08f28748c39bdfd68fb255a9483cfeedba964855b97714f08056b19ce5e7958443", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948789, "uuid": "8c4926d6-177d-4124-9112-065515d901e7", "value": "T157A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948789, "uuid": "4183866a-6538-4726-b33e-8e6639af72c3", "value": "96:TRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:TRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948789, "uuid": "63dacb05-1b4f-4405-88d8-e3810beb17e7", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948789, "uuid": "933093e7-6631-4713-afc2-bd59f8a85883", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948789, "uuid": "6adab62e-bb77-4058-b236-42720134d97e", "value": "534f62e75abcbb088a215f58a4a90edd734e77cdbea3029c53ffa1306708f61c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57e4b9e-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948379, "uuid": "baf113e4-ffd5-44bb-9bc0-a1c798c20c05", "comment": "Malware payload", "value": "c2e7d718487ab3ff18161d1f395df703", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948379, "uuid": "be7e562a-f303-482f-b8fc-0baa20f6cc3c", "comment": "Malware payload", "value": "53603ea7f4406dd145f1f6af9eb79bdef01d85d50974fab8a6a3f951e5ebf890", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948379, "uuid": "d83dafc1-ba18-4069-8e84-1a6c1e51f4ed", "comment": "Malware payload", "value": "0c356cd55dbc1ca856d5658ef81f58149865bcb4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948379, "uuid": "16e4dde5-b538-4843-974a-7bd783ee18bb", "comment": "Malware payload", "value": "5c17feca56861a13ead5144060cac2e71c77798d8c3b6cd974d524e9eab24b478a1044367c2cbea41f537ce6ce680371", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948379, "uuid": "37e02f3a-5765-48a6-a0c8-bc2d63435f48", "value": "T1A9A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948379, "uuid": "2b214af1-3bb9-48a7-9b74-5ccc9f53d2ab", "value": "96:QRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:QRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948379, "uuid": "5923812d-339b-46be-ac95-93d376a33fc5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948379, "uuid": "2730df4a-4dfb-46a0-8726-a661f2d6c10c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948379, "uuid": "f03f9e2a-d82d-4d35-a340-2d2630b63993", "value": "53603ea7f4406dd145f1f6af9eb79bdef01d85d50974fab8a6a3f951e5ebf890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df21395-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948124, "uuid": "d8b46e59-9d0f-40fc-8cac-81ea62ee5384", "comment": "Malware payload", "value": "5f137648d9eadb262eef1e157f1c88f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948124, "uuid": "f71f8138-506a-471d-a047-edef86c4eb7e", "comment": "Malware payload", "value": "540cd33507a7839bbc38453a465f09613d94eb866aeb578adcd4b85910cf830e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948124, "uuid": "ef0ee853-7ba8-4a1e-aa93-b6f95cb4fabe", "comment": "Malware payload", "value": "d5b12ebd79bd9de7eb02b193fab220e53a94f42c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948124, "uuid": "cd0dec6f-2def-45a6-9785-cd75f3a94b58", "comment": "Malware payload", "value": "e4e3fe0a2b9d996e09318da5f10c61802d4a46f50cf6464b22f8387d6e0b70c80996346680c6df81d9fe507d8c010ca0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948124, "uuid": "49311391-33d7-4cab-a793-ca617e3714cc", "value": "T1E4A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948124, "uuid": "d1d95ebe-548e-44b0-8793-ca077de58fcd", "value": "96:KRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:KRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948124, "uuid": "b11b99b0-4e07-426f-b28a-e987cb60b11f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948124, "uuid": "7f7c5346-6e89-40bd-8603-69de9da43782", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948124, "uuid": "ace37491-baa5-4480-9c7e-fdf2b3a727b8", "value": "540cd33507a7839bbc38453a465f09613d94eb866aeb578adcd4b85910cf830e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef28b7dc-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948798, "uuid": "bd563c1c-1d24-4ef8-b695-15aba0da2b71", "comment": "Malware payload", "value": "6e0d24f448af80118d28b1ccee84d5f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948798, "uuid": "047bfa7a-4dbd-4925-806e-00f62471fc0d", "comment": "Malware payload", "value": "5463e96adc796d510a04a420ee8dcd0261b9173cbb8eb1afa8613b39b462b49e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948798, "uuid": "4e165f17-11c3-45da-afa5-4ee1e60605c7", "comment": "Malware payload", "value": "656e7226f1bee0dd2a871d84ff92e78bf85292f7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948798, "uuid": "a7752e1c-eaba-4d10-b948-5d00c94ee6b3", "comment": "Malware payload", "value": "ad9e7ff6fa24dafc5e98b49cebb49b239fbc6ee0a7d9971fe8a52c36dba2b96920ec368e292e071c9ec414889bac937a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948798, "uuid": "017f85ae-d6b1-4513-80f2-ffdf4e93598b", "value": "T1A9A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948798, "uuid": "0e4b022b-08ad-4a88-9813-e2eca71ea3ee", "value": "96:QRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:QRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948798, "uuid": "af351ee8-9c0d-4edd-9531-85d3ea7d8b56", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948798, "uuid": "00c93c69-bc47-455b-a2a0-c68fefdecb24", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948798, "uuid": "d2fa5911-fcd4-4515-8f48-51d7e46e7eae", "value": "5463e96adc796d510a04a420ee8dcd0261b9173cbb8eb1afa8613b39b462b49e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc2d954-04b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657942403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942403, "uuid": "16b00e54-d739-4ca3-8b84-3153e9793c61", "comment": "Malware payload (Mirai)", "value": "5b9ce6481dbe675443bce080c819b271", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942403, "uuid": "6b08e118-f34c-4862-b3e2-6826c6c68cc0", "comment": "Malware payload (Mirai)", "value": "547051378645f0ee0162d43d5a2f74aaabebcdd1576697c882792cdf75ab1ece", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942403, "uuid": "4a18de45-613f-4089-90d6-d305d3342689", "comment": "Malware payload (Mirai)", "value": "ce465dc32758b1495958338257b729c7a65bbb0d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942403, "uuid": "c70b9a30-b225-4669-a685-a8e9b60aed92", "comment": "Malware payload (Mirai)", "value": "e28d491d8bb88b0dfcb3107558bf07a181dc3e3e3661e7235439451ee0caf2f21ddb4731ef61db65a1e5618055c56c33", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942403, "uuid": "5f4e6ed0-ba91-4646-b4bf-965f6089abff", "value": "T12C3318C4A5C3FDF1EC151A3D207A9BB25E77F93FA071DE9AD3981933A901602A20625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942403, "uuid": "28de578a-fe99-40a7-9b9b-ae1c762c36eb", "value": "768:OYIx79l/h+fOQqIytpyyIC1lZALYf8UpRbgwhBK4dHXkzp4zj3fXEZJ:Ozx79lJ+lUpyyICaQ/hBtHK+j3fEZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657942403, "uuid": "e4b39de9-e6fa-4ecb-a3a6-3d187b9f8c42", "value": 51408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657942403, "uuid": "5a0aa160-0ff6-4f0d-b43e-c06c616f0de7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942403, "uuid": "0b47cf5d-1524-484c-b235-855f8a5a3aeb", "value": "Ares.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda60e2a-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947882, "uuid": "926ce0bc-d78c-4e84-9389-9750495f523c", "comment": "Malware payload", "value": "0075a41c1e3f1812ae2d0d6237ef0c57", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947882, "uuid": "037c9ece-fdf8-40da-9b3e-bedfd9fe30b8", "comment": "Malware payload", "value": "5479b294e0c4256602614ab4cf640345b0be8dfdc87e8248592515c206ad796a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947882, "uuid": "29b1e419-0339-42e0-bf5b-472b932cd43f", "comment": "Malware payload", "value": "d4c4b82b3f66249d4acf838cac5a92220fb1d6c8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947882, "uuid": "d622ca59-877f-429c-89b2-b51c1237a935", "comment": "Malware payload", "value": "08183c73f5b3d541a91488c97cccaa9f94a393be3afbefff3ac31a06ae734ca7e06828ead1d886785452143a8967e47b", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947882, "uuid": "043d5e7d-4eed-44eb-a0a3-25c844d6818f", "value": "T178C533BC72DE24FE86D4A273A7EFD928302B658D60218790ADB341CD1C16231D9EDE5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947882, "uuid": "bb7b04b9-13ef-4c85-b73e-f0615f3dd054", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5Y:tos909Qg6ecEZHyEexmLaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947882, "uuid": "7359600d-5998-4282-9b9a-de2fccabc73f", "value": 2523136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947882, "uuid": "5e1d53db-fbb4-47c5-98ea-959cafc20576", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947882, "uuid": "5d4a8728-bc06-4e78-854c-e2e0a46dd1ea", "value": "5479b294e0c4256602614ab4cf640345b0be8dfdc87e8248592515c206ad796a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06542c1-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948316, "uuid": "f8b7de10-73b6-4083-bd15-3c89d499ed17", "comment": "Malware payload", "value": "cf68b56b8f08e5bda6f6603a357b3440", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948316, "uuid": "d7b69c81-c0f7-4973-a535-cf6b68c38160", "comment": "Malware payload", "value": "54850d17925adf6c695c83c43d33ef0a4e7785f88778583ced92d100949a15d7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948316, "uuid": "67fc8a40-16a3-4550-b47e-3dab6b2f2f36", "comment": "Malware payload", "value": "4a80724998b11df3990f5a4701b34b8066a1d02e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948316, "uuid": "ab68b5a4-c866-42f2-a3e7-f86a20bc2bbc", "comment": "Malware payload", "value": "c193069e48626e48f09c31c681c5877b9c8730917eda1699b175059da91d2a493b58b65f58de946868bbbc28d3dc348f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948316, "uuid": "9c93946b-5e4d-44e3-aa0c-6e0af9075951", "value": "T14EF0F4CE80216C746012CF8DF583C04859B0C5CAE6EB3ADA77AA167E8C59C003FFDA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948316, "uuid": "7daef8a4-67bd-45d1-a1d9-6ea591b9eefd", "value": "12:3WKk42PRrFwYfaEZRrYwYfaEZRrwV4wYfaEZRrwbW8wYfaEK:GTrmYfNr/YfNrwVfYfNrw0YfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948316, "uuid": "efe98f06-1940-43b0-ba24-468d9e94cc08", "value": 531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948316, "uuid": "bde3d73e-eb89-40c2-a224-375cb01f0547", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948316, "uuid": "c076bcb1-dbca-4b96-a24b-f4c88d959d31", "value": "54850d17925adf6c695c83c43d33ef0a4e7785f88778583ced92d100949a15d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c541934-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948202, "uuid": "2c7187f2-8ff6-4166-8efb-969dc0cb57e8", "comment": "Malware payload", "value": "986da8d3e4106440468cfbaa4cef393a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948202, "uuid": "4f04373a-ed84-4c51-b81c-e609f4f8a4de", "comment": "Malware payload", "value": "54d2c90ff9c504175442555b4fd65aa2e59839b0890c57dd63ce4561be3381ae", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948202, "uuid": "de68ebd7-b022-4369-a9c8-3885893f186d", "comment": "Malware payload", "value": "cace3e8f002f01e464e4bb407fedc2824a165566", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948202, "uuid": "5f5f4abf-1585-4353-85d7-a3391a956a76", "comment": "Malware payload", "value": "5484faba16c286f504df0b1b1000e25cc8228c9ef0c0a00d68a9623a088f91eb9379bcbc1667e0fb7b7d16c6364b1157", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948202, "uuid": "594cf0d2-bca2-4994-9a46-cc4dcd3242bb", "value": "T1081423F762E9B0978054B7F9624AD3C1DA16C03933DFA92735A53CAEC85D83834B9C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948202, "uuid": "0eb517c3-b32a-4b8c-b5b8-9148c7438f77", "value": "3072:bxGK8lQY1TsBxxbb4sbc0+/mDJj3yVXFl/IfMAZnq22tRAa6NGx9q:WJl+blcj/mDNgl/I0AcDm2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948202, "uuid": "594c541b-41f1-4b5b-a0ea-f42700f980f8", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948202, "uuid": "35fe5b5d-afcb-4bdd-a150-87aad6b398f1", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948202, "uuid": "9d395182-926f-4e42-bdcb-3085ccafe880", "value": "54d2c90ff9c504175442555b4fd65aa2e59839b0890c57dd63ce4561be3381ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0739c69-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947833, "uuid": "9d32b46d-ad7c-4fc6-915d-e6fc89540d52", "comment": "Malware payload", "value": "3f80b5573e4edeb1e57ae65c0978ff67", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947833, "uuid": "3e31a7b0-0ddb-448b-ab45-884a2e1ab9df", "comment": "Malware payload", "value": "54e96df9a0dfbbba01923632574b075c0d072b5678562f122a40217dc5a6fa33", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947833, "uuid": "d800539e-a2aa-4ded-9d32-ffc6a3ff8f8a", "comment": "Malware payload", "value": "f91f0a6378a39e6346028c98345bd689d4da75a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947833, "uuid": "b168eea5-9867-45cf-b7fb-ab52233e418d", "comment": "Malware payload", "value": "1dd667e1843e1ba727627c489d37cd4a31a1ae5af250e8786fb1f5234a5784a265ddc0bffd003f277fce1ef385963cc7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947833, "uuid": "c672c371-e68f-4fa2-8258-5b1521493629", "value": "T160A1F850112C1AB17246597AD26FFA52B40ECC1B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947833, "uuid": "19823579-56ca-4cee-a162-5a0851d5cf81", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947833, "uuid": "6db15100-a93a-4a43-921f-672559b1ea25", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947833, "uuid": "1e47d8ae-50f6-42e4-9a1f-4877d33c911c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947833, "uuid": "97ba65d6-9a4f-48a8-8cdb-0b2853c38d2f", "value": "54e96df9a0dfbbba01923632574b075c0d072b5678562f122a40217dc5a6fa33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a0357e-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948077, "uuid": "8c5828ba-de8c-4019-ae8e-552398920dcc", "comment": "Malware payload", "value": "c6b1754b3da4ca6d2bfff63339e6fcb3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948077, "uuid": "0fb9719a-5b1d-4d5a-85a1-6bdd7e673567", "comment": "Malware payload", "value": "5562968228291dc27479182c2bb83beec2e9a047763f39c5d3747ecfab1d6260", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948077, "uuid": "5b14379f-8775-4d51-9fcb-7d44e404d8dc", "comment": "Malware payload", "value": "5edaf4a3acb1c0882754a322ed0292052045d46a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948077, "uuid": "a7634055-2fb9-439f-915d-86eae75dc9c3", "comment": "Malware payload", "value": "d19c446043788a9172f989cba4b4be0b7e2900e68ba78a28aa4234014b335a61932eef810a28c4e57283899771ee1d6b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948077, "uuid": "e618673d-1bf5-4baf-9d60-60a79ee87378", "value": "T105A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948077, "uuid": "36e42120-48ee-475b-aa39-11e0879d833d", "value": "96:9RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:9RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948077, "uuid": "889960eb-1a3f-402f-935a-6329cc71cdca", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948077, "uuid": "a8347761-1bdf-421b-882c-8fe6ad68549e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948077, "uuid": "e001c854-64c4-4623-8c4d-c2b2d78a6f26", "value": "5562968228291dc27479182c2bb83beec2e9a047763f39c5d3747ecfab1d6260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47f1f4c-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948323, "uuid": "61702b64-66be-4a7f-9dc4-6d1ddf4659be", "comment": "Malware payload", "value": "078d5b7fa0c40592b419351c43015013", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948323, "uuid": "a013498b-88b3-4236-a20d-6d3e79828835", "comment": "Malware payload", "value": "56041e6e531fb814f22b2cc2c5a2bceb5da813834fabbe27649774b8057565bb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948323, "uuid": "fa5e1051-a2bf-47f8-bb06-61777087019a", "comment": "Malware payload", "value": "87e19df584de46b06c8c4dde4791ca8f9b82ea9e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948323, "uuid": "7814a196-a73f-4584-b3ac-533ff302fc90", "comment": "Malware payload", "value": "72573abc4bfe17d73cb6cfa1c229575b693b50dc89972795967f38ee1438b766c07c00fa6cca05052339b409f792ae4e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948323, "uuid": "980d72ef-dc71-4437-9af8-0fd0cc72c319", "value": "T1F0A1E850112C1AB17246597AD26FFA52B50ECC1B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948323, "uuid": "7714f444-fcac-4a9a-b5ea-64699f96f842", "value": "96:oRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:oRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948323, "uuid": "db372182-0261-4245-ae7f-f23b4b3c7159", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948323, "uuid": "8e1c25d8-a0b1-4386-8cab-95f27fc57c52", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948323, "uuid": "c1dd69b3-7764-4123-8b11-5dd835f3082d", "value": "56041e6e531fb814f22b2cc2c5a2bceb5da813834fabbe27649774b8057565bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e044997-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948017, "uuid": "610d0eb5-080c-4ac9-8a7f-fdbbe2b1620f", "comment": "Malware payload", "value": "2ea1a53ae2f8ba57059c572ec9c3e578", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948017, "uuid": "1d539677-be5a-44ab-a39e-700b48f60b91", "comment": "Malware payload", "value": "563ff55b50266e181f832d5acdbdc237934323cb4091adc2ffa397e58e2097cc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948017, "uuid": "86141663-a2c9-44b9-b19a-3b8d74b9ca63", "comment": "Malware payload", "value": "a223ea4068b4ce38b413dffa68e831785cbf4d01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948017, "uuid": "c7efde79-473b-4c52-a14b-d98fcf715a62", "comment": "Malware payload", "value": "39cf5f3f011b8d6fc9b502afa33c21fdb54d186b69a4ecb959aab74c2a8bca48bf1b4941fed32b1172ee063ffb8a70e9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948017, "uuid": "8ee88706-27c8-4e67-8f72-70151cd5a677", "value": "T15BA1E850112C1AB17246597AD26FFA52B50EC81B0A777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948017, "uuid": "e0d19013-4f3c-4659-b289-44cb31c03347", "value": "96:FLRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:5RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948017, "uuid": "2022e05d-04ae-4144-9de0-c251730e63f7", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948017, "uuid": "41d0485d-6c0c-489f-a07c-c133f50cef27", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948017, "uuid": "4233f86a-d70a-4646-9379-0aeb801ac225", "value": "563ff55b50266e181f832d5acdbdc237934323cb4091adc2ffa397e58e2097cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59959f39-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948547, "uuid": "56cf928c-8ac5-4f3f-8e5e-a85fccc0d2c0", "comment": "Malware payload", "value": "4cde131cb34f5f800614241e3121072f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948547, "uuid": "70aa0123-cff1-4158-8568-e98234b9b635", "comment": "Malware payload", "value": "5757a3ccecb0e59f3fac74ea20001076dfca6ec553b331ac9feafdd782f6156a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948547, "uuid": "450c1745-b150-404c-b3c4-567ef37a4f8f", "comment": "Malware payload", "value": "277cab6ccf36ee7475a7ec0ce073dc10123ba575", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948547, "uuid": "e5a8b6fa-f075-4a41-a790-9373073da91e", "comment": "Malware payload", "value": "44daea5f64a680e990fe7b446cb91dd0237b5e45b92739aaff5b3bdaca78e34ef3b91eb744bec902ce3c47c4b8d5d869", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948547, "uuid": "fdf3f538-3ca6-4a93-b497-ce529e7619dd", "value": "T1B1A1E850112C1AB17246597AD26FFA52B50ECC1B0A777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948547, "uuid": "7095dcbd-be50-4c17-a732-ffeac9a2f46d", "value": "96:fRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:fRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948547, "uuid": "69e62485-3c0a-4503-a049-7735e95d74ab", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948547, "uuid": "9f97179b-cf31-403f-9729-a3587ff06030", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948547, "uuid": "4aa5e7b8-77aa-401a-942a-2f32c1ff572f", "value": "5757a3ccecb0e59f3fac74ea20001076dfca6ec553b331ac9feafdd782f6156a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1fadc80-04e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1657961204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961204, "uuid": "1c5b9402-3e9b-48ea-b211-2ef7d5429432", "comment": "Malware payload (Loki)", "value": "f46efbd85b8081f08624063217c99f64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961204, "uuid": "c8e57748-a737-4dcd-a751-aff548f5c106", "comment": "Malware payload (Loki)", "value": "581a7404b154172a0981d85fee149b0bb5e5598de64042ac1a4e721c2ef21584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961204, "uuid": "8039c917-aff1-4e52-b314-2f55929d95ab", "comment": "Malware payload (Loki)", "value": "e510f2c7876b19188e7af331230f80147f64ff00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961204, "uuid": "f02b4327-3d60-4479-b086-2192782a1ff1", "comment": "Malware payload (Loki)", "value": "c6a8758e5cdcc7db3b4fc8109b73ba28fddfa9505bad63c4595a8a78932d540787c194bb3c6f63687ceee9beea20088a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961204, "uuid": "b3ed8238-f7e8-48b7-9287-f8050ccb009d", "value": "T1C905122372480B9AC0AD47F5E1325CE14772ADC5A54BFE264CC5B6CB22737909A0EBD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961204, "uuid": "c90b167c-7325-4520-99d0-a77a3ee9d2c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961204, "uuid": "04248b43-5ebb-4bd4-baff-59f0970f492e", "value": "12288:flhLuyAHnh7eHbPgktHkGsEGCzs22ThhfVT5/SIIN4WhKr65zXpX34:flhLuyyh6HbPgRI2T/VT5/vrWEr659Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961204, "uuid": "046234c2-8543-4757-aff2-310e053486fb", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961204, "uuid": "2eb3d1b6-1974-42fe-9a87-cf6fafb3d2ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961204, "uuid": "be5ffdf1-4085-4223-9339-1ff5d55b0d07", "value": "f46efbd85b8081f08624063217c99f64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04b4bff-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948263, "uuid": "69e73608-9f07-4a5d-ac09-a08b953498e2", "comment": "Malware payload", "value": "80985a59163711b7e51aec7e791bdb49", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948263, "uuid": "91cdd6d4-d23e-457b-8aa0-a054e5ee5963", "comment": "Malware payload", "value": "583298c246e027def1a834ade3210a822a42bb6bee8ffce32f5308caeea00fc7", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948263, "uuid": "aa72dd00-cd0f-4ec8-9eba-a4968c65d512", "comment": "Malware payload", "value": "020156dca325c3038a7812160e04f6f929920146", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948263, "uuid": "55811cd4-7c6b-475a-8c25-b3b1786c9b03", "comment": "Malware payload", "value": "3ffc4489bcfb4f6f78fd96dd584f095ae560675adfe79f73556d948dfd90efaf6f9e315f5e2444481615996f8df8e664", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948263, "uuid": "02868d2d-b5e7-4579-823d-66ededf615a7", "value": "T1ABB533B975DE24FD86D4B237ABFFDD28302BA68E601187906D7241CD1C16231DAD8E1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948263, "uuid": "4b9243a4-c115-4404-9109-f98aceee00c9", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexf:tos909Qg6ecEZHyEexf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948263, "uuid": "0ceab69a-7772-4142-b7bd-ba51e38d09ec", "value": 2408448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948263, "uuid": "4294a451-8ce1-4342-ad0e-a551ba57fc9a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948263, "uuid": "a8878760-95e3-42ef-a615-3e0d71c5a31a", "value": "583298c246e027def1a834ade3210a822a42bb6bee8ffce32f5308caeea00fc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad40a3d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948119, "uuid": "6f8f5dfb-0765-41cb-acf5-8ddbefbfdfa1", "comment": "Malware payload", "value": "0e6ca6a5ff4a5583f09283f6a02d44c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948119, "uuid": "78628687-bc54-47fd-9530-29dde025d5e0", "comment": "Malware payload", "value": "5869e3f759ea853b2243dccbbca726b5130633031a236f717a56a807e3825a3d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948119, "uuid": "e191346d-e347-405c-9a33-d1badc982d4c", "comment": "Malware payload", "value": "fc9609f540bc8271e0d81ff6c09b1945f337a77a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948119, "uuid": "ffee13d1-3bbb-4c76-9804-0630d3d918fb", "comment": "Malware payload", "value": "5d23159e2a20dc7808109c1573a3030305900f00f6d37499fdfb28d9331c3bc2eece5cede01adc79b8636dce60d1d2ea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948119, "uuid": "60f888a8-7a6e-4785-a59f-86b0bd054e7b", "value": "T1E24191DD04B00CD84064882A3363CC669757EED50BD7DE84D7A182B198CC54FF8D6F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948119, "uuid": "3aef1da8-d0b5-42d9-bef4-38c214b1a8e3", "value": "48:GMygHAzoxp7HGZWx8DX8D78ZH8xYawDn5HU71kwWcHA7gVNXH2BDC0SHErPI2IUU:GMygHAzoxp7HGZc8j8H8ZH8xYawDn5HO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948119, "uuid": "03cdd766-91f8-4d69-926f-dbd19f04bb51", "value": 1965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948119, "uuid": "c3ec2b18-b7ce-4f4c-9187-7de856baa8b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948119, "uuid": "b027bad6-7dc5-4ab7-a59a-d57e7fdc249a", "value": "5869e3f759ea853b2243dccbbca726b5130633031a236f717a56a807e3825a3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b01bd33-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948200, "uuid": "1467a4ea-85f2-4efa-b9fe-e8235bea49af", "comment": "Malware payload", "value": "020b0e155149ded4cae61493494e86f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948200, "uuid": "fb702863-ebd2-4174-a6c1-29692445f8e8", "comment": "Malware payload", "value": "5897dc99aaaf5c4f420c1c70709b08e5b0a7c22b697ebb77106f0c9003f656e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948200, "uuid": "5d94adfe-b0ae-4786-af8d-f63d6e2675b4", "comment": "Malware payload", "value": "58160f19d1a36ef1699c375092961f25571ad9f4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948200, "uuid": "eb13ed02-c821-4d6c-b63d-476d61749454", "comment": "Malware payload", "value": "e8bfca88fb3a48d099eecc6345133c1afb9855227d1ac032facad05e830947dfd7edfac05e1f171510ddbfb3e15e44f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948200, "uuid": "def321e4-b209-49a7-b3be-480ccede62fa", "value": "T12DA1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948200, "uuid": "19084b4d-3d5a-4f57-afa9-ac99af199925", "value": "96:IRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:IRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948200, "uuid": "b2379e7e-97da-4f6a-8697-405276e6dcee", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948200, "uuid": "a8b80e82-2293-489f-a7da-a3fb7a54d8fc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948200, "uuid": "57a7e0a6-1704-458e-a21b-c16a6240a831", "value": "5897dc99aaaf5c4f420c1c70709b08e5b0a7c22b697ebb77106f0c9003f656e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d2ab55-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948114, "uuid": "71cbf612-a1af-462b-b699-32f7d59fca58", "comment": "Malware payload", "value": "f98423e89b9a0f22b3f14417cbc74046", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948114, "uuid": "4deed259-270a-402e-8522-f81c3e06c791", "comment": "Malware payload", "value": "589841e69a2ebe2af134a4b14469ec673f4151061aca3c5b4b8ebb221f25d7df", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948114, "uuid": "8aa66fae-825d-49d6-8dc5-5a133faacc15", "comment": "Malware payload", "value": "25268f2ba8b8f6a5d3c732b0c26a520b5f4379b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948114, "uuid": "d15ff436-6fde-4487-9613-93efec62be39", "comment": "Malware payload", "value": "eaf93f74d0b4814794214bc9d81ccf2d40f1ada14f5b33310c45033c0e71b24f72f3d0e65dd6b2b51531cb27e63ed070", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948114, "uuid": "c27068d4-b2cd-4f11-af29-60adf332c84e", "value": "T1FFA1E750112C1AB17246697AD26FFB52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948114, "uuid": "ab6c762a-d4e6-4688-8f3b-789802246700", "value": "96:4RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:4RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948114, "uuid": "d73e56ad-0717-4b0e-9f02-b2e1a721d619", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948114, "uuid": "18603052-b1bb-4662-bc5b-aa48d89e48c2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948114, "uuid": "f4b18e46-0b33-403c-a0a8-c023b1acd9b2", "value": "589841e69a2ebe2af134a4b14469ec673f4151061aca3c5b4b8ebb221f25d7df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05936566-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947976, "uuid": "f855f193-9559-4291-9782-d69398306d57", "comment": "Malware payload", "value": "f08ecd887e790ce749949e8c83ad00f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947976, "uuid": "9b61b091-f8cb-4370-83c6-01509ab2ab73", "comment": "Malware payload", "value": "58b20001cfe44a29ddcbba862721ae02892e4ce0decd2c86c7ccd5bd6405bfbf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947976, "uuid": "c2131500-9bd8-4397-ad77-b69bf735c8f2", "comment": "Malware payload", "value": "29c7fc9720da2b7325c1dc1af58f8e52003ebb93", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947976, "uuid": "8bca36e2-ec28-4553-b59c-3653724db2b2", "comment": "Malware payload", "value": "0b420b69bb47e6315179dc65d61ec6f382d6748b14a13b0c42d31acd9ffaf9effefa3afa2181d0bbd5fe3b854a38d474", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947976, "uuid": "9e4b12b3-cd93-4ef7-96b0-69740716f9cf", "value": "T100A1F850112C1AB07346597AD26FFA52B50ECC1B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947976, "uuid": "56c7644c-6128-4573-a2d8-f4ccca3ff0cf", "value": "96:1RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:1RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947976, "uuid": "f5649aac-1a15-4dac-b86d-306229740e15", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947976, "uuid": "d3202ba2-754c-488c-b69c-eb6ecfdbc573", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947976, "uuid": "fed1bece-00c1-49d5-8061-86057e8d4ea1", "value": "58b20001cfe44a29ddcbba862721ae02892e4ce0decd2c86c7ccd5bd6405bfbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9c82ad-04f7-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1657969522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969522, "uuid": "5ddf647a-50b3-4e98-93a2-2605d39666f3", "comment": "Malware payload (njrat)", "value": "3d31c2f4526bdf5b89b3afb7e6ed23dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969522, "uuid": "ab4bbfc5-c530-42cc-9f36-b3c0e0583ccd", "comment": "Malware payload (njrat)", "value": "591f16538ee5e8a22c5345d6a31e2b8210beab5c3d3c84434f9c3b58fba9c9d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969522, "uuid": "6dff59c1-d0fc-4416-8d82-59132bcc6323", "comment": "Malware payload (njrat)", "value": "564d372d7bc03ad0d8ad9d863e5424c8ce003d0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969522, "uuid": "1b72048c-f789-463d-87b2-2d583e04ce3b", "comment": "Malware payload (njrat)", "value": "1e5bda00a04631b73f003ed98c7455dc507b980c54d10b10b71cf5af82b550f8e605459408a125e1669e0b91da091f5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969522, "uuid": "2d729978-a228-46b5-a6ce-0f198bf3607c", "value": "T12C73AE1C93C69526D9EC0A79C9533A0127254D0DDCBDB2CB3F99B4863B722F029D973A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969522, "uuid": "b78920aa-c80b-4bab-a235-3e0b277c4950", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969522, "uuid": "ee39ec8b-2f26-4ad4-b05e-33758e59f419", "value": "1536:WcNFOlh4NRA57vdmTAEkr63B3g4bDliYAKKfNtq4AuHB:tNFGh4N6piAEvRFF5nQtq4Ag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969522, "uuid": "2075ba98-f70f-48ab-ac23-3f7bd6502934", "value": 76568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969522, "uuid": "59f19217-a78c-4934-a683-b546ab7f7e8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969522, "uuid": "096f21cf-1d86-46a2-ba4a-48229e6a0b4f", "value": "3d31c2f4526bdf5b89b3afb7e6ed23dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7517c215-0557-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010870, "uuid": "b1afd969-e398-4428-8fe4-07aa45266190", "comment": "Malware payload (Mirai)", "value": "1573bd5734bc9451b3ac17d4c8999877", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010870, "uuid": "4953c2c8-e653-482d-ad9e-82715f82cc10", "comment": "Malware payload (Mirai)", "value": "595b38f769b084eb69c3b82580b724f00fc4491cff47d00f946b565d396c978b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010870, "uuid": "70c9b54e-a27b-42d7-bf2d-b5e3963eceba", "comment": "Malware payload (Mirai)", "value": "c39dae0d6d51db7403f0c7676f13016b1db14146", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010870, "uuid": "d5259e3b-6c72-41fa-bd64-bddc8fb4d2c1", "comment": "Malware payload (Mirai)", "value": "5c8c08a41cf0199e715ce859da90a4651af372cdf1a57ef66634eb7c3c3c60e445b96b6103ecc14e1ad4dc8723dd2520", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010870, "uuid": "66fd129e-d91b-4ca9-af57-ea399fbdf2fa", "value": "T192630856BC818E11C5C512BAFA2E118E331367A8E3DF72239D146F2077CA92F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010870, "uuid": "b39f054e-4c18-4771-84a8-3d83d2459e71", "value": "1536:b4nDPNimU18s0N/yWINKbItQK2ZzOSAnEe3qzqITigQSpmc:mPNG896WSSW2hHAERQSpmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010870, "uuid": "99ccd26b-2337-43e0-8eaa-abea869afe4a", "value": 71088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010870, "uuid": "09e451cd-8f6b-42cb-af22-c6be33f42474", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010870, "uuid": "571ce2a1-df0e-462b-9654-3f3f60cb43ac", "value": "1573bd5734bc9451b3ac17d4c8999877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8a20dd-0557-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010805, "uuid": "d9d8f41b-85b5-4dd6-bc66-e1349367ce12", "comment": "Malware payload (Mirai)", "value": "4d6617d10a6aec6b008a43372fb87088", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010805, "uuid": "6857d83e-0a50-4592-b587-457f4c76e4fb", "comment": "Malware payload (Mirai)", "value": "5965eb5b906b32cd4a91ac13a9149ff8c765346d9636a87975fdb7e67d3549e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010805, "uuid": "bb8f2251-5da7-4a2c-959f-55b81ccf8c80", "comment": "Malware payload (Mirai)", "value": "e9984e1b0f73e6f4e6893ef7a62264c09c9f7737", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010805, "uuid": "e253ab7d-fd4b-4dc3-9f50-75a843d4c4b6", "comment": "Malware payload (Mirai)", "value": "20eaa1696b4bb8fe0b581d5a661d973cdff63145b14c7068f9be3c42a33a4605ee4a642f1fee5ecdecb15b9ce90348e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010805, "uuid": "85d8d5b3-87a0-44ab-b805-fb7eca104534", "value": "T10B536A25AD7A2E17C1E8A17A52F38364B2F51B4E25B4CA6E3D760F8DFF4094426631F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010805, "uuid": "336c08f8-adda-4985-8d8a-965a5c0de5d5", "value": "768:Aj7OjGro2orFu1+VV5dOZ0hzaSKJgGvvaQO+WTIbelVENSGS:AXuGro2oFu1+VVKZ00SlAa6kGelS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010805, "uuid": "6d944734-2c96-480d-8e8f-a7c70e3db87c", "value": 63652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010805, "uuid": "72811e6d-37dc-4129-9db0-529d0c14ee03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010805, "uuid": "4d7bccb7-44fa-45b0-a29b-b0cb8907d702", "value": "4d6617d10a6aec6b008a43372fb87088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8296362d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948186, "uuid": "ef294a4d-31cd-4583-9980-57daa60757a5", "comment": "Malware payload", "value": "81c48c3fc61efc14e4ebf3fd9ecd7e12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948186, "uuid": "80ddc77c-36bc-454d-999e-ac18b3550ac2", "comment": "Malware payload", "value": "59db435d2ca9b5bc678093ade07a13706f03584da28b80b37842f79d92b877dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948186, "uuid": "83f579bb-2a54-4282-8535-d246f3bb41f7", "comment": "Malware payload", "value": "dbf299448fac06e74a4b0b08426719a6a6eb6e87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948186, "uuid": "595c3237-712d-4fbb-af2f-2514b67cbd1a", "comment": "Malware payload", "value": "eb769b364f08aa8ac6bddf1ad96bc66fbe4ee6a721d357aabb98d0a2cc34c69f3b7692e070af92113a14ab8365ca0ba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948186, "uuid": "45ffdf99-3325-4e6a-a23c-87dfa3728cfd", "value": "T135D68C77910238E9E5A98CB4D11425426DAC38875738A3C7BAC871F667FA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948186, "uuid": "255763fe-2bce-4ca6-883b-b75c297cf37f", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVna4:sXyWSpV+Wu7rI3JEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948186, "uuid": "d0a42b44-a829-42aa-9f2b-114eb259f4c9", "value": 12746752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948186, "uuid": "3ac233e8-df2e-4d61-9d13-3a217ef8e752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948186, "uuid": "cbd08493-b89b-40fb-9cbb-ffb8e6d6c131", "value": "59db435d2ca9b5bc678093ade07a13706f03584da28b80b37842f79d92b877dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ceb86e-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657948621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948621, "uuid": "d15ea0f9-8425-4197-9d4a-fb384cda2e5e", "comment": "Malware payload (Mirai)", "value": "67d8a736266d0330d11108725abbec0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948621, "uuid": "1ac01baf-253c-4717-a288-c6014a0880d4", "comment": "Malware payload (Mirai)", "value": "5a78e6de9f841f0469cc9125e550ee725865dfd103be12d17b953c20a5eae980", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948621, "uuid": "35a51d88-830d-43a9-83db-1ad278d2acfd", "comment": "Malware payload (Mirai)", "value": "c0d0bd4f834c042ea1ca9f31517e3f34acf2ca3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948621, "uuid": "519950d3-1df3-43ba-a1e5-d886e4021e96", "comment": "Malware payload (Mirai)", "value": "71b00cd6b89d9e8a119b411c8851f0e3bb5ecae81d17ac49d9541047e7966914107ec76983c4baed9b028e075b176419", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948621, "uuid": "b487f3e1-0a3e-449c-b7b9-28f1b61136e0", "value": "T112D2D06CE70207A8CE52D0B95BA907F52A764EF4A4CB7C33029577A2CB409BD3C639D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948621, "uuid": "adc9c9d6-b393-4966-a382-34cc88f7f836", "value": "768:IPyvYLznDEB2iC+spD/N1J7n5JmGrIe3DBkBzJgGlzDpbuR1JB:3YnnDEBI+spjNH5JmGEOCvVJuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948621, "uuid": "a886916d-486b-4460-99e3-946f2ee2352b", "value": 30872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948621, "uuid": "23109a1d-4714-4f9f-8926-aeee30a4283c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948621, "uuid": "4e12e29a-46ae-4c5c-8dea-56ad07495343", "value": "5a78e6de9f841f0469cc9125e550ee725865dfd103be12d17b953c20a5eae980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1efba3-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947912, "uuid": "eadf2f9e-bcef-46bd-92c9-2a407075fd89", "comment": "Malware payload", "value": "0d28ac49d3d3ffca792db0be619ba91d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947912, "uuid": "cba08384-f4e2-4c3a-b49e-249c32f15c33", "comment": "Malware payload", "value": "5a893fea921126ef6949f2f6d9e2ca6825e3a9453913c301821bfee94f4e8bd2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947912, "uuid": "43640ef5-2e1a-4a65-88b1-c152db8174b5", "comment": "Malware payload", "value": "fce1493839a22dad31111c048a2a513e72a08c17", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947912, "uuid": "bc541bd4-e57a-4842-b3d3-6c454f275b93", "comment": "Malware payload", "value": "6ee775b45cdabb5419974c7f7a1ae9a9e2d893d4c21f4b4fe8d4e48a699462b17ff7ca9927ac8494f7eafb6358418616", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947912, "uuid": "5d058e6c-f4a9-4308-8bec-3a672fadca03", "value": "T1D54188D5109107BD3CABDD52B1FA47C432819D9695CA1F2ED8D87CE998CCD4838E2AE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947912, "uuid": "c375b71f-c12f-4a28-9347-1eae4a9687c0", "value": "48:vuHAY2l2SFiMn2C2r2W212f2Q2s2D2T2g5:vW2l2on2C2r2W212f2Q2s2D2T2g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947912, "uuid": "6fe8a2a1-2d4d-4954-906b-c2e4d12fe6ad", "value": 2321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947912, "uuid": "415fe236-f3fd-47c9-8d01-a57190efbe01", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947912, "uuid": "6b2d6ae2-dc76-4ea1-8e85-87610b5de7ea", "value": "5a893fea921126ef6949f2f6d9e2ca6825e3a9453913c301821bfee94f4e8bd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd53babe-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948392, "uuid": "908017d3-98bb-41a9-844d-b1d2087c25a1", "comment": "Malware payload", "value": "4801c538c660c4e78185d95e9565e989", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948392, "uuid": "163787b6-4f80-481a-af3f-845340f1454a", "comment": "Malware payload", "value": "5b40629935a39d2826fca25b23d43181434fc0cbe0876ca91edbf85d489c49fe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948392, "uuid": "bc3253c7-2389-4649-ba91-03df2319db8b", "comment": "Malware payload", "value": "aa617b697135c8d4869587c629490cb65ffcb6df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948392, "uuid": "2f2b4f79-cb89-42d0-b6b0-4b41f841bae8", "comment": "Malware payload", "value": "166730dc76b4dd3d975b48d9591f87a43f6c1e023080862f7ab04f9ac847305c580f94bc7a7c70cae5e7f6e55c376263", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948392, "uuid": "7fec33d9-0106-4cab-bb1a-d42e9e9b9ad0", "value": "T1C2A1F750112C1AB07346697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948392, "uuid": "4091bed0-82ee-4080-90de-6bb1793ece82", "value": "96:6RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:6RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948392, "uuid": "dfeb745d-01bc-48e2-af8c-435065a133d8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948392, "uuid": "086ca9a1-7773-4737-bd2f-261f65fef09e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948392, "uuid": "933bf45c-eaee-40a0-8773-67cd6881c6f1", "value": "5b40629935a39d2826fca25b23d43181434fc0cbe0876ca91edbf85d489c49fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157275b6-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948003, "uuid": "1db4d308-e353-4489-9a49-6337f68635b2", "comment": "Malware payload", "value": "7c150ba898760241fc00b49b728e8f4f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948003, "uuid": "9d7383f8-ea47-499a-bf0d-3c27e0d74263", "comment": "Malware payload", "value": "5b6a616b9702e79e20479a14162bb6a25aeaa0d428a0434fbfa92d0ebf6c87d3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948003, "uuid": "80c32b76-71a5-4fc9-b287-a2bfbb26e006", "comment": "Malware payload", "value": "86151314faa8c5bc63477d3e111215b915634f9b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948003, "uuid": "2fd7be88-be7a-4a0b-a0ae-fa3b5025f6da", "comment": "Malware payload", "value": "e38f76070914093ecaf97219fe423958d2716a912a1ee12b1b6cd98764cc49963b19bcf935de89467c159f598d7b6ce9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948003, "uuid": "10c786d5-bdc2-4380-92a9-f3f267c91641", "value": "T1CF3173D812E11A793C6599A77AF40A06328195D7EDD12927ECE83DAD5CCCF083DE8E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948003, "uuid": "4f2b4863-7c4f-4bd8-9ed3-39526c480c1c", "value": "24:vVESUVdhdbiUVn6A3zKWUVO88AUV1AUVJ62bUVaIas8UVfWUVq2UVXben:vpUfTmUdhzKWUt8AUEUFUADs8U8U7U4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948003, "uuid": "897ecc2d-a25f-4881-a9a2-a0e07969c9d9", "value": 1743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948003, "uuid": "78069da6-2a26-4488-a78b-79fafbba4c94", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948003, "uuid": "b48c8dcc-caa9-4f41-95c7-0173f93335ee", "value": "5b6a616b9702e79e20479a14162bb6a25aeaa0d428a0434fbfa92d0ebf6c87d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ac3f64-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947903, "uuid": "b3094ec7-0a68-4c8b-8395-b7c9f1f51629", "comment": "Malware payload", "value": "4731b0dec4ae3deed04bbff27cef850a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947903, "uuid": "3626cb28-518c-4d33-9982-505e036dae14", "comment": "Malware payload", "value": "5bcbc406200ffaa4a0f107be9b60c6efaf1f9afa54acae379573c0be0c2c6f60", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947903, "uuid": "459da3b6-dfab-4e24-ba6b-15acee787d6e", "comment": "Malware payload", "value": "26a9f2b1dc01e34e8ad10473f51ab9e4aee48225", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947903, "uuid": "c478ca77-e01e-4e20-bb06-bb3465fecf1c", "comment": "Malware payload", "value": "12dbf2f4050f256a9ffa48f08706e8d98347bf6db6bed39eb722aa4800f82181e1a51f236460ea29859637df15e11af0", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947903, "uuid": "bc165baa-3610-4373-befa-c82a23114f04", "value": "T151A53379B6DA30BD9AA8B57767FFC924302BA6CDA0168BE06DB611CE0406131DDD4F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947903, "uuid": "8b205644-e1b8-4e8c-94e5-d1316a4086b1", "value": "49152:HT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQj:Hos909Qg6ecEZHyEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947903, "uuid": "f54dae98-54aa-47b7-9942-1713d5234e72", "value": 2088960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947903, "uuid": "4b1729cc-e2ad-4075-9062-44627713805b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947903, "uuid": "16b4767e-ee65-4fb8-ab63-ab2a7b923b8a", "value": "5bcbc406200ffaa4a0f107be9b60c6efaf1f9afa54acae379573c0be0c2c6f60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f50ad6-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948331, "uuid": "b449d50a-e2a1-4058-9c54-1bff5dbd9456", "comment": "Malware payload", "value": "4840f7ad9fc11431986e647f17a88b78", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948331, "uuid": "ec12f893-ab2a-4595-9b47-952e1fb49257", "comment": "Malware payload", "value": "5be61a9946f8e4984ca86fa03c1fe3b6098b0b54dc562e29b8d420c1b59cb11f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948331, "uuid": "cbb4d231-549c-439e-80eb-aa6597a51a9b", "comment": "Malware payload", "value": "ca7bc87f15aebe83480a8ec537ec421b22853c27", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948331, "uuid": "6e8901ec-da9f-408b-ae57-5819ce635eed", "comment": "Malware payload", "value": "2cb09880a24a356ec24612fc4c6fb722482563dd0f4544bf0bc18e82202f6cb3c207762a1a5350751938673897c2fa6a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948331, "uuid": "127e54c6-3067-4772-b7d3-f610c5f6c445", "value": "T1174186E0B6B176313CABB4D7A3A95E1471C570163C919F4AAAD8F0F4C98EE4536800EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948331, "uuid": "8aa9d6e7-5064-49f8-b93a-fe5fd13a9315", "value": "24:IjWUad29AJh5ad2eTuRLad2vzad2SVad28NL8Lad2uad2q1Vad2hJzad2RS/5adt:D3E7amq7J0YqJmAS/ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948331, "uuid": "4ab6e8be-cb5a-4cea-bdf6-f21ada2f733a", "value": 1880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948331, "uuid": "aec0e68d-9b9e-4fe4-a0fc-8c2fe461d4be", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948331, "uuid": "dfc00d5d-0e2c-440c-a159-eddbbd323649", "value": "5be61a9946f8e4984ca86fa03c1fe3b6098b0b54dc562e29b8d420c1b59cb11f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abc6a22-04c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657947206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947206, "uuid": "28e2bae0-900a-4235-b02e-922f9109697a", "comment": "Malware payload (Mirai)", "value": "cf10347a0cfd21af08f997d996394ceb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947206, "uuid": "2dc840b8-4c2a-4dfe-aa94-c95f91333a60", "comment": "Malware payload (Mirai)", "value": "5c159e55e15270ddc2d9d3d24a3f732d09d6258cae64d5c3de8ac13c10a450cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947206, "uuid": "b7ecc9e5-56d0-40f1-bca4-0ac14e44fbe8", "comment": "Malware payload (Mirai)", "value": "6a0ebe50ece76068362a8680bb463ed493976be7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947206, "uuid": "ff2e9a89-1186-4620-95f1-519e74303836", "comment": "Malware payload (Mirai)", "value": "12568f35d3c0b89a7ca9bf2db805a3628caee53a082fd43fdee0a7d89857c05f6907aed07d6f4632ba408fffea49916a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947206, "uuid": "8264e2b3-4ac7-479b-8a57-c7b77db101c3", "value": "T100C34B4AFB408B13C4D61775BA9F860937239BA1D3DB730699185FF43F8679A0E27806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947206, "uuid": "4a4082e4-89a7-40be-89d8-f45af8adf0ef", "value": "1536:DCnVTCoECOR5xLkPVyROel/3mUiNqR4YNlbEisZmUIWia10xb8Zkd6gUzw/9TIWX:cCyVCOel/3mUiN86ZmlWXWbFYjM/9TU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947206, "uuid": "cdd7191b-f56d-400c-bb54-a143fd755dfc", "value": 129551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947206, "uuid": "1dfebd95-790a-43f5-9e1a-c79a2b7ec5bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947206, "uuid": "a2d1ac96-7a7f-4b88-bb9e-bbb7f5dee77e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6ad671-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948020, "uuid": "056ef417-4a2b-41ef-9650-9690d7643c94", "comment": "Malware payload", "value": "b874d844dbf24587a1a7a8d4d786a6ff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948020, "uuid": "2fc5f095-1405-452d-a6bb-ecc9d913a5cb", "comment": "Malware payload", "value": "5c85f8deef8aa3afef6d3d588b0371eb1d5921fed0c1d1f82ba0fb5fa54005e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948020, "uuid": "c2bc109e-df39-4f91-b3e1-f27d2118c67e", "comment": "Malware payload", "value": "08f87045d737bb01bf20fb307a67c6ec92078e0b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948020, "uuid": "a75355cb-e12f-4d16-aa26-5fbdd2955a4d", "comment": "Malware payload", "value": "179fd6a8757e5b75df8533e44f92123e7e808fad255dc897bef2d52aa06bab155fc065c2f645d6267b693a97116ed302", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948020, "uuid": "2acc3097-a84d-4655-8b92-9b665706d552", "value": "T111A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948020, "uuid": "69b82937-b295-47b0-a675-7523a6bc4131", "value": "96:uRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:uRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948020, "uuid": "f42ec68f-181a-4550-9778-0c87a855761a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948020, "uuid": "0ffbeec2-daa9-4ae3-afca-055d875ddfe1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948020, "uuid": "85657876-faf8-4f4c-a19d-97378c8279be", "value": "5c85f8deef8aa3afef6d3d588b0371eb1d5921fed0c1d1f82ba0fb5fa54005e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66935f3-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947897, "uuid": "e92b8b6c-b302-447f-b2d8-131902b49bd9", "comment": "Malware payload", "value": "c2a703a0ff1f1fa1873efcc580ffdfad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947897, "uuid": "d374f719-9c51-4c52-b55e-5b71d1f9b178", "comment": "Malware payload", "value": "5ceb397285c015b84a7dfd4bd013bf602410e40fda4564d92630e1924a375fd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947897, "uuid": "098c3f94-97f0-47fa-b903-9566e573eb90", "comment": "Malware payload", "value": "7ca787265a0481e5dd494a500ddb3a02bc93e746", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947897, "uuid": "3be60a12-4154-4755-92cb-f2bcde86662f", "comment": "Malware payload", "value": "b86c5c638279e3d2e2ef64fc9c6a26ddc13a3c45efa719cc711d3c2caee829c95e1fc9b9aa5451337c37a342ce31ea01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947897, "uuid": "ce7ad263-b2b1-410c-aa8d-1adc0798d3b6", "value": "T193968C73945224D8E1ADC974D51416427EB8388B573863CBBEC472F65BBABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947897, "uuid": "a1f1e481-997c-4cc0-9c15-fb2ffdefcd24", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnap:sXyWSpV+Wu7rI3JEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947897, "uuid": "1ab39f84-2266-40ad-a33b-74c14d7a254e", "value": 9207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947897, "uuid": "dd350387-d904-4b67-9b4d-627dcf3bb01a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947897, "uuid": "d42c36c7-a23d-49ec-9640-727ac38b0a52", "value": "5ceb397285c015b84a7dfd4bd013bf602410e40fda4564d92630e1924a375fd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf743357-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948288, "uuid": "ea310666-c707-42f6-9521-408d10cd70ba", "comment": "Malware payload", "value": "d6932f3b15cbb42140a4867290d3dbd9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948288, "uuid": "1d526b39-07df-4082-97f4-5eb37c4e4b2a", "comment": "Malware payload", "value": "5d3165035a12fb65a6cde28726f2c30ea67d3b8c74950da80d116ae2822c90a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948288, "uuid": "bdb42f9e-0ce3-4ede-bc9d-aa2e044a48ff", "comment": "Malware payload", "value": "d5a89649e013bef01c1789eb1d09f47c370be67d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948288, "uuid": "b48e19ca-e18d-4bf8-bbce-632de7e1ae18", "comment": "Malware payload", "value": "8e076920e8cc4af9fae3758c6ae730cef7b6f2e168d0b520d4312ad08a8ed8d27da80ceadadbf8d41ebd1fd50087c11c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948288, "uuid": "2fa436fc-6cb1-4ea7-b8af-6f815f9485e1", "value": "T1E1A1E850112C1AB17246597ED26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948288, "uuid": "09f91f93-9d57-4d9b-af12-1ac880acf7a2", "value": "96:8RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948288, "uuid": "5d597685-4313-410b-8af9-7c059478926f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948288, "uuid": "2cf7db81-fbfd-49d0-ad74-3d6475f51562", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948288, "uuid": "c680ed15-6677-41da-9cb3-29aa86ebf0a8", "value": "5d3165035a12fb65a6cde28726f2c30ea67d3b8c74950da80d116ae2822c90a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b97428-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1657947841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947841, "uuid": "6b94f652-15ca-4e10-97ce-098aa25c1590", "comment": "Malware payload (CoinMiner)", "value": "9c47ea88e0fbc4838ffcb8f602c16986", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947841, "uuid": "4a6b41c4-563f-4981-9466-b3c90848bd62", "comment": "Malware payload (CoinMiner)", "value": "5d56fee0a6c377bf3d7ccb85a5b8d2835e3fd22919d4377b5e8b3ddf3d15ed0a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947841, "uuid": "b8d76d57-16e3-4675-9dc7-8633f4de3453", "comment": "Malware payload (CoinMiner)", "value": "6f25e002173c03809e3da8a8308d338f6050b675", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947841, "uuid": "95980cc2-217b-47bc-9061-cf677abc122f", "comment": "Malware payload (CoinMiner)", "value": "0a92da9b43eed79eb7ec0db50920a8762a6cca31c352e0158b307548dbe443d9c5048b5367eecfbe0fe6e4ac80df821b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947841, "uuid": "993a2943-c27b-48a3-addd-812274325472", "value": "T1A886339C50E97D1E0144DDB402E6DB12B5B71A8FF1A2CB02F46BDD1B1C1D336A8FA5A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947841, "uuid": "51ac587d-1870-445d-826e-90510bd1b3a2", "value": "196608:td69Qg/JFeQ5x7bhE8SSdP8v+nV2BpA8lOkbnKj6EQiUm:acQ59Gd6P8vIoPwkbnuQiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947841, "uuid": "f279f877-9377-48da-9f1b-688cc088c1fa", "value": 8249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947841, "uuid": "98218c0f-cc06-4e3e-b3de-36d0f451f4a8", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947841, "uuid": "50af4870-cf7c-4ed7-873f-b2de9973606c", "value": "5d56fee0a6c377bf3d7ccb85a5b8d2835e3fd22919d4377b5e8b3ddf3d15ed0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba639a9-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947933, "uuid": "6874c5cf-86d6-4a4d-87d7-98583c9f31fc", "comment": "Malware payload", "value": "2631d3c8a1063fc8a462026320dd0e69", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947933, "uuid": "fb9f5111-c714-4325-bae5-5e4f6880e2bc", "comment": "Malware payload", "value": "5d68885812c95c538ec1e15f3958be9b49d93e240cf0ee4f1911cd8d060c368c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947933, "uuid": "2402a9f6-eeab-49f7-9dc4-f13d11cc2ab2", "comment": "Malware payload", "value": "5bd4c159df7c642548258ae22cc950b0274aacc4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947933, "uuid": "53112169-4969-478d-8aef-663990842d28", "comment": "Malware payload", "value": "a4548fda1e689bb3cbe1a2a983452bf3e92c22cf64d1a71c086b4c1a3c417f4875b4ed33e329dcb2c170c06de6fb524d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947933, "uuid": "e4e2f607-5533-42bf-be77-5b756405cb3b", "value": "T153D5330C13ABBCFDF99D052927238DE1C1A991F0F58251A3D66819A85C3F5BD13CFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947933, "uuid": "8e745484-6c22-4a84-affa-0dd615071046", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4h:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947933, "uuid": "fe39464b-43cc-45ff-ba01-54f3a00cb0ad", "value": 2785280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947933, "uuid": "3b3dd918-b8f0-4749-bb8b-e934a6e8d8cc", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947933, "uuid": "1799ca70-5441-4ef9-8374-edc48006f246", "value": "5d68885812c95c538ec1e15f3958be9b49d93e240cf0ee4f1911cd8d060c368c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7d5518-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948523, "uuid": "25947dd6-6f84-434e-a816-d3be69fcb43b", "comment": "Malware payload", "value": "adcafc7e86b91bfe36d0de7157f6a37c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948523, "uuid": "564c3276-79af-41ea-9e33-892ef16fa54f", "comment": "Malware payload", "value": "5d6edc0da8d9c0f042c022e7e771a535904ab4c8b34f81ffb6b978333fe3ef7d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948523, "uuid": "d7c49e58-7bf5-41e9-9b75-c2193603c0d2", "comment": "Malware payload", "value": "da005d09285716f8db15f2c4043903514bc36e06", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948523, "uuid": "8e4f5a33-99a6-4595-8962-7183ac04f42e", "comment": "Malware payload", "value": "0119d9d7d81e75f6152e9cba846efa7c9018550c6ee7f028ce0cdf845eb89d7b64c19a8fd2064bcc92570446d445b7c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948523, "uuid": "feb7d570-28de-4ba1-aa83-a2af19ff774d", "value": "T18E1375058EE39D147373B0A1E6CEA4097A9B40C74F4BAE243C4D92AEEF5277491F46D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948523, "uuid": "a646589d-c40c-4cf6-b21e-4a59dee30d8b", "value": "384:v0FINvSo5o/DNIoq47z2YEEFXBTBfZ4zLZP1hncu/tpbOfvuy/97M8T:YCQIoq47z2YEmXBTBshvbSZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948523, "uuid": "17707eee-dd3c-4ca6-a994-2fa13a49fdfd", "value": 42573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948523, "uuid": "a2e7447f-bb44-4de9-8a39-82f7c3ef5b3c", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948523, "uuid": "4a349c48-3dea-455f-9f6f-e1bd28668b39", "value": "5d6edc0da8d9c0f042c022e7e771a535904ab4c8b34f81ffb6b978333fe3ef7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c04ce12-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948443, "uuid": "f6606ce0-6ccb-4e08-8148-04d3397dc1bd", "comment": "Malware payload (Panchan)", "value": "0025cf25e14fdc69007b70f3fe3f08cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948443, "uuid": "ffde1cf1-076b-42ec-946a-8cace44b3aaf", "comment": "Malware payload (Panchan)", "value": "5d8aab2ce5b8ba8c7b102ddaa3c89ea3ed4426acce68a64f4b1c7711a5d38308", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948443, "uuid": "3b8edcd8-8942-4816-9a3f-dfbd5a538b7c", "comment": "Malware payload (Panchan)", "value": "3c98ad497692ac499de296835e50cb74c2ad9a4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948443, "uuid": "84caefdd-61bd-4d45-aa53-9070920f2812", "comment": "Malware payload (Panchan)", "value": "9debb68d3a851675cd06f0cb5dc93cb4af368b37a9454743801f6e67e201896692b46d759d9d0547f722a995a7e0eeac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948443, "uuid": "a7760924-2758-4e02-881d-517b47fa7c5b", "value": "T1C1B68D73905334D9E5A88DB4D11416426DBC388B5738A3CBBAC471F667BABE48E39730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948443, "uuid": "3c79d29f-0f97-40fa-a621-eafd9f9cb363", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaV:sXyWSpV+Wu7rI3JEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948443, "uuid": "8276d36e-c246-42c3-9f46-76786c2f7dd8", "value": 11403264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948443, "uuid": "289ae80e-5187-40f0-9c4d-0a6b977be301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948443, "uuid": "f68db4c2-f6c2-4e79-a0cf-484d0aa667d6", "value": "5d8aab2ce5b8ba8c7b102ddaa3c89ea3ed4426acce68a64f4b1c7711a5d38308", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948959a7-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1657971409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971409, "uuid": "609e3d06-11dd-4c72-9822-9dfacdf5845e", "comment": "Malware payload (NanoCore)", "value": "2b11cec353a72b0cbc1fbc5051f62e8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971409, "uuid": "f082e97f-074c-4a85-93a8-9ce8c9a5909c", "comment": "Malware payload (NanoCore)", "value": "5dc27ebd6de4eed15818e27feb19f23f6e54bf9d4ee962143d5a90da9aa304cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971409, "uuid": "d2f84a6f-4d94-43dd-bedf-17e9f541142a", "comment": "Malware payload (NanoCore)", "value": "6c526d9de0221e718c039533482df00f71d167dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971409, "uuid": "7c3ab580-913f-447a-bc4f-969326cd6d01", "comment": "Malware payload (NanoCore)", "value": "41e086963efcbf1c48cc233d5f023cf2b6068cc1394564b178e49dd1956f8accf6b6b989506aca22703ddc3482de2fd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971409, "uuid": "bc2b76c3-bdc7-40ab-bbde-ad033aa9b058", "value": "T13E64AF1537A4453EE1AF86786022C2318738DED3A9D3E3DE28E45C6BBB667D149432D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971409, "uuid": "f6b91f5d-f3d7-4cd7-b9aa-dd312e226673", "value": "b1f41127e51c4a09fcb0aec80965d5ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971409, "uuid": "d7b042ee-18d2-4aed-99a6-8518811ec8e6", "value": "6144:GLV6Bta6dtJmakIM5BJOgj8+eJmJ865/s+zZbJKkV:GLV6BtpmkGvj8E3s07hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971409, "uuid": "664562c7-09b9-44ca-89c8-20815172fdd2", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971409, "uuid": "9d87c16a-7657-4155-b8af-54351df4528f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971409, "uuid": "0b569e50-c580-4b2d-ac0d-124b5e832ce2", "value": "Scotch Spoofer V3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734dc842-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (EternityStealer)", "timestamp": 1657971353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971353, "uuid": "fdd7c22e-683e-4597-8eda-7fe6c0c39e4c", "comment": "Malware payload (EternityStealer)", "value": "ee9522f14b1e12cbe22dceff4b80992c", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971353, "uuid": "a15e193a-56c0-49fe-9f09-33de60b658a4", "comment": "Malware payload (EternityStealer)", "value": "5e378aae9cda5f348d778ad6135eba6b04fb4c625f20900abcde1e75289f86c4", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971353, "uuid": "2f7e5c6c-48df-43f9-bf10-3058b4079727", "comment": "Malware payload (EternityStealer)", "value": "721d78a40c25d547ba64113b060170e76a817552", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971353, "uuid": "6aa45f11-c762-4eaf-a760-d33e33d02f9f", "comment": "Malware payload (EternityStealer)", "value": "8b99feba423f3c417c88141737fbf073c4b0fa19ac2de1bffc5bfa3cd55c0b39f0b39803541d481dd67fc1eae4bd361a", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971353, "uuid": "1e98f170-9aa0-4559-82f7-55e590a9c118", "value": "T1549412014346D657E5FB2B7469A267EE8A7BD206936EBE1F03903C0CFD224E18D1EB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971353, "uuid": "6dab1da7-234e-4594-8975-8a84943d10f0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971353, "uuid": "cc9d5e72-6209-4845-a094-1cb34af4580e", "value": "12288:mb/be3YBdFHyynFOeIbV0IekpJ0ECRhLZgSRd:mb/be3CdFSyFO5bV4kpJ0dh+yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971353, "uuid": "913ac783-33cb-4a61-8e16-73eac99c2e5f", "value": 421926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971353, "uuid": "b3d0e170-a315-4d64-8bc4-fa2d0d442461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971353, "uuid": "57a1dc85-eadf-4d9c-9aa7-8d9d55a780a7", "value": "csi.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b4b717-0500-11ed-93bb-42010a9c0043", "comment": "Malware payload (SocGholish)", "timestamp": 1657973474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657973474, "uuid": "0441eff1-7851-4712-b66d-5e0ff6884c45", "comment": "Malware payload (SocGholish)", "value": "59bb9743a2efc8d861b93d1e994aaa16", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657973474, "uuid": "0bc4c19e-b50c-4fb9-b767-3d69ec4a2fda", "comment": "Malware payload (SocGholish)", "value": "5f941ab274622fd8d1a87c7e3961f166399f3293018cfc69704a4d880d0578bf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657973474, "uuid": "ee85fc0c-f8de-402a-9ce6-1d60d1c76719", "comment": "Malware payload (SocGholish)", "value": "db7aab1601c6bf1fee4160187c8d0dff041c6194", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657973474, "uuid": "43599137-1931-4050-b4e8-c062216d3f11", "comment": "Malware payload (SocGholish)", "value": "badb00c5719754e452f543c3cbe9e0c85dbf44f24eed3a4a9b829aee99c4d1dd11b041d9754591af08ff5092a6d08e47", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657973474, "uuid": "270b51fc-9b2c-4218-9088-2809b92fa8d7", "value": "T185218F8A72DFA029D3C73765923E8C45EDACE8319118D4BCB55081B866E483543A5C7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657973474, "uuid": "c23f614e-fa3b-4dea-bbd3-76a2515c1775", "value": "24:1rwq/Qwl2b7P2N9oHOqt046nfYP6CWM7QEKPgEobCBjZeJbR2Ps:1kq/vIXOn40JgPBjUEK7obOylT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657973474, "uuid": "c03b7784-810c-4aa6-b5c2-a09158a4669e", "value": 1373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657973474, "uuid": "b01ddf08-66e4-4b60-906f-999b1eb48a58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657973474, "uuid": "e7f2247c-ed2d-476c-974e-35e69269c0bd", "value": "Edge 3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a884747-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948146, "uuid": "cf59f939-a34f-4ec8-a07e-e0a3a2e0a9db", "comment": "Malware payload", "value": "4d572bac544cfaa123bc4fcbbf5849eb", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948146, "uuid": "7b974178-e7f1-45c8-9f12-2d4413a7f20c", "comment": "Malware payload", "value": "5fb46ba1cc64bb1f89fb137d58efaea3a127780d0752d98db7c59fc2ce5e70f4", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948146, "uuid": "69ba8844-5ed2-4415-bf8c-dbd2759664e2", "comment": "Malware payload", "value": "5677e2aba829c37ae0346ed22517458b1c24caee", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948146, "uuid": "e24640de-cafc-4218-9ec2-c4d8c7741007", "comment": "Malware payload", "value": "5279b63fd76d9aa893778c3913268962d08cf577b7f8aec4690732f0cc31101c906dc40cc25be2e0d2f2ac0c3674417f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948146, "uuid": "22bac124-dc8d-447a-b62f-4351f5158484", "value": "T19EC533319E3BF5D7407E0A19655253B39AB2FDDC181AF404F3B99ADC21CA4F5A0C2E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948146, "uuid": "2f6d927e-eb36-4744-825b-793828b41b65", "value": "49152:DJMych6OZaIU6M9yZ29jsE4dKi4qi7/RhQrM+mvsx562dQ10LIKR7aL4gxQzg+s:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948146, "uuid": "130928e8-00c3-4aaf-9e91-abd39ea7d8c0", "value": 2576384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948146, "uuid": "365f0126-23fc-42c9-87ce-6e27b7035579", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948146, "uuid": "12d88f56-2586-48b3-bb15-a0fc1c43983c", "value": "5fb46ba1cc64bb1f89fb137d58efaea3a127780d0752d98db7c59fc2ce5e70f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d451255d-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947894, "uuid": "57c0178f-de38-4242-9ea0-71a32e9accb1", "comment": "Malware payload", "value": "8137bf683c6a2c006c562511c0f9a84c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947894, "uuid": "60eaf8d3-0ab7-4369-9d09-0cc9b2a1e109", "comment": "Malware payload", "value": "5fe60489106356ad6c84be890291de2514f25219379e586474c51cd163161aff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947894, "uuid": "24754be3-d249-417d-92ac-aa5e0cf2268b", "comment": "Malware payload", "value": "d266ba916e8ac0375f1674bfba1f4181ab9aad18", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947894, "uuid": "66cb59e2-d754-45ec-9d98-2df2491fadd7", "comment": "Malware payload", "value": "dc6a1a4ebda456831d967567c80f201cee219127ed7ef5812b57f5d6ce4e296268d5651dac66d4b2f32bf7dbfc274afe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947894, "uuid": "91a5ad9e-9294-433e-b770-e25c0cc7c6b3", "value": "T17DA1F750112C1AB07246697AD26FFB52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947894, "uuid": "1bae814e-d376-4a01-88fd-97e39da26ee3", "value": "96:hRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:hRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947894, "uuid": "30cb4056-9a70-4970-87b4-cd0a5574d1b1", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947894, "uuid": "be990b85-2bd7-4e10-af18-aa3392dd2134", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947894, "uuid": "682c49fc-8f46-4ef2-be4d-d0dcd71e7c41", "value": "5fe60489106356ad6c84be890291de2514f25219379e586474c51cd163161aff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d76ca19-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948016, "uuid": "43817b26-a6ca-4c7a-a773-b1b3f4eb8656", "comment": "Malware payload", "value": "8d81fc6f5f28d595dfa6d137d96afa8a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948016, "uuid": "1df03e71-1df3-475c-b080-76bb30310a87", "comment": "Malware payload", "value": "5ff9ac8602edf041c2e3bd95f2d87b75e5153c146e876065cc15dd860fbf29f2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948016, "uuid": "443a0644-5d72-4eb8-9e1a-2d0633db35b9", "comment": "Malware payload", "value": "f200557d8320c1b918ddf5234de3a8c241d9334c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948016, "uuid": "0bb963cf-beec-40b5-8b3d-3dca9f89e968", "comment": "Malware payload", "value": "b525c4a8d34f41dd85e79c25d91928da014f725b6abd2085ba4bc66a35e483fd0e401277004bf963cb5d418950e9550f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948016, "uuid": "fad0cd00-c2ec-43cb-bda6-58e10e11a615", "value": "T15FA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948016, "uuid": "7524e0c3-8185-4029-b46e-6c48434ce444", "value": "96:suRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:suRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948016, "uuid": "1b12d388-d7d8-415b-b955-6398a289b0af", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948016, "uuid": "9f3fba00-24f9-4b78-bb69-77058628379c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948016, "uuid": "68554a7b-fa24-47c3-a90e-a794d29b6edf", "value": "5ff9ac8602edf041c2e3bd95f2d87b75e5153c146e876065cc15dd860fbf29f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1def1198-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948447, "uuid": "a1137598-cc2e-464a-9e6a-9e8484467626", "comment": "Malware payload", "value": "5a4de7f6875b3a8c6532fab5bee29b76", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948447, "uuid": "1aaa6cd9-6719-4942-95dd-f56f38517dbf", "comment": "Malware payload", "value": "60a0ed5fecee30f6b8c853aea424588907fd681a7278de935ddb2b3e51c754fd", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948447, "uuid": "dc899f67-88a2-4356-a74a-59b3d6456fc5", "comment": "Malware payload", "value": "10caa586d361e16e19fed664a28e261673b56d03", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948447, "uuid": "b88053bb-f1af-45eb-894e-a028a860e445", "comment": "Malware payload", "value": "c67abb85c0998669881d821652ca6e8d0724d37d1e07c7a3c66b65f8017febf4e247462daea206e17305f98f58d9aed4", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948447, "uuid": "0c343641-fdf9-44fa-bf6c-d88a35d415ec", "value": "T1F615330921F77CC9FAAF16681A130C98C3FE51E2A46A915A13C80C9555366FE734F3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948447, "uuid": "addcf1ce-5254-4261-9d5c-5ebfbf7b2eed", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLa:IDSOgOhntWID2I0WkAf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948447, "uuid": "f92d5524-d4a2-461d-a3db-a31e5d986fa4", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948447, "uuid": "e95b11d5-75ff-45fa-8216-6a61df060697", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948447, "uuid": "eda83608-a377-49d9-a967-37a1537c73c7", "value": "60a0ed5fecee30f6b8c853aea424588907fd681a7278de935ddb2b3e51c754fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44336f58-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948081, "uuid": "a17f2e2e-fd49-49ca-b37e-b5b6ba5765a2", "comment": "Malware payload", "value": "d1bc3bc45d35d33c669dc960610fce51", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948081, "uuid": "b3635155-8f4f-471e-ad84-22748e53bc1e", "comment": "Malware payload", "value": "60c3b7f99ffe77cd3f4e8f75a238ee0af1634ffe9938a61e4a0668ff83ca22a6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948081, "uuid": "48deab0a-0233-439a-a88c-07438e60e248", "comment": "Malware payload", "value": "b3c3b182ac49a81e5ee9cdc840e27954db64fe66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948081, "uuid": "4a0dc8b6-7fb5-4de8-b916-3f5310232a16", "comment": "Malware payload", "value": "5c66f87f2d3005cafe89c10cf6d8a6c1732cb1bdf47d34d26ebaa6809f12ecb61801d102ce9d0e9c982270a224bd2bdc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948081, "uuid": "11453f63-07c7-4753-ab55-f8dca3718ed1", "value": "T11AA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948081, "uuid": "204fad1d-fb33-49bc-8048-8e459c82cebf", "value": "96:9RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:9RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948081, "uuid": "433db8f4-ac4d-4fd3-a9f4-b67cdd053326", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948081, "uuid": "f10e1115-feb0-4e6b-967a-75d06d06c76e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948081, "uuid": "c3058d3a-2098-43db-8307-69f91d90d4c9", "value": "60c3b7f99ffe77cd3f4e8f75a238ee0af1634ffe9938a61e4a0668ff83ca22a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e861c8a-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948125, "uuid": "73c73b18-a7d9-436d-8eef-ef9cd328ffef", "comment": "Malware payload", "value": "b63950c9942ede88e011dfb8383680b9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948125, "uuid": "93250549-f774-41bc-90aa-95c8d729969e", "comment": "Malware payload", "value": "60c40b8ec44b15d321544ced9578e3ce314e861875ad956e0475c814bd6241d4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948125, "uuid": "186dd49b-2ae8-4185-8e48-a93d149fbf90", "comment": "Malware payload", "value": "79a74d2ba3d645db6e0d6a46f3ee8d287a61c2fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948125, "uuid": "3461eb5f-7760-4e87-a80e-94b6104cd2d9", "comment": "Malware payload", "value": "3b1eec81e513a39c203d1ed185e494e7917731a03079b353fc097d281bfd4070befed749cfc6fe740bf38c145f0c2e3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948125, "uuid": "b37617a5-c380-461a-a141-d8431134aaaa", "value": "T12AA1F850112C1AB17246597AD26FFA52B50ECC1B0A7B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948125, "uuid": "bf4ceaa4-9082-4d9b-ae77-fedc2f90fcdc", "value": "96:IRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:IRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948125, "uuid": "75fcdd19-a57f-42ed-a0b1-6a89c0ece0a0", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948125, "uuid": "21720359-72cf-4360-bd04-63319186171e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948125, "uuid": "0c64643e-f7d1-4fad-b565-f468e739c43a", "value": "60c40b8ec44b15d321544ced9578e3ce314e861875ad956e0475c814bd6241d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1aa372-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948767, "uuid": "4bdb5607-5566-4e9c-86a4-78a88c1380aa", "comment": "Malware payload", "value": "80606ef7873a9d77ad467e283fdceed6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948767, "uuid": "991d97c8-d175-483f-88f2-167cccbfd49b", "comment": "Malware payload", "value": "61333774e135522697036cae9523babfc301e36e3c4440a95cbe53c48b4d4cf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948767, "uuid": "81061864-8138-45f2-96a2-fb4f581f9352", "comment": "Malware payload", "value": "ca9646d0ef39efabc265a4dd46d11e3796871280", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948767, "uuid": "8c102260-7a54-4219-97c0-d2abda671b0a", "comment": "Malware payload", "value": "eaa9c1e4a0fdbe477946fa513556204051410d4a56facf93bde981565c3e5b5ba62324837ce5bb14c539626b32d4a85b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948767, "uuid": "03e3eb42-b890-43c2-9e64-62fb46c98b23", "value": "T1F7F4F857A89550F4C1FEE134C76AA213BDA13499073427E76FA186F10B27FE86A7C318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948767, "uuid": "1f29a907-4014-4475-94df-44940f5c069b", "value": "12288:qBxjgfdErj1Qy8T10IDH41AE1phbfrb/T/vO90dL3BmAFd4A64nsfJUYrqSM66su:cqfwj1QylLAE1phLrb/T/vO90dL3BmA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948767, "uuid": "00bbe858-673a-4313-ab35-d4267d0c26d8", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948767, "uuid": "8e37cdc0-5c82-4d0d-a193-76f16bf7a0f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948767, "uuid": "5ca485fa-9d5c-4828-b522-028f58e910b2", "value": "61333774e135522697036cae9523babfc301e36e3c4440a95cbe53c48b4d4cf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcaa05c-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948584, "uuid": "4c2e0930-c0a9-497f-ac71-1c39cab0a9af", "comment": "Malware payload", "value": "87b83e91b59fc1612c785ace5669cc46", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948584, "uuid": "a78ca457-f350-4ab9-876b-0585ceb753fe", "comment": "Malware payload", "value": "6146e9a8bd113bc30fa1fec0fb65de95d0f378c7cb56a9184d8987fd1de0e1b9", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948584, "uuid": "403fb11e-5150-48ee-a841-11d0b0911ed5", "comment": "Malware payload", "value": "3b33ceca8ae94c8f7e7ad27afcd2924270674c96", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948584, "uuid": "7f0032d0-5aea-4764-9678-ada28b0b7e09", "comment": "Malware payload", "value": "ac06d55d7bb8b51e11555231517ccb2eeb833754bb93c82f25883bb2f83c40fb9f94ede482a7e82a9aaa9935d1368548", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948584, "uuid": "09d0e5c5-ac53-4ee0-a50f-f9431eda6bd1", "value": "T117E5330C12FAB8FCF89D0529376389D0C6E852F1A98265F2D67C1598083F57E1BDFA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948584, "uuid": "9ee7dd3a-da24-46f8-bb13-e7a83746d490", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmP:0XSxVJG2fLAqFOfT9sMYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948584, "uuid": "96caadab-f16b-4ad3-ab21-712bf369bd86", "value": 3153920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948584, "uuid": "94af50af-162b-4d07-9716-536c74b10d92", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948584, "uuid": "630e4469-00c5-4dd8-bbf2-5b44cfbb6947", "value": "6146e9a8bd113bc30fa1fec0fb65de95d0f378c7cb56a9184d8987fd1de0e1b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4484cb1b-04c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657947223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947223, "uuid": "bc678924-8b8c-4440-a945-822e577c41ed", "comment": "Malware payload (Mirai)", "value": "76600d70eca7d6dcbb7f8e6fd5435462", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947223, "uuid": "0e0f499f-ada9-4fc8-b4c2-8bd4321c5830", "comment": "Malware payload (Mirai)", "value": "618c1566ad86f25e78320f8c785625d3e910f2db40f1c3ab49b03a8a54eb4399", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947223, "uuid": "a190e61f-4414-437b-b812-cacf0de006df", "comment": "Malware payload (Mirai)", "value": "f7028a46d5f6659c15d680dfb1f10fe72f89e685", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947223, "uuid": "ac4c4602-f9f4-4393-b225-1d60af602670", "comment": "Malware payload (Mirai)", "value": "cbfd31a54457f83dc80da4bc85b2d4b736a51378b48da3a4757e8c3ca987c48e92469892550e8b3b68a0ce0896068e55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947223, "uuid": "1936ef90-2db4-4433-b62b-2dd0798ba205", "value": "T11B63C609BF610FB7E8ABCC374AE91B4528CD645622987F367970D918F64B20B15E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947223, "uuid": "a08eaa9c-8ca1-4041-87de-b0d5ca349a49", "value": "1536:9wHZPL2o5K7AkzYWsIzukEA0xHAws7Qtw/euhZxYzIHyEHa10:9R7AkzYW/zukEAu2eGEyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947223, "uuid": "0c50156f-cc1b-485a-8a9b-b2f03ee266e6", "value": 72772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947223, "uuid": "5f42c979-3239-4332-9c0f-e82d3fac1ce3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947223, "uuid": "231fbebf-c248-4416-bfd6-f9be6128ea86", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a572851-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657948065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948065, "uuid": "327e100c-2c4d-4808-9291-ac46984365b4", "comment": "Malware payload (Mirai)", "value": "ea795855c7158809c1ce54f697596adc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948065, "uuid": "03ead26c-c824-439e-9ee1-6a3cc844c6df", "comment": "Malware payload (Mirai)", "value": "633f981675b67adfef5b4cafc14df7b88fe311e9f0f5d7112986177efb194173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948065, "uuid": "da571e71-a565-48ac-98dd-f6e681f6ec9b", "comment": "Malware payload (Mirai)", "value": "c6ea0c9b4fbad5e1e02039dc71ab7364b5938d62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948065, "uuid": "12f4e414-f549-4ae1-8a41-4b8c700d20f3", "comment": "Malware payload (Mirai)", "value": "93a16a5c31f20b920d0bfd1a1f461d6c969f1ed977e6a750234d0fe1ea2f63274caeda7c39d5764162d9ec974fbd1865", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948065, "uuid": "29f79716-9504-42c8-9f35-a6e7dcf9883a", "value": "T137830A05F7D384B1C8074C7182BABB2A5EB5E93A8534DB6DDB90BF81AD15BC1E04932D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948065, "uuid": "8da9c7c6-3ee0-4a43-ba20-251689ed7f9b", "value": "1536:RkMxO7W0R4UnmS/jY6QbQzFLEI8EJLBOZEiQvTAr1tBocgyhBUd31s0IVPBLro:Rzx2R4UnDkvQzFgI8EJLBViQv8tBocgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948065, "uuid": "65fe9945-1e04-4c86-9e74-6977e1a76897", "value": 83428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948065, "uuid": "fb5c5001-f836-4b24-a913-aa44a546c443", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948065, "uuid": "9d768a7c-0edc-4040-8b6b-cc13d00058e3", "value": "633f981675b67adfef5b4cafc14df7b88fe311e9f0f5d7112986177efb194173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c7655a-04af-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657938689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938689, "uuid": "2f5f9086-3482-44e3-a7d4-68b98748ca5d", "comment": "Malware payload (RedLineStealer)", "value": "c1597708a80d82466d554fd0396b310b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938689, "uuid": "d015891c-03c6-4a70-8a02-b33604a636c8", "comment": "Malware payload (RedLineStealer)", "value": "636134ca558b4d3f741cb5d672f8aad2e649f64ae6f3cdf655a85d53ae5bf459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938689, "uuid": "e0606e8e-5059-4549-8fc4-b9efdd8ca4fc", "comment": "Malware payload (RedLineStealer)", "value": "60003933be07f4f25e179e72020f5cb404932118", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938689, "uuid": "1294d538-8d82-4cf5-bb87-09d858019962", "comment": "Malware payload (RedLineStealer)", "value": "18c3eccc81ad0a990fecab0a2029da34b604bb6905272678fba17079495691384e52855722d431700041f17a1c4b5518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938689, "uuid": "4f972336-0bc3-4af6-a436-60268ea26250", "value": "T10854E010B7F1C432E0AB9630DC7AC661273A79326675998F77B01B5E5E723C09A76323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938689, "uuid": "f8fa8f80-abeb-4421-8b0f-efa063ec2894", "value": "1babba8ebf028e1ff7cbb28d85574e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938689, "uuid": "6f4d73e2-14fd-4961-91be-802159b9bb43", "value": "6144:Awc0r2r+2FAxBQXQgombyUbcS7aAHCpQPI5d4U:l4+2FA/Qtjb37aAHCMWiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657938689, "uuid": "af9133ec-26fd-46c8-8c1f-bf3fbc3048ba", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657938689, "uuid": "f530d2ab-23f1-4a2c-b8fe-c770b4ffd86c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938689, "uuid": "d6555cc8-82bf-439b-a5e2-644a1b60adf5", "value": "SecuriteInfo.com.Variant.Jaik.86584.11091.25977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aeb503a-0557-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010826, "uuid": "a74e14bf-2519-42e7-b41e-62b9885b2fd8", "comment": "Malware payload (Mirai)", "value": "baf473555b546af5cbca6f803c6d67e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010826, "uuid": "bfd819b5-b88c-402b-af95-bf48fac0fcc4", "comment": "Malware payload (Mirai)", "value": "6375ba58b45ab4f0dae8ff95e19c780e9ab8a189794d39c9bcd4917a9501d0dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010826, "uuid": "5c2a2604-72f2-4f39-8825-02f8a525e518", "comment": "Malware payload (Mirai)", "value": "35167f3767285901904bbfaf54f63ea89da7dd23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010826, "uuid": "8460e17c-3b87-4129-b1e0-dcf9655caa91", "comment": "Malware payload (Mirai)", "value": "8e42fd400c9969ae6a72bcfbdf6747e475ac13cbe37c94830889e1fee6efe45015783108c22ab4688aff9f885fa6b2f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010826, "uuid": "a55cbb52-ddf3-4af8-a10d-b68e490bbeda", "value": "T129339DB1C46DAC84C29882B4BD244A785B63E5046A5B1FF91786CB72D007FECF1683F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010826, "uuid": "395c2335-10e8-4d67-8aed-c1ac3f09bccc", "value": "768:m/cLDD36qe5loaiGUCarSeHUHQFqeJF3ExkV3DRtAo0yQVYxHCU51:m/M3xayGUCarSMhqxGTzv0UxHCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010826, "uuid": "e5b301f8-b6d0-48d1-a167-ca5695a30bcb", "value": 54940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010826, "uuid": "71363184-884a-4dc5-b477-8f02324235fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010826, "uuid": "1a98ae2a-999e-4b95-a9d9-d449243d3439", "value": "baf473555b546af5cbca6f803c6d67e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e485e9ce-0520-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657987434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987434, "uuid": "da099a79-be86-4eac-85af-214d88b0c281", "comment": "Malware payload (Mirai)", "value": "ed4c43cc3b70dd2430889a00391f7512", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987434, "uuid": "bf56d525-8015-46a8-afd6-256703f29f29", "comment": "Malware payload (Mirai)", "value": "6398970e0b7653d49a329558a67e1acdec19961b508a15cd97d79b5db609139a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987434, "uuid": "acbb1ce3-0694-434f-b90c-470a32a8342a", "comment": "Malware payload (Mirai)", "value": "4ec1b878792c946813c0ed2c654d9673d0b70024", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987434, "uuid": "3be038bb-a8ae-42f5-9f44-4118de57a5e3", "comment": "Malware payload (Mirai)", "value": "19550f98c7a5cecb99226e1d58b477e4aa268ecf134ccf303ad73f8e4d52211d82544d41a2d24425a9949e4ddb60e2be", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987434, "uuid": "f686c41b-251f-4e1c-9586-d6e2be7b9657", "value": "T16582CF3061AB74E5DBE14431EAEDCEC6971A0BF8D1FC36D216586F78898110211F93CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987434, "uuid": "36ea834c-698c-46fe-ae92-9bdd260048b6", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaL18hymdGUop5h5lK:6/V0P6+kom0tVAoNvm+to1Lms3UoznlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657987434, "uuid": "3638c356-4597-4281-98c4-2e0c9d381650", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657987434, "uuid": "dc3cfaac-8428-4d6b-a5cc-327024ca5346", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987434, "uuid": "d839e3db-7037-4e55-8eb0-92c06c8bd83c", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700e6bff-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948155, "uuid": "3da7cafd-90a4-4dd5-b48e-e2204e22771f", "comment": "Malware payload", "value": "1c9f20bebeff09b360e704959544dca3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948155, "uuid": "b8650a80-2d40-4c01-95d9-332be6ff4a60", "comment": "Malware payload", "value": "63d6fffaec620ec463e7de9e9fa87701c6a422314c3a99d5980cfcb210b499d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948155, "uuid": "36ec9fc8-41ea-4fa4-800a-31fe83570bab", "comment": "Malware payload", "value": "a85b54cabd6dd093d7553873ebc5e00b78c00011", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948155, "uuid": "a59733ca-f94b-4da5-b61d-0e71243ea9e7", "comment": "Malware payload", "value": "9f4a15051b677a5d0f487ee009c0a98a49d1d61107bcbc8ce663689e6f7b666dd20c478a009963787d7967fb7085c112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948155, "uuid": "55c11f45-42cc-49fa-8a47-2f7e8cc1d2c1", "value": "T1EB17BE73910338E9E5A98CB4D51425426DAC38875738A3C7BAC871F667FA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948155, "uuid": "2c74e777-018c-485c-9c6b-ef0d065cdaeb", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnao:sXyWSpV+Wu7rI3JEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948155, "uuid": "9eb74678-9c8c-46dc-b276-4cee9ba77a19", "value": 19169280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948155, "uuid": "de07873a-fa39-40e6-8af4-069e40230864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948155, "uuid": "93dd857c-337d-404e-86ac-b2a09eef1161", "value": "63d6fffaec620ec463e7de9e9fa87701c6a422314c3a99d5980cfcb210b499d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129432df-04b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657942415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942415, "uuid": "dc4aa57d-e1fe-4bac-b19f-fdd97d8ac34c", "comment": "Malware payload (Mirai)", "value": "521539429192831fbf67fe1adbca1deb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942415, "uuid": "c331e47a-bfba-47e4-9134-cf4e333c1f12", "comment": "Malware payload (Mirai)", "value": "6430967ebc859d96f8f80771158e4250852a6202435cc4c3517662a20e08495d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942415, "uuid": "dbe3b438-6778-4803-aab7-82cee0be0692", "comment": "Malware payload (Mirai)", "value": "f54b81236043125e45ce3044db7e6e8107383ebc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942415, "uuid": "00c1b967-7f62-48d4-9af7-dc335ab838f8", "comment": "Malware payload (Mirai)", "value": "d8a35e41e537ec570f7086a4fb7b88f5d5fd2874c56b4a8937cbdb29cc2b8e52f55201fe6758e388d3f86568b3f30c53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942415, "uuid": "2cc62ed4-3767-42ea-b8a2-97824096def7", "value": "T12B631A86BC519B24C6C55777FD1F014E33075BA8E2EE73128D145FA0778B86F0E2AA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942415, "uuid": "efe6539f-83da-4b15-84b1-e0a4d69db79e", "value": "1536:k5nlb3qX0UbbrvkEfE/tUedw9K97i/bDWz9IXijCXRmlk:63i0YrrfsUeMI+wCXRml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657942415, "uuid": "b81fbae9-1511-4358-a794-653090fee473", "value": 67128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657942415, "uuid": "2484a4d0-4399-47ee-8c67-70ac402ca51b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942415, "uuid": "69d95b3a-383e-499d-93d0-127eef453197", "value": "Ares.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc5007b-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947993, "uuid": "5ba29a8a-84ff-48c5-a2b6-992aa972ddda", "comment": "Malware payload", "value": "ba67a31c94309377748c0db151ca58a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947993, "uuid": "8f867ea2-398c-4614-92f3-df7cc5fe3c81", "comment": "Malware payload", "value": "64b50d33fd3509c82f2c2d08320cf953e99238c06625402479fd1a3aa2abb391", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947993, "uuid": "a0f89b2f-e2b8-46ed-9b6b-427f9a6071ab", "comment": "Malware payload", "value": "a2a282aa95c676b99a9e2214abe06a9a1d727996", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947993, "uuid": "b0175ab2-b304-4e35-ac24-a8231f54a0c3", "comment": "Malware payload", "value": "7794341e7c8be24645981433bc45bb57c446fcfe2ba7583fb638ed4ad44577f32bd42ff4f5caaee1712476b441f9c342", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947993, "uuid": "0a11170d-43c2-4bde-a0ff-714d90f2d861", "value": "T10AA1E750112C1AB17246697AD26FFB52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947993, "uuid": "27586d52-20b4-4eaf-b489-38e1f0b265bd", "value": "96:MRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:MRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947993, "uuid": "111230ee-f05e-42b1-8055-d9c1328f09b0", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947993, "uuid": "dfc82ffa-416a-4c58-9ce2-fbb543af7771", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947993, "uuid": "f6f2163e-3ecc-425a-bdb6-0d7ab1090d80", "value": "64b50d33fd3509c82f2c2d08320cf953e99238c06625402479fd1a3aa2abb391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756cd502-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948164, "uuid": "5ea53868-7ec5-4e66-be67-1bc9c6f552d1", "comment": "Malware payload", "value": "ce3d05630190ea47d38de8e917ba6563", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948164, "uuid": "d0e9eec8-3bd5-45ee-87e8-6ab20b9ed7e0", "comment": "Malware payload", "value": "64c023b440cbf865b8adaa8c7f7e78b8c1d9000f591d18b09523c5209a0db5a3", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948164, "uuid": "47393e33-0595-44a4-b4f2-04f0945174dc", "comment": "Malware payload", "value": "baa12d7d49ce5152eed694ff515f3b463067cc5f", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948164, "uuid": "1f73f553-c422-4e0c-af32-be5fd827a27c", "comment": "Malware payload", "value": "06eca66902a0faf9aaf750abef75e9ef08279d0885a7916c9e156265666ce9d877eb750b22549ac31602b19a74740416", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948164, "uuid": "96ea5c3f-4375-4f7f-92f0-64d46f0625e0", "value": "T1F6C533115AD007C9E584CA2F2FDC9936047BEFCE7964EDD782E3CAE1100FE95A5A2874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948164, "uuid": "943fbc18-735b-445b-9140-9b365ae36d45", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfe:G1wwAjzIQOMK2GNKslgus10W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948164, "uuid": "b5280665-cdd0-4403-9264-02464d0a11c5", "value": 2555904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948164, "uuid": "9ec1e750-a2b6-43e8-954d-3d5bda394c83", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948164, "uuid": "ec87ae54-791a-4201-994f-f1a0d903d140", "value": "64c023b440cbf865b8adaa8c7f7e78b8c1d9000f591d18b09523c5209a0db5a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce9f4bc-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947962, "uuid": "1a878b60-fae7-425b-8e57-67c44f410126", "comment": "Malware payload", "value": "8fc32fcf422703c3716c287897e134fb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947962, "uuid": "f74b2726-5979-4439-afd2-a2f6588addf7", "comment": "Malware payload", "value": "64e4d762289590675ad220e656f2a9ffa9219be016d28a5848b9b0aab7a07dc0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947962, "uuid": "761937cf-c9aa-4b02-9a43-23c08e22dcb4", "comment": "Malware payload", "value": "2869b0431a892347592b492eca9fb2b11460fd9b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947962, "uuid": "096a23c5-e587-451b-bce9-58e153faeff8", "comment": "Malware payload", "value": "c372356c1c08e62bac332c824c9970e6876b4621f72cc7580c785746dfdec39b74279da43810201c5449b5c19a69f295", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947962, "uuid": "a48f5f13-e21c-4354-8476-b785d4501cb5", "value": "T1EB416DE030A136743CBBDCE763BA1A4431C25865AC955E5EE8E4B8F89CDEE0525841FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947962, "uuid": "f5ba75eb-ac83-4cd5-8c9d-57804befad65", "value": "24:IjXFABaqugrh/aqpzNOLMiaqxEaq9taq/tNsBaqjNaq+Waq1EaqcTAWaqXaq9aqX:cFAY1+iMnq1bEBDs1m3Xi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947962, "uuid": "0403e133-6b94-45ce-b3c2-5a0ea06a4be8", "value": 2332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947962, "uuid": "67513e98-86b5-4f46-8800-e3b2893cb5f4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947962, "uuid": "d1583ab7-d61e-4d0e-8896-592d4123d87c", "value": "64e4d762289590675ad220e656f2a9ffa9219be016d28a5848b9b0aab7a07dc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c304e88-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948632, "uuid": "5c3d7646-0589-43b6-ac23-68e721329880", "comment": "Malware payload", "value": "fc79067b8372465692f049a934863dcb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948632, "uuid": "1a6debe7-57d0-4c70-9934-0f7ce8f032fb", "comment": "Malware payload", "value": "67744aba680cce7c8df351565eeb89778ab6acd227c85cde04334a7e565288a5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948632, "uuid": "50140f27-62f9-4766-9814-4374ccadffbd", "comment": "Malware payload", "value": "4d48378d9a2bfe4ef53e03af6fe8e9f424ccc414", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948632, "uuid": "cfaa0792-7e0a-4828-93c3-3adc7acefcdc", "comment": "Malware payload", "value": "1bed74142939575e832202962e8e487378ee108f44dc57987a74eb9d17ded9f09cd8a0613b6c4e0c7db2ae8cbd3b23dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948632, "uuid": "90bcc67b-9680-45c8-9247-33d5defff4db", "value": "T1DDA1F750112C1AB07646697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948632, "uuid": "25b60881-dee9-4a44-b5cc-f115debc82ae", "value": "96:vRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:vRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948632, "uuid": "6302cff3-3b74-48b3-917e-0f31e8165afc", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948632, "uuid": "87128274-6b90-4e72-98b1-64613ab62dbf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948632, "uuid": "84640509-c276-43a0-ad9f-979b7d6c2a29", "value": "67744aba680cce7c8df351565eeb89778ab6acd227c85cde04334a7e565288a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc7b47e-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947963, "uuid": "f29fbffa-105c-4d92-83c2-08a224bcf412", "comment": "Malware payload", "value": "dd3976373e2f9a094f03106c51f94b2c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947963, "uuid": "f53d4fd8-83bf-4e68-9524-84845fec72b5", "comment": "Malware payload", "value": "6782706ce993897b0ca3596d112f623bf64744f8d6e642c1fd633573619857b4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947963, "uuid": "00723382-7e84-4ed2-b2ef-76a3b767aede", "comment": "Malware payload", "value": "afd5b2ba1d75d1178773bd315259105fa354d099", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947963, "uuid": "6fbde1fc-cae2-4194-bb43-4d7ebc50e732", "comment": "Malware payload", "value": "34505e71fd37ad67bade064f0e81b3af8be620f2596583d12952409f4e800d7c32db00563fa6cb39cb40a344fe8430c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947963, "uuid": "96b832ce-2d9d-44b4-95c2-770870b804b7", "value": "T121A1E850112C1AB17246697AD26FFB52B50ECC1B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947963, "uuid": "000aa9f4-48d6-4e14-956e-55d846f6073b", "value": "96:bRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:bRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947963, "uuid": "68507b6a-9a79-47b5-9bae-74fd1d695aaf", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947963, "uuid": "f0f410d7-aff8-4ae4-b42a-32263cd1d7fe", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947963, "uuid": "045d31fa-b135-4c14-8c26-629712b132eb", "value": "6782706ce993897b0ca3596d112f623bf64744f8d6e642c1fd633573619857b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcdfa18-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948255, "uuid": "6cad2054-7459-43aa-a747-7adddabf3cb4", "comment": "Malware payload", "value": "ebbe8cfe89c408209ea4420ad6966035", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948255, "uuid": "6898e13c-4a25-4c51-a8d4-3a512c4226ee", "comment": "Malware payload", "value": "678e6a2e5e29b27589d3715704e51b5f318cb5c5a79b8bb9f9d8888f688861c8", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948255, "uuid": "227cd180-42bc-411d-8f17-53f66e28357d", "comment": "Malware payload", "value": "26cc1cf48b0db0a46c90eec0d815ce8e5518fb29", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948255, "uuid": "572662bb-9fb9-4780-a117-80099a64c69b", "comment": "Malware payload", "value": "1dc39189e2bce0f7e5528e4cfac083b45b6935ffa4dfe3ee3e82d2fde2ea19b636adff18ca0a26e117d574706ae6638c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948255, "uuid": "30a55f12-e9f5-4d1f-a615-976c622fc0de", "value": "T147D533109AD116C9F598CF2F2BDC9936147FEFCA78A4ADD792928BF1000FF85A562470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948255, "uuid": "487a0df2-32c6-4e73-a548-e713f7b627d0", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvh:G1wwAjzIQOMK2GNKslgus10j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948255, "uuid": "ece5e6bd-626f-489e-bf9d-2e627ac71566", "value": 2801664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948255, "uuid": "65721a83-0b89-4166-ac52-4bdc8ef205e3", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948255, "uuid": "d7f1aec3-ef8b-494a-8979-8c4ba30bf3e9", "value": "678e6a2e5e29b27589d3715704e51b5f318cb5c5a79b8bb9f9d8888f688861c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cb2f45-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947821, "uuid": "5faabbf3-c886-4935-976a-9bfad607d97e", "comment": "Malware payload", "value": "b381a411a88b1557246664479f1a2fcf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947821, "uuid": "9f9834ea-8e93-4dbd-b7ea-6a3ab554302f", "comment": "Malware payload", "value": "684139c4f26e4e0e1373558aa2661c6fcbfd8a43a93331815cfb6f4306f4a202", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947821, "uuid": "848ac266-4b41-44e2-a765-a381d4635324", "comment": "Malware payload", "value": "fcb84deb9ed779adef5dd9ba0dcb7ce614a78e3a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947821, "uuid": "ad673bf9-456e-4cb7-9766-8b65edffe12e", "comment": "Malware payload", "value": "170341c74dde0beeeb0149aeee80d10d5030575a727a38b5057796b7fde05741611db4e33be405767d9462a50581a4f4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947821, "uuid": "3a622697-379d-4882-b88e-8882684044ab", "value": "T180A1E850112C1AB17346597AD26FFA52B50EC81B09777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947821, "uuid": "a994e1fb-e56e-4fbd-a4dd-eeb549f5795b", "value": "96:sRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:sRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947821, "uuid": "3bc03994-06be-41fd-a78c-593226d44d46", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947821, "uuid": "afff0f4d-7a4f-4b1e-850e-31791fd2fd8b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947821, "uuid": "5c4989cf-d58b-44ff-be68-9a415d1d153b", "value": "684139c4f26e4e0e1373558aa2661c6fcbfd8a43a93331815cfb6f4306f4a202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9007a496-052e-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657993306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657993306, "uuid": "4a95125f-aa21-42ea-8dd9-59036b997451", "comment": "Malware payload", "value": "5a4934a3d6eb3e58318435cab0f90210", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657993306, "uuid": "dc40715c-c54c-4e46-a68f-38d3479fb9cf", "comment": "Malware payload", "value": "6841cdc4383ae306e66140047bd3946a1587e7355802d487064a7d8b4c1c251e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657993306, "uuid": "a074209e-b52a-40f4-babf-b6c54451d5d9", "comment": "Malware payload", "value": "ac8088039a7c49eed95a03b95b06aa73253f7258", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657993306, "uuid": "2cf45c33-2029-42a9-bc24-7418c7ed1770", "comment": "Malware payload", "value": "43c819a55d87d104c42b5bcfc2ad2ddbcdbc15d117fb709b3c3dded6dff3fb4e457497e0bca3c02d6e5406b94928d41a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657993306, "uuid": "555e3fe9-871a-4e0a-8b98-ee0c058e83a1", "value": "T14FB61246E768AD6EC8F3833389F91636054A4C258B4397976914F33C68B7AF44F85BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657993306, "uuid": "b4081489-9bd7-40c2-8bdb-a5cdbe67d2cf", "value": "196608:HfAr1jSGWj9zCvcFFg3kh0k74L5LNrwUI/eILXxN2Io:H4rpSxtUOwk6NL1BseILXxN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657993306, "uuid": "e6c68808-af7d-4690-928e-b310c6ec6af7", "value": 11253091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657993306, "uuid": "863284f6-a485-48a6-be1b-b568d7d6cb50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657993306, "uuid": "305af748-65b9-45a1-a7c2-dfaedac267fc", "value": "Language Translator_v1.1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea8199d-04d4-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1657954434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954434, "uuid": "7ed69efe-c1a4-4f61-bf9c-d040eab84da2", "comment": "Malware payload (AgentTesla)", "value": "3d0d629f51b3d833fd399c021091dd91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954434, "uuid": "74b2346d-5328-4b7b-aee1-31d9c52b4ea6", "comment": "Malware payload (AgentTesla)", "value": "6861fb6e838e22f2390a933aa35ad81de5f34c5846106c46e581a02f3cc6ef28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954434, "uuid": "1454e1f2-6cb4-4fe8-9ffd-31a3c4075343", "comment": "Malware payload (AgentTesla)", "value": "00dd940704b2052c30b90826a47e54d229ae47af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954434, "uuid": "3ebf32f2-8105-47f4-a852-2933dce73cca", "comment": "Malware payload (AgentTesla)", "value": "21fc391b98e3b2f87d78a490032a296b544e794b1106708415ad1d1c92813fe51fc0184f997afb149876895085872724", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954434, "uuid": "469b0b66-8d3c-4805-ac45-64a1263406f2", "value": "T1AE34EDA0685F49B2E608DD1E25A4F6506EBAFEFB30C1147123AFE470CF55AF29EC8550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954434, "uuid": "fa6718e7-02f4-4827-b01a-1e04b675d92b", "value": "1536:iYvYOlom3JH0qMPSlYdoPpWcBXtAhvZVzFz76mAg5eeVhMDw5wfLc:iKh1wVzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657954434, "uuid": "085cf9d2-827a-4a4a-b636-ae8c771a0a06", "value": 240298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657954434, "uuid": "d318afce-6a03-46e5-95a8-10b0c661c48b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954434, "uuid": "5ae6573f-32fe-478f-84d2-2db10ea2bce8", "value": "CONTRACT ORDER 0022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe4dd6e-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948181, "uuid": "3f5284c4-c600-4442-b35b-f838589374d8", "comment": "Malware payload", "value": "8cf7537a42904ce4f7fe327723338831", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948181, "uuid": "9b15d4c8-5de8-4b1f-af4e-8e7a7ab45645", "comment": "Malware payload", "value": "68719ea5f578478194b7b17ed99a0f29c44041ab5498fca0da587a85812cd108", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948181, "uuid": "a8a89046-0775-4f15-a9bb-76762f201741", "comment": "Malware payload", "value": "af4fff5ff5a47404621c817737a6178fb738ece0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948181, "uuid": "89259c7e-ba0d-4d7b-aac4-99e271eb331f", "comment": "Malware payload", "value": "50ca490e3f2ea915d0e7bdd0ade89d7f38b967b080c300be121ae611f9a6b4c56c0e4df34d206ede801d284a63feea60", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948181, "uuid": "a0a560e5-e91e-487f-8ff5-5e4e434fd291", "value": "T145A1F850112C1AB07246597AD26FFA52B40EC81B0A777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948181, "uuid": "8beab102-af8e-41da-a5b4-e665595a16a5", "value": "96:GRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:GRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948181, "uuid": "a6689d05-3b09-466d-8d4e-ba6e22bb036e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948181, "uuid": "1f21b467-4970-4ea5-b9c7-27865e306085", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948181, "uuid": "77f73822-8998-4fb8-8ffc-d65483154e39", "value": "68719ea5f578478194b7b17ed99a0f29c44041ab5498fca0da587a85812cd108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644314cc-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948565, "uuid": "45551e20-b1d8-4c0d-931f-2c9aeaf5e1ab", "comment": "Malware payload", "value": "5ba38bdf537b297464b070e6947390c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948565, "uuid": "e92164c1-ec7f-436d-ae84-0c2f953359e1", "comment": "Malware payload", "value": "688896fe5dd3b07b2e612ca887144e5c1a894bf6da9bbcfe3c7544bc71d5453b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948565, "uuid": "c8642bde-5f79-46d5-8187-61249abd9955", "comment": "Malware payload", "value": "62e2804bbe176c797c868453f4f60ecaeac3ea91", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948565, "uuid": "4d3e97e4-189d-4b45-99b9-2ff267389648", "comment": "Malware payload", "value": "96614e19e1038eaee8d97fba914dcb0a52035f1e6081b21a8eb6646268997ac6edf2a76e54724af95ca4e314288b7e24", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948565, "uuid": "898ac7fd-8b0d-4b54-9722-34851dd28987", "value": "T185516629EBFEBD6141E6E674AA2C51CD04E921A515487E5FE98CF273908002E43F4FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948565, "uuid": "372382bb-25ab-4b97-8be8-e87ef62bb9cc", "value": "48:yX8AUM7LZfa/d9P4+1zbpdpEtRfGAVEREtGuREbVROGAypgX+guXcguqXShe5o:y/USL0tbpdpEtRLVEREIuRE5RcyJXcIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948565, "uuid": "31b5d513-2b94-49a9-8045-a427db59f731", "value": 2981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948565, "uuid": "ed002cd6-4a7d-4694-9f42-3d00a80d0c02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948565, "uuid": "14cf95eb-4c54-42ee-b00b-0b8b659b3979", "value": "688896fe5dd3b07b2e612ca887144e5c1a894bf6da9bbcfe3c7544bc71d5453b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f457738-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948422, "uuid": "a93d12cf-7aa5-4432-915a-13902e9d405f", "comment": "Malware payload (Panchan)", "value": "1e36d19c7526a70faf0a45b12f610ecd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948422, "uuid": "eca75450-762c-4c4e-957b-906cbe51f5a4", "comment": "Malware payload (Panchan)", "value": "68ce399d1d2e45faeb031bf1a1dbd5fe8e446330c1f74868e404cccf683e3755", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948422, "uuid": "b9b46e31-9c23-4f8e-b5ad-dee7260d0aa9", "comment": "Malware payload (Panchan)", "value": "661226df962af457ff1e993bcbf54ce02539e566", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948422, "uuid": "0ba16438-8d46-42db-8045-967c43d287fc", "comment": "Malware payload (Panchan)", "value": "0340c861e1f5a887cec057a1cb261fc099096d3730a75e705cdf749dacd1f386d3a4573281cd9732b8fa8a0c041ff5c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948422, "uuid": "d743c8ea-4fc6-4ae0-84e5-46f096a0e863", "value": "T1B257DF7792067CEDE9B94DB4C41015816DA878874778E3C7BAC870E6A6EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948422, "uuid": "576341b1-39b2-4ad2-8fab-1798391d52b2", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaV:sXyWSpV+Wu7rI3JEPf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948422, "uuid": "6b843b53-6a2d-49c9-9efb-94a64e875c93", "value": 29229056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948422, "uuid": "6e792bc7-e812-42e6-bec0-660c58fa4c71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948422, "uuid": "c6e3905b-4ebe-459f-99f2-4eab2d748301", "value": "68ce399d1d2e45faeb031bf1a1dbd5fe8e446330c1f74868e404cccf683e3755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c37e876-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948524, "uuid": "80a9f633-88a2-4d70-b220-a1a63051cb2d", "comment": "Malware payload", "value": "fdf83c271265227579d8a5ffdb40eafb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948524, "uuid": "b68d50b6-a293-49c8-ba8a-bb2ef1ce6dba", "comment": "Malware payload", "value": "68ff0129e76ad708cc1eb0d5a4d44a1b818807ffe2498c7dd2a94d092d6de5d4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948524, "uuid": "fb0d9ef5-0d35-4556-b0b0-e5dd7c644ec3", "comment": "Malware payload", "value": "b1e33fab07a84e2aee7f89ddb103667d6a2fe7ac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948524, "uuid": "8b696d76-416b-41cc-a534-5f31fa08d916", "comment": "Malware payload", "value": "466b35379f88c7bb58b678951fd0a2ee384708c4735b592a3cf20b4d207833c7777b08b987a26e15adc2c2db3de2ce52", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948524, "uuid": "37b67e5e-97d1-4c07-b2e7-c8ce88c27791", "value": "T1863195CB32A20B746CA5B92F726AC85430D4E6C71DCA9F587CEC38F6418CE057448793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948524, "uuid": "c0b44b12-7c74-42e7-8697-aba22b662705", "value": "24:vpni+pnhpnYc4kpnNaspnppnAspn2+pnfEspnKCpnrJpnBpny:vp9php54kpNbppplp2+phpKCprJpBpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948524, "uuid": "9d685d47-b63f-4dba-a7d6-b418b6d9ae01", "value": 1504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948524, "uuid": "59b4dc1c-1409-434b-a924-4a04cf9a3dd5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948524, "uuid": "1228a9e4-b51c-4b08-b223-dfff4784d461", "value": "68ff0129e76ad708cc1eb0d5a4d44a1b818807ffe2498c7dd2a94d092d6de5d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e4b374-04af-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657938687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938687, "uuid": "aae8d559-6e2b-42b9-9614-4509b8fb8e88", "comment": "Malware payload", "value": "f4d79abdfd95c6e7644ae2fb5c7a9f22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938687, "uuid": "051eaa1a-477d-4321-a4f5-78f319cd7556", "comment": "Malware payload", "value": "696450722098a7d2e790dfa101de47c7194f019282e62d6a0e1a4afe97f0086f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938687, "uuid": "ba1de28b-fadb-4979-b018-bd76d264bd66", "comment": "Malware payload", "value": "a7b2628e507a60d7e33eaa8d3154948c4f73b005", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657938687, "uuid": "50f8ed36-0489-46a3-ba81-b2e50ff3f1f8", "comment": "Malware payload", "value": "e64efcdb23b9578ec3e23c01994450f2d25af397623697c739bd0970052945f1a4cbbdbddcb566e7025d4f433a3a9e06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938687, "uuid": "c99b8e85-cbf4-4777-9704-279249c9dfb3", "value": "T10FA31939E8C45E02C0D62279FA4E524C73277BE8E3EAF115DE1B1B6077EA85B1F26401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938687, "uuid": "5a27ea9c-0871-4035-abca-f4930111133e", "value": "3072:kZFc6y2tgyE0RLr6r3S5ciLKCPbkloWc6dkOLzBh9cUn:63y2tgy9RvVNKC5Wc6dkOLr9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657938687, "uuid": "e352962f-d618-4db1-89cb-b8bab603f8de", "value": 104696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657938687, "uuid": "4cf08b65-60c6-499b-b57b-5edbf3cb29c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657938687, "uuid": "3f42c90d-c635-4a01-97ef-dbee65ae2ded", "value": "SecuriteInfo.com.ELF.Mirai-BXRTrj.6608.8879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a3dc2c-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948424, "uuid": "296b2dc2-68e9-455b-a4cc-aee3fe7704e7", "comment": "Malware payload", "value": "852def78fc056f90177843968d412d9f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948424, "uuid": "b1289e2f-9db5-4a92-b49f-326432fb5c02", "comment": "Malware payload", "value": "6973a40a0f1a8259b15fc3ec9b165e6215a9f0769c10713d5c1a8ea8196e2ab7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948424, "uuid": "83c5fc38-3092-40c8-8593-cc022700b82d", "comment": "Malware payload", "value": "08fbbb5a4f7c18bb3bafd663fdedcc442a4c2f8e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948424, "uuid": "d41edf14-d1c6-4704-bff2-b9f2ea592319", "comment": "Malware payload", "value": "8ce183d2485f3a80aa90c7732b72ee32fdd288472a4eb72ce5b64cb5b1327f5d0b087c4aa0fed7da190da6a9d78d32ee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948424, "uuid": "29d0f7b1-e228-4e32-b25b-2d7c0ffe2d42", "value": "T1DEA1E850112C1AB17246697AD26FFA62B50EC81B0A777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948424, "uuid": "1e99e9dc-ef65-48f2-bf55-aef8abd14019", "value": "96:8RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948424, "uuid": "9eb3429e-9452-49ac-aba3-a76784a53558", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948424, "uuid": "aba459a0-f597-4db3-aba7-e55478a80b0f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948424, "uuid": "20c756fb-b91b-4a4e-8217-0dcc9614ab74", "value": "6973a40a0f1a8259b15fc3ec9b165e6215a9f0769c10713d5c1a8ea8196e2ab7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7dda6a-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948256, "uuid": "540443ec-a0c6-4794-b0d1-b188b144ed5f", "comment": "Malware payload", "value": "809f1e3ebfaf48958cd58e8c52f1a230", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948256, "uuid": "57e8149c-b60d-4f88-bb50-965a527e6b33", "comment": "Malware payload", "value": "69d8edd01421588dc8db5022e51a516823e058c5d633032a042c24b6efbf166a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948256, "uuid": "80de26fa-67cb-4586-b1ee-6f7826d3a0c8", "comment": "Malware payload", "value": "5ebb77a296f5b17a67a2e603de5b6902e3e70880", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948256, "uuid": "64ff9ed0-2474-4a77-bd89-ee9ed6721a5e", "comment": "Malware payload", "value": "8386d9b910639e7a9947cdaa693b5710be58fb3552e2afdbcf2e41a32b0d062a14daa0fb7b263ff6d79556b53fbc0fd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948256, "uuid": "71a9c160-b0ed-4f82-afd8-9985fef7bda5", "value": "T1A541F0CA5F729EF9F55AD53847370A3937AA520847C14289E1ACEA006EC430D85DE7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948256, "uuid": "682e029b-4f15-4f77-aba5-db542711f2dd", "value": "24:3+Ydb5jl8AmslI3t8AmypR/z2HdllPj+qtWB4u3GMI8paeudz3N9l5zBkEp7iBAm:OG5E4GYg2H7E1eHeu/9LuEpgn38vmBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948256, "uuid": "d61af9f6-36e8-41f9-97db-67a7cff41e05", "value": 1983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948256, "uuid": "6e80f1d6-3db4-4cd7-ad2e-09fad105d699", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948256, "uuid": "9b342295-cc60-41ca-8538-0a2ca1332477", "value": "69d8edd01421588dc8db5022e51a516823e058c5d633032a042c24b6efbf166a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4970d55b-0511-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1657980732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980732, "uuid": "e0758e06-e8ce-4b8a-ba1d-67d2f1d3e339", "comment": "Malware payload (RemcosRAT)", "value": "87047c7b743dc86ecace2e23e8947162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980732, "uuid": "7cc8d66a-ccbb-4e9a-bd03-2b564f902594", "comment": "Malware payload (RemcosRAT)", "value": "6a4738877a8d3f4d83307e55744060b133e23c6652e45da6e81e218ef083ed98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980732, "uuid": "bccec90f-e3e0-4803-9fb7-19a6b7d7bcc6", "comment": "Malware payload (RemcosRAT)", "value": "e3dbe8cd88fdd5fb35cf69a63bd127cd724a4b06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980732, "uuid": "5bf268ec-bf83-4386-90ab-6d25e2e1da9c", "comment": "Malware payload (RemcosRAT)", "value": "1e14593c01627f84c7c1675bcdecb2b29d0481ad68fd2b7132001d5be829842e2c5179e15cf9cef4b1a453211eebfab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980732, "uuid": "4a21560f-46f7-435d-828d-28e9fc52213c", "value": "T1E8055B15E2E089F3DD26163D5E0796A4D429BE106D2CD8876BE83ECD6FF8A8134271D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980732, "uuid": "92107769-3eb1-4274-9c29-0fac1df5993a", "value": "077780b656ccb18d86eb00528cd56a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980732, "uuid": "c8f93ea6-bff2-449a-ac76-2c7a5eef3385", "value": "12288:wmgi3VtzPY+ji70/Gm23P+SraklRm9Q266cY4s6JBCbRJBT:wvuPY+h+hP+KaklRm9stY4s6JBCbRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657980732, "uuid": "59072dd6-c6f8-4ea0-8cbd-8c1f59b4c66c", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657980732, "uuid": "3010e6e5-1269-4471-bacf-a2bb7daedde7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980732, "uuid": "7b5e1933-a545-46ba-9657-fdcdfadf60a4", "value": "Djjqgjxvsvivmgvqnndlztehakutbkzaeo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6320b02e-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948133, "uuid": "7ad61027-e125-4121-a857-dd29890b499b", "comment": "Malware payload", "value": "7ba9c860c1bff7d84968b8068525f1dc", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948133, "uuid": "21d895b2-08aa-4432-b644-95f46d3461bd", "comment": "Malware payload", "value": "6a51f57a509796b96451ddcef516cd12fec85a79b4e82ae3c106bcac2970be4e", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948133, "uuid": "cab4583e-ec5c-4c77-b45d-95a0ecd3259b", "comment": "Malware payload", "value": "f190337abe630d0fdc425b0b2dcfac0f59579d8f", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948133, "uuid": "8c3ec956-0718-43ba-b095-d2dc4308a543", "comment": "Malware payload", "value": "603b69eebfeef16725f182b5b7f2750bde4a2719191558a7681f85cde2247a4d09b3db04d2ad28a3fe88881685e03894", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948133, "uuid": "5599f36b-8e26-4655-a9af-6e1f7de84031", "value": "T100A533B5B6DA30BD9AA8657767FFC924303BA6CDA0158BE06DBA11CE04061319ED4F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948133, "uuid": "6a41d096-335a-4f77-9e99-d00a44eef8a9", "value": "49152:HT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQ7:Hos909Qg6ecEZHyE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948133, "uuid": "2cef7873-18b1-4aa0-bedf-987da578ebe7", "value": 2084864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948133, "uuid": "09c0cf6d-921c-464d-92c9-66c0d359ef7d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948133, "uuid": "f3559387-bdb2-4980-a022-b46e454f9631", "value": "6a51f57a509796b96451ddcef516cd12fec85a79b4e82ae3c106bcac2970be4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02be509e-0559-11ed-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1658011537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658011537, "uuid": "7352b29e-5030-4b47-a812-53ca1da05615", "comment": "Malware payload (QuasarRAT)", "value": "0631b419f1d2aa1f51d565697f7ff56e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658011537, "uuid": "1a8bb643-5960-4725-b9e3-8acc67466807", "comment": "Malware payload (QuasarRAT)", "value": "6acfd8ef2502433b3023934dba693d72885c9b113858d30fbbb6ce2c44722f4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658011537, "uuid": "626236b5-8aa1-4122-8257-e76116e301be", "comment": "Malware payload (QuasarRAT)", "value": "7b36991c776244da5acfddd8ac6b6707f371c403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658011537, "uuid": "83427bcb-2a50-419f-b272-296feccb208c", "comment": "Malware payload (QuasarRAT)", "value": "26e9a784446d8a1901bd3b6d6799bddea3bcb645de4a920dec8fd1fbeee57b0a8ee069fe63e20582a0bb2dbc09a36f31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658011537, "uuid": "e976ee8a-8598-45ad-8bf5-e5ded0cb2d8a", "value": "T1D3E5F1BA4ECDCC5AE9A618B4BE64415ACD7881704F2FC6029E0724FDBEB4B5D76432C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658011537, "uuid": "d57bf45d-acb6-4d9b-9e21-bf1e7793545d", "value": "6144:R5gmOwGhvYugXNTmIaQmIm0ouYsQjeJaiUgCO/LDhjsV0LoPK8EHfUWv3xP:op8RiIRmVpbO5K8RHfUWv3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658011537, "uuid": "b4937f24-57f7-441d-a970-4aedeadf0614", "value": 3126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658011537, "uuid": "15ed1edf-1dc5-4d10-b378-75167550e2b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658011537, "uuid": "0945cc64-3b6e-43a6-b19c-27ea15b1f6b8", "value": "0631b419f1d2aa1f51d565697f7ff56e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f884f8-04c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657949752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949752, "uuid": "8dfe503b-d0ba-4ca0-b497-709cb28d43e6", "comment": "Malware payload (Mirai)", "value": "056932115b18975ab85d38517ac56e51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949752, "uuid": "ca4c6d25-928b-4cc6-85a1-41947a4e4501", "comment": "Malware payload (Mirai)", "value": "6b7d2656c7ddf100fb4d8fc63181c56f03d14279c71c963cc3838e2ab496e250", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949752, "uuid": "a2c573be-0084-43ba-86ee-eef45a0f7e88", "comment": "Malware payload (Mirai)", "value": "5b1c0d8410593d06d54392106efb0fdb0c194482", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949752, "uuid": "6a1511d0-2949-42f8-93ec-3325f6a1f223", "comment": "Malware payload (Mirai)", "value": "b5c36bd583c38c47d4bc466b7bb6434ee3da5aefc8258a40e75cb5f82192e169b7d6faae07cee08ab4bdf35e32b13da0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949752, "uuid": "de1af4bd-ddd2-4209-bcda-508110ec3d72", "value": "T13C933A07B71C4F43C1DB59F029BB2BF15769B9E112A36181B91BAEC05B33AB81523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949752, "uuid": "91a862df-1ab6-48ca-baa5-c0fb9f5a3bb2", "value": "1536:T3oCu/OcwUBvPsTbwHH3P6zMSIHsiO6aRv/lz535hLg6wOFO6V6qDjjofSee:T43/qUBvPs6X03IHsi2/L5hL7wOFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657949752, "uuid": "c4f1a2dd-4b64-4224-8ef1-bf3e9dce6211", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657949752, "uuid": "ff037f16-9182-49e1-91e9-8b5c1d09031d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949752, "uuid": "4821a9ec-5fcb-457c-9ce6-88b777d7f5e8", "value": "fuckjewishpeople.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1305d7de-0541-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658001256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001256, "uuid": "95ee9222-5d92-44d0-a45a-b09f6f58c898", "comment": "Malware payload (Mirai)", "value": "c1a087db0267b72678e951aeb5261611", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001256, "uuid": "44a49316-ab24-4009-879c-03d3521b0e71", "comment": "Malware payload (Mirai)", "value": "6c07aaf0fb39e76cc30073adcc5dfaef4dc0185db4ab5c45cdee4feaf02194fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001256, "uuid": "a9de67e4-2214-4df0-a9d3-b661b74f212a", "comment": "Malware payload (Mirai)", "value": "55eb41277c67d15191de7edfc8013f18a27f5029", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001256, "uuid": "5d87e6df-3b9c-4256-828f-9a5e1d1900db", "comment": "Malware payload (Mirai)", "value": "e611760bf6864b9812065c4fcf2e8909ea397684124bd0635bde7a85ee9c469775fec15660a40de9679939ab9d7643c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001256, "uuid": "cc48b5b1-d742-4441-b492-e6fd955be264", "value": "T12363965D2E219FACFFAC863547B39E20924C33A626E1C944E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001256, "uuid": "55f6e754-8355-401f-a842-ac0607857f9f", "value": "1536:YkJrDD25WpoSBvfvbxvbiMvb5nG6bU0fN2vYvLsCF6YPEDXV:7dDDkW2U1d2vYvLsi6YP4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658001256, "uuid": "784819a9-7b79-4313-bd36-0cc221065d1f", "value": 67560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658001256, "uuid": "8d8ac1a2-b111-4085-9186-3aba684d2b50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001256, "uuid": "f83761f6-50e6-48c6-bb69-0a5b375616f4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4cf949-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948180, "uuid": "28aa3678-9128-448c-9131-dea41ff59f08", "comment": "Malware payload", "value": "78c0dd74a2b6d2928673c61ae61e59b7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948180, "uuid": "564dff77-4fc8-4218-b202-b91aeb4e080c", "comment": "Malware payload", "value": "6c5b2294a00b848589761741d41989629f1a391adb2ebed6663042ceee2c4db7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948180, "uuid": "84712621-0c02-45ba-89f4-65d0b594e2a2", "comment": "Malware payload", "value": "d16f60a21b7b54773f3901c10dacc403a75c14a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948180, "uuid": "f030ecde-be8e-4004-9955-e977852b5b0f", "comment": "Malware payload", "value": "eb824014d1018cbc40690c6ade5e61b98ce4608bbf29da0601d303f86ae6f7160f6cd91ddae571ce5ff522375ab5fb48", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948180, "uuid": "1e865060-67e2-48a7-b149-a6abead14a36", "value": "T1A0A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948180, "uuid": "4f4d5b95-7c54-426b-ba7a-bcb52d171e0c", "value": "96:qRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:qRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948180, "uuid": "8e3e7e54-83c5-4910-b6f6-6fe776780a85", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948180, "uuid": "4fb7489d-075a-4271-971c-cdeb58fecd9e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948180, "uuid": "3da0e0ff-36bd-423a-bfd4-8d61fae783d3", "value": "6c5b2294a00b848589761741d41989629f1a391adb2ebed6663042ceee2c4db7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f40775f-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657948476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948476, "uuid": "25857f59-982f-4410-9f89-b6abcc899499", "comment": "Malware payload (Mirai)", "value": "8c0d0d7b60aa1d280506680753756364", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948476, "uuid": "e542f7ab-5f94-4212-b794-4b573f095649", "comment": "Malware payload (Mirai)", "value": "6cbce5a9b45ad22e2d0211b8c4ec6b05b17896e9eaa6e659bde7240de70bd821", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948476, "uuid": "6072b65e-58f1-414e-9b6e-58fc7d02cbd6", "comment": "Malware payload (Mirai)", "value": "03a5c93e8d41d8a42800b7cddde08a76e3e2d8e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948476, "uuid": "5d7685cb-f9f1-4686-82b0-9b1bcc8c5739", "comment": "Malware payload (Mirai)", "value": "f1586b4e061c2d9c2c78125a0881d990090044c38118e16d0b988bc621c32e8e48631811c3a02735a579feb8942a0ff8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948476, "uuid": "fb4f0015-fb02-4882-8b8c-89bcc859515e", "value": "T1DB8208D14693C9F1D82F83F1607FAF3A5DB0C61A0124DDA2E728F9726C9BA10D46A30C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948476, "uuid": "5776c9b3-77ab-4347-87fa-ca4969d7f77f", "value": "384:fzdXpT7QDT7BmweEM/0rZjJOO5pPxbyp7Ci+Zg:rdpMwweErlXPy+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948476, "uuid": "9baa444f-aadd-4608-aeef-58a5b2ad0f96", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948476, "uuid": "6b869b8c-5ecf-4c00-bda9-e8d176b4cd90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948476, "uuid": "4cda5260-b416-420b-9728-be2037909505", "value": "6cbce5a9b45ad22e2d0211b8c4ec6b05b17896e9eaa6e659bde7240de70bd821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02baf6cf-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947971, "uuid": "6bc42411-43d8-4a4b-9584-f7399608bc1f", "comment": "Malware payload", "value": "b4999e1690d281c2d8e29281afcb0105", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947971, "uuid": "734b7a83-ba24-4c0a-8b86-2bf07630e401", "comment": "Malware payload", "value": "6e34048cd6199e53c3363c29629920dab5c2acac646344f624d2e512f4cb9b03", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947971, "uuid": "ed1a3171-31db-49a0-89b6-ce80ceaa81eb", "comment": "Malware payload", "value": "bad3cf3148e2285b308177eef4ca4e0da22ef2b5", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947971, "uuid": "e4eaf0a4-1b97-47a3-a747-6bdf35116505", "comment": "Malware payload", "value": "a86b38bc7a79218c4ccb53731a0b7dca064da2674d5c0f891e9799d5987027cff61bbe32c052ff91d5f1a271d686ce85", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947971, "uuid": "9fc3fded-c6f8-4f00-a696-b0f3acf879dc", "value": "T13CE5330C13EAB8FCF8A94529376389E1C5E852F1988265F2D67C15980C3F57E1BDF921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947971, "uuid": "3785a12e-8dab-47a9-8385-db6d87e71f5b", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmw1:0XSxVJG2fLAqFOfT9sMY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947971, "uuid": "7a3482d4-1172-4b18-83d0-30f0658d94b3", "value": 3252224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947971, "uuid": "01d89694-573e-4919-a982-7a337c427a53", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947971, "uuid": "5c83ac48-25f0-468d-ad34-d5859a0ba896", "value": "6e34048cd6199e53c3363c29629920dab5c2acac646344f624d2e512f4cb9b03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebda5e53-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948792, "uuid": "1fdfad6f-634b-439d-8a0e-3f592bc8acf7", "comment": "Malware payload", "value": "7b94eb847f2cdac9c355fe3ae3975ac5", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948792, "uuid": "09c812cb-37c9-495b-a7bc-b42e64ac1ab2", "comment": "Malware payload", "value": "6e54c10445c1282917a63dc6421d1a402f6b9c94d893915cad13167d70bbfb97", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948792, "uuid": "e86c6c29-8c0a-4365-859d-a467ed845065", "comment": "Malware payload", "value": "64c43178fceb4f05d43ac35165f53701577ef331", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948792, "uuid": "fed598fa-c830-4be2-a66f-949249cd39e4", "comment": "Malware payload", "value": "19f13c2490ff0017c39a7bf46ac0db22526582db2605f2315da93f9d55457f91cc94806df8e0a834be9c5f48006a0787", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948792, "uuid": "b098ffbc-8fa1-43bb-8864-1bad6fc60552", "value": "T1BAC533BD76DE28FE86D4A333A7EFD9283026658E60218790AD7341CD1C16231D9EDE5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948792, "uuid": "422e590a-c32f-4ba6-88c9-ba3bdd0b95a6", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5x:tos909Qg6ecEZHyEexmLax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948792, "uuid": "efd9b897-14ea-493f-bb87-1e75f787fb28", "value": 2543616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948792, "uuid": "005ef8c7-31d2-4ec6-8550-a5e13841304a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948792, "uuid": "5057c782-77d5-4619-b618-b5d1493199ae", "value": "6e54c10445c1282917a63dc6421d1a402f6b9c94d893915cad13167d70bbfb97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8685ac-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948495, "uuid": "f23104f6-f028-4b9d-9c1b-dc9848ca758d", "comment": "Malware payload", "value": "4c5e4ebe411f63eda3a771d59bc40e39", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948495, "uuid": "f92c413f-2acf-4989-96c3-f6bda53cf923", "comment": "Malware payload", "value": "6ea4425ff7d08fe753bb9a32f07340ac94a054149461c85f0821964f3a0ad3c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948495, "uuid": "a82e621b-5054-43c9-8c21-dc88d3c4f6a3", "comment": "Malware payload", "value": "16e0b7c4a7e3251617df57e788d4b3f5ce705e91", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948495, "uuid": "9034ac94-a2d3-4eaf-a95f-a984c55e8f0c", "comment": "Malware payload", "value": "c250d1118e683676aa4c2c25d8ec3e66035e2c29d81144806a02dc2a5308cf5e10603b8f41c1f0064cdcda649f11f940", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948495, "uuid": "8c0f5e53-5444-4dac-b3aa-496e7fb0f9ab", "value": "T191A1E850112C1AB17246597AD26FFB52B50ECC1B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948495, "uuid": "91ec4d7b-8323-4a1b-afee-36ebe08e2945", "value": "96:mURYZxQOBpLyxIcymLKY8M991wuIaQPYPW:tRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948495, "uuid": "ac543275-8bd2-4a51-bc71-9c148a2a2cb1", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948495, "uuid": "a651e113-381c-40a5-99d3-e7fc8b2e7e4f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948495, "uuid": "0ea08422-9295-446b-a22a-25348d008b00", "value": "6ea4425ff7d08fe753bb9a32f07340ac94a054149461c85f0821964f3a0ad3c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253b3952-04f8-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657969934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969934, "uuid": "5cd1dae5-b50d-4738-9294-c001c737f62f", "comment": "Malware payload", "value": "4f8af0733ce83de8809f61308b7bd280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969934, "uuid": "30d18bed-3294-416c-932c-f63d9f466366", "comment": "Malware payload", "value": "6ee66d1744b129dcf0a0aa23e93273d132c498cde618b5cce19c230512c0014a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969934, "uuid": "0dab46c4-1088-4000-a8e2-6ef6038dea4d", "comment": "Malware payload", "value": "bb0fadf1e8f5d99f612d4e031b68392352d87742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969934, "uuid": "d4b95022-e118-43e2-825e-32697ac922d2", "comment": "Malware payload", "value": "bf92955ff5075d22cce83e1ad6a51b59bc4aa59fcffcab3c5e5c5d395c648e9d08d76ce49b591ccc090f4dce566f2c6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969934, "uuid": "53f9d65b-447b-4c5b-8e7a-6b720cde0cd9", "value": "T11425025F35598599ECCE8070CAE1AFB4F0E5A6703DA4E36E2FD3869C27119268723353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969934, "uuid": "c9512a4e-65c1-4f5a-81fd-45b928877fe2", "value": "7a195ad20dd0c44e24aea9fff812861b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969934, "uuid": "525f032e-f485-4812-be8c-17f51e8d3dc5", "value": "24576:yC0FMBxw00XY8r0v5dzOxFZARM8w6eFWcO/zz8dZ13Sj:3Lwjoe0hd0ARMvWR/zWkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969934, "uuid": "db407206-33fd-4f23-a4e2-382408c4dd81", "value": 965000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969934, "uuid": "888e8ff3-8017-4359-86d2-3c1dd4ec53a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969934, "uuid": "900571e1-54f3-4d6a-a27d-e905ebf56b0e", "value": "virussign.com_4f8af0733ce83de8809f61308b7bd280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b449e9-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947872, "uuid": "79626c8f-7d21-413c-87c2-a8a38accf457", "comment": "Malware payload", "value": "5db44ff8ffedb90fc0d6412422bcc14c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947872, "uuid": "3d4e1dcc-252c-4528-82a1-b69ac549dd26", "comment": "Malware payload", "value": "6eff2fdc7916a16a801b90af2ec0f275fcb3d85175a0cf36c00d5680586720e9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947872, "uuid": "1f20a2f8-5e2b-4a6d-94b8-7d61c9b7953e", "comment": "Malware payload", "value": "246d7f04870dc6e8775eae82d0d9c37369ffdfa5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947872, "uuid": "2af142ba-5ef0-48a9-8130-9753597ef788", "comment": "Malware payload", "value": "46bc3aab2bb1e43bcca90040093740a0df843cee4d1f9b372a30094bb1d3195a66378d59b3768ff3f0b7babfff167c63", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947872, "uuid": "f1c589ca-f81c-48e5-a2bd-4cdb3bbfe55d", "value": "T106A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947872, "uuid": "90870b4d-d458-4ef7-9909-cde914c8e11a", "value": "96:uRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:uRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947872, "uuid": "96310e08-716b-4065-93b5-011af1926138", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947872, "uuid": "a8a09975-7a2e-40d8-9794-bfe0b805fe37", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947872, "uuid": "fafece4e-c650-482b-906c-b343f4492858", "value": "6eff2fdc7916a16a801b90af2ec0f275fcb3d85175a0cf36c00d5680586720e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b606f967-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948702, "uuid": "ebe3decc-d7e3-4682-960d-72b7b1dfdb70", "comment": "Malware payload", "value": "1ca15f01faaed8f53fad5189c01451d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948702, "uuid": "13827ba5-3e49-41bd-a25b-0878baebe543", "comment": "Malware payload", "value": "6f71ac9a44f921b0bfd0ac71a8f8c3f775963ef0bca02bdfd1374627069750e6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948702, "uuid": "1b715441-454a-4b30-9a42-d535d9bd5d93", "comment": "Malware payload", "value": "e9474b39dd565145127e5ac9129dd96c16351e0c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948702, "uuid": "841c7a87-a5d5-41d7-849a-4ffd2e5c1c9e", "comment": "Malware payload", "value": "3eb987e5b021dda2a84f0f772a534b4542b3b98f78d8253083024dff78685c718b865561a147fbb45cb2467dfdc29a90", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948702, "uuid": "d73d7f3f-17a9-4547-b602-597a931959b1", "value": "T101A1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948702, "uuid": "dbd25fc9-d1ef-4298-9bf3-911c8cdef2df", "value": "96:YRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:YRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948702, "uuid": "f82a12be-1ead-4132-b6ad-e028ca7e8788", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948702, "uuid": "33bde9b1-f3e8-4959-b446-c43ccb8a2371", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948702, "uuid": "30fce6d9-1851-43ff-b69b-5d36258e205f", "value": "6f71ac9a44f921b0bfd0ac71a8f8c3f775963ef0bca02bdfd1374627069750e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c139ff7-04e4-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1657961355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961355, "uuid": "6f6428bb-da2b-491b-975d-ab1cc06a0c9e", "comment": "Malware payload (XFilesStealer)", "value": "ed6ab174903aba3558e733cc03ce4f93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961355, "uuid": "263288b9-277e-4eac-9f0b-24956f29a607", "comment": "Malware payload (XFilesStealer)", "value": "6fb30a54ed4ae6318cce0b0df4b395aebc1c07d27e2be873a16769390ea0b657", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961355, "uuid": "f326ceaf-e7f1-4e26-bba4-da3ade4acd1b", "comment": "Malware payload (XFilesStealer)", "value": "ef1de89966791826bbbf17d9e612eaae96562225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961355, "uuid": "c98b389c-e9a9-4e0d-a03b-5800771bb62b", "comment": "Malware payload (XFilesStealer)", "value": "5fa7f7727ae0cb25d16d4532b98df449d0da00ec787acec469f76c67c06c2bb2f65e02ce61dc35e51af4dc85889ccf76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961355, "uuid": "ff8d4ee0-61a5-4264-9afa-97605abc9298", "value": "T1A27497D832147B9EC867CEBD89B45C64AE607C67831B4103A55336DD9A3E9C7CF21CA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961355, "uuid": "ddea95d0-66a1-4893-a1ef-7ab6547c1fce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961355, "uuid": "a2a12816-cfd8-4cb2-88df-0b6de88b36f9", "value": "1536:lvBP0DBoWAIBn2tbGiXc6CshbiFRysfpp65lDVclN:OSzKn28iXc6CshbSbvSlpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961355, "uuid": "9f54d72e-2dae-4acf-8098-2e10ad7591bd", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961355, "uuid": "adade1ff-6182-4953-9a75-5794cd151406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961355, "uuid": "82140c96-856b-40ee-9cca-cfff9d903dd0", "value": "ed6ab174903aba3558e733cc03ce4f93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6715cbc5-0557-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010846, "uuid": "b9717eaa-d5c3-4eda-98ea-819ad6ec6b81", "comment": "Malware payload (Mirai)", "value": "9da9203e78e75e36ea9a7af4c0c5bfe8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010846, "uuid": "4c63bbba-cac1-4cee-b9d9-400fe65ea3a1", "comment": "Malware payload (Mirai)", "value": "70a810f1c540f7f83840ed7d485c361a4126f85e31b585ee485742dd4c259e8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010846, "uuid": "51f39855-822f-46ee-a889-fabb5cecc8b7", "comment": "Malware payload (Mirai)", "value": "23400c1071d0708fdaa797658ff5b16499283ce9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010846, "uuid": "f4f9ab6a-b728-4b6e-965e-d64f17408844", "comment": "Malware payload (Mirai)", "value": "c7a405afed27f8d7c79584117b689c4d5ec3e3f1a5462009e79e2c80e77b717b916a561457c4d00ac73cdf635b8d0f18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010846, "uuid": "cca91bfc-5b7a-4e71-8c1a-4d1ea24bf646", "value": "T16653AEA6C81DBDD4C8008234B122DEB82B63F405D6671EB59E8389A55447EFCF51F3EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010846, "uuid": "2516fba8-6cb2-4ac1-9bf6-7a5ef3c51dcd", "value": "1536:pa8FF3Ec4zhafwt1BIWJN5p/NqbnjxKi18jCTA:pXFFEc4zhogbSjwi1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010846, "uuid": "99629753-5b3d-4b13-8ef3-f0c05a3da5e4", "value": 63956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010846, "uuid": "833921f9-2113-4800-ab7d-beabc49c008e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010846, "uuid": "e62b4db9-2345-4105-b871-4d2bd513f07b", "value": "9da9203e78e75e36ea9a7af4c0c5bfe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe018e0-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948685, "uuid": "3387f9bc-5637-4cb9-b867-aaeb0be0aa90", "comment": "Malware payload", "value": "aeda42013a3fbf893ab16757dd97a8ef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948685, "uuid": "6f109fcf-1fd0-4b07-a9b9-c664d1a16a14", "comment": "Malware payload", "value": "70cb9bd3b32269e455f4b8129a6957f6e82b0ba74b23ead4a0350b6dfa8d0160", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948685, "uuid": "aa9190ca-3470-4df4-9742-ca365ffb6ea0", "comment": "Malware payload", "value": "d484a02ceef5e2a1dcfa8498c5b495a62095a22e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948685, "uuid": "ec365352-0f0a-4996-947c-515c67366b98", "comment": "Malware payload", "value": "61df656a9bdce1d874cebc4cf5ac02f9d08521f98e2051f0c7ebff8e6947d30b73e999df6261f649b9344e2988bcda28", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948685, "uuid": "c0933711-0295-4858-949a-75f5dcca989d", "value": "T1AD51A1CA042104F23CABDC7271AED04637D2CB95A4D26D8EC9E578B61DDEF18F489A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948685, "uuid": "b15f664b-36a7-4c9a-a612-26e92726e241", "value": "48:vWOBOsFWHuWyHlW8RlWxpoLWaXNJW3tUW90WA1WJ4WORW2ZDWOyOPE:vWk/WHuWslW8LWxKLWaLW32W90WA1WJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948685, "uuid": "0dc55da2-a660-4a14-87c5-1890283721c6", "value": 2856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948685, "uuid": "20fb6b5a-ee34-43bb-9040-32265b08f6f5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948685, "uuid": "0834b98e-1f48-4458-8f5b-e46dcaf96e01", "value": "70cb9bd3b32269e455f4b8129a6957f6e82b0ba74b23ead4a0350b6dfa8d0160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadd8b66-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948817, "uuid": "20bdd723-cc46-42bd-af04-f637db7bd513", "comment": "Malware payload", "value": "808b0bbfda39a60f3c00c1c59315e31a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948817, "uuid": "23f8ea7d-70cb-4053-aea6-79ae97cbc381", "comment": "Malware payload", "value": "70e3c30b57731a9ddead01e688f6e3db617a5070b59ab301e194c3c7cb14be8a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948817, "uuid": "d09609d0-084c-42a4-8d8d-2a023f7f68a5", "comment": "Malware payload", "value": "42b6449eef1dce8e5caf4969975923d9d4639bac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948817, "uuid": "1174a967-8f9a-4798-9f1e-beb3007050c2", "comment": "Malware payload", "value": "4c1f22b06b7868ad4c702e2318d7972f5f65308f600c4563cb563f995837de19348b4e8516e79d1bd5fbbf76bc9f8bb0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948817, "uuid": "8506ebec-7c2f-4f09-9f36-18dfb52ab8da", "value": "T133A1F850112C1AB17246697AD26FFA52B40EC81B0A777B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948817, "uuid": "e75ead7d-b439-4d88-a130-8d5fc27c8436", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948817, "uuid": "3efac83c-57c5-4adb-bbcd-2e15cafdd96f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948817, "uuid": "3b953085-b281-46d6-8e9f-2e6883bd59d9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948817, "uuid": "4cbb3415-8dd7-4195-adc9-a89e5416fcca", "value": "70e3c30b57731a9ddead01e688f6e3db617a5070b59ab301e194c3c7cb14be8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acf3b1c-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948871, "uuid": "5fe11cda-5a55-47fe-bad7-ad070783a447", "comment": "Malware payload (Panchan)", "value": "2d21a0c304ed856301cf90c28a6c130d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948871, "uuid": "78bb3e01-cad0-4f94-af03-12505cb081f7", "comment": "Malware payload (Panchan)", "value": "7184b2064739ce5ff09ce5cea8fe0d61dfd0bb3124f35c1ef1f359d6806ab213", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948871, "uuid": "723e6e2f-fc21-4970-9a03-5b9398fdcf9c", "comment": "Malware payload (Panchan)", "value": "8a2c33d34ecb3d52bbed6607b448494084398da5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948871, "uuid": "70e5483f-7176-4ae8-a6e6-c8da02670adc", "comment": "Malware payload (Panchan)", "value": "ceb42146b6ea4a0d6e421f229a4a4c276ce27e48ef1d54e534967f4d8747a4f1a39dc5347cfecab86721d0b4aa221990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948871, "uuid": "afec4e65-5f6a-480d-940b-f9ad4a7fe7b6", "value": "T1C827CF73910738E9E5A98CB4D11425426DAC38875738A3C7BAC871F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948871, "uuid": "8ed552f4-9f47-412f-ba87-a879e2c04f86", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVna0:sXyWSpV+Wu7rI3JEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948871, "uuid": "ec8aee1a-8adc-4c7f-9bf0-d9432b7cea7d", "value": 21725184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948871, "uuid": "818c2772-386f-4090-8bcd-c662b2dbd5fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948871, "uuid": "106e127a-6e73-4b7b-8a2a-495768dd7c30", "value": "7184b2064739ce5ff09ce5cea8fe0d61dfd0bb3124f35c1ef1f359d6806ab213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12010455-0541-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658001255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001255, "uuid": "7a89d91e-7ef1-4b02-a6e7-8894577ee4b2", "comment": "Malware payload (Mirai)", "value": "2ad8428bc943e38834d36dd6514373ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001255, "uuid": "06663de7-54a9-414e-9518-3085aac21601", "comment": "Malware payload (Mirai)", "value": "71fe9bf019f0450c3261be773fd67c3273f2adceedae146ccdd2c399528ab1a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001255, "uuid": "0c36aea2-f730-4f8c-ad65-67789952df3b", "comment": "Malware payload (Mirai)", "value": "2b99cbefb76b8f6f826f337861713392bbf2632f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001255, "uuid": "9d6e3094-5a0e-4aa4-bb6a-1eb34af658e3", "comment": "Malware payload (Mirai)", "value": "188da4707efe41f606240b4137798e68d2465a0975f840d52903b1ae86c919a0d13ba1d26b53a67ab000541a2ba6cf27", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001255, "uuid": "e470d454-6720-4a44-9a42-6674acc803f5", "value": "T171332917A9C1C1FDC559C23443BBB13AD862347E023CB19A7BC8FE2B6D49D609E2D858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001255, "uuid": "edb4946e-11b1-43f0-b97b-2f15b5fd2d45", "value": "1536:mSy2VYToJhFOQSsx7tsQWw0qBo9ho7E6b:42VYsJhwQSsxJXyio9SE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658001255, "uuid": "2a496dfc-af9f-4bc3-a8ce-12c34afe1fd8", "value": 50432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658001255, "uuid": "7103cae4-b81c-4b48-b6cc-1ea9f1e69714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001255, "uuid": "38fd98fb-2e48-46f3-9f81-55fb4aed4334", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13917e8e-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948859, "uuid": "e799ce8b-76e3-469b-9070-218f556f143c", "comment": "Malware payload", "value": "cca0ac021a8e76e733a9232bf351a35c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948859, "uuid": "f5fbca1c-a0f6-4e88-bb9e-a474b2ddceb8", "comment": "Malware payload", "value": "72c28e2ab2e8cd6f7b81190fe13541667485632b0ed207218367e2f623968da2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948859, "uuid": "c15228fe-062e-4b3f-8a9e-5a7a96658783", "comment": "Malware payload", "value": "33f68695b701575bf707950bd460f4dde4f2d1b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948859, "uuid": "7bb12bb6-2605-4bb4-806c-e5cd23e6adfa", "comment": "Malware payload", "value": "7075f19eb495094f85734bb651e3ea57d402618302022855df89d9148a2785884fa5a6eade39b8bbd1ed2f802d04665b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948859, "uuid": "b119d4c9-1a75-47c5-8d09-a10c5a46750d", "value": "T158A1F750112C1AB17246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948859, "uuid": "629a91be-2c84-49a8-bdef-4144634b06bc", "value": "96:3RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:3RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948859, "uuid": "0d5d28b5-e87c-4b71-8213-067b50e68de5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948859, "uuid": "c52bd7b4-612f-4f6b-9932-9ce887b70b03", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948859, "uuid": "ae0ab0fc-67ef-4bec-9e75-dfb81462bd15", "value": "72c28e2ab2e8cd6f7b81190fe13541667485632b0ed207218367e2f623968da2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d4f2ca-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948193, "uuid": "e41d6a9f-625f-4dc1-b89d-2bb07570145b", "comment": "Malware payload", "value": "830ed1b3716b1ee5e9e63d12e5decc86", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948193, "uuid": "f23adbb2-91c9-46c4-a164-5782204c2594", "comment": "Malware payload", "value": "73100dda9b3393a5792db6a74d6c8f53f913f5a602cf30b03b5f0326b6132319", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948193, "uuid": "9eb50748-6bc3-4723-9a06-54a66772965f", "comment": "Malware payload", "value": "f40a3f78365ddb4b8ff336a29e014c109c39c42d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948193, "uuid": "5eb9f026-1396-4d36-af2f-6e42ceaec247", "comment": "Malware payload", "value": "c44b28e0520cda3b35dac24d9ca883c4aa703eddbff39d3042f68e15188987136aea2c77871380f0a9db877bf13723c1", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948193, "uuid": "e5914c81-32db-4567-8ba4-362e41f16bd3", "value": "T179C5330C13AABCFDF99D052927638DE5C1BD91F0B58260A3D7681898583F5BE13CF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948193, "uuid": "d6f0db9b-45f0-4693-a902-60376890cfa3", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4B:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948193, "uuid": "821aee7b-409d-4514-ac7c-15c2e5f0074d", "value": 2744320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948193, "uuid": "b61058dc-aa13-4398-9d0b-022c946c9bbf", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948193, "uuid": "3be3a194-8a16-4834-905a-5867b07dfb28", "value": "73100dda9b3393a5792db6a74d6c8f53f913f5a602cf30b03b5f0326b6132319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7e3746-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948097, "uuid": "93fdd703-b47f-4bbb-9c4a-da78ccca7df1", "comment": "Malware payload", "value": "7b8813490d21cf5402ac1ad91fc02946", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948097, "uuid": "a0124228-0f05-46f5-b891-f5bc4c4026df", "comment": "Malware payload", "value": "735d35e5e08ba64d6da549fa24043f7462d128e65d10d8d8a6b6e308484f7df0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948097, "uuid": "67271709-5c2c-4940-80b6-978958c28c0b", "comment": "Malware payload", "value": "4c746f4e3fb3c78c4781c41af3f723f8ee98174a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948097, "uuid": "8f059aa4-7d67-4f4a-bfdf-c576169a5ba4", "comment": "Malware payload", "value": "5111a3aa28ab3ed104527dc1a49205953f020fb0c759fdd0c6fa93a17a65755d4a5a8cc12eaaea279539ecf6bbe7197f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948097, "uuid": "47434065-4a29-45f2-b13d-e1b79cac94cf", "value": "T196A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948097, "uuid": "a1ee3323-0ce7-4cf1-b499-705d6850c298", "value": "96:aRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:aRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948097, "uuid": "d7abc422-b076-44ea-86eb-782b7e33db65", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948097, "uuid": "6e402b4b-6167-46b8-b5f9-a77bbde263bd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948097, "uuid": "142bc31b-9263-4bc7-8200-4474b06bf2ed", "value": "735d35e5e08ba64d6da549fa24043f7462d128e65d10d8d8a6b6e308484f7df0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1e390a-0518-11ed-93bb-42010a9c0043", "comment": "Malware payload (Chaos)", "timestamp": 1657983739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657983739, "uuid": "62262a11-9b11-443d-8289-118ca94e2a15", "comment": "Malware payload (Chaos)", "value": "c86419b8db8a223534ad4eeb7a3e4b72", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657983739, "uuid": "208d5ea8-baf2-43e6-9f79-7dda30c1060e", "comment": "Malware payload (Chaos)", "value": "739b133a8f133943739c64ad32d4fafa701c2d89270c938db14f995f0abcdd70", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657983739, "uuid": "41a8c459-b2e8-4549-921f-0f660e735dc6", "comment": "Malware payload (Chaos)", "value": "25310225b637cc044a1ad97525f6249bfa86ae1a", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657983739, "uuid": "75e1ca2c-625e-460e-bedf-e146cf287938", "comment": "Malware payload (Chaos)", "value": "e1b37e7f616eb8645cde14e70a37b655fe986281952ffb149528e377c2c52154290c61897631f13268f28ddb43c26a9a", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransom", "colour": "#3725BE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657983739, "uuid": "85113029-4010-40bf-9558-8d2b1044fbac", "value": "T16BB2B50867FA4A39F6FF1F7869B251505B75B857DC3DD74C188A008D0932B9CCD60BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657983739, "uuid": "513ab435-149d-4bd4-a6fa-17f003b3f82c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657983739, "uuid": "499bcc7c-67fa-4abc-8b9d-d9d19afdda7f", "value": "384:m3Mg/bqo2RMUYBssIpYHxNqoJ/r91CzTyew:Uqo26djIpsUg/r9EOew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657983739, "uuid": "23b60794-d6b3-443a-a483-8a72659845a5", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657983739, "uuid": "987356d5-d945-45cc-b726-c478dc861ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657983739, "uuid": "e0e9e3b1-fc22-4d43-be15-b589be9c6e2a", "value": "svchosts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fed21d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948356, "uuid": "1d7591b7-40ca-4533-a8c3-20eab8ffe374", "comment": "Malware payload", "value": "362ca3038d16424663700cc02348d0e4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948356, "uuid": "cd1c4f15-b848-4c28-975e-fccb441db0f1", "comment": "Malware payload", "value": "73fb4540c2df6f316858c5c2f0f47eba7f5c62cb303fe337aa532b45e4fc7f7f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948356, "uuid": "05ed514c-e418-42ae-afef-3b5b277bc7ff", "comment": "Malware payload", "value": "79c6fff6e6d24edd62f2683cb5f4439d93f33a02", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948356, "uuid": "87c46b13-da8f-4978-a38b-4ed1e44d44d7", "comment": "Malware payload", "value": "11832569f553a5d3f516def77a037d382a77ede95048eaab120b9a1da13c29e739f3ab6ecbd7447a802f32416dc03613", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948356, "uuid": "a00ab3fa-b43a-4d64-810d-764f41850f6a", "value": "T14EE09215FCC1847E607FC469FBE76D5E560F1121424B263CD7F91402F8B9C945042837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948356, "uuid": "22bbca79-821b-406c-972f-e636e9f4418d", "value": "12:/VJ8HPI5q4nYVitgh1sghyTyigYtPi5yiil:NqPI5q7qLHfRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948356, "uuid": "b7fbe9f2-f4aa-428e-a8b9-1debd9b91015", "value": 398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948356, "uuid": "af2b8162-ffa7-42bd-b0d3-76756da70bde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948356, "uuid": "203169c4-6a5d-418d-acd8-2f5a5f87d531", "value": "73fb4540c2df6f316858c5c2f0f47eba7f5c62cb303fe337aa532b45e4fc7f7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cbce7c-0547-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658003814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658003814, "uuid": "cf8ac4ee-70cc-455a-9a71-b54c01a4a8a8", "comment": "Malware payload", "value": "32844e92bbd498244e3a2d8486181ae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658003814, "uuid": "0ce8db4f-9883-4e49-bcbb-eb49b94c7aee", "comment": "Malware payload", "value": "742489bd828bdcd5caaed00dccdb7a05259986801bfd365492714746cb57eb55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658003814, "uuid": "4e2795b1-46fe-4d8e-bd7a-ee149098a015", "comment": "Malware payload", "value": "2a4f6fea8b4e726d01b0d1b1e629d3a392e063c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658003814, "uuid": "6c02f6ef-52ef-41f3-862a-3ca2f81d0a55", "comment": "Malware payload", "value": "1758f56c3fdfaea4484237c9476864c4530b76e4223f17f3f9b9c33bdaa6bc10da73bfda1b7368af1aef8437b8e34d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658003814, "uuid": "ae507141-3f9b-4d6d-ab59-2f063d1e8cd5", "value": "T1CCF31216EA7097AEC681A97703992083CD24DC7D0083542766FD827CBCECB1B6D727D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658003814, "uuid": "5d51b1da-d8a2-4580-a98a-8a2dca16b640", "value": "50e4645798779602979868f1b8517523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658003814, "uuid": "7ed096fb-c2b3-4f4b-97c6-5b777008f566", "value": "3072:e6u2G0diw9r2iyJE/rdfzGO8EhwJYWB475vj0na8BY2TgJn54QEHdM2uoecqwZ:P1L9Byo5fzGO8EcNK75vYVTED/E9M2uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658003814, "uuid": "f78a6919-b48b-48e8-b43e-fe31860f2183", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658003814, "uuid": "df87d97a-b6a7-4755-af45-c7d2ee7ca3df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658003814, "uuid": "c8ebe73a-a16a-4d51-a075-9af4d022dc3e", "value": "742489bd828bdcd5caaed00dccdb7a05259986801bfd365492714746cb57eb55.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5106dc-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948498, "uuid": "a9742d0c-b8da-4da7-895d-49dff13f53bf", "comment": "Malware payload", "value": "f3fdb0ba67ed9a7eb6e2f77835151e35", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948498, "uuid": "2d95f1b6-c9be-43ab-971c-c5dbfc08b463", "comment": "Malware payload", "value": "746bc6299872ff6d804d2eb73667869c94353c43ede6d55fb89e8e4affe90d0a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948498, "uuid": "a5f3577b-69e5-4444-89a6-3160fb0527a1", "comment": "Malware payload", "value": "4d4bf159460e06dcaa768f123908fe5d5053bcb4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948498, "uuid": "301024ba-9645-4139-b540-5885b305b188", "comment": "Malware payload", "value": "26ac5cb793ce4017f604961de3d6a6e6b5d57d66f906c6ac9f0dea2c065dde2d52834e01cd5e1de5f9fe451d7fc0bbb8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948498, "uuid": "a027cab8-3912-4a61-bfcc-5c18abc2143e", "value": "T1BE418CCE12910BF56CA9592775E40A0630D581AFDCF47F2A4BEC3DE84C8DE097549AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948498, "uuid": "8d753d07-5e15-4c7c-9abf-cff7201f4f28", "value": "24:vds/Rs/kwdscs7cWdsYOsLVdshszds6s5ds+OsiKdswsBdsKsZds9sJdsorspdsV:vWwM9PJyEKc450WD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948498, "uuid": "c8499035-bfed-4c64-8b89-911cd80826ae", "value": 1988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948498, "uuid": "33278486-2e99-4484-9dad-d420ac82d55d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948498, "uuid": "0aee297d-8966-4df2-8dd4-497600542dfe", "value": "746bc6299872ff6d804d2eb73667869c94353c43ede6d55fb89e8e4affe90d0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecadc992-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947934, "uuid": "4fdf7b96-0883-4fb5-b47f-3c3a1f66b748", "comment": "Malware payload", "value": "7fcd1a70c8bfc043b60ce5b7ce140160", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947934, "uuid": "53d087f4-d7bb-4572-919f-1c8b8575b70e", "comment": "Malware payload", "value": "751f706822748806ecee29e9ba0f50b77ca5f5680b6ec607bf7e698293067a99", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947934, "uuid": "a43404dc-1490-47c8-979c-8f57ce7fa8f0", "comment": "Malware payload", "value": "dfe3e2bd1e1cb9c6d35307484de108ffc4e25830", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947934, "uuid": "412c0287-55b5-4ac1-875f-2f47b9390eb4", "comment": "Malware payload", "value": "9e1650b9e5bc2476c397f281cf3083edbd5846fbb9f76dd6ed5d59f48631a92b8f00a6c8cd16ce704ae8ddf3999dad29", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947934, "uuid": "e181c450-06b9-414c-9494-cd30b6f62556", "value": "T1EEE5335099D116C8F594CD2F1B9C6536053FEFDA74A8EEE3D2D28BF1000FA82EA72564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947934, "uuid": "698c4391-4390-4bfd-b2ac-ecf21e1b16d7", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqE9Z:G1wwAjzIQOMK2GNKslgus10Y1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947934, "uuid": "7d66acd9-9347-4ed7-9c8d-bda7ebdb9d44", "value": 3166208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947934, "uuid": "25b3b921-4a7a-419d-9b7a-310132d2b5e4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947934, "uuid": "31ea9b76-e463-491c-b343-ecdc5e0eca31", "value": "751f706822748806ecee29e9ba0f50b77ca5f5680b6ec607bf7e698293067a99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e50a26b-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948528, "uuid": "843a1b3f-6921-499f-b4fa-68f97e0728ac", "comment": "Malware payload", "value": "2b554053765ee92195fc001605cebf44", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948528, "uuid": "2e8ff4a4-ad50-4311-b346-21b5e93966b1", "comment": "Malware payload", "value": "752701133d121944d35e0f3f74edd9a973261a58d83bd1eb0b36c7e406ab3cf2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948528, "uuid": "eb3cb4d4-ed0f-42f8-887e-4f1360d45e1f", "comment": "Malware payload", "value": "42f49f3b5f943b95da4db305965d2d00a35ef1e7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948528, "uuid": "560e9b27-7bf8-4820-b56d-492cdbb595ab", "comment": "Malware payload", "value": "325869958681f800f48296d9b52f45780cee3d97959315a71c1d5272c6a114f17870db4cab22041be962c58db2bd3c44", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948528, "uuid": "113d37a6-1256-4ab6-addb-0269c82a0bcf", "value": "T15071A8E57834B6753CF6A9B366E64A02B2807135B8D44D42E2D5F4F8488EF91F180AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948528, "uuid": "8af28c3a-1ab3-4807-8ea8-84a63865209f", "value": "48:5+MV4kZj1V4dgrWV4OqoV4kENkEEV4EwWkV4Qj1V4dekZV4xwSV4+LkiV4u4U4mH:ppe70NDEpePuMH/sWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948528, "uuid": "22b362b5-dba3-41c9-8b22-bc0185659d99", "value": 3580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948528, "uuid": "7a041135-86d3-49d8-a1a7-bd42e400a442", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948528, "uuid": "6ed1afcc-ec97-4cab-9d05-01d3c1f082c5", "value": "752701133d121944d35e0f3f74edd9a973261a58d83bd1eb0b36c7e406ab3cf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a2ead3-04d4-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1657954425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954425, "uuid": "bfeb9471-ca25-4547-8a7d-77efe664e167", "comment": "Malware payload (RemcosRAT)", "value": "acf489e91e37d8b90ae41eee1f26308c", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954425, "uuid": "d4f5f6cc-62a0-48dd-af0a-bc9ea9207b0d", "comment": "Malware payload (RemcosRAT)", "value": "7552326de3a85dff87eb8f64856e15a3f2d462dd65b12df5e4c80909fed60c65", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954425, "uuid": "547032ba-b276-4962-9e58-c6f85c0b1b24", "comment": "Malware payload (RemcosRAT)", "value": "01de3b0597531bd292c0dd917bcc61d0d4b82f74", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954425, "uuid": "63465e0b-1a4c-45b1-98b2-888924e84b60", "comment": "Malware payload (RemcosRAT)", "value": "4bd8b2ff72eb40092b446aa8435f7843a84a8a73b411b4aa66a5fa3221fe862ac1689031913f13171a7bfe9058f53d9b", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954425, "uuid": "8bfaa79b-0f7e-4c44-b883-30cb0143d2e9", "value": "T165E25EA2B292DD06D98903764CE7C7E67726FC516F63834B3289F71E1F72AC08902657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954425, "uuid": "09a0ec35-fd33-4c23-bacb-21f7d5cc5f12", "value": "768:Fgk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJxydvAh/gCD2UNh3:Ck3hOdsylKlgxopeiBNhZFGzE+cL2kds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657954425, "uuid": "94df164c-e76f-437c-a727-9c7e4da9011c", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657954425, "uuid": "92211c30-36ef-4049-8776-eeebec16444c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954425, "uuid": "6a7ea06e-1b50-4e9c-9c4d-09ffb42b2a28", "value": "past due invoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1f16d7-04e2-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657960815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657960815, "uuid": "9732fa89-1a4e-4bd7-8730-0eb7ac556533", "comment": "Malware payload (RedLineStealer)", "value": "6f8d64fb6b3890b2cf8b552af9c7a2be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657960815, "uuid": "5af6e9e3-80e8-4ddb-ac00-039f62e4dd5f", "comment": "Malware payload (RedLineStealer)", "value": "756618a5ff59650fdb911d1f2cd27b1be927c83076f5de9ef7beaacedc3d678f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657960815, "uuid": "fb2e7a1e-92ad-4c73-bdc2-c26ab345b994", "comment": "Malware payload (RedLineStealer)", "value": "e4f4ae3e87f3c1fd755bad18e9daba3d4e9e6130", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657960815, "uuid": "8ff18c48-8541-4700-bb7d-a79052c2f445", "comment": "Malware payload (RedLineStealer)", "value": "d36c5264598fd91bfd67cf326e1bfd0e994dbb4dbdaf4859ab7539eba518dd65666c8ff8448479b13a43cb9d66702b01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657960815, "uuid": "b161724b-f276-4108-8dd6-efcca59c150c", "value": "T157648D00BB90C434F5F712F44ABE9278B52E7AA09B2450CF62D52AEE57346E1EC3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657960815, "uuid": "be364304-870d-4fb0-acf5-a71b17e8a401", "value": "149733ffc6fb8cb84df8287483828e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657960815, "uuid": "28592e55-361b-4bf0-81a1-4cfe5b554b0b", "value": "6144:dI/nfBVx8qBMmlxiRJsh76bVIWbBZveqYTd21G:dEfTeKMCoRJsh76e+4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657960815, "uuid": "1fb80ced-fb2b-4471-92d0-7574ba0b8d40", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657960815, "uuid": "c5684270-6e0e-4fbe-a9ba-ff3ec6578e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657960815, "uuid": "09de0994-f4b5-4da0-be97-517806f8e6f6", "value": "6f8d64fb6b3890b2cf8b552af9c7a2be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbf7f66-04dd-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1657958596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958596, "uuid": "12242243-21c7-473d-8c07-68d8ba8a8e8c", "comment": "Malware payload (AgentTesla)", "value": "cea1ee73f91f5a873a77e3a7e1233c82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958596, "uuid": "2b0ebfa3-4ee3-4b50-bd5b-09fbe1550f50", "comment": "Malware payload (AgentTesla)", "value": "75a0d35358a0d487802583885c1037405da0450bbd69483c744a71b0e1f3f2c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958596, "uuid": "3f74c739-f14a-4165-b929-837d51e93518", "comment": "Malware payload (AgentTesla)", "value": "a788477fe53968aae3844c9ed7e329fb7702b59f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958596, "uuid": "ff73f9e2-6e20-4ad2-af24-3ebbdf8d33b1", "comment": "Malware payload (AgentTesla)", "value": "8d3202478fa8181e568ead01e492e0cd9fe6e018922376bd1e6a72afd4400b61d612f4cedfee0adfff6d1809432ffe6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958596, "uuid": "82ea6427-6dde-495a-b9f5-16a7bcbe8d34", "value": "T1A015222735584A6BD0BD4BF2C43249D103762DCA6996FF111EC4B6EB1973B50AB08BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958596, "uuid": "d58cc666-9045-4cba-9afd-b787f3229530", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958596, "uuid": "851587c5-963a-4997-8b46-6de32a38dfd7", "value": "24576:/lhLuyyhorWEyLp2Nt2KWVucY8IjtnH659Y:7LuyyCrrMcZZnHGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657958596, "uuid": "d91ae764-1426-4c42-aa50-7db33276a4bf", "value": 910848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657958596, "uuid": "dfd67929-ffba-417b-99b3-bcbb79f9aeee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958596, "uuid": "fb5546ab-bb71-46b7-895f-4eb0d718bf6e", "value": "cea1ee73f91f5a873a77e3a7e1233c82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8ddada-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947825, "uuid": "25e21312-0173-417b-9340-6442c30d2256", "comment": "Malware payload", "value": "cc77f78365c472de6dbf441d5848c727", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947825, "uuid": "c8c8cfb6-dd0b-4f71-9579-fbcaf1875e62", "comment": "Malware payload", "value": "75d3695db9a86814156f05a0706de6d35a62a222aa597513b86084489f096df6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947825, "uuid": "48d37725-0dbc-48fb-b5f9-bcfdf5193ec1", "comment": "Malware payload", "value": "56ca41583289127fa9cdd02c279e8181ddfe2556", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947825, "uuid": "b3548bee-54a4-4b58-986f-9eeeff1d172a", "comment": "Malware payload", "value": "b5c389f68334e53bbe1bcf57edcfd18894abf11801c8a4207e6cf1c52f79ac5d20b3fe7c536df3cf5d3f8e1fb61a061a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947825, "uuid": "bcb19fda-ca67-43e2-931c-4ff0943981c1", "value": "T1FCA1F750112C1AB17246697AD26FFB52B90EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947825, "uuid": "ae653f02-0ca7-4758-8b71-661b8c112176", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947825, "uuid": "9d884c54-8bf1-49c2-b377-3a4495df33f7", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947825, "uuid": "7837a55f-9f26-4bb0-b497-80404e91e279", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947825, "uuid": "28a99a00-551b-4309-a619-e38158839367", "value": "75d3695db9a86814156f05a0706de6d35a62a222aa597513b86084489f096df6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71621660-0504-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657975215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975215, "uuid": "30741076-7662-4f21-87bc-44ae1c4a5765", "comment": "Malware payload (RedLineStealer)", "value": "c0d93be16887be5361939930f47675a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975215, "uuid": "6b64e34a-8802-4fe6-a039-8ae5a6379e35", "comment": "Malware payload (RedLineStealer)", "value": "75e9154185d404e68a38f7f3bfcb0ade61438e910ff1bb1e0e790491a60ed6ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975215, "uuid": "681e5037-2f8c-485e-8abd-fbfa83aa771d", "comment": "Malware payload (RedLineStealer)", "value": "bd5ac0d01d2d6f1cb46a2096e61656c8a862e57c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657975215, "uuid": "2af5f6bb-b70f-479b-bc30-7dff4bbaea17", "comment": "Malware payload (RedLineStealer)", "value": "fef6d523912b63b9c283ea813c568e1c8e448acf4954b9c0e721c66b5791494adebff40f8ff11dd09c14a0aaa614a11b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975215, "uuid": "b91fd174-2272-4709-9d0e-e58882489e9a", "value": "T1A9648E00BB50D434F5B712F446BA8278B53E7EA1976850CF62E56AEE57386E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975215, "uuid": "cb4b8603-1b85-4dfd-921d-a49293ad6cb3", "value": "19b703097c4f74d6bb1c823ff614186e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975215, "uuid": "fe4cb956-a4e7-4945-9c25-5f8a6af1774b", "value": "6144:PiY6kQ753vfzb7bUMgzMPD59Ztr9MIEupOuMDjvIKgfA8:PiYxS/rPbNuMr59ZtNZMDLcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657975215, "uuid": "78a15d6c-41ec-4b78-940e-f0647c202861", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657975215, "uuid": "fc7667d6-76eb-43db-8f60-68eb093b296f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657975215, "uuid": "8506518e-d616-4141-b72d-ac61c543d4b3", "value": "c0d93be16887be5361939930f47675a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a64d1c-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948347, "uuid": "f5c5f9ba-3d7c-4fa8-a724-4e5487b29ed5", "comment": "Malware payload", "value": "e2d3226cca187f640b5ea1669743d0e1", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948347, "uuid": "c6e03db2-f0b9-4c76-9de8-e1c953c60929", "comment": "Malware payload", "value": "75fbbe09c0450dabcdb3063988fe775d9e0c156ebd6efddde99bc3ac24f23648", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948347, "uuid": "eeb7e242-1590-40f9-bcfe-e88eabed2a69", "comment": "Malware payload", "value": "153ea61617664ee75f52153b2a56c0c8d6d09255", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948347, "uuid": "e744052d-b4da-45fd-9ead-e376e6cfe01e", "comment": "Malware payload", "value": "f3f25d3df460e68848780816073460623929c908a1affc428f8598972bd74f8773b0261f87b7e8686e70ae6f528211a1", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948347, "uuid": "e29478a3-1214-40bf-87e0-9bc1e2e1d069", "value": "T1A22423F262D470879154B7E8518A97C0EA69C03E7BAF7A373B953CDED44983838F8490", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948347, "uuid": "f50d8365-446e-4b35-a76d-865f031b4b63", "value": "3072:bxGK8lQY1TsBxxbb4sbc0+/mDJj3yVXFl/IfMAZnq22tRAa6NGx9TvVtQoOGZVWW:WJl+blcj/mDNgl/I0AcDm2zvVtQaeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948347, "uuid": "479aadcf-b937-44e8-96d9-a0323403babf", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948347, "uuid": "d48cf9ed-f1f6-4d62-8fb1-ac088a5fdf5b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948347, "uuid": "4c544e1a-2d00-4914-a145-c50e2ebc4d29", "value": "75fbbe09c0450dabcdb3063988fe775d9e0c156ebd6efddde99bc3ac24f23648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463b3b50-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948514, "uuid": "0c96ef2b-db62-4012-bf6d-e97debae8b1d", "comment": "Malware payload", "value": "3efdf2f02d6e55d788aeba9afa1cbfba", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948514, "uuid": "48b3f32d-194f-42b4-bbe0-084a5c99d59d", "comment": "Malware payload", "value": "766fa5a57cdbeaab887a9110fd0af9377b6bb2cb5a7ff3686ca40e8b29a8f2eb", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948514, "uuid": "d434b330-13c5-4ff9-84f6-e472fca6be08", "comment": "Malware payload", "value": "38439314a2c5af3b6258820254eeb40b7162c042", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948514, "uuid": "5edd534e-7329-4299-a5af-82d21740f0c7", "comment": "Malware payload", "value": "c8dc21f9befa3bb4eaad9e5798be4631aebd87441301d44ad01058405137b406a69795d3fb82107b45af51283fd36a10", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948514, "uuid": "6f2bc08a-3afc-4be5-b872-3ddca6ab52e6", "value": "T14E9533C4A396E4758CFB614D0A46E96B39F43BA8F17F9A47188007D2014E319AF5DBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948514, "uuid": "c470b60c-2046-4f00-8808-a2bc69cce872", "value": "49152:q1XHxnnkot7KjX0aKgxC2Iqy7/W5u5+OYyhV5TQdqBHm:q13V3a0rqRIZ+wrvNoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948514, "uuid": "ca33d0a2-3ece-4b16-9098-d8bdfd44414d", "value": 1929216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948514, "uuid": "ea8d002a-4744-41c4-83fb-d24c57cae5ae", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948514, "uuid": "b760451e-8ac8-4dcb-ab58-21f877ab3e08", "value": "766fa5a57cdbeaab887a9110fd0af9377b6bb2cb5a7ff3686ca40e8b29a8f2eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331c4d25-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948053, "uuid": "8121cc4a-92ad-499b-9d6e-d6f449f37af9", "comment": "Malware payload", "value": "bb565b86d408569f866fe983d5dce456", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948053, "uuid": "7a72acb3-d82f-4758-91d6-fd14c0661acd", "comment": "Malware payload", "value": "7701de8f97dc0e95f95f2e9ecc79b41506aac605731aa07714b9836ef06793fb", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948053, "uuid": "71e0ea7f-8537-4d9c-9558-e7aaff830fd7", "comment": "Malware payload", "value": "640add02dab763e3fe293f9079ec3dbd0471a2b2", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948053, "uuid": "5c1ac330-ba3b-411f-ab93-fd40aa17a97b", "comment": "Malware payload", "value": "20a614a0507d415fd5e1dc980ee75b4bf43f0d57daba97d1ffb71e04755c900d33e009f463125e01f0f69cc62ab0a325", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948053, "uuid": "f3ed6921-5fca-4572-a232-d1a5d92b8d9b", "value": "T173D533807367E5B69CB7624E0E81657E36F57B9871BE8A936CC442C1050D338BE2DB78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948053, "uuid": "c5800161-0e57-49b8-ae01-def857c10f28", "value": "49152:q1XHxnnkot7KjX0aKgxC2Iqy7/W5u5+OYyhV5TQdqBHFRX9KBnxIffVLpMArxsjn:q13V3a0rqRIZ+wrvNoGRtKzIVLplxsV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948053, "uuid": "cece0661-9d10-4505-8c91-022d56cc0bab", "value": 2940928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948053, "uuid": "3c46c94f-87f0-4e54-bec6-77044e58b86b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948053, "uuid": "07497705-6b64-49a2-b128-0e9650f306e3", "value": "7701de8f97dc0e95f95f2e9ecc79b41506aac605731aa07714b9836ef06793fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1708d475-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948435, "uuid": "1e7577ac-fc54-41e4-8c5e-e63d857656f8", "comment": "Malware payload", "value": "9404aebca76774819d8d6b7e41160c79", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948435, "uuid": "ae525ade-0113-4d85-8aaf-b79a3a0f7be6", "comment": "Malware payload", "value": "770561eeab995e78ba50567fbf7e21b84a856d91f4f310e4253c754892c8d1a9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948435, "uuid": "6c6e512e-a024-47d9-9558-718108f65b32", "comment": "Malware payload", "value": "8e06fa2b191cafa335ffbea1a754be255b032576", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948435, "uuid": "37e74324-c4bd-43d2-bfd7-664f1d3201f8", "comment": "Malware payload", "value": "3297d97952affcf834c2b252fdf327707047049a7768d59856246d5d9bf210a0fb8083688344bbbe615e05080ee0f933", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948435, "uuid": "8ee0a447-6944-477b-8687-50d972cd990e", "value": "T1225172E023F1F9BA3D7754AB1367E84031D060942DD1BD0898D8B9F5BACED4692D81EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948435, "uuid": "7d696ad0-28dc-49c0-af97-238341842789", "value": "24:IjeHrQraeW0XeYakekeU+exkelengD9IeYeleA5eve6lAhf:VvI9Wahf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948435, "uuid": "409bcc7e-e5c5-4725-a01b-61f33d51e380", "value": 2526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948435, "uuid": "ab60e4f1-9d2a-4a57-99d1-8ca83e018396", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948435, "uuid": "ee2f3ae3-e101-4d07-a1aa-60e274574489", "value": "770561eeab995e78ba50567fbf7e21b84a856d91f4f310e4253c754892c8d1a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c1ed18-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948505, "uuid": "329c624a-40a5-4cee-b33d-21dbd00cdd3a", "comment": "Malware payload", "value": "0b943decc1acf050dfd125af83b1a06d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948505, "uuid": "82b12435-682a-4129-b801-b42d685cd66f", "comment": "Malware payload", "value": "774b902d46f927e5235fa571432a5edda3b7fb61afc4193c005e37f4f3b1d8e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948505, "uuid": "33ee8da3-e2fc-4165-a1fb-4dc6672a5603", "comment": "Malware payload", "value": "9924cd01682f9dd07f0d8cacf5dd560755b9438f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948505, "uuid": "997a192e-4c89-4cfb-9b77-e1c52e22924f", "comment": "Malware payload", "value": "840e84f98e3d6856e32c23c715bf867a78df98ecb0122c026333f1d68b870936a41e66f31524c62e270851d79cba13ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948505, "uuid": "fafa03bd-935e-4a6e-82fb-eda5d0a8c854", "value": "T1B141ADD813120BF6ADE95D1775A8CE0530C7A54FB8C6FE984EDC3CE8484EE497069AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948505, "uuid": "51743914-901e-40a1-a7b9-ab612382d2cd", "value": "24:vCb2/kwCh7cWCYLLVCmzCX5C+LiKCVBCHZCiJCoIpC/2/kD:vww8F1/SSKc4Xk0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948505, "uuid": "d7fb7d22-2070-4632-a985-5e937d9e47f5", "value": 2014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948505, "uuid": "0bbb8e85-ba3b-4180-a84c-84ad01162d7d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948505, "uuid": "c890c523-e428-4179-a4b7-9b7a512592b7", "value": "774b902d46f927e5235fa571432a5edda3b7fb61afc4193c005e37f4f3b1d8e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1af7f4c-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948319, "uuid": "1ed52de7-ac11-4f76-8c97-602e41685ed9", "comment": "Malware payload", "value": "235840ac5ba246cf1f3d8de0e0e76e79", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948319, "uuid": "32a15bdd-1e4d-4ee8-bbc1-534649fd2e09", "comment": "Malware payload", "value": "774ed84370c31cbede1ded9bfdc902cbd72dd2b2c3e029022ffe394abce59e45", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948319, "uuid": "1af5098d-b989-459f-8a27-3dfbc830ffbc", "comment": "Malware payload", "value": "609f405307ab43497bf26ed350160621e6d6e838", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948319, "uuid": "40600e05-ce65-478f-adfd-c309b49459f6", "comment": "Malware payload", "value": "eae0d43edb30e1d084bde5ccf7f0bcc7f455b913a8eaf47d3ddb561de002aa99eeca1865eb47826f530a05f02935ed75", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948319, "uuid": "b6ef0723-8ebb-4a9f-9c23-5353c9366193", "value": "T15DA1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948319, "uuid": "b7b8745c-4e42-48c7-9f83-ddb6d87f88e6", "value": "96:zRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:zRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948319, "uuid": "f09f5648-aa66-4bd2-b3a1-7fd2d33dcf9e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948319, "uuid": "4e6719ad-f794-4a8b-b4a8-53b6a613a7a9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948319, "uuid": "cb551c59-3727-46b1-96f8-fc9d2583a6a8", "value": "774ed84370c31cbede1ded9bfdc902cbd72dd2b2c3e029022ffe394abce59e45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4009318f-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948504, "uuid": "2d2026c7-9e43-495b-9d11-2d86213b7ab5", "comment": "Malware payload", "value": "4599e63e0f939a11b6647fd5b8ed83e6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948504, "uuid": "4f277f7a-4215-4579-b603-2372cc35e677", "comment": "Malware payload", "value": "777d22189da685898df46ca563c97094958185d59bfeefa1227fbeb188380395", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948504, "uuid": "2d0c8341-1b0a-4411-b76a-7f7c97b2f1f3", "comment": "Malware payload", "value": "329b7dc424ecca223bf770b69f2feb58d17f0d7f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948504, "uuid": "1eda5480-e5c5-445e-9023-36f13a81635e", "comment": "Malware payload", "value": "209bea0a0a03c76f7c3d73092f18d05952d5f583bf47e7533ca5f0d92126c985e1f31eeaeb0f1c59c7c37fce568afd7f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948504, "uuid": "43d8dffb-a722-4225-bc6b-c814f15f9f46", "value": "T10FB2E984F26CEEFD28C0D3BAEA16D431AB2D70CBC865B49131DF495E5E884B4F21D499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948504, "uuid": "15d24705-1a16-44bc-9c87-ff137a8bed77", "value": "192:eijXyBJkcLP51+jm5zUQ2gPoXICP1zmzs4oZq1Jop9P1TAJBa9fj8+5TTTWHy+Gr:mLP7OsbPgIQ1iJJQJvxCYbl3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948504, "uuid": "0b5aabd9-b321-40d9-8629-7a95f9ec8f15", "value": 23501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948504, "uuid": "6003815c-5f91-4ecf-9a7f-0fbd5ec9212c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948504, "uuid": "5b0de4cc-97a5-43bd-a310-be24cf42133f", "value": "777d22189da685898df46ca563c97094958185d59bfeefa1227fbeb188380395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd805fd-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948604, "uuid": "0d4dacb6-cc14-4876-b310-4426de01307b", "comment": "Malware payload (Panchan)", "value": "4073442570f7d8a3e77e0d2854c95425", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948604, "uuid": "39c6059d-dfc8-4938-95ee-57518a7a005a", "comment": "Malware payload (Panchan)", "value": "77ec253828c542bd05dd5ccaa6c306cc200ab0735d62b80a43e31b5b8d10570f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948604, "uuid": "77a34f0f-8bde-44f9-894c-3bb1556333b0", "comment": "Malware payload (Panchan)", "value": "932b5f6d278b03c7fcc04ce7a0cbc8398558f4cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948604, "uuid": "7dcda103-7336-490a-b805-d401598aed1c", "comment": "Malware payload (Panchan)", "value": "521b1cd45a88e44e7a1708b71f06a389f4e19c4b01a4a3ba414c8f554dd35196afbeda35289a3a72bcadb41134ef2695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948604, "uuid": "3718af76-ebe0-4c1c-951d-4425226e8dcf", "value": "T1DA47DF73910738E9E5A98DB4D01425426DAC38875738A3C7BAC871F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948604, "uuid": "7561b44c-9548-477e-9400-1de10eb15cf8", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnai:sXyWSpV+Wu7rI3JEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948604, "uuid": "e9e2183e-b8ec-47a8-9364-7679d9c48bf6", "value": 24903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948604, "uuid": "e35a9b8e-6f13-43dd-b1aa-02872d257ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948604, "uuid": "c16aa5dc-9d2a-4968-a75e-ef34f2e6ce07", "value": "77ec253828c542bd05dd5ccaa6c306cc200ab0735d62b80a43e31b5b8d10570f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210a3ae3-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948022, "uuid": "3e097d70-cf7f-4950-aa06-997f3dbccfe7", "comment": "Malware payload", "value": "daac2732d74730666ec511b61b26a1b6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948022, "uuid": "3be6187f-5c64-4d06-84d9-3781cd7db540", "comment": "Malware payload", "value": "77fc1188c21134632a7de5be6e0f1045f6348149e7788d93c154de4b3a0eebff", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948022, "uuid": "bd5e46e2-05a7-440c-bf61-f445f3439f56", "comment": "Malware payload", "value": "ebbc9bb61befac9f09d45686622a033f1a9da124", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948022, "uuid": "f42e75f1-36e6-4000-9aa8-a032689f1a0e", "comment": "Malware payload", "value": "876cf9440a21d722320ee989ea2d072a5b50f578308354bdabdaf6c27d2ffa86c717719942d0737047579b5498ac566c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948022, "uuid": "926629ff-56cd-4a1e-b175-a6fd276b832d", "value": "T1CDD5330C13BABCFCF89E052937638DE5C5ED51F0A48254E2D62819981C3F9BE179FA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948022, "uuid": "e79e99d2-9754-4564-8970-e3869bb5e6e8", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4f:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948022, "uuid": "3b2c7060-903f-4ab1-9270-c4cb04b97e83", "value": 2908160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948022, "uuid": "f0eb174a-d183-48e4-b437-e2b0af71d340", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948022, "uuid": "5466c007-4655-4a52-92b4-6f748e6ca44d", "value": "77fc1188c21134632a7de5be6e0f1045f6348149e7788d93c154de4b3a0eebff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a10509d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948225, "uuid": "a22c5a5a-8337-4477-bf5a-ba4915a09bd7", "comment": "Malware payload", "value": "a830de0bc27c5be5d846f7a727777439", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948225, "uuid": "f6259c59-83c9-4b68-be04-ad01f0db5a27", "comment": "Malware payload", "value": "790ae9cd3410926b985bd9034b553026e24b1cd1c5d1606d45f201610105b71b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948225, "uuid": "0824e250-c8b0-431f-a8ea-e5130a029ee0", "comment": "Malware payload", "value": "ef612040ac578cb9adf964681af67486b3e91e02", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948225, "uuid": "ff0edd3e-6f2d-47bb-ad89-5f042fa09d7b", "comment": "Malware payload", "value": "aea0095b975fb04b224f825358b54e06e80dc51e43b7f8b63fc6623804ad26dd0c1ceb4d169b38fdc493486bd111adb1", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948225, "uuid": "4b1b6296-b9d9-460b-8961-0880da9ac474", "value": "T108E533794E3B79DB103E2316585643F38661BCED1818F425A3FA96DC348E5F4A8C2BB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948225, "uuid": "ff1d2f88-1906-4550-902d-62da4509cd05", "value": "98304:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKR7O4gLtubex6E6H7b:R4FEQETHt3/b2TdR7Xgqo6Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948225, "uuid": "ebf60aa1-2b53-44cd-ae27-f088ef5c18f5", "value": 3211264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948225, "uuid": "ddb9404c-2a72-42de-804b-0fd386902cd9", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948225, "uuid": "a6d23ad2-eacd-4ad6-8d7f-68ce88ab88b5", "value": "790ae9cd3410926b985bd9034b553026e24b1cd1c5d1606d45f201610105b71b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44b461b-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload (XorDDoS)", "timestamp": 1657947920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947920, "uuid": "b603848a-403b-45df-ad58-0f1aeae39b9c", "comment": "Malware payload (XorDDoS)", "value": "b8befc5d44a8999b16cd181f77d8e71b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947920, "uuid": "722d66da-d322-4d21-acf0-d35e5738f777", "comment": "Malware payload (XorDDoS)", "value": "7925ed5696a4f0d0faf546a13fabbfd6b8f860a69a1c8159f8ac589d77b928e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947920, "uuid": "5438f27f-646f-46d7-aab7-67dd0659fc48", "comment": "Malware payload (XorDDoS)", "value": "9861ca01a881af4aa4cd46ee9a382cbdda36767f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947920, "uuid": "2be429b8-3835-4343-aa91-7cc1aa9070f8", "comment": "Malware payload (XorDDoS)", "value": "50fdc8a12cc479dbd0a059a60f59bf0acc3a28a181b9a69885d2608466f35bf115742c7ef32da7184a2942a1bcd6f998", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947920, "uuid": "87b96e4b-614f-4492-94a8-b7b16d82e1c1", "value": "T1D5643B16E24390F7D82704711387F7FF4620B636D420DD9AEB94AE5BA9339E2664D323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947920, "uuid": "2620cc25-af5f-4468-ae7a-5264ea93679c", "value": "6144:VufRvuKqCdDVZssuEn5MorhkmKADpPnhcfPdqyoIT:VeRvuKqiVZ4En5drNK0pPEfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947920, "uuid": "f06f7423-9352-4234-b4b2-8e16a3db2922", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947920, "uuid": "bf1fae4a-7de6-4970-8d97-a8318953d8fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947920, "uuid": "84868b9d-639e-49e0-8e5c-984a5e1c23e1", "value": "7925ed5696a4f0d0faf546a13fabbfd6b8f860a69a1c8159f8ac589d77b928e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499b155f-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948090, "uuid": "7e0e9580-e39c-4e48-8da4-8322c3ac825f", "comment": "Malware payload", "value": "fc81551be95a7fe6fd5ed77779c1092c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948090, "uuid": "9dd7b869-ceb9-41bd-82c6-ad344052d176", "comment": "Malware payload", "value": "7941f15768e9d1d404f02ed05e1090bb385e8da9ed055ae3d3ba74128812d5a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948090, "uuid": "4e420fc8-2f9e-43b2-a8a7-abf8601f3037", "comment": "Malware payload", "value": "a08448ced26776049e1111458561925284fd9086", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948090, "uuid": "a95f5b45-3405-441e-900c-5a2f316a32b3", "comment": "Malware payload", "value": "c39402a7ba8b9d02c263e2d3680b14717ff685753001b03bd256957e9dd25d3e9edcc66f136aeafc58aeec86292c60fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948090, "uuid": "b9224cda-397a-40e5-b74c-7e857b8117f5", "value": "T1CDA1F750112C1AB17246697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948090, "uuid": "0e056d20-5e2f-4ef7-842d-b3a0ca27be8b", "value": "96:AiRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:AiRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948090, "uuid": "1e8f0c93-9788-42c2-8565-4dc706b1219e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948090, "uuid": "d0c5db28-1677-4ac1-81b2-fd25fedb0505", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948090, "uuid": "a94e7f47-3051-4b46-9f5f-9cda491f2c18", "value": "7941f15768e9d1d404f02ed05e1090bb385e8da9ed055ae3d3ba74128812d5a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15163743-04e5-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1657961746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961746, "uuid": "d0dcf4fb-d562-436b-a472-86563ae771c8", "comment": "Malware payload (AgentTesla)", "value": "8ffd977cfb97a56bc9e601dde3edccb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961746, "uuid": "5d8b06c1-c20c-422c-832c-c0186338eb37", "comment": "Malware payload (AgentTesla)", "value": "799ea07eb5ebff5c712b5365e156e5792f38d07919de9ea45067e0d17b628ab9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961746, "uuid": "55a13a8e-caad-4ff2-a926-2fac3047be5a", "comment": "Malware payload (AgentTesla)", "value": "5eca570916bc32be9bf2c3b8622085fca09574ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961746, "uuid": "39f523e7-268e-4d2a-9af5-0969fbb4c759", "comment": "Malware payload (AgentTesla)", "value": "2fb1031ef02716ada33ce3cdc175b7cacdafb72282c614f039d98ae05b93536d946ea238e5ed7bcfdb6d0d222fc1885c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961746, "uuid": "6517afd2-5538-461a-8ce2-e3aa42695c0b", "value": "T1FE05021CFFE88766CB5E677CDC7413218370E0D66627F3596690A1A86D23B121AC0BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961746, "uuid": "1efb1bd0-8488-4623-bd37-4d4ee46f7917", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961746, "uuid": "d9765aa2-a6c0-4577-b03e-d2747f2c7931", "value": "24576:bKvEF5+9rcr3q1lW/Hb4ANUvh03zvUGQOs:bIEFw5crD1UC3zvUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961746, "uuid": "d4283c93-9481-4586-be83-fce02b6694ea", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961746, "uuid": "16ea992f-d148-4eae-ab50-8ef4199f7d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961746, "uuid": "7f010f44-c004-4279-b249-0a05794ab670", "value": "8ffd977cfb97a56bc9e601dde3edccb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e07414-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948322, "uuid": "ad76a6ec-5136-4125-bb2b-d408f2c8f142", "comment": "Malware payload", "value": "6409c93b912b8c2f03307a121f37a4c1", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948322, "uuid": "65148023-191d-4f3b-813b-3f7138c8c3b4", "comment": "Malware payload", "value": "79bd9240cc506b4bf3d4f819f7aa9ba93c176691b1ebbceb7eaca9e3d436f297", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948322, "uuid": "48b820a2-2c5d-4d43-a654-ef008c09ca2a", "comment": "Malware payload", "value": "4f4606e4ef1a81cdeee725f184d8427a23f5574b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948322, "uuid": "f601cf0f-6b0a-4f29-918f-c9aeb9291b6c", "comment": "Malware payload", "value": "443cc529b3fca8232c320c5d804e9e718c55b7664e1ba892b5b382f6df14637ea836516a4d1c8f1a5a9aedaecdd971ab", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948322, "uuid": "217b93c7-cd21-4acf-af2e-0a9017c8f3df", "value": "T1CCF5330C53AEB8FDB8994628376348E1C5E952F1988260F2D77C19980C3F57D1BDFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948322, "uuid": "bd6959bf-3bf8-4e90-b3f5-5af45f6eab18", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXS:0XSxVJG2fLAqFOfT9sMYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948322, "uuid": "f61c0a4f-3274-44ab-b73b-6967bcc2ff5b", "value": 3379200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948322, "uuid": "79c480d9-c0d0-4ed0-b850-7bb2ca360a71", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948322, "uuid": "d9102205-83db-42ad-99ce-e35dafa08133", "value": "79bd9240cc506b4bf3d4f819f7aa9ba93c176691b1ebbceb7eaca9e3d436f297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b74f4a9-04c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657949731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949731, "uuid": "7d3d9470-6106-4042-a2cf-a3a515f0bbec", "comment": "Malware payload (Mirai)", "value": "37eb87888fb7ed29186edb73e9530073", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949731, "uuid": "3729b94e-df8f-4f05-8c48-f4bfa56e32e0", "comment": "Malware payload (Mirai)", "value": "7ad6efea791ce2d25915b7a31e5b74620a7b67cb786a90aba6cec9fef32e6517", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949731, "uuid": "ac32c7c7-16a4-49f0-96f7-e5c84828968f", "comment": "Malware payload (Mirai)", "value": "a8f32caef70d4345091f72bef15b48ea53c348e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949731, "uuid": "f4d33a7e-5438-4577-954c-9df4bd0017a2", "comment": "Malware payload (Mirai)", "value": "e3a5699f4f8dc1e222c8d6747f7fff0acb151d8332808c97fe35619cad84d8fa51ff355355f6301eee3293ff4d8aa64f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949731, "uuid": "99e6ed37-a0f1-4a03-8c58-736013e37f96", "value": "T1D2B3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949731, "uuid": "9cc003ef-335b-4ce6-847e-b559d24f1b51", "value": "3072:C/4g3Kd1rO5hZmxgA9OKdwwjF9GhsR1Ae:O9anO5hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657949731, "uuid": "ea3b274e-5260-4841-8596-d22f7774f120", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657949731, "uuid": "127cd4ea-0cf5-4591-8ca7-074c1f0a2508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949731, "uuid": "8dca3011-46a3-474c-b0dd-0b7d5c76d46e", "value": "fuckjewishpeople.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9788de1a-0508-11ed-93bb-42010a9c0043", "comment": "Malware payload (Sality)", "timestamp": 1657976997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976997, "uuid": "8c455baf-0f97-42ea-980b-58736f01c766", "comment": "Malware payload (Sality)", "value": "480130235a7e456be7d7de31c47e7d07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rasnsom", "colour": "#D80B63", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976997, "uuid": "0edf6dca-5479-4505-be95-dae1f9fd85f0", "comment": "Malware payload (Sality)", "value": "7b23a666b13afaaba8005119e47c2f29f396c08a4d087abd3a0a254d3a6dbbe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rasnsom", "colour": "#D80B63", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976997, "uuid": "0c0e9556-62df-42ac-8bb6-7ea16c9ae85c", "comment": "Malware payload (Sality)", "value": "67baa1f65ad6244485ddcf819c64717981e92d2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rasnsom", "colour": "#D80B63", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976997, "uuid": "f4697187-718b-47bf-b94d-c29589cfcc21", "comment": "Malware payload (Sality)", "value": "6c3bf8ad91c912aaa7d34266b1404d7aea03028cbbcc890855a65922d926ae3567202847ea3fb038cdbc6d88de7031dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rasnsom", "colour": "#D80B63", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976997, "uuid": "470a82e0-5661-41bc-8031-a35c93a13f18", "value": "T1C29423DF7A55A202F8F816B4D9C7122345B0062587FB863BB5243D22B46F03759FBB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976997, "uuid": "4ba02396-678a-4fad-a407-01e01f434cb5", "value": "890e522b31701e079a367b89393329e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976997, "uuid": "adea0b4d-0e44-419e-b02c-52037e68ab7a", "value": "12288:P6Wq4aaE6KwyF5L0Y2D1PqLq7ZD5SXRw6ZXERf:NthEVaPqLIDQB3XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657976997, "uuid": "d3d116d8-ec6f-4fd5-a696-192fb4791414", "value": 433223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657976997, "uuid": "5a79d719-86d5-4612-9bd3-c94a0c8b5cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976997, "uuid": "e46c36f7-31fb-44ae-a898-261ea565afc8", "value": "FSZJXW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bccae7a-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948148, "uuid": "eed78220-05f7-470e-83bf-6ba4574d7db3", "comment": "Malware payload", "value": "0c39b9a4f98dcfedfe636da52d809349", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948148, "uuid": "c6fe9e0d-ece6-49b2-acd1-e0e143b69c18", "comment": "Malware payload", "value": "7b25f148e001bbdbf77305f9bbc8ba6157162c2112dbe0345f7b3df633c035dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948148, "uuid": "5b8f2bcd-fe26-4a7b-bd77-15025ceaf40b", "comment": "Malware payload", "value": "5c57fa2c5065c067f01b1b75cf5101a860d19392", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948148, "uuid": "129cebf9-89d5-4ace-b966-706a00812722", "comment": "Malware payload", "value": "97dd628d4524a464c60cb32714887befce06efb6e5a170389f41671ba40e3f0267398360bc5b5e2608bca2fa012b5d9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948148, "uuid": "029b1982-3e96-4734-a917-1f10d799c526", "value": "T16CA1F750112C1AB07346697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948148, "uuid": "96fe6cc7-66df-41df-882f-1f83edb00176", "value": "96:8RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948148, "uuid": "7a5aa843-f879-4e16-9f17-4798a579ae62", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948148, "uuid": "509a67bf-2abc-45e8-bba5-65077524f8a6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948148, "uuid": "7433750a-3dbb-44c3-a23d-3c8d355cd98c", "value": "7b25f148e001bbdbf77305f9bbc8ba6157162c2112dbe0345f7b3df633c035dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b6dab9-04e9-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1657963817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657963817, "uuid": "a529a25b-5f44-47c0-ad29-bac331c2616a", "comment": "Malware payload (RecordBreaker)", "value": "ec7bd1198f7d8a1be746e1ccf6eb1390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657963817, "uuid": "8f5e48ca-712c-4392-86ad-664f5aaf2d49", "comment": "Malware payload (RecordBreaker)", "value": "7c23a4178b8fc14dedfd30b2b8fe462b4d936210bc64d6a14671b14a9387306a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657963817, "uuid": "989dcbd3-8943-4596-8d06-faaf9104296b", "comment": "Malware payload (RecordBreaker)", "value": "9b763313e9c1146122597728cb644e2bc819c405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657963817, "uuid": "2ece6bfc-cdf4-4454-a626-cd6bdfb401b7", "comment": "Malware payload (RecordBreaker)", "value": "158358c6ef13118ef9ea0c6358ff86579201e9b5408a0d77c6270f69422d75b051c092ae1a04049b81872251bd466074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657963817, "uuid": "d4aee39a-e124-4fc8-9939-ea4acfbfd6f9", "value": "T146741956F6B190F2D4BAD1359662B627FC31BC6C873067DBAB81AB260B307D0A53D701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657963817, "uuid": "eb4f0184-051c-4ac4-9482-9d2352622635", "value": "3c86c2b83b33b86ba24b34af43867478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657963817, "uuid": "66e94675-7359-4767-a3a5-556e3715f103", "value": "6144:weYIaZEPD78jA9aNG49faV2K2d6Or989IwfvyvbAxXUt:we2Z+8dvpe5yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657963817, "uuid": "99b66fb1-6de2-4dcc-bfbd-0ac0d18cc32f", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657963817, "uuid": "c8f34efa-610d-49f3-9d04-5aaf33b4d3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657963817, "uuid": "82a37b36-9ff3-4a82-97cf-5276ee002651", "value": "ec7bd1198f7d8a1be746e1ccf6eb1390.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e104aad3-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948774, "uuid": "b194e1d7-0a44-4de4-b3b2-cac72696ac99", "comment": "Malware payload", "value": "ce7f78f9515d341f03c9620ddc11c638", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948774, "uuid": "f67f06c3-96db-4526-ae66-27b4e118847b", "comment": "Malware payload", "value": "7c972f7317f2977d557a1fe9a2a451bf6a0e34b37c71890b1e377c316ee9ddea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948774, "uuid": "afc59f8f-23db-4d61-9200-d7b45b87af6f", "comment": "Malware payload", "value": "3d4b9a4620336b72a6c055ff2513497788ef0b6b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948774, "uuid": "84875697-ffe0-4e2f-b932-c517e891410f", "comment": "Malware payload", "value": "82f58086236de39c9b9fe3c9eb7fb1d7ccc9ed070e0df19fb60ed3f0fbff7c1cbdc52d6aed2ecc176b41246d5e756598", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948774, "uuid": "cd2c832e-f9da-4320-be16-1801b58b7822", "value": "T194A1F750112C1AB07246697AD26FFA52B80ECC1B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948774, "uuid": "be112567-323b-46ad-840f-d82caf039da4", "value": "96:PRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:PRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948774, "uuid": "63593433-9d7b-4270-8dfb-46b8bd1de2e0", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948774, "uuid": "dfd1da8d-a1c7-48dd-9f1a-85f4a240a394", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948774, "uuid": "5ca2a936-0c4f-4a76-a94c-12c11af67d5f", "value": "7c972f7317f2977d557a1fe9a2a451bf6a0e34b37c71890b1e377c316ee9ddea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d843a293-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948330, "uuid": "20e40878-17c2-4a86-b7bf-c4294b096184", "comment": "Malware payload", "value": "7872404a56a570372ec2bbf8f4163600", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948330, "uuid": "ca4d770a-9089-4367-9195-b9b91d1d77e9", "comment": "Malware payload", "value": "7cb08774633ad9e102e2c9a979658cac5507f63f12221207c4408cd5271bf833", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948330, "uuid": "3f29f980-e00b-4624-9064-9915ccd00f66", "comment": "Malware payload", "value": "31c1ac9515a4d95b1389fac45917979997fd4be7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948330, "uuid": "1d52ebb7-25fe-4277-a9d6-f7e9bd8562ab", "comment": "Malware payload", "value": "c33c2da4997d2dd94a25b04bfbb35ce731313ed99430412fda4b5d5bc06e896829ea3f40b98a6e620666af937ab461ec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948330, "uuid": "ab8e3430-7257-47f3-ac39-268efef8c0d2", "value": "T1F5316BC433716A713D659997F6F4CC0A3181B0D99DD16906BCF839B8498CFC93585E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948330, "uuid": "2a6cf916-d68e-41f0-aba5-4d0f5b7243a1", "value": "24:vrUoMbiUOA3zKWUt8AU2U42bUpgs8UoUvUWXn:vrUoMmUOIzKWUt8AU2UNUpgs8UoUvUUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948330, "uuid": "fb0a2e06-f170-44fc-b02a-2557582699af", "value": 1723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948330, "uuid": "48585e08-7922-4822-9535-098008a5fe81", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948330, "uuid": "02dc54cf-a739-44fe-958d-3e33f0fa1c82", "value": "7cb08774633ad9e102e2c9a979658cac5507f63f12221207c4408cd5271bf833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b8caa7-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947943, "uuid": "27fd2e5d-d9f7-43cb-9461-defabe0c9b7b", "comment": "Malware payload", "value": "39570a7dac13a3ba6a6f1f96f4c3f0b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947943, "uuid": "a7143858-12bb-42ea-af02-ab221641f910", "comment": "Malware payload", "value": "7cbab48e3010389c80c19fa7a095c1a7c0a41e7a24abed2837a53f340ef514eb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947943, "uuid": "fbe6626b-26bb-4dad-b14f-a0719c915e32", "comment": "Malware payload", "value": "3860c8f25a2ff07bddc4482266fb6befcffbe8d1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947943, "uuid": "34b2dbc9-0905-4e19-a76f-7eb41ee76d3c", "comment": "Malware payload", "value": "a01dd903d3e995deff7b356451379366de8e0d868b465d077eae0ece0e395c7db288e966d4aa35d5563a56955aedc7a4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947943, "uuid": "bd114458-8b90-4fb8-8356-f187e533634d", "value": "T1DE314DD4296539743C7768E777B91C2632D4A0756CA2AD496CE8B8F48DCEE0122C81EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947943, "uuid": "6c722869-eb3c-4d2d-aea1-60af50207981", "value": "24:IjSMcLbic4Gl3zKWcL8AcIcHbcS/s8cQc1c8n:RMUm/GhzKWO8Al+l/s8j0/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947943, "uuid": "30502b8a-2489-44c7-82aa-50f2070ef167", "value": 1680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947943, "uuid": "2a36319d-bcaa-49bc-9bb9-ab300f804d80", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947943, "uuid": "a614a4b3-c957-4d35-96f5-4f3b98730d07", "value": "7cbab48e3010389c80c19fa7a095c1a7c0a41e7a24abed2837a53f340ef514eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c589ddd9-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948728, "uuid": "c374b228-ca19-47e8-bee0-b58dd18da2aa", "comment": "Malware payload", "value": "182be4e7136619107ae4c41601d43118", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948728, "uuid": "a9e48a95-571e-4ecf-9e02-920c9b0f6b74", "comment": "Malware payload", "value": "7d031312baf7d28ccb1bbf7598c368f29b33c88e650e22e115d02b308f0b6491", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948728, "uuid": "93b2d496-1ba7-4079-b639-dda11bb9ba0e", "comment": "Malware payload", "value": "b06060d90decfa5bb90f379a17f34699fae7ad6f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948728, "uuid": "89c3dd6d-7c2e-4525-a938-5d812da0a45c", "comment": "Malware payload", "value": "c3736da8920c5d79a098e21d7e74e01aee50f4c4aa9c5f8c37c29b265b06bfb3aa62f3fe6940a0dcd3550ae43d20742f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948728, "uuid": "2c398066-61f9-4019-87ef-87f2777b7b68", "value": "T1D2A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948728, "uuid": "d2ac7a34-04de-4dca-8a8a-4752bdc549e9", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948728, "uuid": "988e2b7c-6d60-4584-a4f0-6002f36fa534", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948728, "uuid": "c45a69eb-6dd7-44da-901c-e2a0b09adabd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948728, "uuid": "5bd8bf8a-d10c-4a23-b006-8229e77a981f", "value": "7d031312baf7d28ccb1bbf7598c368f29b33c88e650e22e115d02b308f0b6491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d16035-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (DarkComet)", "timestamp": 1657971404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971404, "uuid": "6524f209-43c4-4dd0-9e16-9063246afd85", "comment": "Malware payload (DarkComet)", "value": "19a746b898deaa130c14968ba78cbc95", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971404, "uuid": "32c0b62d-2590-485d-9433-37d4051cfd57", "comment": "Malware payload (DarkComet)", "value": "7d13ffb5266d4fc98c19721899c7d720496b0662b7210166cc0ff6a13eff1898", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971404, "uuid": "ac5352e8-340d-4f1d-af9e-1240ea3ee7de", "comment": "Malware payload (DarkComet)", "value": "5b2d1a94bc6dd99d118d57b3dc5f95632b4e0da4", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971404, "uuid": "dc07b615-6e9e-456d-8231-17b5b1358aba", "comment": "Malware payload (DarkComet)", "value": "f321598aa77620fbd59450fe2ed88cc978c3fb045c800f444c0ea0e5a683b0761f913057dfae53a97a068161d04a2688", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971404, "uuid": "d7d29f43-9810-444a-b462-c75c8442390b", "value": "T1B3466E751148E20DC9BDADB7CDF6C4A5B9FFA0C220149CAB91B348578976D3734388EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971404, "uuid": "eec8f07f-4804-42db-98f0-f24d457be3dc", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971404, "uuid": "f422e514-d016-4c29-96d5-b5a72e104e67", "value": "98304:rnsmtk2aPnrHztkv8r41Ndr5FCAAa0PqmqQhNTBA+OTLzrxCrh:TLQrJkv/3kdqmqmjA+OJ+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971404, "uuid": "95bd7b81-6869-4427-a8f1-40694c74dffd", "value": 5728256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971404, "uuid": "dd2778d5-998b-48f1-ab88-7d339e07729e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971404, "uuid": "f769fa27-b30b-4552-9bf7-fb6cb7283384", "value": "S500RAT.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd31df6-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948096, "uuid": "75df98ed-f579-46f7-b752-737dd92984a3", "comment": "Malware payload", "value": "0d2649bb2cc48503a8270819e4295df7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948096, "uuid": "3478e58d-7421-4ecf-aa4e-356f9c78768f", "comment": "Malware payload", "value": "7d1c95d49c0ad4a1844abc317f5b35bb310fe55bb531af67876f344181ee458e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948096, "uuid": "0d4ce3eb-56f4-4345-96b5-60cda3769a44", "comment": "Malware payload", "value": "0bd92c3c9ef9f033f3eea3f2f93f1b823a120214", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948096, "uuid": "f525ef29-e23f-4f28-89fa-80dc018ec6ff", "comment": "Malware payload", "value": "fb04cccbc91bbcdf180a9c32adac902c3e5a7fb8a4f3fd58b7da1188cfacb2cc83749057ac5ea94032d80f9053b48634", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948096, "uuid": "b31197f5-58a4-46e9-afb3-e40075b93384", "value": "T14A2101EB4C12DA3A2F035AE0BB1370ECD770CE8B7CE3E96A57B48564B0469511215351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948096, "uuid": "48f3b05b-1b94-44b6-8018-67ee1caffb23", "value": "24:KWTMGmQnMGmQfan94bMGmQIEfSyNnumVPRO0VYExuEYpMqyAk9GfdaMGIutdfv:KWAwMwfa9wzSFmJU0Vf8l6qO4dh8tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948096, "uuid": "f9e65419-f3f6-4a39-85b9-693eba4d84a2", "value": 1352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948096, "uuid": "174e13e6-8972-4d15-b2e9-fe37230e7b4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948096, "uuid": "cc8e0e82-334c-4ccd-8df5-98c56cf1d822", "value": "7d1c95d49c0ad4a1844abc317f5b35bb310fe55bb531af67876f344181ee458e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251db044-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948459, "uuid": "acc879ae-45fe-40ba-8670-1f8eb593609e", "comment": "Malware payload", "value": "d61bb71a347fb94855b7e249ddd632a8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948459, "uuid": "092ed8f2-7527-4589-a777-55c777e3b72a", "comment": "Malware payload", "value": "7dca9406f033bee3b95a55d3828be7431a90c7f1c4886757fe733081a5139809", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948459, "uuid": "6cdec53b-2266-4f08-bdd4-3fc40bd99279", "comment": "Malware payload", "value": "e44bd18a0c5eb6ab899acd1698ae6cbfd2b2b494", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948459, "uuid": "143d58f0-4975-4b9b-8b13-cd293bf92192", "comment": "Malware payload", "value": "896f47b81657c1c86f4bcf823b205ca683229e4d3c00cd15c39dc25c764612c32c5cbefbc37d93b8756cebb536114644", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948459, "uuid": "a549e08f-c536-471d-a103-9a5e30d8e53f", "value": "T183A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948459, "uuid": "47277071-c974-4ef5-940d-89d1fec0ed99", "value": "96:sRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:sRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948459, "uuid": "0f1abc43-45f1-4fa0-a31e-403df7552a79", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948459, "uuid": "097a758c-7cfd-475f-a383-c5159f63d262", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948459, "uuid": "e3d64811-c36e-40be-8c1e-e393469bf453", "value": "7dca9406f033bee3b95a55d3828be7431a90c7f1c4886757fe733081a5139809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce7d15a-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948633, "uuid": "44195bb6-1eb7-4864-8438-d5ac3b418780", "comment": "Malware payload", "value": "2c353490c6b1985528fca21b2babce73", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948633, "uuid": "fcc05360-6391-4b94-88b6-dc790b62b577", "comment": "Malware payload", "value": "7e62e48b2e3a5ce3c4c1a9af1c277dacade9a705206fcf183f3e6ace891a2330", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948633, "uuid": "44d06dc9-c262-4dd6-9c30-20b3fcaf42ba", "comment": "Malware payload", "value": "07a354347478d394f9b67f11056ae1edc94ab98d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948633, "uuid": "d171015e-7d2c-4ed2-a90a-df480fe10423", "comment": "Malware payload", "value": "cc4bfd9359d3b55637c9a612304f9a080e756880491fc67c642088e0e313e3f0dbb2e3f7143f54f773ddeb76c5f7b9d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948633, "uuid": "f2faeca6-c73b-4dc5-b672-dc138b4ca02a", "value": "T112A1E850112C1AB17246597AD26FFB52B50EC81B0A777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948633, "uuid": "40369233-8b0e-42bb-b9c9-4e2ad1047ddb", "value": "96:KRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:KRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948633, "uuid": "c408e58d-5184-4045-88e1-8afedf0c53dc", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948633, "uuid": "9e05a451-5a8d-4c1f-8f9a-9cdee7d2a052", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948633, "uuid": "e3004ef6-8565-49ca-9481-4728d569e3c7", "value": "7e62e48b2e3a5ce3c4c1a9af1c277dacade9a705206fcf183f3e6ace891a2330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047a6113-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947974, "uuid": "266cf184-7f87-4071-a5be-7d59b623b500", "comment": "Malware payload", "value": "e051f511eb5fe4b78a3ad842d200d2b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947974, "uuid": "ea021a9a-1e9b-4bc1-9f7d-2f231be2e90e", "comment": "Malware payload", "value": "7e704a5343a8ef03773019c5b28822180c12cada07fc94525aa1175f23a92125", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947974, "uuid": "caf81251-5af7-4084-b09a-12c76ac403ce", "comment": "Malware payload", "value": "915e9640a677678edfd74f87d6c765f17c47290b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947974, "uuid": "ee076cb8-9dc3-499e-abda-bf42366f7cf5", "comment": "Malware payload", "value": "094ea1611d26ca516c5ce215a6337b7b3873af7e28bf4c3f784cfc8e39d224826e6f31c6ab86556585fa16972bc2cdd0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947974, "uuid": "a29e9cef-d9ce-4f9d-9acb-07cbde52feab", "value": "T1ABA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947974, "uuid": "732f1ae1-cfb6-476b-8fb8-719f69798c18", "value": "96:LRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:LRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947974, "uuid": "ccdebe2c-7f88-4245-aa98-08fbde9fb92e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947974, "uuid": "e75dada9-5e6f-49a1-bdad-64f09b2fc193", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947974, "uuid": "6e3a1443-d3ef-4c92-a39c-8371f99e41e2", "value": "7e704a5343a8ef03773019c5b28822180c12cada07fc94525aa1175f23a92125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc71e4f-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948391, "uuid": "c8e8ad1b-00ff-4251-a3d3-fd77dc6630a1", "comment": "Malware payload", "value": "bf042cb734471c118bf8479a83c60f2e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948391, "uuid": "74d37a42-a97d-4df6-af50-18ee33367935", "comment": "Malware payload", "value": "7e96841c90f2aa2bce177df3b36c9e435d118cbcb325bcb62bc09909ff9e1b9f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948391, "uuid": "85d2da71-426b-43ef-b0e9-f3f1ee54a0cc", "comment": "Malware payload", "value": "b271bc45e8b5185d231c2ed3bdb7cc99be1e081b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948391, "uuid": "6ca26a7d-87ac-4b29-94e9-e3601082c2c1", "comment": "Malware payload", "value": "d200674af3ee92b5c8c4b6782ea1ab537956358d9115aad72a45315f90ffa3714f6fb53efc92f1a4d28a7699527060c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948391, "uuid": "cfccb1c1-a7e9-4617-a40c-37897faf6052", "value": "T1C4A1F750112C1AB17246697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948391, "uuid": "21360fc9-ddc8-4793-b7c1-5e2e38028493", "value": "96:3gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:3gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948391, "uuid": "174ed84a-e055-4462-b9f3-1771eba89855", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948391, "uuid": "f24cb49a-330f-4210-9822-19745f25c45b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948391, "uuid": "4bcaedf6-9d39-4e42-8ef3-41a946e5a8e8", "value": "7e96841c90f2aa2bce177df3b36c9e435d118cbcb325bcb62bc09909ff9e1b9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a3a548-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948102, "uuid": "61c2467a-0f38-4602-9666-a4f40e5ff5db", "comment": "Malware payload", "value": "6029beefb706b3ad1b992d9fd6118a2b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948102, "uuid": "3a4fb2ab-8b4a-4fa4-8b0d-f814a2d93110", "comment": "Malware payload", "value": "7e9755c040063abcef1d70c836239cc15749bed6d9d5f1d61e9fd0f10c92ebc8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948102, "uuid": "045c6088-dda2-425a-ad4a-8b65924506ba", "comment": "Malware payload", "value": "b88f008f63614848aef3e6d17a603ffc5d7dd9e4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948102, "uuid": "43585d58-52e0-47c9-af04-e9c9967550d8", "comment": "Malware payload", "value": "f2fe7ae8e34dbb748959b947ff833cb7327861c0fd8fcc809f238e23ae9116b58fb1fa9b4ed1f14f68047b3219afe5b5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948102, "uuid": "51963de2-b31b-453b-add0-e1e80d567a76", "value": "T1F3A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948102, "uuid": "7bb50e13-c3dc-4c37-a6d9-744ab7cdb30c", "value": "96:QXRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:QXRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948102, "uuid": "d32cf682-072e-49d1-a3e1-346403e7850b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948102, "uuid": "bef15171-25c5-449b-8d4e-5cb48026bddf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948102, "uuid": "58dc9e74-ee2b-405b-b6ff-44e9216b68b6", "value": "7e9755c040063abcef1d70c836239cc15749bed6d9d5f1d61e9fd0f10c92ebc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235de50f-04f6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657969072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969072, "uuid": "d17c9099-a52f-4e9b-a702-152e62219c45", "comment": "Malware payload (Mirai)", "value": "85a9fde8dff0da614151665f8da4bbaf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969072, "uuid": "c8f1e20a-c475-4b3e-8130-08ed38765777", "comment": "Malware payload (Mirai)", "value": "7f1e039b4b39e14fac20368b277b7bb8b0d7ecaab59c600eaf46a69b852780a9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969072, "uuid": "2f2ca807-a698-4d0c-8628-702ad466ccdf", "comment": "Malware payload (Mirai)", "value": "703bbdd27d1e4679aa3c76039dd2e63031d27050", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969072, "uuid": "656f2bfc-f18e-4365-8ce2-bb8d36e657a7", "comment": "Malware payload (Mirai)", "value": "3fccb777386dbe3d97c1fc7ecc6d28c0f2768beb7de11d38ba81e295ad211ac7a525261e369133560e33ce89a01b3688", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969072, "uuid": "fc5cf1d3-3232-4924-add4-dc3fa09b3afd", "value": "T1C863965D2E219FACFFAC863547B39E20924C33A626E1C944E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969072, "uuid": "960cd493-b11b-400e-9605-2a1fe7fbe7a0", "value": "1536:YkJrDD25WpoSBvfvbxvbiMvb5nG/bU0fN2vYvLsCF6YPEDXV:7dDDkW2Uod2vYvLsi6YP4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969072, "uuid": "ffdb3d94-5a0e-485d-a4f1-028d36fdcba5", "value": 67560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969072, "uuid": "70efb3d6-efc2-47c6-9363-ededcc33a65e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969072, "uuid": "dd565ae3-ddbb-490b-ac21-46446aab6428", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1603a5ee-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948433, "uuid": "c5b43cee-f738-4394-b301-8d5ca3605ce7", "comment": "Malware payload", "value": "a1d2f4a96a07ba036e5aa2cab464324c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948433, "uuid": "0fc3b3e7-d5a2-40e1-a793-aad10afcfeee", "comment": "Malware payload", "value": "7fc347406ca6f1aa388afb7e1d86e454dc49b9290813e01fd9440f4957e8cbf1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948433, "uuid": "023a6074-2298-4e9f-9989-f89f6ec85d2e", "comment": "Malware payload", "value": "92be2f455dd30c9ca12efa4897e215bb93cb55e4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948433, "uuid": "6d7ce2ff-4a2f-4df0-8f97-342f677d743f", "comment": "Malware payload", "value": "96213595856b0533ff8a120578ff13ea6187ac8e11881a8729b37c7cd8cb99a943b7620f06d6af66fc73d0ced3d2f8c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948433, "uuid": "1995370f-d213-433e-9c76-3ac80ad54ac5", "value": "T1E4A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948433, "uuid": "9a98d9b1-836a-46db-9de0-239172235c01", "value": "96:dRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:dRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948433, "uuid": "1efdc2d5-7bce-4854-b394-83cebfe60b8e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948433, "uuid": "fd9d25c9-4100-4bc1-9df6-8cab36eb285f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948433, "uuid": "5b7d1be9-ddd8-4a00-bfea-8d04a36a04f2", "value": "7fc347406ca6f1aa388afb7e1d86e454dc49b9290813e01fd9440f4957e8cbf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c65f606-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947988, "uuid": "de7be5a0-8a4d-41e6-88d8-55ca55ed2b2f", "comment": "Malware payload", "value": "2cd610236e2340b8d20d02710b6626f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947988, "uuid": "c91f8294-78e0-49b3-8f58-33c08b6a0cac", "comment": "Malware payload", "value": "801a9b3ae0dbcd3dc4533ff537244053c502841a5c7a1f32080f92f8e9d3e626", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947988, "uuid": "dbf5ad06-238f-4e02-9722-ba3d5a301088", "comment": "Malware payload", "value": "073b70e6ed888ca5bd3554087210a0dfac754d1a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947988, "uuid": "001f86d3-c2d9-4050-bec6-5765ecc66029", "comment": "Malware payload", "value": "4dfd68f875a0ab7d0bffeca8f77696af9f341f5992f9483b548566a586aa255e7921b34ad819b1513bff50259c8f6dde", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947988, "uuid": "b7f9035c-e299-4c16-bbc2-5a93b3250cdd", "value": "T195A1E850112C1AB17246597AD26FFA52B50ECC1B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947988, "uuid": "850985cc-f11c-494e-a061-98dbd5c31835", "value": "96:TRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:TRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947988, "uuid": "ad33af9d-7d92-4250-938c-0970d54f7597", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947988, "uuid": "682f218b-b865-4c2a-a2bb-543b28971750", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947988, "uuid": "32aff64f-1c52-4fd6-8838-f1b5d5e443e2", "value": "801a9b3ae0dbcd3dc4533ff537244053c502841a5c7a1f32080f92f8e9d3e626", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd58112-04f8-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657969921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969921, "uuid": "72897e34-c3da-4c4f-b360-d64b898d37be", "comment": "Malware payload", "value": "2d9cf34aa3361d0960c945552928d4a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969921, "uuid": "54b9f5af-7f5f-4667-a552-89a0f98197da", "comment": "Malware payload", "value": "809c7c9100e3b270fb903f09606c461dd61f19438ceaac87e17228e6d117301c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969921, "uuid": "992806b2-2046-43df-8910-926029269a74", "comment": "Malware payload", "value": "2dc197a25a6c777050b04871923e4547f425d37e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969921, "uuid": "1c206dcd-e9a0-478e-887d-cf9e7d45039e", "comment": "Malware payload", "value": "dee492c73f82b7afdccd8029e00d61fba5f896cceb10819c908406067a85961bf52e2367cffc508e78cb5afdb246a4c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969921, "uuid": "db414671-7569-49fd-ae70-2b80ac635d1c", "value": "T11125025F35598599ECCE8070CBE1AF74F0E5A6703DA4E36E2FD3869C27119268623353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969921, "uuid": "9342a4b1-49ce-4cad-8770-9ab1e1f5d735", "value": "7a195ad20dd0c44e24aea9fff812861b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969921, "uuid": "7b2ad5d3-b646-4323-8865-076fad8b0164", "value": "24576:6C0FMBxw00XY8r0v5dzOxFZARM8w6eFWcO/zz8dZ13S0:vLwjoe0hd0ARMvWR/zWk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969921, "uuid": "8a634a84-5fbf-40ec-9ace-e84567ddb994", "value": 966896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969921, "uuid": "af4b937e-c228-46db-978d-c973830dc44d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969921, "uuid": "3ea98578-7c5d-47d7-994d-127c62695fb6", "value": "virussign.com_2d9cf34aa3361d0960c945552928d4a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31690b5d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948050, "uuid": "8afad59a-cd32-4e27-9079-766512867353", "comment": "Malware payload", "value": "b5dd147e1fe27750ab927b9d40fb9f8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948050, "uuid": "ef4f42cc-4eed-480f-ae45-ac005720f7ea", "comment": "Malware payload", "value": "80d3b9e1a4cae33106335aff3bb28daf581b9fe0e59538627ed9e2fb3d87568d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948050, "uuid": "73b40261-f5f8-4af8-8f8f-b34171b651b9", "comment": "Malware payload", "value": "db3c7d3dbb875f79a283013a3a5b2a88d04b4140", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948050, "uuid": "a3be0b00-eb99-4be8-b61f-2dcd400ce75e", "comment": "Malware payload", "value": "d4cddd47ccf45f21185e195d74e8dcd89a6de0768af9b859ae2ce0f628e76d51e93350e8c260a2469a8c5db182d7a268", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948050, "uuid": "c9aa161b-3676-4678-9a96-c30969a3b534", "value": "T1D6C3C69A6F913FBFD81ECD3742948902119C895B63A9BF772E74D008F68610E5AD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948050, "uuid": "cc70c045-a7d7-476f-b4f7-8821118dac6e", "value": "768:oglfMpnOKXOvGJrBKu0lh4alpd7reOu/3oKasNqX1EgCg8jzIIw0EzSIX39A8RhC:g53OvY4JlpdZufbKl09wpzxrbDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948050, "uuid": "4d991f2f-efee-45f8-95b1-9b2e3ea3ffa2", "value": 125956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948050, "uuid": "c26016f5-d299-4d2b-9963-09ff71cf1831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948050, "uuid": "6c1d107a-1e97-4e09-b86a-09f42f8d7740", "value": "80d3b9e1a4cae33106335aff3bb28daf581b9fe0e59538627ed9e2fb3d87568d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68807f29-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948572, "uuid": "798d58ba-a564-45fc-8dcb-f6a1b87958eb", "comment": "Malware payload", "value": "d471092cbf0a1d0ff2b88a048e930623", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948572, "uuid": "2a7f9e49-0867-4beb-af64-b1068271c511", "comment": "Malware payload", "value": "81002118748e8f25416b7adf93855ce02b6ac1a78a7c0d9d5953227af8330de6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948572, "uuid": "3f5e155c-82c5-4013-b8b2-52c5b74d5744", "comment": "Malware payload", "value": "2741b2f0f7282f92461e57b44b078f7dc3e2e31a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948572, "uuid": "121ea710-dcff-4730-b4e0-1d36280647f2", "comment": "Malware payload", "value": "b8d85e296764c9cb4580c8515ae455ee72ad0989256099db17695c17a42d0d1a1858a12d42504fd0d965c7e19f6be1da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948572, "uuid": "3d45a382-6a27-4175-b845-8933d5769a37", "value": "T1CCA1F750112C1AB17246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948572, "uuid": "a6f8ae23-d9ca-4e4c-9f9e-1ac45810fcae", "value": "96:bRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:bRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948572, "uuid": "b04fcec7-22ec-406c-a277-67d6b5790309", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948572, "uuid": "108bef65-c02d-4f4e-99ad-834746dbf765", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948572, "uuid": "dcc89990-6884-49d9-b87e-24077c289c02", "value": "81002118748e8f25416b7adf93855ce02b6ac1a78a7c0d9d5953227af8330de6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e8711d-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948858, "uuid": "5c606dec-67de-42c4-9590-7489778cd974", "comment": "Malware payload", "value": "3e4ace5584ee6ec8bdd678763ae88f64", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948858, "uuid": "10790996-dafc-4a28-afdd-45246f498d78", "comment": "Malware payload", "value": "814ad465745cd682439c86c4651f797241e94f0829a89abc4f16d44db495aaed", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948858, "uuid": "e4d50e2b-800a-4bb5-b26b-4b7e793b0acc", "comment": "Malware payload", "value": "1983766c1312b3946baf67e37615fd24fd23711b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948858, "uuid": "beb2eaed-97c0-428f-bd5e-6942cfcf1c4f", "comment": "Malware payload", "value": "a2c9314519aad4f9b776ea822055cd188bfad749fe309374c64e91284d6fb87d1732de4def3471d7e54a77a9b884d259", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948858, "uuid": "426a64bd-d54f-4685-982e-30a9a6af7d39", "value": "T16001E1E857625063EB065E8AF352914C76EF62DF76CFCA34A8317F130456800BDDA650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948858, "uuid": "6dab2f93-f7c7-4df4-a9fa-08a3cc58a75e", "value": "12:VaFxAaFxOYFWgFd5soLFoIzF0w3FVrDJYCJzFRXYFYFSOhIQLF2tsrF7glEFIp5W:VOBVWAsoxbp02h92Fo9hIQx2tO7x4vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948858, "uuid": "86c03794-c723-49cd-9660-0c2db0422bb1", "value": 837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948858, "uuid": "aa3e8a82-bbd8-4968-b3af-fa8a726a3bb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948858, "uuid": "3978cb59-a45c-40b1-9f46-b53714ebb1f5", "value": "814ad465745cd682439c86c4651f797241e94f0829a89abc4f16d44db495aaed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25aee9c-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947944, "uuid": "c8ca8b24-65a4-4f3e-9a43-b5ffeca93b26", "comment": "Malware payload", "value": "74fb777ab8717ba531da064e121fc70f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947944, "uuid": "6f2099d5-683c-4d8f-8399-90643ce3c3a6", "comment": "Malware payload", "value": "8154480cc004683f67bc728f744b36ad8a25e5583c23df23341436e16ea4f809", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947944, "uuid": "23b81ec8-c56c-417c-9b36-d625fd0c0a27", "comment": "Malware payload", "value": "2d4511c935f6f3b4dfebd2222d760ace54deee1a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947944, "uuid": "bc444b40-b053-4dc7-82eb-08fd48da16d8", "comment": "Malware payload", "value": "80bb0714813da2fa5b953808873d73c38175c0697a262028ff67b0a97e03ad8a643e7432c1707336ccb0362d2b67aaf0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947944, "uuid": "4abbbba0-4a9d-4ee6-8478-c931611903d2", "value": "T1EB318FE431B136743CBB54E3A365180732C15822ACE06D4CA8E4BEFA6FCEE0525841EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947944, "uuid": "80e34fdd-714f-4f48-931b-620165f34093", "value": "24:Ijmacmcicmf4KWcmkQkeddzAcmNcmmbcmvcm9xJcm6Fcmtn:daX7XAKWX1lAXNXSXvXHJX6FXtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947944, "uuid": "43a033fd-6bc5-4305-9aab-898d502c55db", "value": 1740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947944, "uuid": "b37426ad-5514-4091-bacd-97685a8e16e0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947944, "uuid": "5c8bc291-e2a9-4b30-8920-8bd30cc6c8d9", "value": "8154480cc004683f67bc728f744b36ad8a25e5583c23df23341436e16ea4f809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc35ff0-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1657971369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971369, "uuid": "955056dd-ef82-4653-bc4d-230b9e3cb672", "comment": "Malware payload (NanoCore)", "value": "571ce52d612b57876aa558fec9f237e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971369, "uuid": "380932fc-3601-43c7-8940-962ec0c5df34", "comment": "Malware payload (NanoCore)", "value": "815908fece7ac75f6c042540de7525c7289b30e8d69e1e882700b607c33d007a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971369, "uuid": "4ec7cd3f-a38f-4800-9aa8-29b6f00430a0", "comment": "Malware payload (NanoCore)", "value": "3e12aebb1455f842fbfce5c72450c5b0f20987b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971369, "uuid": "36eda330-7d77-497c-b5b9-49d92b0566cf", "comment": "Malware payload (NanoCore)", "value": "9b4ded06ada715940f7bbce91659fa93309267fb82fccf82f4981f0d953171db543bceeee20f2ef7cdec3f1001d65af8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971369, "uuid": "692c6b2d-8722-4f3c-93b3-f263460fbd37", "value": "T145E4020277D88A1EE19E45BDA02651639339CEE398D3F3DE58C8366B9B763D106071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971369, "uuid": "f69726bd-9f4f-4f78-88f9-261cbd650b0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971369, "uuid": "fed88e9c-b299-4f19-81e0-aeb331b969f8", "value": "12288:vLV6BtpmkTbdfsSZWCW9V1XKxqjH9FU9G9BsYLF94EOuLNtLuLA5+ec:TApfPOiUpGqD9FUc9yYLFWORFuLAcec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971369, "uuid": "3dcd12be-9174-497b-81f3-3051cedd13ee", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971369, "uuid": "fa16a37a-a5c9-4518-bf0f-67f2a245a53c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971369, "uuid": "b9342c58-1fcf-418d-86bf-4a434d23b159", "value": "Eac-Fucker-CrackedByDQ.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e042bc-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947923, "uuid": "6265d3ae-c3e3-4730-b5d0-0342deed5b18", "comment": "Malware payload", "value": "ed0ba3b9617453d11f1a771bb06fc2e3", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947923, "uuid": "bc1b30e2-f5ee-4dff-927f-e94a8c170009", "comment": "Malware payload", "value": "8186161f6b775ce89c341c947ca6d9bbb822567a5936f038ee63a16275bfc996", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947923, "uuid": "0d5c470f-f919-4965-b008-18185aeaf81b", "comment": "Malware payload", "value": "be370665720fe6ec1a7fcb3353c016c629437742", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947923, "uuid": "4c71c927-d1d0-4b42-8b50-5f704a9a9620", "comment": "Malware payload", "value": "8e381741370f09204c7797c54bbcb864cb45522cf8c42d16fee2365572d4bda421aef198447ee44c55e12236965aa78b", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947923, "uuid": "c5fa67c1-a186-4cfc-a24b-a0e341faf4b4", "value": "T12FF5330C53ADB8FDA8994638372385E1C5E852F6988224F2D7BC15580C3F57E1BDFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947923, "uuid": "e7ea21e7-f78d-414b-890a-210a24e59316", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGMt:0XSxVJG2fLAqFOfT9sMYNMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947923, "uuid": "13d5c85a-d472-4c01-816d-20a95e69899f", "value": 3489792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947923, "uuid": "a4731a80-52d7-47cb-828f-db74420bd711", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947923, "uuid": "0b11b5db-3349-4f1b-a7d8-f7931ad87b31", "value": "8186161f6b775ce89c341c947ca6d9bbb822567a5936f038ee63a16275bfc996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ca0f14-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947894, "uuid": "a89b478c-f919-4caa-be62-837182809144", "comment": "Malware payload", "value": "d221ef4c2c939e76c03d5a04a8f9a2f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947894, "uuid": "87331d3e-a4e9-4d7f-96e9-12eff67b4fd4", "comment": "Malware payload", "value": "81a4cb2e782263bf79925ca094a462e0bc304d366567d27984755100d753ed17", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947894, "uuid": "d54cf897-56b8-4949-99b0-8ffc1538fc63", "comment": "Malware payload", "value": "8237cbf39f9178c24254e811e4f9a4c658945075", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947894, "uuid": "55b21ee0-6224-48c6-9838-4aa6bea7c5f5", "comment": "Malware payload", "value": "ec4113b10781906e1ee6f11f608062c94becbfe6b15cadf6761ef77790bfcd0ae15b0030e2755a87f5ea0540cbcecca2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947894, "uuid": "e4923bac-b660-433b-9208-ab85887ef461", "value": "T192A1E850112C1AB17246597AD26FFA52B90EC81B0A777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947894, "uuid": "b6852a8f-5ff1-46a8-b4cb-51ccb7c14d40", "value": "96:CRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:CRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947894, "uuid": "bb7bb2d6-a95e-42b1-b76a-3a0e2cf33517", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947894, "uuid": "e0f4246c-c5da-4de7-a258-1e981e466325", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947894, "uuid": "798fcc78-68ed-4f33-916d-727526a008ec", "value": "81a4cb2e782263bf79925ca094a462e0bc304d366567d27984755100d753ed17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e6d87d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948131, "uuid": "b2dd421d-2053-498e-a230-60a7e4769b5c", "comment": "Malware payload", "value": "a59d8ec795eae0ff68e274631091025a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948131, "uuid": "3ad6aee1-c361-4dd3-8feb-d668f7ad73d1", "comment": "Malware payload", "value": "8203493f9c0f53b30ce041ca2bc1fd920a7b5e236cf107a383da4b5313d0305a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948131, "uuid": "39833351-ff34-47d9-b9f4-e601f8719ec7", "comment": "Malware payload", "value": "2d0f4c26f84d0a238399772099cf57f926e84bf3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948131, "uuid": "0e4ad2b2-f218-45a7-a9f9-2de71b327bf2", "comment": "Malware payload", "value": "dcbf65e6b32f1fd00c057061544d5ac1a7abd518976e0895dcbe744d37f49ce4cc34edb85c3eac82ad4b63ca6652c004", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948131, "uuid": "9ebdc5f2-8565-435e-b6f1-ddd749ef70c0", "value": "T174A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948131, "uuid": "b04fef27-b1fa-41de-b27d-cd88c3498112", "value": "96:RRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:RRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948131, "uuid": "33bfaf9f-c700-4317-b03e-87b95d1cb7a9", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948131, "uuid": "59429bab-750a-4686-a2f4-8e59c76d3b05", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948131, "uuid": "96cf4fc0-d4b2-4da3-b3dd-85766b56934b", "value": "8203493f9c0f53b30ce041ca2bc1fd920a7b5e236cf107a383da4b5313d0305a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6045de14-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948558, "uuid": "f3127d14-47ba-4bda-a78e-2538a3b64b4d", "comment": "Malware payload", "value": "0949004cfc689e3fda8c114988563072", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948558, "uuid": "5d08389a-df64-4a0a-9c4b-d3c1495dbec4", "comment": "Malware payload", "value": "820bfc1b3dbd7d65f63c7a4390fba0d05cc81d6522ce8f9a399a00b475213b56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948558, "uuid": "e623abe5-e06d-4d5b-a0ea-f1fdef2ed50b", "comment": "Malware payload", "value": "e5805adc5033f78556f3ed251b9f5a01708ecca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948558, "uuid": "5abe79c4-20ce-4806-abb6-bb700e65d0ad", "comment": "Malware payload", "value": "9e986e56f15eb4305eca4e954c930ebf6b887cae99a2fa0f1d6f4622297a88981ee0667cedb1ea9c729a5d0117f13542", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948558, "uuid": "e734fd39-a121-4353-8a89-4777ea31eed9", "value": "T12585F757E89590F4C0EEE174C726A213BEA13489473437E36FA18AF11B26FE466BD314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948558, "uuid": "4cfc8a55-66cd-4659-8e87-b2d6eef840ce", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14:sXyWSpV+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948558, "uuid": "dda5ed03-c427-42a4-aae1-055d56416935", "value": 1736704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948558, "uuid": "34f7269e-7bc1-457d-8b0b-af2ed4224c75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948558, "uuid": "29f93df0-30a3-48b2-8148-1651412e0557", "value": "820bfc1b3dbd7d65f63c7a4390fba0d05cc81d6522ce8f9a399a00b475213b56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269cf309-04f6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657969077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969077, "uuid": "f08ef44d-c994-43db-89a7-3e6f2d50b9be", "comment": "Malware payload (Mirai)", "value": "d42c8729312101aa298853f5f253c926", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969077, "uuid": "415a680f-9ee0-4b34-a836-5ec6e3de1382", "comment": "Malware payload (Mirai)", "value": "82831e3f6c55f870d699055ec7deed6c0f0c07512fe035096a87cc67a5641e17", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969077, "uuid": "bc5ac757-f7f9-4da1-8a20-3fff3b449461", "comment": "Malware payload (Mirai)", "value": "06deef88253e305b79d00eac4abca14062f9ac03", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969077, "uuid": "baff95e6-efbd-4109-9db6-60fe2a5d7e58", "comment": "Malware payload (Mirai)", "value": "448127867623c88f6d7adfa1dea277c42feb6e2611a7b78b560cd7234eb8a30f512731bbe8cc0a1fa9f42c26e07d0748", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969077, "uuid": "8799b7ff-08ec-42f0-8cbd-3b713c9e8566", "value": "T1F0331982BC919A02C9D46377F62E01CD3B2563A9E2EF32079E226F1177C9C2F0D67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969077, "uuid": "c2bbe50a-0f12-4921-80c8-9333b05395ed", "value": "768:bUdjUpPsdKlOiy+1YIeSV53b8+oQASV0ObFBNOq9EVl3kMqf:gjUpUcK++IeSV5rm3SqE9VH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969077, "uuid": "e0611350-709f-416b-939c-f6b0f98d1c90", "value": 51600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969077, "uuid": "9a392a64-bbb5-4fca-8f8f-282c97762a84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969077, "uuid": "b279453a-5a31-4660-8be3-42d5d5b3379a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2149b33-04fc-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657971915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971915, "uuid": "db00f35d-422a-464e-9649-0265268f5398", "comment": "Malware payload (RedLineStealer)", "value": "cfce10f307b9154dd96f42f6583e40cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971915, "uuid": "a55d6a77-71d6-4560-a9be-2bd7e470db20", "comment": "Malware payload (RedLineStealer)", "value": "82fdc2a52f7c3f5cb993f9189fd306a80ce43d6b4baa2c77f99d7f3d47fb1311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971915, "uuid": "8887bb20-93ba-4323-bddf-0af076951802", "comment": "Malware payload (RedLineStealer)", "value": "698d124e5f986597745f7399294377887f0b732d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971915, "uuid": "30e3e83b-5162-4003-998e-9951898db801", "comment": "Malware payload (RedLineStealer)", "value": "543d52bad36284a301e040eb906003d8c5d5178d27e2105c5b337bee7c0a9192d8e48225b18d5cd777b64288d6f0bba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971915, "uuid": "9005dd4f-aa58-49c7-a607-be15fcffbb81", "value": "T1B2648D00BB90C435F5B312F45ABA9368B52D7AA06B3450CFA2D52AEE57346E1FC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971915, "uuid": "4c2b06b7-4941-41f0-a64b-27b8e76eff97", "value": "19b703097c4f74d6bb1c823ff614186e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971915, "uuid": "376297b4-3de9-4671-8ca9-091aa5ad2d7c", "value": "6144:odODIrFcSMaUq46R5gaP4ktytg45FwSycaxa/ZbyjM6U:odamcpZn6zXP4ktytlwSAxkZV6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971915, "uuid": "a3888a20-c2aa-4b00-914f-e09bfec97abe", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971915, "uuid": "3075ccc3-7493-4935-aa43-6bf81e37aed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971915, "uuid": "dddc22e1-c06c-4c7d-8ff0-6dfc44891ee5", "value": "cfce10f307b9154dd96f42f6583e40cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc79f8a-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948342, "uuid": "0752f217-2438-4342-9338-204f33414ed0", "comment": "Malware payload", "value": "ff8d894c4eff67e454c46847afdf1d88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948342, "uuid": "9275336a-60ca-4909-bf8d-fe783acd96f8", "comment": "Malware payload", "value": "8332871673d8e9d90c95a463e1bdc73b1fae1a59b46767cab1c0c9257de4e7f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948342, "uuid": "2b249c9c-b412-4c42-b422-7d81e4823f21", "comment": "Malware payload", "value": "b836326d1e4e5180408a95c1ce14134496fd9e83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948342, "uuid": "539892f9-4bc2-454e-92cd-c832255ecf57", "comment": "Malware payload", "value": "132b091ec3487200015deedead446ebeaa9f8976b00bd066cc2333ea74cb3b2764fe91d362b874763dbd0f506a84cb9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948342, "uuid": "d9db2d3d-7af4-4b0c-93d1-497131870160", "value": "T12057CF77910678EDE9B98CB4D01025816DAC78875778E3C7BAC870E6A6EB6D08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948342, "uuid": "e6bb566a-df5d-4a0d-83db-177246f00181", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaK:sXyWSpV+Wu7rI3JEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948342, "uuid": "0bb061f5-fb2e-48a4-82d6-70ebef662a2d", "value": 27918336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948342, "uuid": "62faf120-8b4e-452d-9593-7143bf2cabd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948342, "uuid": "505c0342-2d36-4704-9c9a-39ca8cd176e8", "value": "8332871673d8e9d90c95a463e1bdc73b1fae1a59b46767cab1c0c9257de4e7f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25384465-04f6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657969075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969075, "uuid": "fffbf4dc-20d6-4f0b-a0cf-7a4952177088", "comment": "Malware payload (Mirai)", "value": "666030b6af4cf33d44e6304de822e66e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969075, "uuid": "cbea850e-67c6-40ad-8e94-9cb6541936f1", "comment": "Malware payload (Mirai)", "value": "847cbaa1b563dcf13da91303d98f9d19db43cf662680d634316807d35fede047", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969075, "uuid": "dbb880b1-708e-4675-9313-13e3dabdca3c", "comment": "Malware payload (Mirai)", "value": "1391892d2dbade46da3b5a79a2a523488cc69a1e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969075, "uuid": "49e13463-089f-4eb5-a420-3ac8994cd306", "comment": "Malware payload (Mirai)", "value": "c421bac6ce769b07cec9adb6e3ef3bfe73e477f769758a9c15504beabc6f89bd46abeb71524591a62e724d42f611c5cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969075, "uuid": "25b98ab7-3981-43d1-b7cc-a7e1b4c09bd8", "value": "T162332917A9C1C1FDC559C23443BBB13AD862347E023CB19A7BC8FE2B6D49D609E2D958", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969075, "uuid": "67e660cd-b6c6-4c09-89bb-e2c749b2ef20", "value": "1536:mSy2VYToJhFOQSsx7tsQWwDqBo9ho7E6b:42VYsJhwQSsxJXhio9SE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969075, "uuid": "a572f090-f00d-40bf-bb2e-7a680f2eaf94", "value": 50432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969075, "uuid": "9f8d7583-61e5-447b-9148-ca10aa251add", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969075, "uuid": "c797faae-308b-490f-9c5f-c4b77a9caf7e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22901203-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948454, "uuid": "509a7219-8ff0-436c-8fb4-555d7b9f1194", "comment": "Malware payload", "value": "e7f29715c03b61bbf5e227966ff49d21", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948454, "uuid": "39da51d3-6ce4-4f78-b1dc-327538a18742", "comment": "Malware payload", "value": "84c890e571f9c3c56c40d70ceb7d6e1162279ed00f04c6ab8965c6702a455dec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948454, "uuid": "d7469d64-b15c-4504-9975-bf2936ec16fe", "comment": "Malware payload", "value": "7b1bfcd2ae5ae2e6c444f86dd23de6c0024a5e02", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948454, "uuid": "2f6a4fdf-aa1f-4ee9-8d88-24776a3831d4", "comment": "Malware payload", "value": "115c999d8e5127d7d7e074dbf5f1e8476a5f42d6de2517e0316b5a9ce86602a9f7dbeb8b99638b942d2295d5a612bdb1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948454, "uuid": "c31004d7-5ab4-4dd7-8d94-d2d4c8810760", "value": "T128A1E750112C1AB17246697ED26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948454, "uuid": "1c3701fd-9342-455f-addc-ee937564dec9", "value": "96:/RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:/RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948454, "uuid": "70b763bc-c93a-4671-be89-35256c21bb1a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948454, "uuid": "fac14942-2f47-42dc-83f1-5dc476e68797", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948454, "uuid": "608e4872-fd69-46ab-abd0-f7091a5ea4f3", "value": "84c890e571f9c3c56c40d70ceb7d6e1162279ed00f04c6ab8965c6702a455dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b17632-04f8-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657969939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969939, "uuid": "05cd1602-1f92-40a1-9469-debba9cc199b", "comment": "Malware payload", "value": "66a9dc815440f0c3926ed146a7379a90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969939, "uuid": "66546b8b-642a-4694-b878-daa294d54f2f", "comment": "Malware payload", "value": "84f3defac886206bb0e44b53ca68edcf051d68a7e7156e54aff52c5e6dd949d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969939, "uuid": "b184cce7-e9ed-4e6a-b51d-d5b56afc2612", "comment": "Malware payload", "value": "e9224686c2013a960fe7063547d4d895cd7aeda5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969939, "uuid": "63b9f076-9a5d-4c57-80d5-7128fe5a6b90", "comment": "Malware payload", "value": "65c3401ac6cf2e4141406344f7b238c61ec2340ed50e511899a42b8e22534f13e5fd13226ae73dd30a5e0cbe145f9364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969939, "uuid": "272684b3-60f9-4755-93ee-71183252c6cf", "value": "T10925025F35598599ECCE8070CBE1AFB4B0E5A6703DA4E36E2FD3829D2715922C623353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969939, "uuid": "ea308645-599e-460d-91b0-f820de1a124c", "value": "7a195ad20dd0c44e24aea9fff812861b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969939, "uuid": "18f61428-a777-48ce-9712-2e632b2de8f8", "value": "24576:4C0FMBxw00XY8r0v5dzOxFZARM8w6eFWcO/zz8dZ13SuA:RLwjoe0hd0ARMvWR/zWkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969939, "uuid": "489e57e7-522c-4dc2-81e8-e07968146dbb", "value": 967288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969939, "uuid": "afec04b3-f682-4cc8-b167-b3f72ab013d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969939, "uuid": "cf37374b-600a-41b9-b55f-88460d7f27ab", "value": "virussign.com_66a9dc815440f0c3926ed146a7379a90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37cfc8b-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947865, "uuid": "da5556d9-994e-4e65-8bc9-fb1f5a05bf1c", "comment": "Malware payload", "value": "3f7013c41f8b1e59080202ced04f4a37", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947865, "uuid": "534b26bb-0061-42be-8cca-89d780546e17", "comment": "Malware payload", "value": "84fa9ab95360cf5bbf7550f7ec9f0e43c1e6527ac1708b93393e781c76d32eab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947865, "uuid": "d590eca3-9a8e-44ae-9e2c-891af957f321", "comment": "Malware payload", "value": "55dfb223a4dd1fa55e13b1750f02944bb841caa0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947865, "uuid": "c698d8d5-9f80-402d-a801-b1b30f49ba1a", "comment": "Malware payload", "value": "d622f1d2ea83d5bd4ffe31be5a023f45295708765471a47b120b521dff0032992d407e2564d50fdf48c428362f0e782a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947865, "uuid": "53986671-349c-4d45-b182-07106ffc40b1", "value": "T185318D9076A129343EFB5ED7A3346C10718060212CA45D46F4FCB8F58E8EF0969804FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947865, "uuid": "0204468d-9c6c-4176-a961-d604cab889be", "value": "24:IjJyOeJ5aIOeJ/WkaUoOeJboOeJHOeJWOeJH5OeJUMOeJxeOeJzOl:J7O1odoh5Z/ele", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947865, "uuid": "32b7deb9-6247-4dc2-8a3e-e2d110cd0c7c", "value": 1860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947865, "uuid": "7a225f23-b77b-4136-a075-69d861cbefa7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947865, "uuid": "fce5774c-6233-45ab-be0a-ed4be169125e", "value": "84fa9ab95360cf5bbf7550f7ec9f0e43c1e6527ac1708b93393e781c76d32eab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f45112-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947871, "uuid": "b1c1fe77-c629-480b-b587-fbefd45537df", "comment": "Malware payload", "value": "367e90dc3eb759b47e83c5ace13cbabe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947871, "uuid": "027861f2-376d-4c0a-bcaf-7e127e2a8912", "comment": "Malware payload", "value": "852ec1374e55d57639d713af29cfeb18652274b12ad42d818cbc76e996956131", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947871, "uuid": "fa592a59-25fb-4bcf-90d6-6ddcfed16790", "comment": "Malware payload", "value": "3e788c48740db3edb1b8ca1bf003136572256dd4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947871, "uuid": "fff40238-219a-45cf-ba5f-ed02f916d0a6", "comment": "Malware payload", "value": "63fc7fbe0ecd7af6311d91a1e879561c1437a84ff5928325064d073ad29b5c005f0ad53a12cd41dd77c31cb1484a9d13", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947871, "uuid": "df07e25f-0d1d-4997-a464-fba13aeab3a8", "value": "T1A8A1E650112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947871, "uuid": "18b8eb73-c77a-4225-ad4d-a4d4bd51e5c8", "value": "96:vRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:vRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947871, "uuid": "d347e6a5-5812-430b-b38d-d96dd282ca71", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947871, "uuid": "212e3e58-2d42-4baf-b427-d140deefa060", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947871, "uuid": "94644a29-b39c-4783-98b5-5518e8627b52", "value": "852ec1374e55d57639d713af29cfeb18652274b12ad42d818cbc76e996956131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cb7417-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948775, "uuid": "0406428f-a1ad-4138-92e9-6bed8c3bab16", "comment": "Malware payload", "value": "b90cfed3900f4eba11ca135d54c334b9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948775, "uuid": "40207658-527b-4275-b2d5-7cde97601ad6", "comment": "Malware payload", "value": "8549a8fc97a9943b278ea0e9cdb79eff31a696778d83415278cc019ae7d0a100", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948775, "uuid": "77da5758-bdbe-4234-b827-cc6e3b7b7115", "comment": "Malware payload", "value": "a59de50783624ad2914e7888702b7b16cf9eb0d6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948775, "uuid": "961a5e07-9733-48b7-bca8-0b650a7bd346", "comment": "Malware payload", "value": "9be412663af9cbadd6c75c996aad7e9a6f16da267e83999ac8e91c9adc7bd218ba2f4d1978546dcd7ebf164a813b2df1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948775, "uuid": "3f94a8a6-5844-47d9-8f06-b37d6f2ade99", "value": "T1DFA1E850112C1AB17346597AD26FFA52B90ECC1B097B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948775, "uuid": "3d591266-2ebe-42cc-9650-59360ab7daf1", "value": "96:lRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:lRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948775, "uuid": "2cf2b8bd-579f-4069-8667-cbaf343df171", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948775, "uuid": "ab434d61-1239-4460-bd7d-ec8bff94f5ec", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948775, "uuid": "a9b1db2e-6948-4335-b7f3-de3d45e48405", "value": "8549a8fc97a9943b278ea0e9cdb79eff31a696778d83415278cc019ae7d0a100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f724028d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948381, "uuid": "0dca006e-be6b-4c34-949c-1a275f2e28f5", "comment": "Malware payload", "value": "e058455ba8e0354d450e7a74eeb97450", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948381, "uuid": "b2a28176-8c9d-4b93-a252-38ae9252d725", "comment": "Malware payload", "value": "861fd6ec50fd8bbd2eccdf167d23e853285bc830d4502dc87eeca0b16407a48f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948381, "uuid": "c2122009-99b4-4c83-9285-8b44c96f09f0", "comment": "Malware payload", "value": "f5887d9ac14c623a3a96a0a4f435f30e47262caf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948381, "uuid": "c06137a9-97de-4f33-b722-911304771232", "comment": "Malware payload", "value": "a2aac5e4b0df7688612b2643c40b82b4c4eb63e1a678e592c78770f772ad432964825a9ab04220864a3cb5f5933c2244", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948381, "uuid": "be40fd9a-a281-4cfe-ba1b-2e148103b770", "value": "T1345175D033B1FAB63EB754BB1367A44031D020642DD2BD4895DC7DA4BACED8692DC1DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948381, "uuid": "1cc9c8b8-3b39-447d-90fe-fb3b704dbd7a", "value": "24:IjjlmrQrajlH0XjlJakjlLjl7+jl2kjlMjl2gD9IjlZjlGjlh5jlyjlRlAhf:4MvE2qtWxo183uzRqjahf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948381, "uuid": "23718b26-7c13-47c3-80ae-32673c694144", "value": 2591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948381, "uuid": "19729d20-edda-49e5-8197-5a1a68ed8236", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948381, "uuid": "4c22b4e8-f7a2-47f0-8afb-f511fe91eb6f", "value": "861fd6ec50fd8bbd2eccdf167d23e853285bc830d4502dc87eeca0b16407a48f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f503e6c0-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948378, "uuid": "da507889-a494-40e8-ba36-6c44e81e798b", "comment": "Malware payload", "value": "07e45790afb75320483fb1961fd1d6d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948378, "uuid": "e8de1d89-dfee-4a90-8c26-c02d8fbd0128", "comment": "Malware payload", "value": "864d35cf0e96ecb870f78f4775d76487b10f25458b393f5fa551dc676f87ee07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948378, "uuid": "20d28d0e-4c5c-4a03-a93e-3963f518978b", "comment": "Malware payload", "value": "62c595ca0dfbcf50effa430eb474f6f158d5f1b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948378, "uuid": "1c7aba9d-0e18-4627-8eef-d95b1ea26f92", "comment": "Malware payload", "value": "dfa5a56261766710676a0ccae3829a925e94285667dc425df8f7a23ec689bafffe3d267526af7daa1f2faeb1e8177841", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948378, "uuid": "2adc3c72-a21f-4d7d-916d-e499d17d5b15", "value": "T1D407AD77910338E9E5A98CB4D11425426DAC38875738A3C7BAC871F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948378, "uuid": "001ab6d3-711d-444d-a680-36a97957c0e3", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaK:sXyWSpV+Wu7rI3JEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948378, "uuid": "f9421157-fb4d-4a88-aab2-27476922bc61", "value": 16973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948378, "uuid": "2fba7184-ffbf-4432-864c-546cf3d46b34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948378, "uuid": "081d2607-2e07-45b6-8225-5750ed84648e", "value": "864d35cf0e96ecb870f78f4775d76487b10f25458b393f5fa551dc676f87ee07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b14410-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948166, "uuid": "a396a64b-a827-4e73-a183-dc3d89215390", "comment": "Malware payload", "value": "de23a3860bfbdfe1bccfb44e488582ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948166, "uuid": "31e5390a-f418-4938-af79-37c073620fd5", "comment": "Malware payload", "value": "869b2d9276b26af036bee32e9c51344b2f6081e8a1f30e7c688a51b053c6398f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948166, "uuid": "6c221971-156c-4880-b8c0-5a44b62c9734", "comment": "Malware payload", "value": "6f6e8d6a38873128751aee7d994f32701b20f5b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948166, "uuid": "15d01801-517f-4402-a48e-ae0ff9ed432e", "comment": "Malware payload", "value": "939831d685d6bc93d67112355eba5c157d62d11eee6c39a178be30f739d3f23630b4038559b2efce1f55e62b76cd2cd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948166, "uuid": "8c2aa8c9-f8cc-4aa2-b12e-a89594a93cc3", "value": "T17F41F0CE1F325EF9F55AD93847370A3937AA560847D14289E29CE6006EC030D89DE7D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948166, "uuid": "7512a0dd-d8fb-4020-951a-c08ab19472a7", "value": "24:3+Ydb5jl8AmslI3t8AmypR/z2HdllP3bqtWB4u3GMI8paeudz3N9l5zBkEp7iBAa:OG5E4GYg2H7F1eHeu/9LuEpgn38vmBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948166, "uuid": "4794b75e-8c01-45c6-8fb9-ef84d2a67ebc", "value": 1983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948166, "uuid": "d49a63a6-2ce5-406c-946b-8695c38d128b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948166, "uuid": "c71f10b6-c562-4360-a2b1-0cb447a7ccdc", "value": "869b2d9276b26af036bee32e9c51344b2f6081e8a1f30e7c688a51b053c6398f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36ffd34-04f7-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1657969823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969823, "uuid": "521ecf88-e10d-4363-b189-1aa720b9ba9e", "comment": "Malware payload (njrat)", "value": "580618f804814e097a024dcb16fcd7b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969823, "uuid": "e96cc00d-b19b-4a15-b8e3-198ae38ef246", "comment": "Malware payload (njrat)", "value": "869d01e807ba1bf96b688ba6c58d4047e552be4d5f4fe892b88d953a4642af11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969823, "uuid": "5840a59a-9d10-4d38-be6d-5d937cf10dec", "comment": "Malware payload (njrat)", "value": "c4a86c46cfb318560faa2240d46692504ba2207f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969823, "uuid": "a65f7f9f-e99a-4dea-9903-7248e85db3cc", "comment": "Malware payload (njrat)", "value": "9c7023ea50afbd0884752e46d8d237e8ad5d3d0c368fc807d3e2eddcde57fa52e2d2c540e90c1bc0542ef26f7c3141ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969823, "uuid": "ce9a1036-ae36-4897-962c-4f926c1eb8d5", "value": "T16F94ACCF0DD7124C4F302A7730E89D62E91E056BC3CFA350E19B6FC96E0938AAD59956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969823, "uuid": "1d46ba9d-1da4-45c6-b039-e3fde5ba1926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969823, "uuid": "9a9cabed-d92e-4f7d-95c0-bceac749bcd0", "value": "768:vH5+JwoiVhfVU+VIOhC163Q/BLCXYNEA28w58O0d4q5r:vZ1VhfVjgxET745r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969823, "uuid": "765a0312-c5e9-4bf5-ba7f-47ab6ef0e0ab", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969823, "uuid": "a7d154d3-9521-4f8e-a9d1-68b9cd2b6919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969823, "uuid": "3bfa8b72-219c-48d3-b714-92431a96681d", "value": "869D01E807BA1BF96B688BA6C58D4047E552BE4D5F4FE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276edf1d-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657948462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948462, "uuid": "41900ff0-0f01-4dfa-bdcc-0164cff35385", "comment": "Malware payload (Mirai)", "value": "45cdb8fd89b4b9c1f8d937a5259bcc7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948462, "uuid": "49980e29-53a1-432d-a643-e31fea315275", "comment": "Malware payload (Mirai)", "value": "86d0e5b509dfb50af7262fdbbd73581ec2e4d326017baf2e474b7e064b1aa0ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948462, "uuid": "2e0735f6-101f-4133-8fbb-b988ff914268", "comment": "Malware payload (Mirai)", "value": "1ffcb55283959f76e67cfad167d9aadb14a60d2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948462, "uuid": "63f08ac2-7623-46bd-ba95-bf91bc8fb328", "comment": "Malware payload (Mirai)", "value": "44cc78d6b1f98280a2bbcd23f9893017a0cce77f5c27a8540b36f93194abcc8934043590be9974a64dba58e48816faf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948462, "uuid": "255907a9-4917-4540-9405-ff85ade6d75f", "value": "T162733907AA8184FCC09DC17047BBB53AF47334BD0238B2A667C4FF17AD49E615A2E995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948462, "uuid": "589a4dfb-b4dc-41da-8263-f5186ca35f8f", "value": "1536:NKjmbMxScPcKXKx1aFkEzPd6PbJThUrkt91WxFe8gci9m+LJhO0Bp7lwbZnI:NKjHx55XK7aF/rd6PbBXoxFeii9J1hOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948462, "uuid": "01c14c72-aeab-4318-97c8-52bf789160a2", "value": 74176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948462, "uuid": "8a460e98-0262-4e6c-b930-42ac465aa655", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948462, "uuid": "d04bdde5-f45e-4b9c-b1d4-3b482873eb84", "value": "86d0e5b509dfb50af7262fdbbd73581ec2e4d326017baf2e474b7e064b1aa0ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda3ee9e-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948822, "uuid": "742d8708-621f-4501-83ab-e096bc6a6da4", "comment": "Malware payload", "value": "f29a6300ce11d1fcc8845301cf5147d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948822, "uuid": "1fc381ff-31d5-4500-a6bc-d52c93b24450", "comment": "Malware payload", "value": "86da0b503ce29a928a9776d9930615bda5affa9d614ad3c56a2f526b9fb96dd0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948822, "uuid": "23886f0c-64da-4884-9fc7-404150e7f64d", "comment": "Malware payload", "value": "543bc9b743af2d7d03d55f73ef9feb6ec387571d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948822, "uuid": "c04a125f-97da-4da4-8fe8-27b07b209cf4", "comment": "Malware payload", "value": "336590b31e9e9d377cf40a53fb095583fbaa292722e8d7f822212ac19e9e961127535670d412b2541f07c081242bc707", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948822, "uuid": "38fcbfe5-1dc9-4886-94b2-352153c74bbd", "value": "T14BA1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948822, "uuid": "1cda956d-fa6b-4138-8061-59c661fbd4af", "value": "96:IRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:IRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948822, "uuid": "dce3ad17-de69-4bc2-9968-5b625a133473", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948822, "uuid": "86fce53a-e079-42a2-91ba-1c43b6cb6d67", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948822, "uuid": "44a7b787-17de-44f4-8876-12830afcbcd5", "value": "86da0b503ce29a928a9776d9930615bda5affa9d614ad3c56a2f526b9fb96dd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9d13ad-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948015, "uuid": "0a3f4269-877e-41f6-adc3-a29a0c31fe14", "comment": "Malware payload", "value": "4ec1d517d5accd354ccc718a0daf0100", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948015, "uuid": "70e6c0a4-c42a-4340-9926-36c8304ac317", "comment": "Malware payload", "value": "87590efe41c79f2ec0334c32930b6194b8e2d5c6bda90c15e6682a5c3a3aaa18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948015, "uuid": "93ad66e1-4083-49d7-9f3b-bdd4a451de8e", "comment": "Malware payload", "value": "ebb87ec73e6dc635a0d401768543c86f7bd623ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948015, "uuid": "4928988a-eafe-4e50-a2b0-1ca0a2dd60c8", "comment": "Malware payload", "value": "515ad0b4cb7b18b5f3e11130c0d436e4b63efa48079677683f12723e8a029b7de0bdd658db5f7c22963c07b2c9379d38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948015, "uuid": "f5dd13ab-45ed-41af-9921-20aaf8197712", "value": "T14EB68C73945334D8E5A88DB4D11416426DBC388B5738A3CBBAC471F667BABE48E39730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948015, "uuid": "b51a1a1a-468f-4e40-8051-52b103202018", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaB:sXyWSpV+Wu7rI3JET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948015, "uuid": "0b5fd66b-884a-4f36-94c5-bb29770846de", "value": 11075584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948015, "uuid": "df008fc7-9888-45fe-811c-766bc77eed67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948015, "uuid": "e4dbf37f-a77c-4461-af88-6575fdaa00c0", "value": "87590efe41c79f2ec0334c32930b6194b8e2d5c6bda90c15e6682a5c3a3aaa18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167d0529-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948864, "uuid": "e2ebbd30-7881-4e6a-a699-efe5e0c5831f", "comment": "Malware payload", "value": "fc000819036b0fe6a70e7fb93213bd86", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948864, "uuid": "bf913863-2ad0-4764-841d-ced7b5fcb3ca", "comment": "Malware payload", "value": "87dc63a17ce7228eb76a0d438d8dc898123872f3bb37281c5192941072ddd39d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948864, "uuid": "d9982244-16e9-4945-ab72-3b0b4bd85d54", "comment": "Malware payload", "value": "09c9996bdca15e0960a16f0153b32c814a68cb19", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948864, "uuid": "bfb4d6c4-8c0c-4cec-bfd7-de18d93bd8c6", "comment": "Malware payload", "value": "bf0a8bd670969ffd094895196fe29cac9ca68429dc24db8b59dd940e41ff68a5c5d074fd4a65a48e2ce12687eb572928", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948864, "uuid": "668e0670-009f-48be-b6f8-5495df62cfcf", "value": "T1C9A1F750112C1AB07746697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948864, "uuid": "c1cca25d-6693-45ff-8193-0a5ffba15873", "value": "96:eRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:eRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948864, "uuid": "9f8be103-00bd-4285-83c0-847fff3c9faa", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948864, "uuid": "62919f37-96f4-451c-a660-c408e22fa555", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948864, "uuid": "68f6fa03-f2ad-4db6-8574-53100ec73b59", "value": "87dc63a17ce7228eb76a0d438d8dc898123872f3bb37281c5192941072ddd39d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2183beb2-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948453, "uuid": "df5ce2d3-98a1-4005-b727-867ca5ff8ea2", "comment": "Malware payload", "value": "375e2d4aa54368328b19dd7d5f840d12", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948453, "uuid": "18343356-0d9d-4945-a996-ebaf8c9492b7", "comment": "Malware payload", "value": "887625899adf91266e779713a82fd0270ff6d993e4d352c61f4ec3c424c8ca0c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948453, "uuid": "2f01afbe-a0a9-4118-996d-02da89e1511b", "comment": "Malware payload", "value": "fe854be58db072b82ab14c4c4cbed42d330d0c43", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948453, "uuid": "f026d3de-14a5-47b5-b360-4f6e5070c1b3", "comment": "Malware payload", "value": "f0662a71798e32576783dc1ba2eb8997afb331dc7c2e169fb3f0d4a36ba413064005c91009372ed5504d2ff771928881", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948453, "uuid": "ff8a6bdd-4ea9-401b-a0c5-7e79096939f1", "value": "T1DEA1F750112C1AB07246697AD26FFA52B90ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948453, "uuid": "825184bd-a8d6-491c-aa48-dd712b03497c", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948453, "uuid": "8b7e2b9d-1e8d-4681-94a2-3e3a4828bc9f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948453, "uuid": "8c2ac4b7-7057-46f8-ae32-851097ad6c04", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948453, "uuid": "4827342b-fa84-46d0-b361-ce6e37c7586d", "value": "887625899adf91266e779713a82fd0270ff6d993e4d352c61f4ec3c424c8ca0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8861653-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947901, "uuid": "8cee575b-2617-42b7-90a4-ad782b469330", "comment": "Malware payload", "value": "28d8ae96c598169b5dc07ba01eacffe2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947901, "uuid": "ff5b6591-aeed-4c94-bd7b-9e30dec6b361", "comment": "Malware payload", "value": "88a9d4c7a8f11d6cc30c44b396f7d2ffdec086e57262f6875ad15981b03af5b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947901, "uuid": "79d2a9cf-e8b4-487f-9c62-e06b3aa17d86", "comment": "Malware payload", "value": "796a27b7d733a10ac1e4da869725655002801182", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947901, "uuid": "7cf7608a-ac65-44c5-bc4f-43a8c106bc76", "comment": "Malware payload", "value": "79752b93ba1f7f7f5dd46fd41bcb740d5baddc53788d2c0a2451623248bd405d1b5802db84dff92407a5e05757a2eb9f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947901, "uuid": "ce8d5571-d9cf-453d-b1cf-67bc2324d95e", "value": "T1B0A1E850112C1AB17246597AD26FFA52B50EC81B0A777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947901, "uuid": "69183fc3-5f90-436a-911e-fbc87fd9587b", "value": "96:ARYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ARJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947901, "uuid": "fc1acc45-0217-4c4c-8e4b-9c964eb03730", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947901, "uuid": "48ef485f-12b5-479d-ada1-00f62c6b15c6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947901, "uuid": "62059e3c-57d4-48ce-af2f-08f966c6755d", "value": "88a9d4c7a8f11d6cc30c44b396f7d2ffdec086e57262f6875ad15981b03af5b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3c3c44-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657948390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948390, "uuid": "fb7581dd-0845-4354-aa3b-2dc9a587bac0", "comment": "Malware payload (Mirai)", "value": "e1d373f35480de05d1676e73a0f49cd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948390, "uuid": "7e311174-1adf-4d2f-b5b8-c9a700987401", "comment": "Malware payload (Mirai)", "value": "89cb50f1f1a9a342c79fa23444e981fc35641cf539bb86f2da9d5837900b5c8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948390, "uuid": "00cd1dd3-5d4a-498d-9b7f-fd62ad72aa24", "comment": "Malware payload (Mirai)", "value": "f04768356345c5ccff5c47644aa96be7827cc352", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948390, "uuid": "35f55e2c-0d80-43bd-8e46-50f69c7a653d", "comment": "Malware payload (Mirai)", "value": "22a02915372fb2e57b550b54ab7c0270a440bbec459f698e553fcbbe6ce4b62af41972888f7d3a53d437b80733150745", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948390, "uuid": "ae7311cc-65b3-4199-a6bd-f964d74afab4", "value": "T1DE630980FB8385B4E8050EB9913EB73BDF77B41E48386A67E775F9912D86A40707520E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948390, "uuid": "d53e7060-9812-4f9c-a54d-a01b1ca2fa34", "value": "1536:rdpMwAlvMsIHV1QCsksHEL2zUsIa//E+0LG8qzR:LMwAhMsk1Qbks22osIa/c+4GZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948390, "uuid": "a04bef76-7f5b-45ef-a36d-cee05acb8961", "value": 70828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948390, "uuid": "0ede3984-707c-4502-8bd6-1905ccf7bae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948390, "uuid": "3d185628-2bf0-4311-abb6-48d8e662b877", "value": "89cb50f1f1a9a342c79fa23444e981fc35641cf539bb86f2da9d5837900b5c8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c5573b-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948569, "uuid": "03c75663-52be-40de-9de5-80c21da9e6a9", "comment": "Malware payload (Panchan)", "value": "97f6f1cdeb5f53795cf1562526d29bda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948569, "uuid": "5a9c87d3-d923-40b7-8301-1dbbbdabc545", "comment": "Malware payload (Panchan)", "value": "89ed12ae09481ef479e121952397df1c2dac8b66e86fbe84680923f4ff6e9947", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948569, "uuid": "9c4a78f7-8575-4812-8688-a4efaa58b97e", "comment": "Malware payload (Panchan)", "value": "dd3a9c49075aa97cd25c64f825e4d23d34161585", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948569, "uuid": "8149b52d-e613-4a83-9b00-40f90ff146cd", "comment": "Malware payload (Panchan)", "value": "f0db8ef2368e5edf8684a725cdb12badaa2822cd039687c753766049a1d11dff56c0e8efd4a4e2ea5d3c1ca6191ed53b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948569, "uuid": "5ceefdd3-2764-49c9-95a2-369bb46afc66", "value": "T198867C73945624D8E1ADC974D51412427EE8388B573863CBBEC476F65BBABE48E38330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948569, "uuid": "33cfe09e-bafc-40df-b75c-dbc0c86f0cff", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaO:sXyWSpV+Wu7rI3JEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948569, "uuid": "2ce322bd-6f8d-47e8-b73b-d264cc70166c", "value": 8388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948569, "uuid": "6ddbb5e0-18c0-47f0-801f-1abbaa5ddf34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948569, "uuid": "a4e256f3-41dd-422a-b799-dfca7c6e957b", "value": "89ed12ae09481ef479e121952397df1c2dac8b66e86fbe84680923f4ff6e9947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a65894-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948084, "uuid": "6fd92464-b590-4861-9385-5196b50ee295", "comment": "Malware payload", "value": "ef1ed3f5fd03c1b8e3689d4dbc5d8784", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948084, "uuid": "4a90542c-e6ec-4dd9-ab7d-c9145fb7e5b3", "comment": "Malware payload", "value": "8a49c547fb59928a9fa83070bb466cd3524075e7d117bff99ab2f55806446e5f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948084, "uuid": "2ca6f7ff-025f-46e8-b2d9-77c9d336fc9e", "comment": "Malware payload", "value": "8fa10fc5966ba23b5318cb2bc0ca886d7caafa74", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948084, "uuid": "341735c1-2ae1-46ed-b5d5-d2125a6d59e7", "comment": "Malware payload", "value": "c2237eb838c9a291fe46129568115af18f01cbd6e9513f9b6f8ffbbf5c6c9254502d0b6b8e38065a7e3bc3907d660357", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948084, "uuid": "15e87749-0800-4738-a744-843651702843", "value": "T169A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948084, "uuid": "63a136b6-18ae-4cb9-b84d-8a6b2013fa3d", "value": "96:0RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:0RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948084, "uuid": "76f16372-c2c7-40c4-8e1a-a14030f9581f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948084, "uuid": "ebac9acc-7ec6-4c52-a63a-d7348c055c1a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948084, "uuid": "d64dd16b-291d-41a8-9753-104c3239b8e6", "value": "8a49c547fb59928a9fa83070bb466cd3524075e7d117bff99ab2f55806446e5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55471d04-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948110, "uuid": "9e2d095c-3aab-43f7-8de0-0e76bf7ef337", "comment": "Malware payload", "value": "d22597326852e1c4c90e127e06ee027f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948110, "uuid": "e8137df4-7d09-4ee4-8f55-ea7272a8f39b", "comment": "Malware payload", "value": "8a5770b9c6a0c507bb9fba78cf0a7613adc80d3e8ff5c4b05fecc8112feadf74", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948110, "uuid": "90e1f98d-1d54-4b3f-86dd-a649b9225bbe", "comment": "Malware payload", "value": "cdda4d55a2bfdc22b02ff3f6ef7e63ef3ef34a00", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948110, "uuid": "ca1d29c9-f6fd-468b-b2d8-a457900db29d", "comment": "Malware payload", "value": "be26ef6a02dc62b041040e99cd7dd5cc90d260ee215c0931cb646742b4ee00824d6e8a9828e5315164434f1c9de1ae63", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948110, "uuid": "f8b4805d-44e7-49ec-bd28-4c4dac51c3fc", "value": "T16551A1D82798EA7F2B93453BA1BAC55031D571A176C6BE04C5D83EA2B18CDC471DCB83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948110, "uuid": "de15ecfe-0ba2-4cea-a62e-a26522f58ebb", "value": "48:vvgZvW1vGa0cv55vYJvXzv+dvMlvNvvQ9vTTfvctvbKf:v2YJjubkKtGXfaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948110, "uuid": "eabcf826-6cac-4b6d-892b-5b36fdfb29a5", "value": 2866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948110, "uuid": "59ecc13f-a8f8-459d-95c3-86a5b6e05554", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948110, "uuid": "7e146b01-aadb-4879-8a3c-41aa98a70d04", "value": "8a5770b9c6a0c507bb9fba78cf0a7613adc80d3e8ff5c4b05fecc8112feadf74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f417b8-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948398, "uuid": "278899a9-1b36-4a8f-be88-7090b549af9e", "comment": "Malware payload", "value": "0201e108e7c3f839915e9390a770a845", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948398, "uuid": "ad946a26-b4fe-4ef4-a9ee-076e675032f5", "comment": "Malware payload", "value": "8a666d7ebf892ee9b7555504489a80308033390360446e768c82a3aa8a1f7fd8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948398, "uuid": "e30f0602-04da-4896-96e4-1fff54a75eb6", "comment": "Malware payload", "value": "511ba38b82960986b7635312feae2f6b6ee1a32d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948398, "uuid": "db674d2e-fbd5-4804-b4d8-a4b021f19c28", "comment": "Malware payload", "value": "2ecdd5f862930d17e61f895b78073ff3e1b8bfe913e8ff269ac1a6f171d8faeb415f4b0a699e346da3a167003270b0ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948398, "uuid": "e9524e4c-e89c-4d54-a3ed-80f7ad8de318", "value": "T18E5148C1727139303EF72EA76335AC10B1C560312D91AD89E4FDB4B48E8EF496A841BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948398, "uuid": "aae2ad54-f357-4eba-8a1d-45cf195dd760", "value": "48:4+rprznrlrvrsrvorzrirD5rrrzr9erfe:4edzrZTUo3CDtv39+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948398, "uuid": "a22f9df9-3bbd-4905-886e-771d34378d97", "value": 2620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948398, "uuid": "7bc9530b-16d9-4e05-8338-cdc96eaf36a5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948398, "uuid": "1c47ca0c-675d-45d7-acc0-a2dde1042435", "value": "8a666d7ebf892ee9b7555504489a80308033390360446e768c82a3aa8a1f7fd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe40474-0506-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657976045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976045, "uuid": "b29e3d7a-49a4-4ccb-9334-b22b21c51af2", "comment": "Malware payload", "value": "c0da5d297c38eb259935cebd4f176ab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976045, "uuid": "e1dc3279-32ad-4df3-8f2e-6426472e803c", "comment": "Malware payload", "value": "8a73e18bea582bc60cce3c5c12ac78aa30170b6ebb4c5c614ee65fd409c3fead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976045, "uuid": "573b4206-c229-4982-862c-fa5814f6ae81", "comment": "Malware payload", "value": "2105b49fc2e033c54b6dc6675b8bc8d6974b0cac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976045, "uuid": "34a21a8e-d6f5-472d-8c19-5482d1051470", "comment": "Malware payload", "value": "532b9678faa4ab612a0c40f50f4ae673119070561a585db15fffecebdc2e44cdc783bc9d25361e1c75e28a1d55f3c2a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976045, "uuid": "b1e98c38-f213-4c65-bf41-505e364cb8e7", "value": "T115B35B5F73A430F8E1768275C862160AE7B5B8360B619BAF17A4465A1F333D18D3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976045, "uuid": "636530fe-06c4-4b5c-a0d3-4ef5a71e99fd", "value": "fe080e7efbbb6e625a8f52da71f5d240", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976045, "uuid": "4b2605c9-665f-48bf-8a65-d68c8669fe77", "value": "1536:ncuLeuHLo4HwYpxyux0Syj92aWcqs2byZtk+dm/qWg7TsWnfOd09dljLjgDJPHZu:ncuxoVFuazcKqs2t/pg7tMMdkGx5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657976045, "uuid": "7a90fb8f-974b-4a52-bd54-1bd397608003", "value": 117760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657976045, "uuid": "1642d9db-94c7-469e-a47e-a5802be3bba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976045, "uuid": "0c539061-5ded-4993-bd62-57da89189adf", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902a4ff9-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948638, "uuid": "fc3f0910-ddd0-4b15-b791-9377f774d9a3", "comment": "Malware payload", "value": "02e60cdbccd093172a110f633c5f3bc6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948638, "uuid": "37f9e24e-fe1b-4151-a8cb-eefb229217e1", "comment": "Malware payload", "value": "8ad95dda07cf2d3e35304d5ec68985ab4819ecd86415f32be7092acef6774f6c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948638, "uuid": "26d4ef7b-140c-4252-b94b-0d830f2b3584", "comment": "Malware payload", "value": "5914df35801a7a8784019156b01f156292a7ac59", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948638, "uuid": "644d7d93-2515-44fe-8e70-f0c70500d937", "comment": "Malware payload", "value": "9823a8225de92b248947210e227a275e1a84e99a5f5b6cc7bea25ac87f9b604e59946e312707c616a31edee9158068e7", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948638, "uuid": "4533a5be-66b0-4147-a7dc-dfe6110929b4", "value": "T1ED95331166C017C9D594D9272F8CAD36147BEFC63824F9E352E29AE2204EFC5EDE2874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948638, "uuid": "e750b4c2-7931-4d27-99eb-3d3924280924", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAV:G1wwAjzIQOMK2GNKslX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948638, "uuid": "ce1fb3a5-0d62-4485-b0eb-d29bbf318e2d", "value": 2060288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948638, "uuid": "05c2b6a3-0157-4b06-b95d-a31abd1ddcf8", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948638, "uuid": "b1934967-d50e-4a1f-ab83-43d87f5c54b5", "value": "8ad95dda07cf2d3e35304d5ec68985ab4819ecd86415f32be7092acef6774f6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae369c63-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948689, "uuid": "b63c6c11-df74-4e89-be06-ba31eb22221b", "comment": "Malware payload", "value": "89e36aecc2f02331f628a4acd4da2a93", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948689, "uuid": "713c2da1-49e7-4f74-ac01-61e29e61263a", "comment": "Malware payload", "value": "8aeda2cc515835692b9a3f1df82978155a5d6f77ab35af8bc448eb85e091107e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948689, "uuid": "6299893e-aef0-462e-885c-1415ed97cbe2", "comment": "Malware payload", "value": "6ee1688d163f6b8ab69adf9482327075003e2bc4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948689, "uuid": "4bca67e6-175d-4244-a655-766cf200f5d1", "comment": "Malware payload", "value": "21a298f4f06a99e1fbfe45df6126576bde7977b9d9dc408bb6b22bb7c31472ae5510fac79ffbd48607753cf5de2af315", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948689, "uuid": "cb8b1bbd-344b-47fc-9dd4-a0b0046b997f", "value": "T10CA1F750112C1AB07346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948689, "uuid": "7ff766ad-79e3-4548-bbf7-5af1577cf51f", "value": "96:0RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:0RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948689, "uuid": "bb5ac8f4-0a19-4f7e-bb3d-c2423411e8a5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948689, "uuid": "39a76810-ee70-4ffe-8547-52cc6f60b613", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948689, "uuid": "152da035-c3b2-4455-80df-df1c48567bb8", "value": "8aeda2cc515835692b9a3f1df82978155a5d6f77ab35af8bc448eb85e091107e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b34482-052e-11ed-93bb-42010a9c0043", "comment": "Malware payload (DanaBot)", "timestamp": 1657993233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657993233, "uuid": "1a238cfb-40b8-4481-8c6c-698addd588ab", "comment": "Malware payload (DanaBot)", "value": "12357c3d33ac132f57dc9240f575ca82", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657993233, "uuid": "25f0e9cd-6f02-4005-add1-6deb6b2e05e7", "comment": "Malware payload (DanaBot)", "value": "8b41f1a7600c31472ed6fa7c0d57d8f0309d888850c675b6ebed7d05ebd76cc6", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657993233, "uuid": "3c20da34-acc5-4994-91e9-b155455e3c9d", "comment": "Malware payload (DanaBot)", "value": "acab145d43ca3625876aabf694fffc07725787fc", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657993233, "uuid": "add78a18-c1ad-45cb-b45e-970fb422b8c6", "comment": "Malware payload (DanaBot)", "value": "850c89fefcdc320e57961707182ea10008e32526992fa212a1ddeb832df4a7e1fed587b5ce5e84f78a01134309a874d1", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657993233, "uuid": "3a9f3b43-6e15-4a9d-807e-08ce4029af6a", "value": "T10E563300FBF0D078E47E79B84AA983A8B13D2592AB7054C774F669EE4935BD8CC35607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657993233, "uuid": "1286ad3d-6551-4089-84bc-8733d4861106", "value": "e40d187c9305b8e1a4c2b8b45c147ade", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657993233, "uuid": "296277c0-55db-40b6-87fc-29dca7b44d40", "value": "98304:GHNL1gtCI+/bpbwckfxT7e8PB7I2vFpalkQDMzDyQIYbh5xijFGzAkE4iBYL:x3adop7eOMmpakQDU95sGfEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657993233, "uuid": "678fb2ee-9691-4dae-b346-83ce00116d9b", "value": 6216704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657993233, "uuid": "e77d54e1-0d98-476c-8ec1-07fb28b8cdc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657993233, "uuid": "16e5af1b-ad79-43c5-97ab-75906ce6f3ea", "value": "8B41F1A7600C31472ED6FA7C0D57D8F0309D888850C67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc4a450-0513-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657981514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657981514, "uuid": "d37b66b9-7a76-46df-82bc-f6ed5f1465b5", "comment": "Malware payload (RedLineStealer)", "value": "e3274b1566143d12e49cc6cd070c43b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657981514, "uuid": "c32806f1-b4b9-43e5-a07b-da2c79a9c609", "comment": "Malware payload (RedLineStealer)", "value": "8b94467a6cdf2a6ab77443ea4573ddd0e8f209f3e433cc0a322e170e7945aedc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657981514, "uuid": "6686f94e-fef5-42ab-a290-bb75bfd7414c", "comment": "Malware payload (RedLineStealer)", "value": "6130d4b5783e5af088ce396272e5bc93e398c9e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657981514, "uuid": "0cc5678e-6ae9-4cd2-9096-a7fd3de7ed7f", "comment": "Malware payload (RedLineStealer)", "value": "2786ba25ee4f9976653bebe8bb3b8dc56f834505d96478bed8530c26a918e27165ba4a24f61841caf43bd1e712d45c7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657981514, "uuid": "6373017a-9fed-4eeb-a2fc-e32f7aee9507", "value": "T16494CF10BB90D035F5B312F45A7A9368B93E7EA1672450CF62D56AEE1B346E0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657981514, "uuid": "bf041f0e-1d8b-4b7d-b283-047b29213f6a", "value": "363debf0ff85eb6df1e94b75eacd8b61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657981514, "uuid": "f04c7a85-57e3-42df-a063-e82cdf7c87bb", "value": "6144:P1ptSvGcz0ubBWgZJL0SiujtqKCDN9pQ49tQtVbZ2TJzH4PvmX:PvwGM1bE4V0SiujtERQOQtVt2TJs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657981514, "uuid": "b3a13ebb-1ad5-4e60-a5ea-ec839a60b0ac", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657981514, "uuid": "94c2717e-2c02-4943-b1f7-d7aaab490627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657981514, "uuid": "0664f337-2063-4a83-bcf1-5184239bd76b", "value": "e3274b1566143d12e49cc6cd070c43b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15cd104-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948667, "uuid": "aa28f67e-0458-430d-8678-a55ec75d4b3c", "comment": "Malware payload", "value": "67226b9d42221aa814e5c73a85800d0c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948667, "uuid": "d2112251-caa4-492e-8bfc-1b3c1d3419f2", "comment": "Malware payload", "value": "8bc9dbd98e9a23091f5d2d20b7d13357f8898dac38149dadbe8374a079c72aba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948667, "uuid": "edb5aefe-accd-4144-bcf5-051de9168e60", "comment": "Malware payload", "value": "4fabeff93f8d0cb746132d93002879f48ac71477", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948667, "uuid": "35db22f3-3826-48db-89fa-256641f713e8", "comment": "Malware payload", "value": "1daf719576e9b31c943c0303b46928612ce23550523c13943ab86db7d5b97b4c9129d10de393a479e1ccb2d8a4eb31d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948667, "uuid": "df525757-71a1-4b61-acc0-da23201917da", "value": "T131A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948667, "uuid": "316b27b3-629b-4b6a-9afb-22a998804ff8", "value": "96:cRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:cRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948667, "uuid": "9630054e-5019-4efb-83a1-739f075bfd16", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948667, "uuid": "fd8f40b4-48e7-4225-945f-6004f6155aa5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948667, "uuid": "899c753e-98aa-49ef-bb81-106849f5aac5", "value": "8bc9dbd98e9a23091f5d2d20b7d13357f8898dac38149dadbe8374a079c72aba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6686ccba-0519-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657984217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657984217, "uuid": "fe1b1c94-15a4-48f8-b256-53af405e1155", "comment": "Malware payload (RedLineStealer)", "value": "18898031ee964ae4c47e90feb11aee60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657984217, "uuid": "5bb31f1c-87ed-4b50-b84f-792efc6b29c4", "comment": "Malware payload (RedLineStealer)", "value": "8bcfb6fd1fd3f95410dc269069c9cb95eac2518b3a9b2eb2f3f957797a789729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657984217, "uuid": "a0346fc8-425b-482b-b5d9-b7ffc0eaf634", "comment": "Malware payload (RedLineStealer)", "value": "e6fafe3dfdb9792aceee26e4e9cf4fb85116aefc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657984217, "uuid": "b370ae22-603e-4b49-8932-109ae51c8295", "comment": "Malware payload (RedLineStealer)", "value": "520dcc71bbb0ffd0264b834a0eb42700f6e01b3c69f0a82c3feabe7ea9588085b24318e47d357e8ceecb210003edae45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657984217, "uuid": "d7f66c39-b94e-4035-9535-8afd66c5d697", "value": "T16B94CF00BA90C034F5B792F456BAD36CB92E3EA1576451CF62D52AEE5B346E1EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657984217, "uuid": "c8c8c3f2-da7e-43b5-b069-6971c2361318", "value": "363debf0ff85eb6df1e94b75eacd8b61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657984217, "uuid": "8d5061ef-2a0d-43a9-bf9a-b40c0e723ca4", "value": "6144:CnccNYvvgEkSmIrgNlYhT+DtK6rHwpHHghvy9QenQdbBznWQ8mmQJ/:Cn3iv3fBslYhT+DtBwiAPcbVWQ8mFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657984217, "uuid": "5321a0b0-b578-4866-9a41-acfac275bdeb", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657984217, "uuid": "57fff19c-c746-44a9-bfb3-4a1fe7912799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657984217, "uuid": "f045bf36-be87-4650-8882-bd890d8529de", "value": "18898031ee964ae4c47e90feb11aee60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14dd8f8-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948721, "uuid": "00b20d63-e35b-4a18-9962-385254c547fb", "comment": "Malware payload", "value": "4a8968c0f9ddbd0b7a3a6fe80f01dcb6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948721, "uuid": "cf8e96b6-ff3b-4ef5-b31a-b5d85cafb4eb", "comment": "Malware payload", "value": "8c1750c6a6587ca234a212c9c996affa73fcd38bafc8db85ffe8b915c4b0d5c4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948721, "uuid": "43b89ce2-dd7a-4856-a52d-a5815ca11534", "comment": "Malware payload", "value": "4434e99a600a29b4d0448fbdbe4bdf368ce2ccdc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948721, "uuid": "2447a493-8cab-4c0a-a869-00f3ab3da2b5", "comment": "Malware payload", "value": "0ae74e732c82e2d994c7fe36ddbb26130d5f42dbb98915e9c45dc71087009f730921ed7d2f9317cb8c433ef7f6bf5355", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948721, "uuid": "12fc067b-6886-4518-96ef-657aee4cac3e", "value": "T1B1A1F850112C1AB07246697AD26FFB52B40EC81B09777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948721, "uuid": "a226e7ef-8722-4aca-8011-95f446d10831", "value": "96:uRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:uRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948721, "uuid": "90f1d84b-dc35-4459-989f-d86d852adf09", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948721, "uuid": "ba962685-d048-4c7e-a61e-5f98ea6813ca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948721, "uuid": "29f3636f-fd08-4185-8e6e-caa3728342f0", "value": "8c1750c6a6587ca234a212c9c996affa73fcd38bafc8db85ffe8b915c4b0d5c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b4ae13-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948413, "uuid": "4210c049-dd0f-4536-811c-521f19a78a47", "comment": "Malware payload", "value": "c5e7b703e496195ad90e57aa5dc87376", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948413, "uuid": "89669394-c14a-4049-9f17-5d402bc4e639", "comment": "Malware payload", "value": "8c3430c45d8b68528ea6e80b82cd9862f0ed4e2333b7a90203c2164ba8a3ee84", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948413, "uuid": "c04e637e-bb72-431d-8d59-5950dc027c51", "comment": "Malware payload", "value": "cb64c5c650f10cdf7191220ce6910e47df97592a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948413, "uuid": "b8ee9726-8ba1-41cf-9555-85ebe724fe03", "comment": "Malware payload", "value": "cf3e05fefaac0c8ebcac26b5ed0ea0a525d80a6aa23f5f1a51f928f6fc002dcd009714c01ad59483921009ad8b3460a8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948413, "uuid": "abfbd293-b20e-4ff3-8cd6-fe931ebe4ac2", "value": "T1BFE09226FCC080BE603EC565BBE7AD5E550F2212824B253C97FD6442B8BCC481042D37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948413, "uuid": "b127263b-171e-4f25-a01a-bcb6818221f4", "value": "6:/QEpNaN4f/rVYm/PYN3F5/iOqVKhOqLsVKhOqNiVVNMiOq6O4uVfvOZQiOiyiiOU:/QZwjFnYVitgh1sghyTyigYtPi5yii1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948413, "uuid": "146c1da2-54db-4224-9bdb-366947906257", "value": 384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948413, "uuid": "8bfb778b-160b-471b-9de8-4c17206a8ec8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948413, "uuid": "e5948ebd-e5d4-4b11-a17b-323fcefcc9f4", "value": "8c3430c45d8b68528ea6e80b82cd9862f0ed4e2333b7a90203c2164ba8a3ee84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c6ee8a-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947814, "uuid": "b9c223ee-a7c7-4fe4-bb30-43523651b498", "comment": "Malware payload", "value": "85554bf965ee57ac6ee90ae6e7aa0a54", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947814, "uuid": "ecc93d51-6588-46c0-a502-94d8ebef584e", "comment": "Malware payload", "value": "8c6e311165a49b137f294a615bd0d7b7aeaddd82caf5aeaaf78b7b796ad88782", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947814, "uuid": "a74b27d5-121c-4e2d-8d3c-7b8b627941ad", "comment": "Malware payload", "value": "213a041f60941ebc5cffeb8a00cf344a88c6a852", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947814, "uuid": "0c5f866c-f289-4328-b24a-984e0a8c4588", "comment": "Malware payload", "value": "957d81b48f2210169510b53290db30e0e2814088478acb704a192ce2d2325cd3f53712e71fa4ee46eb06ec8142b3e7d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947814, "uuid": "fee2d0b3-92f9-47a0-8c87-7e26c85f97c2", "value": "T106A1F750112C1AB07246697AD26FFB52B80ECC1B4A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947814, "uuid": "e0abeb6a-84d4-4c20-9abb-4a076fb0a007", "value": "96:BRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:BRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947814, "uuid": "ce3e68bf-20ee-43a3-98f5-29e7d097e98f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947814, "uuid": "769e0594-d195-406f-ab3f-870e58306282", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947814, "uuid": "9ec0eeed-82b5-442e-a9aa-06348afc8fba", "value": "8c6e311165a49b137f294a615bd0d7b7aeaddd82caf5aeaaf78b7b796ad88782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99484f74-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1657971417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971417, "uuid": "631114ee-9576-441d-8d10-0070305a9963", "comment": "Malware payload (Formbook)", "value": "3a2dd995c38097a52d377e3931901dd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971417, "uuid": "aff21efb-9f9e-486e-bbb2-52b3293d1d2d", "comment": "Malware payload (Formbook)", "value": "8c751b182c88374bcf394d912e27b3ef855ea5a834cb619272c8de7bbc979925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971417, "uuid": "3e7f7112-5b9e-46e6-89d5-675b446adc97", "comment": "Malware payload (Formbook)", "value": "c324a8ef201f5c17645ddbde9fb88bae3ece1370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971417, "uuid": "842dbcce-1e4e-4607-963a-947a2a430b4c", "comment": "Malware payload (Formbook)", "value": "effe4ccadfa72e6b22f69fc2522da5909b3ccb081869db98f237ed304f73d966c95dc56c5fee95183d01d2187413fa5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971417, "uuid": "19a1d82b-1695-495e-8a26-8c92861e850b", "value": "T1CDC4FA382301B948DE953DB8506756E578EF9CC0A602CD33E7A0A5C7CDF583B58A987E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971417, "uuid": "3b2d58be-c590-4b10-adff-fe0f9601adef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971417, "uuid": "0e636572-01a3-40e1-a968-87a216674a5a", "value": "6144:OBo4r99+z7GOpBGJoZp0JI0sP/Ox6OGNFd4k82WPXl0cTR2OH5N1qDTBRtUghFxn:OezCOpQrJTltj1qDT5vGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971417, "uuid": "f429140f-1e2e-41c2-9e6e-1892fff12286", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971417, "uuid": "7d01bb91-7afc-4edd-b3ad-55b9c82fd8a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971417, "uuid": "d545111d-807e-4103-91be-01ac58a46924", "value": "tmpE035.tmppolnpiwpputbbs.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e938da3-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948018, "uuid": "e23c3e24-e49a-456f-ae83-f15a1c720b2c", "comment": "Malware payload", "value": "84becd54f5404862bff6f67cb0cbb134", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948018, "uuid": "4f04267e-9f6e-4a62-804b-514904fe630b", "comment": "Malware payload", "value": "8cc010ad4955db0916a72fab10e66f3e3f44b093bd40e1fd9951d92bec58d750", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948018, "uuid": "e4fb5f17-1b67-423f-b0d9-a15f5513c423", "comment": "Malware payload", "value": "6cb6e14e95c5849c1f92ef2ba479367397417cf1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948018, "uuid": "bd4c3ad4-8ee9-4874-9a3d-065b33b7186d", "comment": "Malware payload", "value": "361450576bb91c2428b3113cfb365831f78f0211ca5a7165a1bb63c7a6b4c472287e4f335e97ebec6483f3f727d2281c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948018, "uuid": "43a39f28-c9da-40e9-9538-84c8d9881e6d", "value": "T1ECA1E850112C1AB17246697AD26FFB52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948018, "uuid": "4cc38156-752a-422e-bcf2-6b0487c7aabe", "value": "96:HLRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948018, "uuid": "7df26ac9-cbe1-4518-b710-bc5391e5d4da", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948018, "uuid": "25c52080-3fb7-44ab-9269-d964e64f4523", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948018, "uuid": "a2026271-d0d2-4eae-b882-b26ec980248b", "value": "8cc010ad4955db0916a72fab10e66f3e3f44b093bd40e1fd9951d92bec58d750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f35a4a-04c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657949727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949727, "uuid": "bac36365-f13b-4599-b928-f20ccdf5013d", "comment": "Malware payload (Mirai)", "value": "31e5f4875bdbc8b2e0204025e68cb67c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949727, "uuid": "f747faac-10e3-416b-a3a4-ec5fefab2640", "comment": "Malware payload (Mirai)", "value": "8d472a56c87b71f00855733bb5c27df46ec666211a79abfa4361e71ca60edff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949727, "uuid": "7d6a8a59-3e79-435b-941b-37a0a5d322e9", "comment": "Malware payload (Mirai)", "value": "59952317e450f7e14628c0f189e807daf3f5d884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949727, "uuid": "ddab3ed3-8d36-4295-b384-0135e55638cb", "comment": "Malware payload (Mirai)", "value": "f97f65d0beec2c33a683912d6448d4b35c3e68632665b113135d4ea6bd9e26084536aae5223383e0c43109f286446c30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949727, "uuid": "0dc2a4e4-98c9-4e6f-a714-5c1befb5f445", "value": "T11EB3E857FB11CEB3C85FDD730AA68A01108DA99746D57B6BB3B4DA5CE74684B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949727, "uuid": "83426d1d-9cd9-4143-ad5c-0feca5ee7137", "value": "1536:Tgz/qzNLW/fMiZIX98U0I/QwErQNOS5hVwbfKdwwjF9GhCPR1Ae:Tgz/5f5g8utgG5hVwjKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657949727, "uuid": "3407784a-3077-4614-9818-e0ae15b9a958", "value": 116647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657949727, "uuid": "138054f8-ad9b-4756-98e8-daf72567e44c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949727, "uuid": "8483e9df-17ca-49ae-8c93-f5621409b28b", "value": "fuckjewishpeople.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d757b0-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948009, "uuid": "7787b501-5f55-4fdd-8b0a-e2ba1e203673", "comment": "Malware payload", "value": "fa8e13bb7dcacba818be0e1637a8c85d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948009, "uuid": "b6e4cdc8-3a4e-4b31-a499-feb7ff282928", "comment": "Malware payload", "value": "8d627d8f21a6900f4274bf6e327a034c9313beb924453c02297b18f1da25eacd", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948009, "uuid": "953f9bee-65db-4fe6-b029-f62fd471ae39", "comment": "Malware payload", "value": "f374e752bf268628e43e20607f867bc89873870a", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948009, "uuid": "a943a11f-513c-4a6f-a29c-e6e27859c1a3", "comment": "Malware payload", "value": "aea08f76996f33d97cc9bf4cd0da9bef7772fb4d762dbcc3f5b2c3131d235c63ca7554f6afa7cae5d6daac25b9641ba7", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948009, "uuid": "cc9f0061-3a1f-4585-a2b3-591ccf7e302b", "value": "T154D5330C43BAB8FCF89A492927638DD1C5E921F0A58255F2D63C19981C3F97E17CFA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948009, "uuid": "56322306-02c7-4dee-8d26-858e5c520269", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4m:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948009, "uuid": "07047363-fc98-4abc-8844-358933d59c00", "value": 2969600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948009, "uuid": "056f79f4-743b-4c92-9c3d-f3aa8f4dac7b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948009, "uuid": "fbb89ee8-ae81-4c43-b976-442ce79e6ee6", "value": "8d627d8f21a6900f4274bf6e327a034c9313beb924453c02297b18f1da25eacd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0832ad02-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947981, "uuid": "d02f4777-de5b-4b86-b106-30afb9a03721", "comment": "Malware payload", "value": "2007b408817c61c3a37e77cbe1f21466", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947981, "uuid": "c4b0b9c8-1cfe-46c3-830f-97345417d789", "comment": "Malware payload", "value": "8d7c8612220bc34e7d6e0a35803847592e554eeb730e963870005febbd7179d1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947981, "uuid": "d630bf45-0ca5-4e01-a671-4d412edddf73", "comment": "Malware payload", "value": "1560660f40b1732d2ea6c1c343c4a22ff447897e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947981, "uuid": "70cec608-f58a-44d8-9f4d-60d1bfbb6c90", "comment": "Malware payload", "value": "0dc51ae45de7e473c1a8d6278907b4e2f7b2d6e50c73ca7ef193e7af4443d44ba85b9a367a62e014f7033307164e2d5d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947981, "uuid": "8c72c91d-f5ac-4017-a60d-22a1d3bedfb6", "value": "T1C0F02719FC8844BEA13FC89EFFEA3D8D110F5110068B2E3D96B92D02B4B9C585081437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947981, "uuid": "ab3c4c60-5c7b-426f-9472-edea44d646f5", "value": "12:/VJ8HPI54/PYfBiuy4ghsesFrFBEGghgu+hYuTyisJF8EpASNyiiuyw:NqPI57RZrTBEGCnuoLpvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947981, "uuid": "f699dd4b-369b-414c-8b02-076c19c6b630", "value": 475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947981, "uuid": "612b4073-721e-4b76-90a6-dafe705d58f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947981, "uuid": "7cd714c7-fb62-43f2-b364-a6307366b724", "value": "8d7c8612220bc34e7d6e0a35803847592e554eeb730e963870005febbd7179d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b7b837-0536-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657996696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657996696, "uuid": "34b9e49c-944c-448b-bdf1-bf12eb3f7afe", "comment": "Malware payload", "value": "2cc308cf9f9ab4a826e87a17b3c6c930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657996696, "uuid": "0f9e81ee-a74f-4fa2-9b53-516731275572", "comment": "Malware payload", "value": "8f489b9b28f01f795eef5bd0e43a1e2e900dbd9e459c3b20e53aacb8c3691506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657996696, "uuid": "5c2fc52d-873c-4c61-98fc-1246d5f590dd", "comment": "Malware payload", "value": "1f2bd99b6cb20173c49470abc6f15c8bb0b2f626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657996696, "uuid": "664e59bb-7871-4a10-8927-352f5ef12260", "comment": "Malware payload", "value": "c3b6c5c002507d9388f791e6ff297a895d4123f48195acc257b4da978e5b97c7a4e342141b2b72b0c63dd8219d4bfb3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657996696, "uuid": "29d68731-e56d-48f8-b081-c5ae9b6f02a6", "value": "T10F72C8CB93F20E27FAA1C37D882A56874F35D9ADB8A5B65B35C155CD3812B808BCC714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657996696, "uuid": "8079548c-7d4c-4b59-8eb6-fcdb9120753c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657996696, "uuid": "9c0b6751-6b6e-4b48-bd7c-8f089d0db907", "value": "384:vOFr4PSSXzwQgtMNbzA90NLmSIISSSSSISSSpvKACPO4:2r46SeMBmVCG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657996696, "uuid": "71ba7783-ad0e-441f-8868-04bb0b06965a", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657996696, "uuid": "646b5160-04f2-4101-bd27-3182d7f7cc53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657996696, "uuid": "c47a514d-c265-45e4-bf58-ad81121340b0", "value": "SecuriteInfo.com.W32.AIDetectNet.01.17291.7025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91533305-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948211, "uuid": "cdba87ad-fd46-4e1f-8832-f600fbc1c31b", "comment": "Malware payload", "value": "176cf24a481d8fb5650623fb87cbb5c6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948211, "uuid": "de684009-2d9e-41ac-8438-7725426e8fc6", "comment": "Malware payload", "value": "8fe2ebdb021b838da447818f9179d6c2f1ed369962f4c38ddfcd726ce09b576d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948211, "uuid": "e3eccf21-77a8-4c75-a73d-3be440500c29", "comment": "Malware payload", "value": "2a2e48ceb6553ed3c5300d1d461926b97e1e9271", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948211, "uuid": "4bbc5716-594b-4fb2-871c-5cf2752335e5", "comment": "Malware payload", "value": "eb741570c24db512339351fa38652cf6d9bde0eca052cae2b1c9ddc29a821edd0b0d56a6e41084cdddae84d6e6a32123", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948211, "uuid": "9fa50b6c-ba6c-4596-aed2-61e8d65f35ad", "value": "T1A4F0E209E88844BEA03FC89EFBEA2D8D010F9114068B2E3D96B92C02B4B9C485081436", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948211, "uuid": "28e904ed-92fb-403a-a29e-6417f16feadc", "value": "12:/VJ8HPI58HYLNiuy4ghsesFrFBEGghgu+hYuTyisJF8EpASNyiiuyw:NqPI55L1ZrTBEGCnuoLpvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948211, "uuid": "7136fb9d-8eac-4034-8ac5-9084744c0cf6", "value": 474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948211, "uuid": "904b8e81-4481-464f-bd1c-db49f34349fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948211, "uuid": "457df7a4-64aa-403b-ae0e-1c9f43eaa195", "value": "8fe2ebdb021b838da447818f9179d6c2f1ed369962f4c38ddfcd726ce09b576d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a6333a-04c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657947195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947195, "uuid": "4aebdf44-7267-446e-b6df-c84f0f049e11", "comment": "Malware payload (Mirai)", "value": "a51f1c87208d9eb6873f60d5a8542da4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947195, "uuid": "534f22e6-a2a1-4ece-b368-741125003530", "comment": "Malware payload (Mirai)", "value": "8ff305244885626e86f7791397e03518fd91bfc7abdc15d716506e859cc212e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947195, "uuid": "98b8cb92-e879-41ce-9760-597cce614e14", "comment": "Malware payload (Mirai)", "value": "868d653532a43e044cae9f5208860be30c8d2b0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947195, "uuid": "1e95eab4-c534-47ac-aa54-2989ffe5102b", "comment": "Malware payload (Mirai)", "value": "cbc477a1cde8ec5bf14d2d0d31fa48c23104ccb335901c2e4f3f1f59bf544668b2705b750050f149f77566683bd0d6f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947195, "uuid": "f2f57e40-1251-4855-9476-eb646c2de2a5", "value": "T131436C52FC819A12C5C51377B61E5A8E3F2563E5E3EF3203AE215F61378A81B0D2BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947195, "uuid": "b07e573c-a8b1-4455-ae6d-641014774c11", "value": "768:DisLcFxhHl4sjdNHLY7uAp+b+JPaRSAV35oojTJl+BNU8TvnGkwslZY10Uv:XLczhHjXLY7uAaRSapD3hga10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947195, "uuid": "778b9c1c-557b-4026-b624-628052a802ac", "value": 55712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947195, "uuid": "7f849910-547f-422e-930d-c8873939118a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947195, "uuid": "2e5a307e-4983-4fcc-a215-64203ea81fa6", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795124be-0555-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010018, "uuid": "7e15a5c4-8184-4d8f-8f25-c16ce93a4b3b", "comment": "Malware payload (Mirai)", "value": "f79aa99cf6d9f73e82be7f2b3b382f07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010018, "uuid": "d9b24fe1-8fd7-4f4a-b6f6-0a6a27d9525a", "comment": "Malware payload (Mirai)", "value": "90072a66dfc4034e39947bea09191bf1a51904ecb4d8110afc595b70507549f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010018, "uuid": "96269d36-cdae-4d1e-9e1f-2dae9774830f", "comment": "Malware payload (Mirai)", "value": "8fb94484b7a43a41f6c7cc425599236827c473f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010018, "uuid": "6b7301bf-13a5-4524-a3bd-8880e5ece7be", "comment": "Malware payload (Mirai)", "value": "c2380a0db2dd592336d157ed139c52b84c2166d271cb0e9d66e465bee506dc70a8223b812183ebe86aabfc6871e8d31a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010018, "uuid": "d6cd4ee3-73f4-49bf-aeb4-acc535a3fd83", "value": "T15163189278D19A12C6E423BBF96E01CD332563A8D2DF324B9D212F5477CA82F0D77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010018, "uuid": "91760b29-6462-4f8b-b5af-f5a195874c4b", "value": "1536:E69UvD15uu1q7+pIVF5fiJZyqpRTozCZcahWMUne4g5O9/e35eb35:E6+ZlRgCZvhTEg13w3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010018, "uuid": "3fec8255-7dd3-4798-a113-218b162f08f0", "value": 72260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010018, "uuid": "d4f86910-0d7c-45c6-831a-bc85744165e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010018, "uuid": "7dca7840-8c7d-453d-8570-776d6acaa1d3", "value": "f79aa99cf6d9f73e82be7f2b3b382f07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6df3dcd-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947898, "uuid": "1d5d1732-8142-4d40-b886-637c392038d4", "comment": "Malware payload", "value": "b0b49ffab0e9701123e3af2d50fbfe1e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947898, "uuid": "50cb1c5e-485e-4658-9a69-1a66f915b7a7", "comment": "Malware payload", "value": "907dd91b348ddf8c85abaf10bea72024d9877b647395d025d113133eec54508e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947898, "uuid": "7d3c4c09-fe39-4614-96f9-7f1d2bed915e", "comment": "Malware payload", "value": "c51aa7351f3c033dece8586046504502888be9df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947898, "uuid": "34ae534e-fb3d-4444-abd7-7d8c8b664813", "comment": "Malware payload", "value": "b46f1e246f30b962589d510ba5ec69976c32f0d912750afedd32cf65be79ed7fabcdafd33cde53c53e52aa2cf1dc445d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947898, "uuid": "b0548840-1d7b-4694-bc31-c9e081e2e018", "value": "T1A6A1F750112C1AB07346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947898, "uuid": "5642b5eb-bc08-4aa2-b78d-f011b5c283c2", "value": "96:8RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947898, "uuid": "9cbf60ea-bee1-4e24-8e92-5e0983eaa392", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947898, "uuid": "7382c369-c84f-4435-abfc-7f0d16bd094e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947898, "uuid": "49f37faf-5d3f-488b-80c3-97cb6bd98785", "value": "907dd91b348ddf8c85abaf10bea72024d9877b647395d025d113133eec54508e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b0669e-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947951, "uuid": "82e61f92-64e9-4ae5-8a3c-c2fc7eec3180", "comment": "Malware payload", "value": "8fc63ea3b2b5d995cc5e1912ddc09441", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947951, "uuid": "1605a430-4a8a-4d32-8039-03cd8845da75", "comment": "Malware payload", "value": "90a06da0d278c4488cec78a0128b5ef71746b6deed02cfb94a6d543568665c3f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947951, "uuid": "63c97a06-69b6-4c69-aa8b-fc248cebb5ac", "comment": "Malware payload", "value": "d851a36041148dc835627c3205dd100f415a5207", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947951, "uuid": "ce44818f-61dc-4fc6-b132-df240709135f", "comment": "Malware payload", "value": "53a6621e7adb60127a2f85c7df161c5be00e53257d632f53b0ce351a65102ad14d620471a190ea4047200adf70b9a0c5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947951, "uuid": "b6b42ae3-c455-447a-aaa1-5514fdfbbeb4", "value": "T12AA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947951, "uuid": "69cc954f-0cf0-4cd6-88a7-e5c9c57a80ea", "value": "96:KRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:KRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947951, "uuid": "da8ba98e-f378-4f08-89a9-07eca00c15e4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947951, "uuid": "fe03e46a-199e-4bef-be5f-da027a6af34c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947951, "uuid": "207bad82-5c33-427a-9dc2-9ff73412d784", "value": "90a06da0d278c4488cec78a0128b5ef71746b6deed02cfb94a6d543568665c3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111a055d-04b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657942412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942412, "uuid": "7473c518-84c4-41bc-985f-cfbd4a1d6a7e", "comment": "Malware payload (Mirai)", "value": "ae4aec3a373faa1c1371d8abf3291c25", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942412, "uuid": "d51ae088-d617-4f88-ba35-f0f3e10671c5", "comment": "Malware payload (Mirai)", "value": "90c89a51b285b20873237728d48567265f19c237d602cbfc4749dde6f8ef0886", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942412, "uuid": "1002ab9a-719b-4beb-92f2-ebda2791b8da", "comment": "Malware payload (Mirai)", "value": "41c40d883d4372c41e8d08093d526ada2209fde7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942412, "uuid": "653aa7a0-b1f3-4a23-8a4c-bf875c77072a", "comment": "Malware payload (Mirai)", "value": "27ea2680c19bd32448d931e275d32fc3f25a5992021abb8becdfe0f7e0f53101131f5b129a27e7bb8e6b3c909ef332fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942412, "uuid": "ca8f8308-e2cd-49f4-ad45-9cbb6d9d68ec", "value": "T1A3D32A46EA408B13C5D21B77FA9F414A3322DB55D3D733064918AFF43F86A9E0E5760A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942412, "uuid": "e4650de1-1da1-4452-8148-d927547e2725", "value": "3072:n/iZI/ifsUesR4JJCFsBQkF4QtgA0/+B0UM/9arw:n/AsiUdsu/CFsBQkOQM/+BXM/9arw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657942412, "uuid": "06756e17-e4a2-4a2d-9c32-7a7b0f69f517", "value": 130103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657942412, "uuid": "a43e28c3-27e3-40d8-8f2a-ded9acff4c9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942412, "uuid": "dd08716c-f3ac-4ffc-b747-375ae27bc140", "value": "Ares.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24390e46-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948028, "uuid": "0d56bce3-b58c-4b1f-a750-2e800c179689", "comment": "Malware payload", "value": "4922b48f7a1e43f616a1c960ff7b017a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948028, "uuid": "3c89978e-3525-4123-9632-20aff7128c0a", "comment": "Malware payload", "value": "90d11552d5df185a711a7b7e7271ef454530cf0c83a1c985fbe308137c2731d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948028, "uuid": "780832bb-b143-4ae0-af32-56bfcd506ad3", "comment": "Malware payload", "value": "92c68f473036fced3cba92454452c02d8aaeb097", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948028, "uuid": "5628b295-db1b-4029-b942-94a7f3a0726e", "comment": "Malware payload", "value": "670b97e8703c3439d7408bb7aa4daa70ce58b5a9eb03a73bcc341deeba2ef013d9d46e7575f1defdd47d3a3dce8742c5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948028, "uuid": "16589304-d463-4789-b333-c99693edc7ad", "value": "T1BFA1F750112C1AB17246697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948028, "uuid": "c4ec31dd-45af-4074-8128-78485124aff3", "value": "96:vRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:vRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948028, "uuid": "222f4bfb-558a-4e39-913d-342ca2fce76e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948028, "uuid": "bade6250-b66c-4774-ba30-4ac4de4e8c7a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948028, "uuid": "e9f6796c-2aff-4f42-b06f-bcc349b9ad25", "value": "90d11552d5df185a711a7b7e7271ef454530cf0c83a1c985fbe308137c2731d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c198d6-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948304, "uuid": "1f0b9b18-5cfc-4bb8-a897-0d46a50aebb5", "comment": "Malware payload", "value": "a372b3ac05a17f860dbf9efcf8c6e63b", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948304, "uuid": "fd503fc6-3ce8-4075-80d0-9a595e2d735b", "comment": "Malware payload", "value": "90e42b9f37dd4ca6dbc1e48e3943ecc77ddffd147868d5464a7fc8c89016c7cc", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948304, "uuid": "0d2b78c1-f540-4f90-bca0-3258fd46056d", "comment": "Malware payload", "value": "6656cefd283747879a92e98a624af26a33108203", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948304, "uuid": "4431fedb-572c-49e8-980f-946716637d79", "comment": "Malware payload", "value": "9d50f4cd0bf200b0bc66f976243580b9818c86044caa166ccc2b3eaddf64bac4f45a7610a3c1c7f7e0f8d21fef261dfd", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948304, "uuid": "bb609aaa-8c23-4179-a3c0-213572609769", "value": "T12514233E15F10EBB35FD45BA8FBFD919611C65DE00BEC39587DD009A1046A26B2E2BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948304, "uuid": "acfbc9a0-c437-40c8-baf2-0d75863acba5", "value": "6144:jJm+C7X3cXB3cmubZW/xtwlRa0mTbQYY741Vz2TUNB47:jJmL3cFcmubZ+xOObus1fv47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948304, "uuid": "db944864-07e0-4b2e-acbd-0ff156e43673", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948304, "uuid": "2162d4f2-1e3a-4ee3-8236-669b2141cbe3", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948304, "uuid": "e48db7c1-b65d-44a2-b78d-14b104c198e3", "value": "90e42b9f37dd4ca6dbc1e48e3943ecc77ddffd147868d5464a7fc8c89016c7cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1840bc67-04f8-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657969912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969912, "uuid": "d45daf4e-4c72-41c8-b844-65d21c3d3913", "comment": "Malware payload", "value": "001ba541aa538314ecb8407df44874c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969912, "uuid": "777863a1-2b50-4bd3-90ed-1dc9ab13af39", "comment": "Malware payload", "value": "9105768335f33a9d8f642e7f5bb5a1fd95b1e9726191d2046f5a2f009f963722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969912, "uuid": "a07325e4-2337-4746-8192-40506e31f78d", "comment": "Malware payload", "value": "5ed5e1dbd37c919516ce391c87c61018f29d5053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969912, "uuid": "c77e6fa6-da5c-443f-817b-7a34315e52fe", "comment": "Malware payload", "value": "a2df4c212c9d8b96b5c3a0c4206c7069d11e07d86dbb6796d7f71f8ddef77f099ad224a698db1558409fbd9da2b1bece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969912, "uuid": "813a81af-cce6-4c37-8b07-05c7c9695c67", "value": "T1E825025F35598599ECCE8070CAE1AFB4F0E5A6603DA4E36E2FD3829C2711926C723353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969912, "uuid": "0c3fc306-21e1-4c83-87ae-6a295b11ab77", "value": "7a195ad20dd0c44e24aea9fff812861b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969912, "uuid": "52aababa-b9e5-49ee-8603-5fbc16c1c350", "value": "24576:kC0FMBxw00XY8r0v5dzOxFZARM8w6eFWcO/zz8dZ13SN:VLwjoe0hd0ARMvWR/zWkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969912, "uuid": "36efd43a-370d-417e-8fbd-0b849de1f19c", "value": 978952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969912, "uuid": "6fd5410b-c075-4286-822e-fbb55cd72bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969912, "uuid": "53f472bb-c307-49ad-8ced-ccaa8b178f28", "value": "virussign.com_001ba541aa538314ecb8407df44874c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed81823a-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948365, "uuid": "e973c163-1bd4-4f70-9fad-fbe9aea2be89", "comment": "Malware payload", "value": "0d690e61dd8fd7dc9cea888764c125b9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948365, "uuid": "3170f4b1-e86c-4aa7-b28d-451f3ab0104a", "comment": "Malware payload", "value": "919e41cdab977c947accf6980b155054b13fb83500d6eb568dce293cae0374d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948365, "uuid": "3b2ed61b-2ef7-414a-88e0-b7246d7e4d68", "comment": "Malware payload", "value": "8f708d252f8f328017d26f924850803cbc039a38", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948365, "uuid": "0a568011-704b-4c8b-8428-55a821edbfc4", "comment": "Malware payload", "value": "fe4bb1e5dc0a2c9f416ff60c96cc0ad3ef77795650221d1ec085cc63c04262f3e2718a139b10f03acf7d2d6aeeabe647", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948365, "uuid": "d29dc294-ffce-4100-8ff5-2a8851438378", "value": "T106A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948365, "uuid": "6fb114ac-5df3-4fda-901a-86da4d7fa20f", "value": "96:VRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:VRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948365, "uuid": "29b076d0-b792-4d3d-b671-a5f25428b2bc", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948365, "uuid": "f039965e-eb6d-44df-8491-9592b201e485", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948365, "uuid": "ce020330-7109-488a-8690-8c7f20597e24", "value": "919e41cdab977c947accf6980b155054b13fb83500d6eb568dce293cae0374d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38d64e6-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948349, "uuid": "3a58b110-7e53-406d-8262-ce0ef410b4d7", "comment": "Malware payload", "value": "074e7e35ef983ef573160b2c9260539b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948349, "uuid": "2c1882b3-1c04-4029-95af-04817e403409", "comment": "Malware payload", "value": "91ae1c0b7ecc91c7d241c817bbc6de6be67972b1f0758612e23e1deb44ccb38c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948349, "uuid": "b84d7d01-2a32-415b-9a9f-780537f70cec", "comment": "Malware payload", "value": "825abe4a61472f4889e28ddd39faa9dd9fdeddcb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948349, "uuid": "7a70093e-9dfb-4d27-87ad-acd6a752acfa", "comment": "Malware payload", "value": "0c82808b41a3650edb0d6d75350bdcdcbd6677e2535bb2028747ca51b0bcb8d4e5b13acbfc4c1d5329b164e649cfa322", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948349, "uuid": "5aef270f-3fc7-421e-918c-6821817df217", "value": "T144A1E850112C1AB17246697AD26FFB52B90EC81B09777B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948349, "uuid": "d1b8bd9b-eaf5-4397-9f4d-bcc63ec28bd2", "value": "96:YRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:YRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948349, "uuid": "4dadc0ec-8e30-4c06-a1d0-c7857f76b438", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948349, "uuid": "f5d95668-6e69-40e3-8d74-d25559b12146", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948349, "uuid": "cdd29b29-430e-4cc3-9888-c7c1af47ee60", "value": "91ae1c0b7ecc91c7d241c817bbc6de6be67972b1f0758612e23e1deb44ccb38c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a92d77-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947874, "uuid": "99747a1f-5345-4479-aeea-c55e58522bc2", "comment": "Malware payload", "value": "a8f6f6343891ec332f8254ddc4164ed5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947874, "uuid": "be889507-2deb-452a-8463-bf1f4368afb9", "comment": "Malware payload", "value": "922cee38b8e58403f10da14e6f36e89e5d4286ef1fecf81bbb3dcce3ee3adff4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947874, "uuid": "38fdbe87-078b-4f64-9b4b-6880f4a73148", "comment": "Malware payload", "value": "04d9a1cbaede79edcd7f8977e5fd9cd139ea58d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947874, "uuid": "36170a95-afe1-4c2b-82c3-5f752a128630", "comment": "Malware payload", "value": "8d225bfbb413b81ca06a3940cd559912b8b6a3d030e970bccfce9883b584c3cb30e34b38188de766681e6ce82bfcce50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947874, "uuid": "07e011e1-63c0-4bc9-b427-35ae842f8173", "value": "T1CDA1E850112C1AB17246697AD26FFB52B50ECC1B0A777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947874, "uuid": "f74f9d3b-cf79-4fed-a46b-5615db77d0f5", "value": "96:jRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:jRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947874, "uuid": "0d02c5fd-a180-46f8-92d6-dbca0312ced8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947874, "uuid": "8efcd81c-1e64-4a82-9707-378121f87970", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947874, "uuid": "9585d78f-4d91-40e3-9764-f6d1c30cb3cd", "value": "922cee38b8e58403f10da14e6f36e89e5d4286ef1fecf81bbb3dcce3ee3adff4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f64d4c6-04c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657947214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947214, "uuid": "d42a98bf-3c37-4214-9f44-870d6697cc40", "comment": "Malware payload (Mirai)", "value": "ee15b0dd44e833dbf3e23225876e2fb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947214, "uuid": "c5d65e8b-574c-4865-a856-18f8213a172f", "comment": "Malware payload (Mirai)", "value": "92be455ac829d4d2644c554cfe9b529311edf088c47904d231f89cd5fe2c2223", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947214, "uuid": "715ecd37-b702-4da9-b74c-74d034ddf76c", "comment": "Malware payload (Mirai)", "value": "167400df09365d9edad80263dbcdebec80f7eea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947214, "uuid": "0fd4acf5-7276-4dcd-bee0-0f9b0c258532", "comment": "Malware payload (Mirai)", "value": "1366e501fcd2ed2b8bb85188f30cdc476049550adfcfa299d04c4ad2acd4d1d35465259bbba9faec659080a12882f65f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947214, "uuid": "2bf20f04-992c-4ded-919f-764127e03fec", "value": "T189333AC4F64B81F6D54B893010ABFA3FDB32CAF592B0960EEF956E31D9335025206A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947214, "uuid": "5b3fc5df-8126-4388-907f-fe5e813434b8", "value": "1536:Iq7gJnSevHjXbOqmuRSa4l9MwpATou6QOYXJRL:Iq7gJRHjaFuRSaGMw+ToTQOgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947214, "uuid": "6f019cf8-139a-40d1-bfee-ea7676424801", "value": 55056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947214, "uuid": "2ed6a4a7-b6b0-4232-993a-0e4092de180c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947214, "uuid": "a35c9a16-5422-4f51-aa90-eaae3d055e44", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7537de-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947907, "uuid": "94767281-5856-45d7-8c42-6075ec47264d", "comment": "Malware payload", "value": "3fbbec491a23f456892c1e220b8c1682", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947907, "uuid": "762f16f3-9605-4747-9165-f47ee15e0f47", "comment": "Malware payload", "value": "92ea51780aa545a75009959c6aa225ffad3d9b0f136a3efda41650ce6d06b270", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947907, "uuid": "cb2a416b-12ff-4fcc-bc5b-653eaeda73ac", "comment": "Malware payload", "value": "04af3f53ef2292df04ae16f6bbb93088e4b18103", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947907, "uuid": "4de2e487-b649-4b38-bed8-1e2f72867ab2", "comment": "Malware payload", "value": "f5a0a71ac9f928ffb2e426d5d0a0a10c98eb763f230895da499c08d8fdc04327e88873cca194750d5a11e41f00af9477", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947907, "uuid": "634dd023-8379-4336-9dea-77af0c06d371", "value": "T1FFA1F850112C1AB07246597AD26FFA52B40EC81B09777B358433A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947907, "uuid": "afa9455e-2552-41fb-9f8f-521e8edd656c", "value": "96:ZRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ZRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947907, "uuid": "467a18a5-5a5c-42f7-a4fc-e61a00012db8", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947907, "uuid": "c0c9be88-f55a-437a-9ffa-3329f2526a2b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947907, "uuid": "6843a370-e9bf-4e5c-9c17-eb420c6856bc", "value": "92ea51780aa545a75009959c6aa225ffad3d9b0f136a3efda41650ce6d06b270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9e76e8-0555-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658009975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009975, "uuid": "08d0fb38-1d68-49a5-9507-e22adef9c267", "comment": "Malware payload (Mirai)", "value": "f7fb38b05d6ada0961162a0cba6f9676", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009975, "uuid": "a81ee741-8416-4aa9-ae26-38007b64a1ad", "comment": "Malware payload (Mirai)", "value": "93283b5b3176617b5b0122b5c38ae44be4521c4286d357647b0a55498420ea02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009975, "uuid": "bd5ae13a-5117-4751-b803-eb9626727e70", "comment": "Malware payload (Mirai)", "value": "4d510e1a432052c65d49b236090c33eb0cd7eef7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009975, "uuid": "8ad80a54-7aa5-45c3-a561-e96d10f7e3d4", "comment": "Malware payload (Mirai)", "value": "e7534d33aa4484235010ccbbe1ceb245e21d8e261a88ba47003af326fc49899cb450d54335635f4f62bc23dba36f4a20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658009975, "uuid": "a8536604-852e-4122-9b92-3bf460d8efbe", "value": "T14A33185ABC919A19C9D0237ABB2F509E331173E8D2DF3317CC141B147ACAA1E4DB7692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658009975, "uuid": "ebd7a15a-8697-4131-987c-768cc8e4acb2", "value": "1536:iVK9yZz8YVhOLgcTdD7+WtnmKrJ+2c/KC:iVh8YqV+UmKs2c/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658009975, "uuid": "d6235868-4a06-45b4-92dd-3a3930d067dc", "value": 50544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658009975, "uuid": "7417e4d6-3e55-42a5-ac8c-2a1790139826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658009975, "uuid": "afd705a9-dbf5-457f-9ac0-06599ca044b8", "value": "f7fb38b05d6ada0961162a0cba6f9676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8e0c79-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948578, "uuid": "43c272aa-541b-48e4-b3c8-3bf73a8cb164", "comment": "Malware payload", "value": "eefe02fbc4bd9aaec7f3a0264fec176a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948578, "uuid": "0ff044f4-abd3-4501-8484-a096bf081adb", "comment": "Malware payload", "value": "934010c0e84074b5808bca000482bc73c3241a06ed96b99c6e69ac988366612d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948578, "uuid": "497b10d9-b393-44df-8678-64b6489da557", "comment": "Malware payload", "value": "04f3d1bc7679bbe011ebe43acc02521a730f14d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948578, "uuid": "20d0a796-15e3-44c1-bfcc-8f15f94fca74", "comment": "Malware payload", "value": "9a18aedc5be4dbb98041333b9d8aa0c2b7b65b6377ebd47c0b2badf27dee53e8294a8811e18ec6592f5267367e744d2a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948578, "uuid": "c7d738f7-029e-4509-9285-0b281bab74d2", "value": "T1A9A1F750112C1AB17246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0796C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948578, "uuid": "1767df05-1b2c-4c19-85eb-a4dd8d65f469", "value": "96:y5RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948578, "uuid": "b8c19b4f-1ffb-4d0c-84b8-dbb2a1dbbd53", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948578, "uuid": "30b55f1b-16d6-49b1-a11d-80e307e4556b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948578, "uuid": "58ad4e90-29fe-419e-aa93-37eb787a72c5", "value": "934010c0e84074b5808bca000482bc73c3241a06ed96b99c6e69ac988366612d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad346e07-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947828, "uuid": "fcb7db9e-42f0-4a8f-b2a3-0fcd791c1b81", "comment": "Malware payload", "value": "41c4cd826754a4fd473adb539f6a16cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947828, "uuid": "cc8b5ab6-ff4c-4457-a921-3ea699c0f3b0", "comment": "Malware payload", "value": "9449f16a010346aa3b29f1dc80fa7d932a2dc6da540e3d7e9847435d5f010ba1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947828, "uuid": "1d329a1b-f14b-465e-8351-65a46010c927", "comment": "Malware payload", "value": "0f40af64cb8a0434d41017c7d3053a1a82cbd0f8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947828, "uuid": "9df8f5a7-55fc-46e3-9240-ad31175c11c3", "comment": "Malware payload", "value": "398ca4f5fe8d1a78b65aadca3265fdd220e35b3aee95d44c9cdc2c278345daa797d0d5ac6185604a6b9bf804a7817e49", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947828, "uuid": "a3ea6a40-dd64-4953-819b-ba47caff2ecc", "value": "T1A8A1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947828, "uuid": "e318586a-0728-47d6-9de2-1811ef31ea87", "value": "96:QRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:QRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947828, "uuid": "4a611346-692a-433a-9b40-f2070a22d6f7", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947828, "uuid": "5d0a8b4b-97d3-491f-aa8c-60d72a4cb4d4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947828, "uuid": "66a0c6a7-22de-41d0-bc3d-3239817cfde1", "value": "9449f16a010346aa3b29f1dc80fa7d932a2dc6da540e3d7e9847435d5f010ba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4c72ea-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947878, "uuid": "37187d0f-a9b0-4eea-9dc6-eaa97bc4635b", "comment": "Malware payload", "value": "bfa3de90f040713b64860c3ee52eba0b", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947878, "uuid": "62568f1f-ceb8-4e1b-8d6f-9133ca726eca", "comment": "Malware payload", "value": "9469e274e01af47ab8962355c7fe157ea6b6c7db114dc5644b8f1bd50fb91892", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947878, "uuid": "f42a37e4-b390-40e0-9e9d-df90828bb886", "comment": "Malware payload", "value": "93dcd6cca9e0bd321491f228b23342af51776754", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947878, "uuid": "7d75ca4d-a586-4dc7-b56f-64d9a0202a84", "comment": "Malware payload", "value": "a05636905a7a3708224961dbcb6524775c689480342daa87f69c6361cc8cdfb0dbb9769f6d6cbaa2de2ff9e72d9c89ca", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947878, "uuid": "7faaa2bb-a721-4f78-a868-f0f15377353b", "value": "T1DDA53336F0FA79B83646FBF64904D6347ABAC38639B633121FF8ACCA512415B7674058", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947878, "uuid": "03fe3827-2986-4ffb-a4ba-30628b6e9f90", "value": "49152:ijoGN5J3sAs+aa8d6q3RKNhvqa87NXcHnSySdkOFOd+LgEBHd:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6Hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947878, "uuid": "6ecc174d-cd1a-4eee-9872-d7ca7ee80341", "value": 2191360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947878, "uuid": "3111b825-0ab5-4e09-8e48-fafc684f9c89", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947878, "uuid": "ad83e525-f63b-4b46-84be-e8d04328843f", "value": "9469e274e01af47ab8962355c7fe157ea6b6c7db114dc5644b8f1bd50fb91892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb24f2b-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948416, "uuid": "4b0e1fd7-e0a0-4fff-b98e-b9ae1ae645dc", "comment": "Malware payload", "value": "6715577cca56f9ee8e1e2fc632695e82", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948416, "uuid": "56065f02-5756-4817-ac0e-ca0a5b34fa2c", "comment": "Malware payload", "value": "947163c78c34b0b298e643d1a2f5839d96e7e6c68795c9730c39eba30a16791e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948416, "uuid": "54fb045a-51ec-4e4b-8f52-b0b9f40204e8", "comment": "Malware payload", "value": "3da582384cf040e3d646f9e40a9ab82fefde5a0c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948416, "uuid": "eeb76fcc-80d8-4015-a85a-db70453f85ad", "comment": "Malware payload", "value": "740e444646cabb2e3114098e7e66bd78c469adaa9d602d6e116a9b754ddcd4227d6733eb507d71f90feaa0b53dd1aeb3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948416, "uuid": "c5bfcaa6-0aa4-4330-aa21-44b36d5ac70c", "value": "T16631C6C0267135B83CFBB89763651E1571D250747CA07E88B4E5B8F485EDE4922C40EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948416, "uuid": "8a6484fd-e49d-4d43-b287-53312688238b", "value": "24:Ij6KFG6KfHV6KRc96K7767556Kb6K66KB6KCu6Kk6K7k:5Nb3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948416, "uuid": "f6fb7591-9fdc-4bc2-95cf-29029d43a168", "value": 1690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948416, "uuid": "0be13249-9ed7-4010-94cc-dab64429faff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948416, "uuid": "27e1fb34-dc58-424f-920e-9a113d029cce", "value": "947163c78c34b0b298e643d1a2f5839d96e7e6c68795c9730c39eba30a16791e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97f2e44-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948305, "uuid": "649fae3e-246d-46d3-8e52-4c1ddd9104ee", "comment": "Malware payload", "value": "fce8531aff70673d987d0d6765a72484", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948305, "uuid": "7ef3b7a2-febb-4eda-a6a9-fe9afe5cffd1", "comment": "Malware payload", "value": "947f23226f0c2dfcbef1f9aa5ce6518f9c23f89dd715eba260bdd972778ca73a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948305, "uuid": "8dc66a7c-fccf-4669-927f-a4db2a3c0843", "comment": "Malware payload", "value": "90b5a2cbc29f797bbe6c992f8d993ab337f1db89", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948305, "uuid": "4819cca6-373f-4246-8fa3-1f3260ee8191", "comment": "Malware payload", "value": "b4a87cb0b315267f54450444b180f84f19e7de2b3274c3b83bda3e68a5c49642516e936d699a7e1c1e7d3b731d1b0e28", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948305, "uuid": "95c63e05-d44a-444f-a922-1766906653d9", "value": "T10992A53AAF61DCB00954473DF6EE542D5FDC044B0CB645A8B00EDAAD8F6DC5DA98838A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948305, "uuid": "314f877f-b7e3-4ae2-8676-235cb7fad69e", "value": "384:fGosGrHFHsv1TDKzHwMH9OHMhH75UbGcjpp:f3Sv1TDKrwc9eMJ75Ubjpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948305, "uuid": "b375e10b-5b66-46da-a962-f44cdbf88295", "value": 19579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948305, "uuid": "a540cf19-9731-4bd5-9999-1e4d0d210f3f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948305, "uuid": "bbf6590c-dd6b-42cc-869a-d83f87167c38", "value": "947f23226f0c2dfcbef1f9aa5ce6518f9c23f89dd715eba260bdd972778ca73a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726e0587-0519-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1657984237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657984237, "uuid": "956a139b-4094-4ebd-9ed3-3c99249246cd", "comment": "Malware payload (njrat)", "value": "b2728357f5d7ba3200a775a08b126b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657984237, "uuid": "5794fb4c-29fa-4dd3-815d-634e88a56783", "comment": "Malware payload (njrat)", "value": "94b8ca0be2b96d06f84a91e380f181d35fe745fd897307809e2ef9071d0366a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657984237, "uuid": "9d680aaa-39cb-46f6-8632-6e341b22b3cc", "comment": "Malware payload (njrat)", "value": "fd06a051db26088fe0ab9f6fa9072d6d89d497b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657984237, "uuid": "5d468d1e-9fb4-4077-ae0a-dc0d4a991c96", "comment": "Malware payload (njrat)", "value": "da6c7afc5bce542783164c3d0e7a49ee7f0c02f5e9d2eb288292f7963f5d977320267089807c5d15e00c9c23f20ee75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657984237, "uuid": "b5831108-2bf4-474c-9def-a3ec9e94a954", "value": "T14AE207467BF94215D6BC1AF88CB313214772E3838532EB6F9CDC98CA4B676D04245EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657984237, "uuid": "36432c62-8be5-4aa7-9205-c515833403b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657984237, "uuid": "88ef048e-3b5c-477e-8117-4c3db1af6dcb", "value": "384:w0bUe5XB4e0XjODzw0Q0mS03AWTxtTUFQqzFpObbV:1T9Bu6Y55dXbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657984237, "uuid": "d9ab0a5e-805f-4da0-97ca-85217e94097c", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657984237, "uuid": "fe4898dc-0b0e-4ae6-8f35-933d32dcebfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657984237, "uuid": "f39a5b12-cb7a-4f27-97e9-87b0d10c298e", "value": "b2728357f5d7ba3200a775a08b126b66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8bbfe6-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948795, "uuid": "bf3e00e3-be6a-49b2-9be6-04786d6e12b1", "comment": "Malware payload", "value": "f0f5c87973fa8508735264b2d3bcac37", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948795, "uuid": "a9a3b637-4f8d-4393-9587-78c7103bc40d", "comment": "Malware payload", "value": "94fb1472edeb0cdab3f11f27dbc3a166e0bb3524c04f8d3ff4e7d62570a093b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948795, "uuid": "83d30f28-88ec-4417-9c7c-e2dead7a0aa1", "comment": "Malware payload", "value": "001273c7794219298c4a3ab2d041bd02369d4580", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948795, "uuid": "9b806547-010d-4023-bf8e-ca287c906eb6", "comment": "Malware payload", "value": "e5933bc0a3560c196878536c4c5b9b730bb3a4a589b1e51c0102d51df79fc769b140e7064fc3d70fabe5de7c3ca6dbff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948795, "uuid": "2f0e0381-0e0d-446d-9dbf-04516046e76b", "value": "T161A1F750112C1AB07246697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948795, "uuid": "e75c3578-cf6a-456d-b47e-92a57d4d5ab2", "value": "96:FRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:FRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948795, "uuid": "b7372ea9-98f4-4353-89e9-b462c90c66e4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948795, "uuid": "3dc08b89-b4b2-4b3a-8e93-97bd3d2abeec", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948795, "uuid": "37e1c2d3-7b7e-4402-bf0a-d4316c0b91d8", "value": "94fb1472edeb0cdab3f11f27dbc3a166e0bb3524c04f8d3ff4e7d62570a093b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6e1c3a-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948447, "uuid": "a23ac3ad-3c0d-4d45-bc9f-9477a3a08466", "comment": "Malware payload", "value": "93ca0f12892cb39f14e5fe5b9161fc54", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948447, "uuid": "217d27e9-fc30-42de-9676-cc45f3ea7bcb", "comment": "Malware payload", "value": "950e99e3324b08e4436bb2d12b58d758fdefe14f1b4be39dfa4bc1427f9584a6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948447, "uuid": "99ac6e6b-44af-49e7-a0f9-0a5702650ad3", "comment": "Malware payload", "value": "b50ee6df794790b900726a04a2f1d506764183f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948447, "uuid": "70c6e95f-5b4d-4d08-b69b-40cbcfb5fc81", "comment": "Malware payload", "value": "435af7e2381c284b187c508dd97f1be742fba6f654b1fef47d837d6c7e38cd21a984de6fc96a0a0c26da3d1d3163bcd4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948447, "uuid": "fbb46508-9b8b-4248-b18c-6f4ff7f067aa", "value": "T182A1F850112C1AB07346597AD26FFA52B80EC81B0A777B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948447, "uuid": "fefba755-8e08-4d71-8f2f-2b4fd45cc226", "value": "96:URYZxQOBpLyxIcymLKY8M991wuIaQPYPW:URJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948447, "uuid": "8c9cb079-4ba8-462c-bfa0-530c83a6d023", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948447, "uuid": "be1538b5-1348-49b7-ab34-cc7cec816048", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948447, "uuid": "abd24170-bb16-4943-8f63-656af6e9ed49", "value": "950e99e3324b08e4436bb2d12b58d758fdefe14f1b4be39dfa4bc1427f9584a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6c68cf-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947850, "uuid": "12d007bd-01de-4232-b5eb-91a9b8b4ccfc", "comment": "Malware payload", "value": "04e308c01d3928d9db5bff4e6908fe3a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947850, "uuid": "d61d9bea-d0a6-4c28-ba3d-b339a24b1c18", "comment": "Malware payload", "value": "9646ec7df450cf35e898623f8eb1dd3fe66569730156d0bb055d04ebb5272afc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947850, "uuid": "db6f10d5-5598-4abb-aa69-a013b7675c87", "comment": "Malware payload", "value": "f6b1ea587fd0004c4a57782a87123b6b1b5e2772", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947850, "uuid": "c3b1320b-0f50-478a-b786-2f02e57f429f", "comment": "Malware payload", "value": "b095e365280bca91b4ec252a08febf47763a5b33b6110da017b99333fcfa9a79a68e5afac5fcc465c0240ab8abc58dbb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947850, "uuid": "a6296cf6-9a65-4a6b-b649-6482ca17ce57", "value": "T1F5A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947850, "uuid": "a40fef20-5310-4e94-a14b-5ca9530db4bb", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947850, "uuid": "e3e25808-0c3a-4c0c-b47c-db18ae74557a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947850, "uuid": "48fbc17b-8efb-4856-8f3f-a18bb242ddca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947850, "uuid": "f7575a86-5855-4476-8d5f-3bdb7cffe5d5", "value": "9646ec7df450cf35e898623f8eb1dd3fe66569730156d0bb055d04ebb5272afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462a181d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948085, "uuid": "b1a5b671-a9f6-46d5-bff9-d6620eaecc94", "comment": "Malware payload", "value": "d58d365a7baecae8f16373c06c685cf9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948085, "uuid": "22fbd0a9-921b-4310-87f6-605e598e2545", "comment": "Malware payload", "value": "969d7b910afb563dbe2ba5901241f0cb3997a4494ad34cb58ccb599b4bb4d1a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948085, "uuid": "0d0a7673-74b6-464b-9304-ae9dca9abe86", "comment": "Malware payload", "value": "5612775b2c0498f2d57f698c2d1876272a9e112c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948085, "uuid": "38401123-e33c-4390-a7c4-6743967866d1", "comment": "Malware payload", "value": "472e040b9ea8ece3cc27cb88e57e87ba4fc177d056e90ddea1a7010f919094770c881f97c5a217d629b645f3890266f2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948085, "uuid": "65787278-6224-4b9b-91d9-874bb4677bfa", "value": "T166A1F850112C1AB17246597AD26FFA52B40EC81B09777B358433A63C74F5DB8E0796C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948085, "uuid": "2e16d3b3-faee-46c1-9579-a4e6661fffdd", "value": "96:kRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:kRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948085, "uuid": "50568b8f-3470-458d-ae9e-74a7eb9740f9", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948085, "uuid": "04f03f32-9cce-4710-a8be-86dd440e2554", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948085, "uuid": "2ae7f96a-e233-4e74-b824-1d9d3e3918f2", "value": "969d7b910afb563dbe2ba5901241f0cb3997a4494ad34cb58ccb599b4bb4d1a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92d7f60-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948385, "uuid": "16b4276d-8e19-4080-95aa-18a71734d20f", "comment": "Malware payload", "value": "e60e7350a0e90d8a1237ff59ea835837", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948385, "uuid": "032db2e5-f158-43f2-87d5-27a7ff6ed746", "comment": "Malware payload", "value": "96ab937e45a6bc2f7013d017a5fc5f7ced0c8a1a20645e988c1aaa49835b2479", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948385, "uuid": "d6816fba-b3d6-460f-a05c-c433db719400", "comment": "Malware payload", "value": "30fe4df6eca692b920ceae1456800f9209090f18", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948385, "uuid": "071dd371-cacf-474b-904c-c8ff5a680363", "comment": "Malware payload", "value": "419ac635ae7c70a387cdfd9e288eaa513ba508133eb0d312e0414968d568803d307d22d1e8a92f0c3d8aaf36aac86e3f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948385, "uuid": "42327cef-002d-4ac8-b3c1-47db4ed2d154", "value": "T19BC53336F4BB79783641E7E14604D93A6BBAC35A3ABA37160FF4DCCD912410B726D098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948385, "uuid": "88ba083e-3e5e-4b62-a38f-01238e52e7c3", "value": "49152:ijoGN5J3sAs+aa8d6q3RKNhvqa87NXcHnSySdkOFOd+LgEBHVCjzr1o:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948385, "uuid": "97569e76-3014-46ab-a5c2-3edd899bcd7a", "value": 2625536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948385, "uuid": "210f0d30-fac8-40c5-bee8-99eaed89ac12", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948385, "uuid": "d2e7c0e6-5ae9-41d7-9356-ee75a6e7765a", "value": "96ab937e45a6bc2f7013d017a5fc5f7ced0c8a1a20645e988c1aaa49835b2479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ced43c8-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947989, "uuid": "e22357a5-85b8-4ba8-afaa-3642ac450e12", "comment": "Malware payload", "value": "d0f6ab4153f32df25c8a35f7cb0fc78b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947989, "uuid": "cefda4c2-6c00-40bb-b074-5e0a4075ae53", "comment": "Malware payload", "value": "97ce07923d2cac91f55d4d053e66b4ad61362e0cd1cee75c992e3f13d5f1177b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947989, "uuid": "d9b1a088-99d5-40b4-a2d6-c47583f64e5a", "comment": "Malware payload", "value": "8aeba33a3fe07e447e0481cdbcdfca144459a160", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947989, "uuid": "43ec01f1-2948-4e63-bad8-0e5036e0d901", "comment": "Malware payload", "value": "ee38195a0ff6181244e4d639618da475618e5f35c0cefac1cef949bc7c69cba0f4db29c5db55b572bf703e8e345f9b72", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947989, "uuid": "e3c4b627-6d4c-41f4-8056-2e4ac71c163e", "value": "T122A1E850112C1AB17246597AD26FFA52B50ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947989, "uuid": "6d52196c-7baf-408a-93ed-1355b981c0e6", "value": "96:MRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:MRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947989, "uuid": "6505339f-82af-465d-8168-84eff798bd9c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947989, "uuid": "bae2acf7-a452-4dc9-be37-602ec57e15f3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947989, "uuid": "725bb4d6-538d-4577-bd11-464d7886a946", "value": "97ce07923d2cac91f55d4d053e66b4ad61362e0cd1cee75c992e3f13d5f1177b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7136bc29-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948586, "uuid": "9cf59c43-1771-4dbd-ad13-055011d4c82f", "comment": "Malware payload", "value": "a34100583600153638b2973f498f59ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948586, "uuid": "72bf5fb3-1539-406c-a51a-de73d8e711b0", "comment": "Malware payload", "value": "9837cb60a0dbb93418bf8fff913df8aa59f85caaa77a31a095d6920555c4c3b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948586, "uuid": "fd44eee5-a3d3-41b4-ad15-6f0d9ea8d921", "comment": "Malware payload", "value": "b24603f5627316387a64841aedc38efbd21b30ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948586, "uuid": "8592205e-d9d7-47e9-bf3c-a19a9c672fc4", "comment": "Malware payload", "value": "ad134f91c647951700fb505b7acecf3c264546726c546b92a62def22c1afadfe7a33c7838e46765202d1b947b147cce9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948586, "uuid": "505b8a21-6132-417e-81a1-945c3593a72a", "value": "T15DA1E850112C1AB17246597AD26FFB52B50EC81B097B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948586, "uuid": "db4900c5-05da-4221-bb8d-6dbb271efaa5", "value": "96:1RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:1RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948586, "uuid": "04e36e77-5150-4601-906e-bf33021f8c45", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948586, "uuid": "ca52c45a-1005-4dfe-852e-344548420586", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948586, "uuid": "632eb083-bf0d-4c56-aec4-6299b05b2e8f", "value": "9837cb60a0dbb93418bf8fff913df8aa59f85caaa77a31a095d6920555c4c3b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b24aa78-04b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657942402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942402, "uuid": "6937ad83-8894-483f-9da1-9434080f6656", "comment": "Malware payload (Mirai)", "value": "e828472159e8fd63567700d0c6b47faf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942402, "uuid": "0b684d58-d0b8-4a26-aac8-49a23e4c7d22", "comment": "Malware payload (Mirai)", "value": "9875752bba6d37603c8792cfe6d9ae772bc7745b74aa0a305bf95f7e676f3447", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942402, "uuid": "854b4f3b-d154-4427-9c14-5f5fed069f63", "comment": "Malware payload (Mirai)", "value": "c08088d29f5bbe5662b40edfef6d6430ba92d14c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942402, "uuid": "05be6903-6365-48cd-a1e6-bfd84cf5347b", "comment": "Malware payload (Mirai)", "value": "4314fe5f9bd5ab02f59ca1f1d252b89e3408520fb7bf0410504e98144ed3bd4b1be8f98b5c4ab69e7f01692a9349db7d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942402, "uuid": "3e3c591f-8be5-45db-a2dc-d80912b6326c", "value": "T18263935D6E31AFBEFBAC86394BB74E20925923D623E0C580D15CED014E7038E645FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942402, "uuid": "b4e2b820-a81e-49ce-802a-d0b44c343623", "value": "1536:jBcxPy9z5wjSagVymIMEXgYOYKRNIqtai/Rl3ZcwT1:jBKQamagVuXgvYKz3aS7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657942402, "uuid": "936c4681-1109-4204-acf5-f97c811b725c", "value": 71936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657942402, "uuid": "a47fb4f1-70e1-4458-a2a0-ae17a062f5e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942402, "uuid": "e5bb9d3c-b19f-4741-8485-12ce9511b19a", "value": "Ares.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68b6f6c-0520-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657987438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987438, "uuid": "08f16f53-b4c0-45d1-b25f-2270bae97ea2", "comment": "Malware payload (Mirai)", "value": "1f9a6b1a316683811bb0b8b3c49a015c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987438, "uuid": "09530b58-3773-4764-a356-edbdca033911", "comment": "Malware payload (Mirai)", "value": "9981705431fee8dd0d4b7b13954678ab5c6ddab0be0354e3fd9efad03ca94720", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987438, "uuid": "b0193708-effa-4e31-aec7-9de9ce872776", "comment": "Malware payload (Mirai)", "value": "8d80831d4c8291f90d71f713d927ea3fe4d19210", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987438, "uuid": "ab6ae8aa-7c5b-4f8f-9f7f-a733bdefe14c", "comment": "Malware payload (Mirai)", "value": "a9dd97c37593aebdbdd6daaed502273a97fc48b0cea16ae5d0f89dd346a237f95584922270e7d781d115da425c1db967", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987438, "uuid": "4d376bd7-aefc-4b54-8de5-26c5926b46ca", "value": "T1F4A2D01472632D65F2ED1C3DC96A836BF9670BFC90F5327569415620C94D20A3E39A8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987438, "uuid": "0acc2081-778e-4245-856d-205cb091717e", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjqshymdGUop5hy:UvQn4j+ZO5fKAlxLs3Uozk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657987438, "uuid": "e96b082e-2517-4088-b1aa-7f10d73f99db", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657987438, "uuid": "8053e123-f99c-4f05-84cb-662bb5c0908a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987438, "uuid": "4b507d54-c444-447c-8831-9b86d2ba5e66", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8987f8c9-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948627, "uuid": "93f5e4e4-d2d1-45b3-9d59-f316148d90e1", "comment": "Malware payload", "value": "62de2df3895964e78cd860d6f2c62154", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948627, "uuid": "a262c523-61fe-4d57-9554-74726ff9c7bf", "comment": "Malware payload", "value": "99d74ccd6102a472dc462605149175bc2d614e03dc9eaa803893bf87fc21ec76", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948627, "uuid": "67a41e93-8b2e-4aea-b49a-5a3a1ffd12f5", "comment": "Malware payload", "value": "27b9fceac61eb21d1b7bf3d564087eded395ff96", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948627, "uuid": "73132bc7-d2ca-4e00-b6de-e94ad1176fe6", "comment": "Malware payload", "value": "cad8a0069789b2ff54ffd9f99ed4f9c1dbde8220157279527a60fcfd32c9d071cf6462af9721955caa8b3fa76e91aa7f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948627, "uuid": "3d440de2-ec43-4464-b248-39e4cc61c613", "value": "T192A1E850112C1AB17246597AD26FFA52B50ECC1B09777B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948627, "uuid": "a03cf3d1-bc8d-4630-8a61-7f9b7d06c65a", "value": "96:lRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:lRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948627, "uuid": "26d2a995-5cfe-495e-aa12-21025e035947", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948627, "uuid": "c4d0e69b-1932-409d-b55f-68103884fb62", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948627, "uuid": "69ee6b91-3586-4ad2-bb2e-2161225f5832", "value": "99d74ccd6102a472dc462605149175bc2d614e03dc9eaa803893bf87fc21ec76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4201a3b5-04c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657947219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947219, "uuid": "53d4b89c-d733-4c82-b856-b76bcb8def1a", "comment": "Malware payload (Mirai)", "value": "8d7710e9a307b5c42f501f6d8f9416b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947219, "uuid": "462c3ddf-3e00-457a-bfbf-bf68c41a0537", "comment": "Malware payload (Mirai)", "value": "99f8cd25df888a0e45b2c92fd6fcac32ccbbf359b05fba5c63a892583fee4184", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947219, "uuid": "ad0cf70f-ba81-4ccd-aa07-d659dafd5d84", "comment": "Malware payload (Mirai)", "value": "55d12f286855a00c8080de864f69a1596eb10437", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947219, "uuid": "47551af0-893e-46cc-873e-79a4de622cb7", "comment": "Malware payload (Mirai)", "value": "bf093b24674ec9f927b814abca73b5fe3f1f1ee6a302ffcd5dbf8987be448f506cfac90b3755bc92d185198af1a68f6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947219, "uuid": "b2086396-8fff-4949-9847-afdd907e44c6", "value": "T14863825D7E615FADFBAD823447B34E20964823E523D1C684D2ACE6011E7024F746FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947219, "uuid": "eff22ee5-7bd5-494f-a97b-2f48b95f0b16", "value": "1536:JimtjG1RPS7lxHXIHXOMHXRFglOPa+DzHBOF4cBV3P8mHa10ge:MSjG1RPKd4DzHBOicBV3EmG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947219, "uuid": "ebba971c-8fbe-4049-a3cd-c41b3e62abba", "value": 72772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947219, "uuid": "6ca06880-f4f4-4ed9-9070-153d3f7735f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947219, "uuid": "46f0edb8-b7e3-4ab1-a91b-9e2ca94b0dc8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5338c7-0555-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010026, "uuid": "be4c5328-219f-40b6-9e75-acaa2e6395b7", "comment": "Malware payload (Mirai)", "value": "947fc755a35d8e60173d483ed1500bdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010026, "uuid": "9d4e5707-60d6-44d3-92e3-c69bc5de59cf", "comment": "Malware payload (Mirai)", "value": "9a6baea242ab50e798d0c5041872b6eee059a3e24f055190f8283f3324d7f928", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010026, "uuid": "15e0c2c9-ade7-440a-b16b-d52af843b801", "comment": "Malware payload (Mirai)", "value": "2463b2d9fd789ee827bb0fd139d46b4f282a91f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010026, "uuid": "22820425-3442-4c5c-abab-3e62498da27e", "comment": "Malware payload (Mirai)", "value": "f59d3a72ce327cad44d49a45f12dd6ba15dfadb1c9914b18a01f72d545f0e01425cc9def858910dfd73de7de9697a4d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010026, "uuid": "2499f98d-4609-4fb4-98ea-c08395dd2d20", "value": "T17B43199ABCD1CA02C9C423BBFA2E419D37252398E1EE72139D112F1177CA91F0D77696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010026, "uuid": "20c3367f-953d-4bd2-9742-0ed103f71964", "value": "768:L0g0PggvbaH7z9W2f1UFXLbwZramaPbHU4At06TJP+c2NOUczoETIhDt5hDEm2tW:Yg0XbY7z4BLbLm0bHUR0kJB2N7/RD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010026, "uuid": "32cba170-41f1-4bc2-a232-af03373ac8b1", "value": 60220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010026, "uuid": "8c60cb60-8d38-4095-b597-c6c995480102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010026, "uuid": "d61ff8f6-e059-4350-8c0e-1606151a1ea9", "value": "947fc755a35d8e60173d483ed1500bdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424390a2-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948078, "uuid": "16d9fada-a49e-4413-ae70-54458065a781", "comment": "Malware payload", "value": "9d156f7b94f4fbc8a2893def0e45bea1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948078, "uuid": "34c94f41-894e-4eb5-8342-31c4ec3abe6a", "comment": "Malware payload", "value": "9aa696965ef500e55f2cfc97dc0399b9edfca69049a48598b0ca00fc401aa810", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948078, "uuid": "b84f533b-4057-44a7-927d-9215a30ff691", "comment": "Malware payload", "value": "90751d5d5328bf4aa6c1f926efa2d1787205b01b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948078, "uuid": "1b77deaf-ffb0-4f48-9df3-6fe153225511", "comment": "Malware payload", "value": "d1615afb94e08945e288a7fb201fb1b54b736600cfcf3af6bdff32f4af5e8470f45e7d8f61e9e39069c449c2e6d8e95d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948078, "uuid": "c5f9a783-6afc-4ec1-9d62-9328d8af76c8", "value": "T174513EC0297124703CBBADA7737AEA4137C298A4BCD26D4DD5E4B8B44DEED4522841FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948078, "uuid": "bc7042c5-190b-4b73-83a3-52f6de072430", "value": "24:IjLFsg0qg/hRQNzupnHta7Zodzt6BBNk0PncqBs1Qs+1L4T4JM4v:SFs9aFoANfR3pSPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948078, "uuid": "37951fb8-d433-4a27-839a-b51f6aaf111a", "value": 2464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948078, "uuid": "a507c010-aa13-459a-9252-d172acf98aa7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948078, "uuid": "fc5f6e35-896e-4cc6-b2a4-8c577a5a12df", "value": "9aa696965ef500e55f2cfc97dc0399b9edfca69049a48598b0ca00fc401aa810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82f7dc4-04d3-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657954289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954289, "uuid": "01f0f7c8-96dd-44fc-bc2a-a92de32c6335", "comment": "Malware payload", "value": "4efa6434b051657a7fda13502ff41ff7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954289, "uuid": "6142f2ea-80b0-4e4b-894e-db86e2fdd900", "comment": "Malware payload", "value": "9b840af943adcc49d4f8cfa535551c2e69957e5278221f9c5284384d4274f361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954289, "uuid": "e48b973b-322a-4d2f-a1d2-0759ffdfe6b1", "comment": "Malware payload", "value": "b1daf8484da18156864c7f88f96e1669dbaa6da5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954289, "uuid": "7690d9f5-b185-417f-ab87-06c5265565a1", "comment": "Malware payload", "value": "46154a5c88976366c223a0e778500a8132effd2a942cc8b4dc2615a9629f93d31ecc0e4fa7609a6cd45d483d2d8e684e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954289, "uuid": "22e89932-733e-43ae-9b45-fc315b864278", "value": "T1EE66336332455080E5E5C93A853FFD98B3FB5E6E8B40AC7D74E279C229279E2C217943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954289, "uuid": "1618512b-e2e6-4789-86b5-bac87935cf97", "value": "d812527b5988192695ea156eae610de1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954289, "uuid": "19a5d225-1f94-4cc9-be4f-79fdf03dd8fb", "value": "98304:Ey7itnRugUQubFMKoIaN9XLFKgrYXrGmOgYu6ITC5a251FrJwNJimB:J7im7zBaNdFK3XrGPgv6ITP2npmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657954289, "uuid": "4a109800-9eb3-4ee8-b8a4-9bd2b53f0647", "value": 7081984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657954289, "uuid": "d2db8726-c0df-4dff-953c-bb12fa1d6033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954289, "uuid": "b79afd65-1936-4d2c-89bf-3feff002959c", "value": "4efa6434b051657a7fda13502ff41ff7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0196ab-04d3-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1657954272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954272, "uuid": "81574c58-67bd-476b-861f-821c68902479", "comment": "Malware payload (SnakeKeylogger)", "value": "747c5eaf9e167ceb56ab6ffd43fdcddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954272, "uuid": "cb5ffc0b-b607-49af-a2b4-3567e48ba5ca", "comment": "Malware payload (SnakeKeylogger)", "value": "9c069b3043b757ab5e67889b9f2820758ddb92823bf91678182d6386a16fd5ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954272, "uuid": "72cd946f-1c01-4cc8-8ca0-d061e667ba99", "comment": "Malware payload (SnakeKeylogger)", "value": "a3a7e37c2a7d81da48156d2d997faef742fb489b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954272, "uuid": "15ddc96c-9080-4b3d-a0f3-0caccde51df8", "comment": "Malware payload (SnakeKeylogger)", "value": "c932f03f3cd350e74ac791b85a42562460edbf28c2bcb36af532b97b4d89d432e4bd884c5eb723c0d667c12df220dbeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954272, "uuid": "ae371a04-2d8e-40ce-b0fa-b760c12d4d5d", "value": "T18FE2C4C1EA54D675E4ABDA31547A4F040672AD53E8B35E0DA8F2B4440EF3210D92B9BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954272, "uuid": "a737f4ea-cd9a-49fa-a50e-b9132181e364", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954272, "uuid": "ac19d13f-d0bc-4aef-b90d-5a6b4f7acb42", "value": "384:RbZ5n6TAfO7kfxKXNR1bHeJhs+nXBjxJd5IyYQGSbdkDzkoebjDTSAWMjCW:Bf6n40bS/ln5IyYpamDzobj/SC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657954272, "uuid": "375f6c9d-fa97-4902-a095-41d98662280c", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657954272, "uuid": "9c76274f-ea90-475c-9a8e-09e0a06952dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954272, "uuid": "00b893b2-c4f7-4c47-a4da-24ee2f1d65c0", "value": "ertac.alpdogan_220715-143038-ba pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517cb976-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948533, "uuid": "84709381-f2b6-4969-984b-97e76f222c55", "comment": "Malware payload", "value": "d6a76de21010f9e92db4f093e080fc98", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948533, "uuid": "6593134e-4e1a-452c-906a-a7983c7d3241", "comment": "Malware payload", "value": "9c09d288e22850a8768f7324610f55f16d0ee2bfe889bb0810faf066235ba7bc", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948533, "uuid": "2e6d57eb-9970-4d1a-87a1-46c4176c1d9b", "comment": "Malware payload", "value": "65e70963dbe8b35aac74615fe49acaa9f71429e1", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948533, "uuid": "0473a6e1-0d8d-4ea4-9734-a695e9461ec1", "comment": "Malware payload", "value": "59683b7b6bd4c9f8b4584fda0ae19bae91d41728689a1d000ed5ebe8215e0ae7b01dbf0d8ade6836552e1cd871670a43", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948533, "uuid": "ca5de9d6-4744-42ca-af6f-2e8ac3d879fc", "value": "T10BC533318E3BF5D7807E0919655253B39AB1FDEC1819F404F3B99ACC25CA8F5A0C6E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948533, "uuid": "a8c92655-9b4c-47a7-90e6-bc9c0e1f6508", "value": "49152:DJMych6OZaIU6M9yZ29jsE4dKi4qi7/RhQrM+mvsx562dQ10LIKR7aL4gxQzg+p:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948533, "uuid": "56a64f46-3141-45df-a9c0-126035f4a08e", "value": 2613248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948533, "uuid": "d5fedbcf-78df-42bf-8c38-556d814e21e0", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948533, "uuid": "299876db-5305-4606-9aca-9e03e5f7f359", "value": "9c09d288e22850a8768f7324610f55f16d0ee2bfe889bb0810faf066235ba7bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5fdc7f-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948796, "uuid": "1d7e61c7-40b1-4ea2-8f63-8a87bcf566b0", "comment": "Malware payload", "value": "84dcf62e1ad1d268c1fdd572cb07cfb5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948796, "uuid": "95c5d322-c042-44ce-9592-8c2fb7c1b511", "comment": "Malware payload", "value": "9c1093a751f7e7a7615c6ab4d41dee09de1127c52e40ac2542de2139f202da28", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948796, "uuid": "f89ec32b-323b-4b47-a66f-572530a35dba", "comment": "Malware payload", "value": "9ead2bf84978bc04a8bf3934698790d1e4a258c1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948796, "uuid": "424f6589-bb2d-4256-8a8a-3d4eea816471", "comment": "Malware payload", "value": "0f60e5f7eda6ba511f3df55b0d0c1db8cb4978e802d9ef6399712ad277193c98fcb8aa327f11e2fb2e3e8d3e927decef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948796, "uuid": "0c7518d4-016d-41d8-a52f-85181a93ac1b", "value": "T186A1E850112C1AB17346597AD26FFA52B50EC81B09777B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948796, "uuid": "ba2ff521-28f8-43ad-bd73-1f9dcfa245e2", "value": "96:WRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:WRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948796, "uuid": "3ee94a20-2816-4b14-bbae-6a91c2f47791", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948796, "uuid": "f93d8650-f4d7-4af0-bc00-b4d412e2f891", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948796, "uuid": "194ef31e-c0bc-4ef8-8119-98571a035fba", "value": "9c1093a751f7e7a7615c6ab4d41dee09de1127c52e40ac2542de2139f202da28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85480011-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948190, "uuid": "5bcae200-534f-40c3-bcf1-7352bbad2bc6", "comment": "Malware payload", "value": "a45143bdd165ebbf06fcf82616938892", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948190, "uuid": "3d65796d-052b-47f5-971b-73b2da43ec65", "comment": "Malware payload", "value": "9c1adbf830f15adb7b543fdf045cec82b4dc28486d824311fbde696df6c0476e", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948190, "uuid": "7dfdbbf1-5b3f-467a-a6af-a9ab59ad4e52", "comment": "Malware payload", "value": "e16eac5c1e63181a06f9d38685005734b7a2a76c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948190, "uuid": "d96486ab-4faa-44d6-a09c-f615242c196e", "comment": "Malware payload", "value": "89b8afbf9df7296c7bfd5c2d25e259f0c751468fa9a6dd85481472d50cbce0adf0fbb1ad639919a786c6e46bed30fa71", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948190, "uuid": "30750b6f-03fe-4426-a3f9-772609a17d49", "value": "T15D253334A6EE7A2425057EE9C941C47996A7C40FA9EE7F237FFCAC8751158353A7800C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948190, "uuid": "85856890-5e74-48e9-8238-6a8258e716da", "value": "24576:ijoGN535ifFGsAs+anNUXend6q3RKNySYmfk5NSJdz7f:ijoGN5J3sAs+aa8d6q3RKNhvqaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948190, "uuid": "1caa9ae1-0410-42e0-bdf5-8b897be9330a", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948190, "uuid": "26faa374-715e-4ba4-b522-f82e5c7b3c49", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948190, "uuid": "bcdb6325-0ed8-499e-b2f1-271b16ef2b07", "value": "9c1adbf830f15adb7b543fdf045cec82b4dc28486d824311fbde696df6c0476e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ec5ed7-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948675, "uuid": "b416f842-17c7-49b5-87d6-bec4a4fc1cde", "comment": "Malware payload (Panchan)", "value": "32d59ae4fa92bd94609bad5da8b47a72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948675, "uuid": "c50a9a54-41a1-4c4c-afae-55f9f1fc7108", "comment": "Malware payload (Panchan)", "value": "9c5d46cb9f651c7467fb0b7b4df0ca1e9ed850042df0ce7bc673c305a0d85cae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948675, "uuid": "3a446815-926f-4b76-8f25-05efe3f36d4b", "comment": "Malware payload (Panchan)", "value": "70aeba7fcc8094da10a4cc0bb86a704ed1170146", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948675, "uuid": "a4c9b698-3b1c-4e8e-9532-4d360912b64b", "comment": "Malware payload (Panchan)", "value": "0865845f1061c03f5b78868e6fc29599864fcd068f038ceb5e86abcb2b4af780c8ed4bc9692557acb8b35c08f467829f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948675, "uuid": "1eec66a2-21b7-4b11-8d96-30e2393f220b", "value": "T14DE68C77910238E9E5A98CB4D11425426DAC38875738A3C7BAC871F667FA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948675, "uuid": "71e819dc-338a-45be-983f-5d6bae9af166", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnar:sXyWSpV+Wu7rI3JER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948675, "uuid": "42c44734-c4dd-4cd7-b9c8-be2c68d0d33e", "value": 14221312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948675, "uuid": "7f9e5b2d-82d0-4a43-af5f-399e80297efe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948675, "uuid": "1df8a3a4-6e84-4ad4-baa5-17e848779688", "value": "9c5d46cb9f651c7467fb0b7b4df0ca1e9ed850042df0ce7bc673c305a0d85cae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015fe18c-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947969, "uuid": "f5c0737b-1030-4923-b26d-4c12bc2c1b2e", "comment": "Malware payload", "value": "df6a4387d0adba07270479f7d71a2e1a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947969, "uuid": "5d228244-839c-4922-8170-c8e0c125f82c", "comment": "Malware payload", "value": "9cf70f2f0521739c5412c7f18386b5f796f1771c6f6c579a4fa23608c442b2ab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947969, "uuid": "721bddd6-a7a6-4678-84c9-10ec63748d6c", "comment": "Malware payload", "value": "f46f4075704181b7470c4eb1a36789f284553ff3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947969, "uuid": "95cb420b-1304-4bb9-9006-cf452d8d1f2d", "comment": "Malware payload", "value": "740e2ae6cb68f4db1253389fd2640d57ec76025c03a44fb883bf0e846a9b79a9ea119d2831ad78d12982cbddb58a1c08", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947969, "uuid": "4a21bdc5-f298-4f70-8d3b-45c1595b7225", "value": "T117A1F750112C1AB07246697AD26FFB52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947969, "uuid": "620e2db9-328b-4479-b63a-20b814e4cbd1", "value": "96:aRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:aRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947969, "uuid": "3a9da42c-c74b-47a7-9117-d966a5c19dec", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947969, "uuid": "ff902afb-9ff2-4846-a575-5d34dfa6b1fb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947969, "uuid": "b6862a2b-cab3-432f-b369-1500d8abadcb", "value": "9cf70f2f0521739c5412c7f18386b5f796f1771c6f6c579a4fa23608c442b2ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b359af35-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947838, "uuid": "8cb5ad39-2c5e-4333-8370-034bfa608bc8", "comment": "Malware payload", "value": "a0f5782c51360b1e7348f66c36997c6c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947838, "uuid": "a66eef64-b837-4d7b-b81f-b38c75de68d8", "comment": "Malware payload", "value": "9d508638a232eb164a4e68815f33ee47b1564e63106675542b503d39c441f59f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947838, "uuid": "2fdc7152-f7ba-4f68-b7c6-425873753739", "comment": "Malware payload", "value": "c38ce5e2572a97b9e30b4511fe82a9d475e4b77d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947838, "uuid": "c32e1ea4-9c25-4043-9a64-6b3903849fe6", "comment": "Malware payload", "value": "ef9dbcb799b347c1088116bb5cb77029cd54b7480a553b16ef76190c1ae6556b3a5346e3160808123cdda7fcdd0ad6df", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947838, "uuid": "ac8ddaf2-0f48-42f0-90c1-155429d5c553", "value": "T1F6A1E650112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947838, "uuid": "c33a96d5-c658-41aa-bfae-73ad1922bf56", "value": "96:ARYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ARJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947838, "uuid": "e1115310-8e2d-4c2c-9a78-a631de096706", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947838, "uuid": "7178ba13-5922-4b44-a498-0cefe5e9161e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947838, "uuid": "8da2c454-d9d8-4d54-81c8-b8337a1f2c43", "value": "9d508638a232eb164a4e68815f33ee47b1564e63106675542b503d39c441f59f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08668775-054b-11ed-93bb-42010a9c0043", "comment": "Malware payload (DanaBot)", "timestamp": 1658005533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658005533, "uuid": "5af488e9-0c50-486c-92a7-54c5eba878af", "comment": "Malware payload (DanaBot)", "value": "5c0be4a5273dec6b3ebb180a90f337f2", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658005533, "uuid": "c87fbb39-8116-40f7-9cf1-a8e92dce4f20", "comment": "Malware payload (DanaBot)", "value": "9d68e9449bcf593abfd4562466a7cc2d35b1c33868e3bcf0e47bda4d9fc78403", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658005533, "uuid": "6c74d9e5-66d5-425c-98e9-f4130240d588", "comment": "Malware payload (DanaBot)", "value": "3a82216a89310aa7b4cee1e58a3af7e16c0cce19", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658005533, "uuid": "aa57a65e-e791-4627-8c46-8f2b20472348", "comment": "Malware payload (DanaBot)", "value": "7f593864c890e1f580af1df8c9c087c3c39c6b5cf2edbdb68d73984497ddf87b56cd0c18f1442c8b8ab66663d3138d30", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658005533, "uuid": "7f66c5c1-9757-47a2-a71b-5f12e33ae579", "value": "T18C5633186521C0B2D15799701635C3F29E5B39A64F49ADDB3F486F7B8EAA3C0423A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658005533, "uuid": "704ae10c-dfc5-43b3-ba7e-58299ce3c393", "value": "db02dfb25ff995ca2ccf9caf737ffcc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658005533, "uuid": "1c03ac0c-cedc-4b93-804d-db61a653c074", "value": "98304:eBjMi36z9cT7q3gW4Rvv9Fb+syu2d3Yz1CXlfPdZK9KYLVFwUx900dqo12o:KBKziT7q3/4Bb+sLW2CXlfS1J1jDqk2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658005533, "uuid": "f0798170-7735-4b0c-94c8-4f3154792469", "value": 6244864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658005533, "uuid": "ce0821f7-7fe3-417d-897b-25e21143d5cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658005533, "uuid": "097b85c7-8ac3-4cb9-9754-08fd353ff33b", "value": "9D68E9449BCF593ABFD4562466A7CC2D35B1C33868E3B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac38cfa5-053b-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1657998936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657998936, "uuid": "1e56d716-48ce-4772-a394-6d13afefa246", "comment": "Malware payload (DCRat)", "value": "0b6ccab1726828401b15add897b4688f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657998936, "uuid": "73572ad0-c7f8-429c-bfe8-5ba43aa2c03d", "comment": "Malware payload (DCRat)", "value": "9dc675f2fafbe7d34ffa2b974cb1120ab1e26d0930fdc3e26422c32bb17cad1d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657998936, "uuid": "0c18dcb1-efd6-4d42-beaa-f07bd1ea40ec", "comment": "Malware payload (DCRat)", "value": "d35057f19a2f5fbc4703ad8a87356025108f5b12", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657998936, "uuid": "2abc7919-e406-4314-8cee-6a5c7e165054", "comment": "Malware payload (DCRat)", "value": "6e9a3d1bc6044d8f67590cebb5ed61dbd2dd4be3b867bb2fed0960f1322fac1e2880760874d0b2ef6bca6e7091ed4b6e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657998936, "uuid": "b2fb34bc-4fbc-44a1-923c-601eeb651773", "value": "T1530506027E44CE12F0091273C2EF454887B0E95167A6E72B7DBA776E55123A7BC0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657998936, "uuid": "affd8885-3b75-40f5-9975-91d27d30a47c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657998936, "uuid": "b24d7a2a-f9dd-412f-b9b0-4c5230880f3e", "value": "12288:2VNB3ru1eom368wpQn/w8EF3D/3482CvN1JOd0k2/i:2B3q1Lm368EQ/wHdDQ8t1bOKk4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657998936, "uuid": "34919fa1-3ad8-45b8-9c4f-a59b947ecebd", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657998936, "uuid": "28fcd22a-f88f-4af4-8e14-01ae3c36388f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657998936, "uuid": "19c8343a-5357-4466-86ee-e3bc67896bd2", "value": "0b6ccab1726828401b15add897b4688f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f9cca2-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948380, "uuid": "0f63e439-8b6d-4444-9d55-017bdd3ada30", "comment": "Malware payload", "value": "4133cb06a9dade9182d3aaf3ab0ac3a8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948380, "uuid": "aa03f03c-5fa6-47da-b739-255b6d18409a", "comment": "Malware payload", "value": "9de3e39fd0992c81bd6cedc926b2b1d1d6bfdc2ea40101e8bb9e2c7a0dcff41a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948380, "uuid": "32d8fbe7-1676-49eb-8d10-98ac89ca63cf", "comment": "Malware payload", "value": "7eae03c6e62088f0e814c65496c2fb30dc315ce2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948380, "uuid": "7d3542c9-b5e1-4c59-bf5a-b17380a0587b", "comment": "Malware payload", "value": "038acc82379fdf1f4b4d1f34de778f0f6ad7b91fd3ce16b9b1b7d9faef9febc41ea8fbc86b3205773ce4f38c076a8dcd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948380, "uuid": "e45e965e-386b-4128-b687-170763b777d1", "value": "T1CFA1F850112C1AB07246597AD26FFB52B40EC81B09777B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948380, "uuid": "c2cef0e6-ede4-410f-889d-30e97c1717d2", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948380, "uuid": "fd9b1bd7-f772-4304-ac10-cf858ac0da0c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948380, "uuid": "0477f77a-623e-4f12-8aac-49002060f4fd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948380, "uuid": "2a5e242b-f77b-462b-8d02-20a9980a9260", "value": "9de3e39fd0992c81bd6cedc926b2b1d1d6bfdc2ea40101e8bb9e2c7a0dcff41a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874aaacb-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (Babadeda)", "timestamp": 1657971387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971387, "uuid": "6323b58c-d1ef-4bc9-b678-d60261040646", "comment": "Malware payload (Babadeda)", "value": "6cdbca5c6ce1901d7a712f0b09b4d94e", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971387, "uuid": "ac417db9-f489-4e64-90cf-363c81747bad", "comment": "Malware payload (Babadeda)", "value": "9e2374545fd02bff5d25134c71940bf423173a9bb611f54f5db6729c8407da66", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971387, "uuid": "91c3ff51-0574-404d-91b5-7840478ccbc2", "comment": "Malware payload (Babadeda)", "value": "c9f5cb5aeb67fa49071df1feab9e66c8e40bae75", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971387, "uuid": "30c08976-11c2-447e-8fd8-de701437c0ec", "comment": "Malware payload (Babadeda)", "value": "1c01b6f18ddf04ba05ccaeae5528f08462641a1b1dcda662fae9990b8923b25a11e9caa7bb625a0b224b5b13ff95019f", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971387, "uuid": "5b5fc21d-bcbe-4f2a-88df-eae5c9f5fac9", "value": "T16F937D41F3E202F7E6F2093100A6726F973663389764A8DBC74C2D529953AD1A63D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971387, "uuid": "e8b180fd-679d-442b-8bea-7fd010cd0b69", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971387, "uuid": "1f1cb55c-0a09-4c12-9d14-3b2716049252", "value": "1536:f7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfDw2AfeO2:T7DhdC6kzWypvaQ0FxyNTBfD3ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971387, "uuid": "1af128aa-0481-49cc-abd5-dd3f01db7f8a", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971387, "uuid": "42dc1be4-0eee-4115-a683-4c4e05c4145a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971387, "uuid": "e462b73a-1fb9-4f5a-b240-90010bbb7929", "value": "mac.exe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc1a40d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948364, "uuid": "d76dea26-9f5a-4631-a548-3efe8ba3dfae", "comment": "Malware payload", "value": "8b50179861507dc42f5cf7b99c6c7d2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948364, "uuid": "7de0e848-5116-44aa-a697-4b89c0f6fe7b", "comment": "Malware payload", "value": "9e7d0244885b3d2a5fde7afeab77bd22e462743909d53f96185e716e751aef19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948364, "uuid": "17f4a789-9558-4906-bc07-2e2eff5f8cbf", "comment": "Malware payload", "value": "8dca983ee7d7ef5ff01c4397717ab5942b862a45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948364, "uuid": "4244fc4a-6ac0-4780-9802-9b9a252ac0c2", "comment": "Malware payload", "value": "61d1ed0c4a85920c1d205de48cfc2f10c7d54bed5c19b6876c49bb2ce03c6bce3fa48ebf69e81e48dc45573857ff7842", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948364, "uuid": "2ffcfad5-bc71-4cbc-b509-2d829cd8604d", "value": "T15747DF73810738E9E5A98DB4D11425426DAC38875738A3C7BAC871F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948364, "uuid": "880bc7d5-3aac-4327-8b0d-33947b8b837a", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVna3:sXyWSpV+Wu7rI3JE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948364, "uuid": "756c0fef-edc2-4693-921f-dcf4bb3b265a", "value": 25919488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948364, "uuid": "b2b5ddbc-b0ef-4119-85ed-aced988deb6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948364, "uuid": "ff201985-683f-4e57-8b66-2782318b89bb", "value": "9e7d0244885b3d2a5fde7afeab77bd22e462743909d53f96185e716e751aef19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0394832-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1657948370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948370, "uuid": "f352e79a-5614-4820-87a0-6471e7ab2b5c", "comment": "Malware payload (CoinMiner)", "value": "c5dffc9ceeec9a468c1613d548be7827", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948370, "uuid": "7b1259da-42e8-459e-8d86-8ca1a0f1a5d6", "comment": "Malware payload (CoinMiner)", "value": "9f324f3a98211ed40b4261d7c5b5b1a9915696ab6b0a0eb4eb008ac96d1f91e8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948370, "uuid": "e85606c9-c41b-4dba-98da-4a59a3013c52", "comment": "Malware payload (CoinMiner)", "value": "3b36179da9f9d20879245c9ca4ac9ca49bc83569", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948370, "uuid": "a9004729-556f-4d33-8e64-66b00dbae19b", "comment": "Malware payload (CoinMiner)", "value": "b78fe09b0b8ad8d60ff0f2aba52d0283c30498f1f41a920aac9e2572f3d76d5e858d42d36306c6f185d6216fcc082d2f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948370, "uuid": "ca92a37c-97c1-43f1-a5d7-7e654dfeed43", "value": "T1C65633467322A9B38CB7530F948674AB3AB77BDC717A4C734CC1B6C30944236BB49A65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948370, "uuid": "e48278ef-b232-4049-8074-5b210ae06505", "value": "98304:q13V3a0rqRIZ+wrvNoGRtKzIVLplxsVmHOx+IK4Wpi5WVHpC/tBYVZpaLEItyfAZ:q13V3HrqR4NlEzIJprsVmHUWkQJC4Hpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948370, "uuid": "7125ab4a-3dd7-4a24-9dd5-d66e03e5b4f9", "value": 6238208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948370, "uuid": "bc1e180d-dca6-4e1e-a7d3-543291487847", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948370, "uuid": "b0e4c987-8a85-4685-8004-ab3b7600fb32", "value": "9f324f3a98211ed40b4261d7c5b5b1a9915696ab6b0a0eb4eb008ac96d1f91e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3fa540-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948227, "uuid": "0506c265-15c7-4de9-a30b-e189bb68cd39", "comment": "Malware payload", "value": "f9d88770534d9bf21408cde59f660fa4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948227, "uuid": "0ad90136-97c6-41f7-89d8-cc845ca450f8", "comment": "Malware payload", "value": "9f496ae81a5bac5825c96a1d50562048aad0f0a9d064a9358e747da63395928c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948227, "uuid": "d9ce75f0-67d3-47b6-8739-8bc103db428e", "comment": "Malware payload", "value": "e4b60aa1f3412d1625d3e714da67bbfeaca1b522", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948227, "uuid": "86bebfc1-558d-4709-8728-1456b5006fe2", "comment": "Malware payload", "value": "2e2c022665429cc7e4de729734de03085b5d678cc07e92fb51b5ee2b53add4438f2fc924bad2b68cefa070f0cc1dc5d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948227, "uuid": "a59f1a3b-b13a-4a89-b577-e9cf5d791862", "value": "T180A1F750112C1AB17246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948227, "uuid": "4bd20eb7-c85c-41bd-b4ad-749fbec59e35", "value": "96:IRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:IRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948227, "uuid": "4f86d259-6e0d-4e35-bae6-4c22862a4eab", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948227, "uuid": "059c03ce-857e-4a7c-996a-8de88ca10782", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948227, "uuid": "0ed5b79d-c5ba-4fc7-b9a2-e1f8ced636c7", "value": "9f496ae81a5bac5825c96a1d50562048aad0f0a9d064a9358e747da63395928c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58556fa9-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948545, "uuid": "c5211dbc-8806-4fa4-990f-78e2ec673a23", "comment": "Malware payload", "value": "a6671062cc391f9ea8256546faeefda1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948545, "uuid": "7be3a08e-78b2-4677-bc0c-bc18b7923d9b", "comment": "Malware payload", "value": "a10a4f3a02addd40afbedcd8cf49014764de06bcb7e02731a45f77bfc94ca38c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948545, "uuid": "19b38b93-9958-48d2-8692-b3c0e856451e", "comment": "Malware payload", "value": "d023b2c85ffff1c00f51c10b21aa8ebcaf5db15f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948545, "uuid": "e7940476-7f20-4cbb-8b68-2120201dbabc", "comment": "Malware payload", "value": "0bd6fe3ddf5f22d651dd87316f51109b310315c2cadadc55615ef38e4f77b6adbc6a7e5e487de2c134db8c535dab4a5c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948545, "uuid": "6451f6da-a9af-485b-b8de-451c02f335aa", "value": "T1B1312C95736139703EE31EA7237958207185B0356D905E8AE8E8F8F98DCEF0926841FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948545, "uuid": "68f326b1-8a4e-4d60-8365-f7b49f49ad7e", "value": "24:IjTOeIaIOeYWkaUoOe6oOeEOe5Oe45OetMOeKeOeSOl:22XCoshg5eSeqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948545, "uuid": "30230e6e-94ae-4e4e-9284-025518aab8ae", "value": 1840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948545, "uuid": "39919b35-4d73-44a3-b89b-b3972dd8e965", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948545, "uuid": "588ec643-9696-4d63-9d76-b33cb31311a0", "value": "a10a4f3a02addd40afbedcd8cf49014764de06bcb7e02731a45f77bfc94ca38c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac09dbe1-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947826, "uuid": "c0304fdd-6e76-424c-8f49-9d93479ad599", "comment": "Malware payload", "value": "e94d4d09ded6a9a84e2b1c843a5d91f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947826, "uuid": "de3bdf60-d0ca-4e0e-ad79-8ffb8207d964", "comment": "Malware payload", "value": "a23c83a608744a1da519bf374c34d779b33d6466a48273b171e85c93e7dd998a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947826, "uuid": "aca93aab-3989-464a-9555-1b56716c9416", "comment": "Malware payload", "value": "193df30e02daa86857bd7b39f57a27320c0ff9e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947826, "uuid": "9190ad5d-99cc-426b-93a7-374f1637d7b4", "comment": "Malware payload", "value": "a2ebd3db31bedbcd7e94403603b850a2fdef74a5cc128c0906c3cb82ac0260a4e9171309968ec2695e8c3bada195284e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947826, "uuid": "dcc6a780-fe63-4d83-b027-56351b432712", "value": "T1DFA1E850112C1AB17346597AD26FFA52B50ECC1B097B7B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947826, "uuid": "ba915655-b8fd-4f74-b3a9-3cdddb5221dd", "value": "96:SRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:SRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947826, "uuid": "28e405ed-0ba7-4f76-8f64-ab97bff35738", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947826, "uuid": "a5bc4b1c-af44-465d-bb82-3690a195259a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947826, "uuid": "94b80e1f-e5be-4bc0-82cd-aff3eaf73b56", "value": "a23c83a608744a1da519bf374c34d779b33d6466a48273b171e85c93e7dd998a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b93181-04d9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1657956774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956774, "uuid": "da6a5497-e578-4805-a72f-cfa375263409", "comment": "Malware payload (Formbook)", "value": "1596165aa3fb494e1f7cc9f48b77565a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956774, "uuid": "fa0fc72d-54c3-4be0-9155-319e524050a8", "comment": "Malware payload (Formbook)", "value": "a2a342873c0951c6f5a9d6aeab88c0819a45c91d416706a811349d1e90ef8cbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956774, "uuid": "13ab5132-6618-44f4-97aa-c7490fcb2c62", "comment": "Malware payload (Formbook)", "value": "c7fde965392b5bdc4c2ef8b410d6d02487778020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956774, "uuid": "343b1c4e-b9c6-48db-a45d-5d5482d4436c", "comment": "Malware payload (Formbook)", "value": "b0a3494170ee9c98cfc3cf3da8750110bbd1717cf8050dde28f5b68575e603c5d7031e8558c1881818839465c4a84183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956774, "uuid": "86d2ce77-f3f7-4b8c-b3da-ed29eeece358", "value": "T1B2056C26E2E0C4F2CD66167D9D1B92A4D569BE102D2CD8476BE83ECD1FF868134272D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956774, "uuid": "bfbdea93-488a-46c0-82b6-2ac84fad41c8", "value": "077780b656ccb18d86eb00528cd56a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956774, "uuid": "b40e096b-3ad2-4c46-9aaf-ef69573f2f8e", "value": "12288:wmgi3VtzPY+ji70/Gm23P+SraklRm9Q266cY4s6JBCbRJUT:wvuPY+h+hP+KaklRm9stY4s6JBCbRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657956774, "uuid": "383dac0f-9128-4c88-8b6e-404f3fc0edf2", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657956774, "uuid": "47d76fd7-86d4-49c5-ab8e-d84edffbbf10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956774, "uuid": "88a7aee7-e727-4545-9319-c1857c7907fd", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cc7d14-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948158, "uuid": "23876c00-fa23-4269-a720-7c7b323457e1", "comment": "Malware payload", "value": "7d0c14578902e5713c5601509b32d471", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948158, "uuid": "cb61ea6e-cab7-4e80-a9e8-6b0bce7ab68a", "comment": "Malware payload", "value": "a2d1e18353bfbbf66fafc31cac768c2d84bd4ece4a7f898eff044ce7964a1481", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948158, "uuid": "a9f37915-7a0f-43ed-875d-fafc420c5962", "comment": "Malware payload", "value": "845282d0357597e37cbdb5b963af61ca0cfcfc10", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948158, "uuid": "5b386feb-551b-459b-9d2c-86cc605dfb85", "comment": "Malware payload", "value": "23e4e3b7077c10257e98d66b537d002222989be9bc30a1d715e3b150769b534867bc71b003ccbdf67996993ee7c65548", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948158, "uuid": "b46866dd-84a5-47b5-af08-24a9a945e87d", "value": "T10241CFE813124FF67DAD6A1675A408457085B0CFF8A2FE188AEE29ED494DF493049BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948158, "uuid": "38ef7ef9-1231-4963-8042-3db72efb5ca6", "value": "24:v3/u/FJx3g7cW3YSLV3Tz3W53+SiK3MB3GZ3XJ3odp3/j/kD:vvgFJx+o8XAoKO4pUQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948158, "uuid": "5012f305-b7a4-4cc7-9546-ea1084deaba1", "value": 2013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948158, "uuid": "2afa2fef-f1bb-4de1-b150-40b3a864eaec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948158, "uuid": "9002158c-739f-4ae7-b2fd-e60a8b0be52c", "value": "a2d1e18353bfbbf66fafc31cac768c2d84bd4ece4a7f898eff044ce7964a1481", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16107e4c-04c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657949722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949722, "uuid": "eab14446-f214-4712-bfaf-724ae992386c", "comment": "Malware payload (Mirai)", "value": "8bab87a159aec81914b4bc8d627e45c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949722, "uuid": "0086d808-d262-485a-8c6f-27658081ff5b", "comment": "Malware payload (Mirai)", "value": "a3202a877921bb7bb41cda26fea1b3d969f1ef6504ad77c0367535120045f530", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949722, "uuid": "fc475ff0-42ec-47e8-9d8b-9b21d6c0e322", "comment": "Malware payload (Mirai)", "value": "4dfc513ffa2fd758400876782b4a39587f3fc9ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949722, "uuid": "71b2dbf6-8c38-4259-8e1f-8289c63632bd", "comment": "Malware payload (Mirai)", "value": "a275af5cd864102a300c1333bf7f021f4a4451f7348ec17d16b2b059a4d55a753bfe1206670aef373ac267b099419b4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949722, "uuid": "56814b51-ed48-4382-ab64-534f8ed5347c", "value": "T142C33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949722, "uuid": "cbee096e-7800-450e-bf13-562be4dbd46f", "value": "3072:idwracAAviNmLpMQ1xG5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxG5hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657949722, "uuid": "0e9ff131-0756-4a38-a6ec-002206780416", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657949722, "uuid": "3fdd1a6a-af25-46f5-9fe3-e9995296a52f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949722, "uuid": "afafcf0c-d857-4d35-afe0-ba044e71b042", "value": "fuckjewishpeople.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a49d24-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948087, "uuid": "6305e97f-9baa-44bf-9244-d86bbae39b4e", "comment": "Malware payload", "value": "0b185e0929e6edcaf459662ccb50dfe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948087, "uuid": "ffd576ad-b587-46f9-adad-795fcf7c0586", "comment": "Malware payload", "value": "a37b519f4146749aef1e3ff0d5a76ef4cf9659927a4a4db527e22309cc988cd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948087, "uuid": "42726ef4-571c-4d0d-9a9c-5fd71af0ea00", "comment": "Malware payload", "value": "0c81ff5e844bde05f6cdd499e9428153510f3303", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948087, "uuid": "fb1f629e-cd0a-4f96-99c5-37dfbca0d290", "comment": "Malware payload", "value": "f13ddd949a19e409befcf19fc1e7e70cae86cd1248569cb737a1804f94c2d636802dcff0f70eec88f5644ac332aee4e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948087, "uuid": "4ab2885c-8060-4be7-b1ae-ee22222e04b9", "value": "T100D3F79B689560E4D1FED174C62A6202BEB13494073827E76F6186F10F27FF95A7C328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948087, "uuid": "ade2caf4-8655-4560-9b20-887242c1409f", "value": "1536:AHbMwjc63iemxVwTYBgTxNJn4VLi+ei7lQSeE2sy/F9d6Kz1+uPEq7t++R:AwwkMYBINJ4i6lQHJB/J0CvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948087, "uuid": "728c9948-e109-44b3-83cb-b3e137c9e5b3", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948087, "uuid": "3a176503-132b-4fa5-986b-15ea35c30dc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948087, "uuid": "26536458-3023-4e43-bda7-333af5094c4f", "value": "a37b519f4146749aef1e3ff0d5a76ef4cf9659927a4a4db527e22309cc988cd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1014a49-04e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1657961202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961202, "uuid": "e878274c-2527-4a0f-9da2-2c8eb886208d", "comment": "Malware payload (Loki)", "value": "8a20c7143ae834a6ab5a0091a241fb7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961202, "uuid": "f216c751-a75c-42c5-8c7a-97b7f6539da5", "comment": "Malware payload (Loki)", "value": "a3a53a459412891de26148e8b9db4ea62cf7322a8c4c2a59fed06f71516415f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961202, "uuid": "31df93c3-4115-4dca-9959-d421e1e07e31", "comment": "Malware payload (Loki)", "value": "f21afc336de3146eb3c2e557c1823b40707103a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961202, "uuid": "39450c66-7352-4512-b1cb-f44f409fcb88", "comment": "Malware payload (Loki)", "value": "1a6f26b4c7ffc4b0693adb0780bd2bfee15ea27a52b032391929a2c01a4cb2c49dcc463563a5364f2dcfc85becb8e194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961202, "uuid": "833203a8-adbc-4f8d-a350-a455b53c74ac", "value": "T1B605F022B2F53F59E6B9CBF5024640600FF5266EB4AEE2158DDBB4DB61A0F410AC1F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961202, "uuid": "e610afc1-9bf5-46b9-886c-9026e381e4d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961202, "uuid": "c7a185ab-4417-49fa-93c0-35ff867d834a", "value": "24576:I+Mu1DHDE6LrWEynExkc+uBqPvmKB402NYBa6POw9Y:I+31k6rIIHJUHB7oka6G2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961202, "uuid": "fbd949ac-9565-4a46-a07a-9b96ed53437d", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961202, "uuid": "c5223fc1-6606-497e-9971-8660ca8e970d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961202, "uuid": "fe556ab8-ea36-4340-91f8-253e853fabe4", "value": "8a20c7143ae834a6ab5a0091a241fb7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15750217-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948432, "uuid": "685ebccb-fc88-4267-8d60-2e19341fbcfe", "comment": "Malware payload", "value": "768357bc33ea378cd11e0edf25dac1c9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948432, "uuid": "0d2cf84e-8ab3-4ab0-ad79-f98c6cc7f1ee", "comment": "Malware payload", "value": "a3da563c89414474fc70831e1976c31df37738c352d7132444218b4b6c7bc47b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948432, "uuid": "efc85826-7dff-4a54-bc73-584223e65863", "comment": "Malware payload", "value": "cb4034ee41043029745401b70aa7e8e08e8cd1d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948432, "uuid": "065820c3-6ffc-4850-99de-63fc99b307c5", "comment": "Malware payload", "value": "8ca4a8d8bf0e7db324c9411d29381fd98f6f958b8db68539cf1d5f470c24c0f5c1689411af7bdbd1b88a76a03f323a61", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948432, "uuid": "2f93d185-7b3f-476e-9eb5-e7ea34befc24", "value": "T1D3A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948432, "uuid": "64ce7c94-43a1-4fbf-bf02-e624dfbeb9c6", "value": "96:kRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:kRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948432, "uuid": "90746ac9-ba72-40de-9e7d-e71e01f21f20", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948432, "uuid": "fb50d7d3-3dd9-427b-872c-b8a898894a0f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948432, "uuid": "094e330f-e25c-4b53-8a8f-4d0d44a23f23", "value": "a3da563c89414474fc70831e1976c31df37738c352d7132444218b4b6c7bc47b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ae7397-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948644, "uuid": "2fe2b524-6ccf-4966-9c0c-5b13be6d8cde", "comment": "Malware payload", "value": "0cd701886255a4f344892730e2526fd1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948644, "uuid": "12280214-dd24-4d3e-a38e-523c9db14c4f", "comment": "Malware payload", "value": "a3fe8a8dc436f68998daa2ebdcd7c04e7c1785e3801994e1fc8219385b54cdb4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948644, "uuid": "856ee24f-58f4-4640-bf95-d6a3ee3d1f86", "comment": "Malware payload", "value": "012b6eba728d2a762a6c8a33bcbec8afc2fa6c6c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948644, "uuid": "6d1d31b5-f306-410a-97e8-8b09b35619fc", "comment": "Malware payload", "value": "94b9f63dd0230d352a355ec83dc08983fb3dce9a2389b6d3bad8111721ffbbaa3b2a53bb9bfbba862f0f8e995d27f7fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948644, "uuid": "1dedd1b6-b715-411b-ad17-e1907c6bc924", "value": "T167A1F750112C1AB07246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948644, "uuid": "b9229be0-952e-4dce-b41e-a3c2b9eec182", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948644, "uuid": "a2536e51-2fac-47b4-b840-60b50ed82594", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948644, "uuid": "6304632b-8e66-4e4b-8d7c-8035f24a2385", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948644, "uuid": "eebbcf64-b58f-46e4-a30d-dffb61dea7ba", "value": "a3fe8a8dc436f68998daa2ebdcd7c04e7c1785e3801994e1fc8219385b54cdb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67a1a48-0520-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1657987357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987357, "uuid": "e34ce9e5-2742-4b25-a20f-2781a4006786", "comment": "Malware payload (RecordBreaker)", "value": "065a30af4b949ed07c5c1761c7426f79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987357, "uuid": "c3395cb4-c0cc-47c3-a526-e9052de44100", "comment": "Malware payload (RecordBreaker)", "value": "a48ba6c3447ff9e85c9524ce4a90771735e5ca09c917b74fce272e5ba171e5a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987357, "uuid": "fb9dec02-b8b0-437c-ae2f-d43d0e9d8493", "comment": "Malware payload (RecordBreaker)", "value": "a3c706e73d278d6124c70d8cd0392f6c47f2205f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987357, "uuid": "066c958b-160f-4544-b2cf-64d98c60bacb", "comment": "Malware payload (RecordBreaker)", "value": "a47bedb17da516e0f06df8712b1c2491b23aaaf9ce66d457c3d8cf4f3dd987b312c3ebf60affaeec968a74f4cad8e4ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987357, "uuid": "6b1e556b-c263-442d-9a84-eaf1fa4f039d", "value": "T10F7612221391D05DC0BCE875C0A7E8E42CF7921A6971297C6E5A9BB23477FA3910FC5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987357, "uuid": "6b22e73a-0da8-4995-91a0-3892eec7aa14", "value": "0901266657d602fff9c7d9a865574642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987357, "uuid": "93e18ffd-f9d5-439e-b392-c491d95d691b", "value": "196608:pnCKHQ3wPpZyJwrxIQWT//Q877vNXbycOMeJc:9pQCpZKwrijL7NX+cOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657987357, "uuid": "517a209c-b2c8-4688-acab-1c57028de381", "value": 7271936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657987357, "uuid": "a8724e7a-d5f9-4509-aeb8-66d4bd64020a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987357, "uuid": "10c9c046-9f02-4571-bec5-bc5478dd3de0", "value": "065a30af4b949ed07c5c1761c7426f79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9caec4-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948765, "uuid": "480b9d6c-7964-4967-9059-71c08859ddac", "comment": "Malware payload", "value": "48e4623f868cfc99266a3a2eb3789baf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948765, "uuid": "42edd584-d223-42a8-90f4-9b1866a40960", "comment": "Malware payload", "value": "a52618bc82b87f9ce7e69887b1a6632f189f42417827a31d986540493c4672ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948765, "uuid": "bcd68984-a650-4203-93f5-41dd38a27620", "comment": "Malware payload", "value": "2eca7e3a39361e90beb8f32a8f722f5b6ba7096d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948765, "uuid": "eafed8ff-1816-4ff3-b2fe-703102fde567", "comment": "Malware payload", "value": "6430c7f488335b6f437f042d36565ae9216d7c6d593313e3c367df8a7321470eb9d8f2017654370f7a5bbd413c198645", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948765, "uuid": "d9127568-4980-42ca-8df1-9407b27d14a3", "value": "T1DBA1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948765, "uuid": "55a833dc-f53c-4cba-b5d8-088894c5e83c", "value": "96:ZRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ZRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948765, "uuid": "19ba2563-a9cb-47cb-be78-77d2ee0d8d2f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948765, "uuid": "cd5ed8c9-d74c-4d84-8141-3716a63a7bd5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948765, "uuid": "2e806df1-ee5b-488a-b9d5-92800912a318", "value": "a52618bc82b87f9ce7e69887b1a6632f189f42417827a31d986540493c4672ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa62bb0-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948092, "uuid": "c2d61045-3e48-4acf-a134-00df01e4083c", "comment": "Malware payload", "value": "8f9884cf871ed8f249674c5c4e4d5f79", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948092, "uuid": "866d4c5e-f5a9-46ed-88a0-e9ba73190868", "comment": "Malware payload", "value": "a526fc64c3373f9a256af4087a8c7cab50b0ffb599364dc1fa23429ad04b1c8d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948092, "uuid": "c0ea1acc-9178-4f34-92ee-db2dee750f18", "comment": "Malware payload", "value": "617c8404618c9b4ac560809d4996940e54aaaece", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948092, "uuid": "e26ecb68-e180-4110-b2f5-6cbe1e1f1e6e", "comment": "Malware payload", "value": "be8cc8acc3afbce7e9f380a62f42d82cac48ae4e10f8cee110d098f48a52e103064b7da8551cc819b7950b587b0a570e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948092, "uuid": "39daefe3-fe95-4726-9a74-24f965545927", "value": "T1DEA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948092, "uuid": "a9a97ae7-e0c4-4622-bec1-5df331bd94e0", "value": "96:JRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:JRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948092, "uuid": "32c9c40b-8d3c-4357-8985-de0a206a4422", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948092, "uuid": "0e9cafa9-4fe9-4c13-965a-389ccc3037c6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948092, "uuid": "93831467-b2e1-4ebe-ade9-a6a6064e53f7", "value": "a526fc64c3373f9a256af4087a8c7cab50b0ffb599364dc1fa23429ad04b1c8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe697a5-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947832, "uuid": "609d2d9d-edf9-470a-a178-cbb724aa833e", "comment": "Malware payload", "value": "d0e92a7e5c278f1428c0c8df1a270841", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947832, "uuid": "aa455619-b9df-4b00-80bf-d9815861cf91", "comment": "Malware payload", "value": "a603abc43f9da6ba0cf44c43ad064a851124d0f517a99221ab708e050243de8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947832, "uuid": "4ebba73f-44e4-4160-8dfd-0f991ecda655", "comment": "Malware payload", "value": "5db2763920c9a88a9049d6c1626af9c344eab0be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947832, "uuid": "6e1d1689-56be-45cb-b502-0046a9687f0a", "comment": "Malware payload", "value": "3ad1538d73353899c52033d555b005575120707a678efc15e5fec144ef3d2150f88aaaaf2c40ebd7360f10aacc0a598a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947832, "uuid": "b5984035-da15-40e4-8150-402f0a0a11a2", "value": "T19457DF7792067CEDE9B94DB4C41015816DA878874778E3C7BAC870E6A6EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947832, "uuid": "a4f809cb-3a6d-4b9c-a518-79c133d80f4c", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaD:sXyWSpV+Wu7rI3JEPfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947832, "uuid": "c8215c50-c4a4-4682-8949-4115a86c2874", "value": 29163520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947832, "uuid": "b28fcb2e-6579-4654-8ecc-29bb271ba782", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947832, "uuid": "f64c536d-892d-4ce5-ba27-00153cce3548", "value": "a603abc43f9da6ba0cf44c43ad064a851124d0f517a99221ab708e050243de8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbffbc13-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947853, "uuid": "072c2ff0-1ea6-414e-81cc-12dd48beae72", "comment": "Malware payload", "value": "5802ecb7408f112485e79738b3479262", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947853, "uuid": "e5a9b25f-1f8d-47ec-8ea8-b675d83f8ab0", "comment": "Malware payload", "value": "a62d4e0e5766bb3b5ec49d16debcfc966b566824669cb14d2b1629bc60500851", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947853, "uuid": "10a4655b-e8f9-4baa-9999-2cf4b0ab246e", "comment": "Malware payload", "value": "b7644e543dbf96433e9dcc50c53611eb06a9d478", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947853, "uuid": "32c7fc94-470b-475f-8dda-b834aab032c9", "comment": "Malware payload", "value": "308e3df923dad419726e2302e6571dd1f7f2d009e958817fd39808e61115d8eb4f959406514bdec9c2a88bc778931bd6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947853, "uuid": "0d7eea15-3969-4a6d-b57f-1f36a3eabd7b", "value": "T13B3196CA31A14BB06CA5E96B367AC81570D8E5C71ACA1FB86CED38E7548DE147010B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947853, "uuid": "218f50f6-1c46-4f27-bc0a-5b5b82ee6e48", "value": "24:vkT+k2ktc4kkuaskekxskL+k4EskjCkIJk+kd:vTHn4kLbPbA+H0CdJHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947853, "uuid": "03d2d088-476a-45db-9a71-bcd20797c5bc", "value": 1516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947853, "uuid": "3e122365-59ec-4e8a-a3c1-89a90358da57", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947853, "uuid": "587e92f3-daa7-4109-8d7f-92d666db1ce9", "value": "a62d4e0e5766bb3b5ec49d16debcfc966b566824669cb14d2b1629bc60500851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4a8687-04ee-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1657965620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657965620, "uuid": "2f3e03e3-b5af-4ae4-bc2d-142160e89104", "comment": "Malware payload (Loki)", "value": "2d6e6742ef4d78e53a0cee8e0d773c72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657965620, "uuid": "2d117a4f-cb0f-48ae-94b2-029fd3843f96", "comment": "Malware payload (Loki)", "value": "a687f170d682cb5046d247b4e35bb06b347f4902cc51dc095071216cc3154ce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657965620, "uuid": "5ae05f3a-9f17-4e32-9a3f-dd4afff8c819", "comment": "Malware payload (Loki)", "value": "66e9e72ade7b0d17a8132338524ab0180b9b7647", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657965620, "uuid": "578fa81b-eeb3-4f6c-97b0-41415d8eddf5", "comment": "Malware payload (Loki)", "value": "3335276f982f9a619ce57c45b718568e8ecffb0892fa901928a9bdb93dc1f24ce59e8cdb5b0c1ffcbbba0683e90e8696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657965620, "uuid": "e6983530-20f9-4602-a7fb-2bb5d6fb87ce", "value": "T15FA32A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A18215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657965620, "uuid": "fdb45111-e4c6-47ca-861c-064e524b62fe", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657965620, "uuid": "e6fb8a79-ce1f-4547-ab3c-6df3022181ed", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657965620, "uuid": "8d9e074d-cb3b-4965-94fc-a5e910351561", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657965620, "uuid": "6325eb1a-e680-43c9-a05e-a4b4770a8515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657965620, "uuid": "25fe5140-6c9e-4679-b781-2fbc9c9901eb", "value": "2d6e6742ef4d78e53a0cee8e0d773c72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e56c063-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948098, "uuid": "aa88049a-4131-4c36-9cb0-bb109ded5063", "comment": "Malware payload", "value": "fd6a1ed98e4b663e1c13118f7c2fca29", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948098, "uuid": "16d16297-7598-4e04-9ddd-6611e6e4b1ea", "comment": "Malware payload", "value": "a6d093de9e3bef49cd502c892c10c03c2bef05b4bb4775f9f0892eeab1fcee36", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948098, "uuid": "a4dc12d1-0461-4327-8926-cb18df8e5b57", "comment": "Malware payload", "value": "d0cdd6542d79e2f2e2d452345edcb8238f68fdf9", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948098, "uuid": "739005ed-3f66-4aa6-b9a6-27e16a343c14", "comment": "Malware payload", "value": "772458ab296edcfd35ebfe25d6920ed3ec52d47cb2b6e443d40e6697a7cdc4613c19f123efde5e2b45d8fcd806f3f351", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948098, "uuid": "9ce9e308-d10c-4ece-bebe-c160a7a20540", "value": "T12EC53326342D5CED2DEE61A738E725DD66D83F2201F2C626D6F0CF4519B322466BB1C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948098, "uuid": "0906e429-e311-411c-ab20-a473338bbdf0", "value": "49152:mRhdchYOzk7//AtL2w0tALKTaH1SNzoZnL4+rUFve+Hmsh22CDY5vfW:mmakkDotN06KTaHE2Z0qonh2vYZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948098, "uuid": "1873c87a-da5f-4635-b5a9-d5017e6ea275", "value": 2605056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948098, "uuid": "e07926fa-50bf-4dd1-bb1d-ec5fe5ba41cd", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948098, "uuid": "400c3810-18ec-49f2-9333-9e3de19fbc01", "value": "a6d093de9e3bef49cd502c892c10c03c2bef05b4bb4775f9f0892eeab1fcee36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0d90a1-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947876, "uuid": "5f8b55cc-4e25-4efb-b743-bc47f9b90e72", "comment": "Malware payload", "value": "09669e14113396e35245bd46a3150d2f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947876, "uuid": "73e00e27-f4d2-4c7d-a4dd-ea31872387cd", "comment": "Malware payload", "value": "a725c32c95d078ee2a83d55d1a95537c21b287caa1e6a1b54846e4792d71a1f6", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947876, "uuid": "0f4681a3-664b-4545-b87c-6f1687796b2a", "comment": "Malware payload", "value": "96f07a78a3a11829b3ce6052198cc2ea60f03ffc", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947876, "uuid": "96380cc2-5214-4d88-b3d9-0696bda9539a", "comment": "Malware payload", "value": "06d0716b80a987f246f9e239153663d1608ab4b9fda08704cbc319efe76bfdc317121a1366a691ca0c238d2ffccff67b", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947876, "uuid": "23333a0f-0611-4dd2-ba2f-f3af6c60b513", "value": "T1B5D533AC71DD39BD82D4B772B6EFE9243426A58D706143906DB3858E0C17232E5EEE1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947876, "uuid": "9e0d1bb9-df5f-4625-98fe-a83d9f1fb464", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5Ig+M4hi:tos909Qg6ecEZHyEexmLaI9MYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947876, "uuid": "b7b0b721-2af5-47e3-b41b-f0b5d0074198", "value": 2891776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947876, "uuid": "fdec1ee8-1e39-4b35-873a-1ebf3e3f5b3a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947876, "uuid": "4a1d097f-7cfe-4635-9845-bced56b9a9a7", "value": "a725c32c95d078ee2a83d55d1a95537c21b287caa1e6a1b54846e4792d71a1f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c57b8c-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948346, "uuid": "49c67613-2c18-4526-8596-62a5a970ddb6", "comment": "Malware payload", "value": "d54fd1f20825e75071d14e878e7b170b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948346, "uuid": "4668096e-041c-41dd-a80a-0bf41965f1ca", "comment": "Malware payload", "value": "a7e0912d535c7b6a1df99b6caa34b5a6385d640922db5d83809f228a3bc9e37d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948346, "uuid": "2d246208-500f-483f-ae11-102378b5914f", "comment": "Malware payload", "value": "b3d32ea1a81a516ef87dbfd27cf961ec2a9b6ee8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948346, "uuid": "b4e139ef-3a76-40b3-b232-1d9f96bd4171", "comment": "Malware payload", "value": "43cc46ea3eccb1befdc8daa40536e46af36775b509b7e9c60d19ddb6bbef192d1264ea828c00d406ec0b2d346dcef050", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948346, "uuid": "a4d1bed7-c90b-4b0c-a618-3404d8575686", "value": "T122415BC721A207F72C90D83332794494B9D491A694C69F4AB9DC3CE448BEDEC68846C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948346, "uuid": "e9e9a219-49cb-4cf1-92bf-43431576bacc", "value": "48:vsd8j1RttQdMqYBRf7GbT6eCKIpL1z5NKIRxIT:vsd8jDttQdMqYBRf7GbT6eCKIpBz5NKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948346, "uuid": "3b2aedfc-ce5b-4c69-aec1-900067dd02af", "value": 2072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948346, "uuid": "cafea68c-777e-43bd-8b0a-0c771e11205a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948346, "uuid": "af3b5391-37f6-499a-b935-3104b1a1190a", "value": "a7e0912d535c7b6a1df99b6caa34b5a6385d640922db5d83809f228a3bc9e37d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076139b3-0509-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657977185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657977185, "uuid": "3ae2192a-135c-4cf9-a9b6-ec8041c6f9f8", "comment": "Malware payload", "value": "705eac327ac1fa4f8c6c466a137afd90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rasnsom", "colour": "#D80B63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657977185, "uuid": "b17fe72e-b8f9-466f-b8be-c0670d185acc", "comment": "Malware payload", "value": "a80c2b5c0cb59b820f48b8e56721fa932d7ecc5d1b20e75dcfd07b5721205240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rasnsom", "colour": "#D80B63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657977185, "uuid": "ae779359-1902-4171-ac37-9e04f21b70f0", "comment": "Malware payload", "value": "b35c3451436b4f62fa4d48492a5e451031475251", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rasnsom", "colour": "#D80B63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657977185, "uuid": "d8b809da-7ef2-4669-98fe-2b293b4845f5", "comment": "Malware payload", "value": "ac506b0c8085035198ddbf29351afa7a84366a946779a363251112951f502d32d857b5461011542fb4ae98a4b6bf0d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rasnsom", "colour": "#D80B63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657977185, "uuid": "29e9241b-dc94-444f-8df6-2d9587cd3fe5", "value": "T1E2B4CF4833D2FF17C0518277F1351A80131AD1999B5BF382A4198E59AEEBB9AF1FD48C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657977185, "uuid": "3c5dced6-ae9a-4c19-8bf4-a2eba70c4d3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657977185, "uuid": "583c9356-999d-48c5-9f2f-aa645e66bc43", "value": "12288:+XZhJdtSOG3mTwaSvUH+aMWcxGbqjnkPf:+7fw7UH+aM5Djn6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657977185, "uuid": "00c30a9d-77ae-4e3d-ac10-65c7e9d81c55", "value": 494567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657977185, "uuid": "57cd402c-f698-42ed-b488-380d00f81997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657977185, "uuid": "797f4cf0-1f12-4cc1-bd6f-8b21514c1f32", "value": "lock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0807c58-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948800, "uuid": "7ea2c8d5-ddc0-4246-8d15-9b3d93756042", "comment": "Malware payload", "value": "2f0a5c6098af735d53ec4693eb0b0646", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948800, "uuid": "0f2d29aa-df20-4ecd-a9db-3dda07436441", "comment": "Malware payload", "value": "a8667d199c30cb0ea03963429a41978c1321ea3dbf6d44f8dd8f8b47b1dc501b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948800, "uuid": "70d0a235-037a-45bc-92ed-c2c356171b5e", "comment": "Malware payload", "value": "b646a4c36ea80a29810955b90524e6bef33fd652", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948800, "uuid": "8d12c3ff-b0e3-457d-b19e-01c5d772c1ec", "comment": "Malware payload", "value": "7635c7b4f2b6cf36e0b09d95062e16eb720b3aa2cbea9351799ed9fa6be1918ffdac36816d15ff6dd085bba597cb1516", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948800, "uuid": "7e803bae-4634-4ca1-85b3-75cffbdf7a78", "value": "T18EA1E650112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948800, "uuid": "15cdfd74-f1d0-419d-b18e-4ec79bf77590", "value": "96:ARYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ARJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948800, "uuid": "fa7cbcc9-e4fe-4ebf-a7d5-3ebdc0c1d8c5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948800, "uuid": "055fc318-3002-4caf-a7ef-e87b6d68c6d3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948800, "uuid": "4a9a13f0-1506-4cf5-a060-ed8f9178451b", "value": "a8667d199c30cb0ea03963429a41978c1321ea3dbf6d44f8dd8f8b47b1dc501b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e18de99-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948044, "uuid": "c3475b75-7c7b-42e8-806f-c46aaff929e2", "comment": "Malware payload", "value": "f0b7cd5377590d4fe596534343812c33", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948044, "uuid": "6cc530ce-13ac-427e-a2a0-4836924a0eda", "comment": "Malware payload", "value": "a8aa54c369a7e45ed47f903a3c5171086ee1fc04725815e4b768509c3eebb38d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948044, "uuid": "6cea4f2d-b09d-492c-a580-450401a804d3", "comment": "Malware payload", "value": "04ae3fd380d2322a037e6bdaeea397bcda225585", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948044, "uuid": "4a8359ac-1e1d-4b96-8dd7-7b004628e0cd", "comment": "Malware payload", "value": "b322619919985699bcbb9258051ee63d32e7dfdd180dbf5c9e2b94d9be33a06286afc98dbca59d193bc6d378ecc84606", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948044, "uuid": "3acc12e5-a40f-444d-aa25-92a0cc36cc84", "value": "T1E2A1E850112C1AB17246597AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948044, "uuid": "2dca7f86-b46a-41eb-b556-dc74340e654a", "value": "96:TRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:TRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948044, "uuid": "4396255c-88db-44a2-97ce-44f8806e2471", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948044, "uuid": "51f561f3-2e84-4b53-9d16-26dc7aa4fe5b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948044, "uuid": "b133a9ff-e125-49f6-85b8-db205c199b21", "value": "a8aa54c369a7e45ed47f903a3c5171086ee1fc04725815e4b768509c3eebb38d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e56f075-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657948581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948581, "uuid": "9455eb09-ff1f-46a0-9497-d67845951518", "comment": "Malware payload (Mirai)", "value": "4faa98a6792cfa0a4e8c25fa64338232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948581, "uuid": "974d5bd6-3cd9-4823-a0fe-94024f2c8824", "comment": "Malware payload (Mirai)", "value": "a91751e8ceca2f6e3bc028cbb759fd5b57dbe37ec739cfae9d008de73c52a104", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948581, "uuid": "8bc3c0bd-0559-49ae-9ff1-13c045fd9266", "comment": "Malware payload (Mirai)", "value": "2404905790c16c5823271d4d8567d353b3ca4dcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948581, "uuid": "7bd2e422-ed9c-4146-b7ab-a8beb8b176c0", "comment": "Malware payload (Mirai)", "value": "091c9e3a9240325a3b10deaedcd952e04a5bf7d6c0bd5652ca67d032f81f9f28782b1966ed6c1cb6ae5823459d5fedeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948581, "uuid": "898fed65-c956-46c5-b50d-3ff97cb15ad2", "value": "T107E3A62E7E22ABBEE169823107F7AF70C79521D227919342F16CE6185E7124D1C5FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948581, "uuid": "58682666-82a9-4ba2-887c-8e1b8cca6b50", "value": "3072:1Atu6SxI/5ZIUj6QP/5NOX6sILJ+DAlwgqVIyFhq1TB3OotUmkmZF01TpM2ke:omclhyFhqfUmkmZF01TpM2ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948581, "uuid": "63f99773-3add-45d6-8ccb-d8e09e56a45e", "value": 146926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948581, "uuid": "0153cb0d-003f-4197-b8ad-69baed084ef6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948581, "uuid": "f2069c61-5e67-47ee-acc7-857c3e069606", "value": "a91751e8ceca2f6e3bc028cbb759fd5b57dbe37ec739cfae9d008de73c52a104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19171e7-04d9-11ed-93bb-42010a9c0043", "comment": "Malware payload (DBatLoader)", "timestamp": 1657956828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956828, "uuid": "0a9fa6d0-de1a-4da3-97f5-a355069c5031", "comment": "Malware payload (DBatLoader)", "value": "6778e53d9ecf4e1c92aca3d3492f0c26", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956828, "uuid": "bd7c6780-7f7b-45d6-8ba9-a5583e71a89c", "comment": "Malware payload (DBatLoader)", "value": "a941ee1d3d01fff7c948e6613f55eed4f64d4310836c40abfe9a6bd221c963b9", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956828, "uuid": "dd4b3da4-e518-46ce-bee4-2192d489d544", "comment": "Malware payload (DBatLoader)", "value": "ecd3bb6ce608a1b81603e965bb61f8b7c68735b9", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657956828, "uuid": "53d65022-9a6f-4d82-aa58-cc966646cf65", "comment": "Malware payload (DBatLoader)", "value": "dcc0177272dd8eb2b0f2fb1ad7b37c57884e29270b9a399305e1c040e57be29dac4ec345d70a2ba930199f21c4e39da2", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956828, "uuid": "0c0f20bf-7421-47ea-a933-d0633d9e80ab", "value": "T195056B51E2E194F3CD6A5A3D8B0B92A4D825BD106D2CD98727E83ECD5FF868534272C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956828, "uuid": "55c7d5dd-3ce5-4ed9-9cfc-e7fa015e6afe", "value": "077780b656ccb18d86eb00528cd56a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956828, "uuid": "151076ca-a78e-45f4-b8b2-5a5242ba910c", "value": "12288:wmgi3VtzPY+ji70/Gm23P+SraklRm9Q266cY4s6JBCbRJPT:wvuPY+h+hP+KaklRm9stY4s6JBCbRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657956828, "uuid": "0d283456-7c35-4695-b63e-b5e16f094178", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657956828, "uuid": "80d07977-6f2b-4f26-8bbf-b7e68f115988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657956828, "uuid": "3c38410d-2d94-4bd5-a19d-56effaacffdd", "value": "new_order_6950695_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690e5bd7-0512-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657981214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657981214, "uuid": "5f006e55-2a01-4a1f-b2c3-d9a8eb46e102", "comment": "Malware payload (RedLineStealer)", "value": "7583ea28e789c4cc198492765ad9a49a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657981214, "uuid": "950bfe7e-73b0-4598-ae9a-044fed325ca3", "comment": "Malware payload (RedLineStealer)", "value": "a987f700a5a840d4e907699c071a07868f840bb2eb12b4fffa265d12d81bc9c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657981214, "uuid": "9c76924a-0292-44f4-8075-4cb5118ad04c", "comment": "Malware payload (RedLineStealer)", "value": "324c9ac688194dd62fd143aa00085c5c9f6b1700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657981214, "uuid": "46fb4842-01cb-4e9a-a166-097be9de5a4d", "comment": "Malware payload (RedLineStealer)", "value": "b4f5b8b7411b967f40cbf723d2cd5a9986d8ec637d6ae03b448287ba2cf3bc35efda5a6cd13c3cff88fb82be69e3d5cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657981214, "uuid": "b1d08f7d-7cd5-4aa5-b913-64dd9919ab2a", "value": "T16394BF00BB91D434F4B712F48AB69368B52D3EA05B7460CB66D56BEE56386E0FD3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657981214, "uuid": "71c013aa-9a9b-47c2-ab1b-778c8cf6bd1a", "value": "363debf0ff85eb6df1e94b75eacd8b61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657981214, "uuid": "4eedfcfd-e776-4b1b-9650-46776bb2d58b", "value": "12288:or/EWidxaAUlmXxtzN0yi+y2vnjkpyG+7:MMWrApx7XzvjkpyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657981214, "uuid": "ee1def9d-b024-4480-9118-8bab932f8a84", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657981214, "uuid": "1b95682b-bcd4-47d8-90e2-bb4672bce483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657981214, "uuid": "7d4fcac3-8e6e-4209-a3a8-29aa0776588f", "value": "a987f700a5a840d4e907699c071a07868f840bb2eb12b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22e8c6d-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947863, "uuid": "79e87ba9-5e9b-49e1-8a8b-6916a53954fb", "comment": "Malware payload", "value": "cc704658d99ef80f511bb57dfbc084eb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947863, "uuid": "873157ce-5d7c-4838-a2d3-2ae0aa9566c9", "comment": "Malware payload", "value": "a9f7f0c4147185a85f4bf1d75f7893651a1d15d856a26d4cced99f69e1e1dbea", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947863, "uuid": "2c8028e7-f219-43e8-9058-e6d06c182446", "comment": "Malware payload", "value": "4c5b02b851d9d6321e10b7444fb957b7342bfbdd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947863, "uuid": "4cc088e8-49e7-4362-868a-20f2a1352952", "comment": "Malware payload", "value": "623304384c2e14e5c757142854febf0f5e9f8020fac3c1db5765570d04060715bc95042a6f94f2294783f9a5a6c70082", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947863, "uuid": "0da354aa-d0a9-4834-addf-d1d30f23e27a", "value": "T1335170ED069166F03C9EDD6B7EA805093180E8E7E8D62F1175E9BCE9789DF09F080653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947863, "uuid": "d39381f3-cf3f-4c55-b078-876265e2d9dc", "value": "48:vRUQUjfKWU9UeU1UoUqUHUWUHUkmUWUWUUUCn:vRUQUuWU9UeU1UoUqUHUWUHUkmUWUWUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947863, "uuid": "e04f1160-c90d-4959-b958-d430007f16cb", "value": 3014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947863, "uuid": "4f0cdf69-b736-4d6f-adc9-7ff443b373e0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947863, "uuid": "f438067a-c3be-4fdf-9480-e93c97e1b976", "value": "a9f7f0c4147185a85f4bf1d75f7893651a1d15d856a26d4cced99f69e1e1dbea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b94e7b-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948570, "uuid": "d8c1ee01-68f8-474b-ba30-73fef2ac82aa", "comment": "Malware payload", "value": "4d8cc45c733bcb9d466d76ce72975532", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948570, "uuid": "ba6b8cfc-2867-402d-9ba9-a0ed5b2e2d15", "comment": "Malware payload", "value": "aa97ad71932cce4e37e5fbfe434f7b972fff20186c5aa927109a5e64e02a3111", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948570, "uuid": "5ddb4c61-e977-43c5-be05-d053779eabb6", "comment": "Malware payload", "value": "aa8ace7dd244a6bc75492082b4eccef9913e4f41", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948570, "uuid": "22118f1e-ef47-43ef-bdbd-a44fcce7cc41", "comment": "Malware payload", "value": "5f8dbac5fcf3adcfc2ea1ed41833ca94907199912cf2562ae968e07c784e2b908b7b00bef4c3d61790cffe009632b107", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948570, "uuid": "a61931a6-ff82-4446-a755-69f3c1303b60", "value": "T10CA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948570, "uuid": "f48e6dc3-3a47-45dd-bf42-4581a067e0fe", "value": "96:ePRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:GRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948570, "uuid": "5cca84e6-ab16-48ac-a411-ac501c580bfc", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948570, "uuid": "2e2c7d2e-fe42-4955-9ec8-80b1fb83af79", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948570, "uuid": "eb8f3730-a5ba-4241-b834-8978a3d5ba1b", "value": "aa97ad71932cce4e37e5fbfe434f7b972fff20186c5aa927109a5e64e02a3111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd135ba-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948525, "uuid": "ebfc8afa-d268-4d21-83da-6cdb79bc6a9f", "comment": "Malware payload", "value": "1694c2109f72c1011705ce0176f68d72", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948525, "uuid": "27f7d463-20f7-4f63-a891-04cabee8b830", "comment": "Malware payload", "value": "aaeaaf5356c73c9645674df66b901d871c2569365e490d4b234b4b7e45cfb127", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948525, "uuid": "11461558-e09e-49e7-8690-fc514ae1cd23", "comment": "Malware payload", "value": "d1d0e799ee2fdd61d0267284254e78e4c9b9cd34", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948525, "uuid": "7ccf7124-cae5-4993-a498-36993bd81777", "comment": "Malware payload", "value": "bddcab2750c4ff21624c161465601c58a51fa77f888cb99337d5f8a61fd8b8360325285c1581cd2f901250a47a9fb978", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948525, "uuid": "82c2a235-6f58-4666-a23d-33b64902b1e9", "value": "T14DA1F750112C1AB17346697AD26FFB52B80EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948525, "uuid": "ca5e4092-e466-4775-b66c-87513c5d9a0e", "value": "96:jRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:jRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948525, "uuid": "5b027bca-ba51-47f2-bf08-3295a8b3b8f4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948525, "uuid": "92e713ca-fb8e-4d80-954c-ed28510b46f6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948525, "uuid": "a5211db6-76aa-47e1-9609-c5902c1c720c", "value": "aaeaaf5356c73c9645674df66b901d871c2569365e490d4b234b4b7e45cfb127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd765306-04e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1657961170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961170, "uuid": "08e01885-074c-4609-886a-3f616e8fa73e", "comment": "Malware payload (Gozi)", "value": "25a690d3ef30c01ed6e0daf255fad85b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961170, "uuid": "bd1984c4-17f8-42d2-9102-11f5b0241a4f", "comment": "Malware payload (Gozi)", "value": "ab0577a42f963ea7cad0b3f5c43ed3a9165e84cefd47144d3f6fc05a951d3ea1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961170, "uuid": "ea3be059-cef2-4422-82b5-ee60e09020ac", "comment": "Malware payload (Gozi)", "value": "9832ef47466eb59c35e6bf4db13e87393f5696cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961170, "uuid": "4abdd2a4-0563-4eaf-b7b0-ffd07c265611", "comment": "Malware payload (Gozi)", "value": "7dbc5b377057874763db077f6331bf7347a70f8850d41d595b7440848ff3feb4c2a09e9d824cdd90d114fab8d90fcdd9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961170, "uuid": "929a7a1a-01f5-4b63-a807-c02b6637926f", "value": "T1C194F1907E3568F5DEEF117FBFB12280918D90E90B909B61CBE91A54095DEF20CD32A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961170, "uuid": "42184c1f-bfcb-4478-9723-369c317e605e", "value": "9fd064296ca056229afb79e2d371c5a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961170, "uuid": "589368ce-414e-4e24-9a73-6ab5a5798d29", "value": "12288:LApqqoh67WqP2NUxwqAhT3ZiJvJmcxyg7Wz:0pqLh/lN2AhT3ZilJmwyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961170, "uuid": "eab02828-2219-41fc-bb71-9136f7c82b5f", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961170, "uuid": "c9e72150-0c2d-4a00-9972-c2bfc1a34fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961170, "uuid": "0d1cbeb1-7d0f-4c07-9d1a-ab5288d67ccc", "value": "25a690d3ef30c01ed6e0daf255fad85b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa722d7e-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948253, "uuid": "d922c624-6665-4b51-80c6-c37d11cf7abc", "comment": "Malware payload", "value": "b6036ac822db0bd3b2dea6c3427abe0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948253, "uuid": "b1d0081e-525c-4796-89e9-200ecdd7a7b0", "comment": "Malware payload", "value": "abb79b34f4b0b92da15a86c1fc7533dd17cfffca362e53ddae98cf978b10d1cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948253, "uuid": "92e64927-024c-4542-a5b7-e359b839b1da", "comment": "Malware payload", "value": "dca0c618e4865e0543ea72f9236431992b0d32f8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948253, "uuid": "189f3fa4-e474-428f-a595-e1a291bc29e1", "comment": "Malware payload", "value": "9ad2d38745c119a3b438ab67f7fd6faf69adbcae73bfc7f6875f57b5ae4a74ecd0a01f5fc0b2d751c9bd70224e804a22", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948253, "uuid": "9797b2d2-58ce-49d2-a7af-76e867904423", "value": "T1CFA1F750112C1AB17246697AD26FFA52B80ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948253, "uuid": "4cf7e63d-064c-4b96-842c-1066d5f4465c", "value": "96:vRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:vRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948253, "uuid": "029c8248-5fd0-4eb2-87e7-b5b2d0416a54", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948253, "uuid": "00cc223a-8f7f-4310-8c81-dfeb8719e30a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948253, "uuid": "016d2988-76b2-4e0d-93a4-00cc37704b12", "value": "abb79b34f4b0b92da15a86c1fc7533dd17cfffca362e53ddae98cf978b10d1cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04cca4e-04d4-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1657954786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954786, "uuid": "d49cfb62-ee20-429a-86e7-e8f207f5b5d7", "comment": "Malware payload (AgentTesla)", "value": "e31449b66f9638acce2cb3c07fdf02f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954786, "uuid": "3db39f07-1946-4869-b0f1-d7f26176276e", "comment": "Malware payload (AgentTesla)", "value": "ac1b3b89d18ff82a2a9db004361b0ae7c8d338846ef15d3eba32564a206d2494", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954786, "uuid": "3f24c592-999e-4651-bd41-45a5bd19a067", "comment": "Malware payload (AgentTesla)", "value": "bb9ef327d5f3fe97e7fc3e71a80ccc35cbbcaa9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954786, "uuid": "3a59c50b-8792-4909-80fe-ab74ee13784a", "comment": "Malware payload (AgentTesla)", "value": "ac797da78b34778ac76695de823c8afd28b8a0ede88e4cee8a0c7e66b36c642d1f783224de859c3dd8e455f425e014f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954786, "uuid": "297531a9-125d-4b84-8815-75227f8032a7", "value": "T1DD34129FFE000358C66DE17ED1B0A49C2EAADD221E55939B544AF7B856FA87CCD03903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954786, "uuid": "f1428682-757d-49ab-a110-235b3ccfd414", "value": "6144:lEqUKj9AxgG8tM8OOyDhsPH5mWd8JJzfIcQ+U9Zdxoe:tS/AcxhsPH4+SJ7IcQ+SB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657954786, "uuid": "a240d802-0d81-4f76-b9a9-4f27a8a8a0cf", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657954786, "uuid": "c52f93ac-4106-4a62-903d-12eae1f94e67", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954786, "uuid": "a677138b-379e-44c4-ad4a-2ad724c80d37", "value": "SCAN 001 S22060100024.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82b2e31-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947873, "uuid": "eb10b990-9b5e-416d-95a5-ddc96fa44b9b", "comment": "Malware payload", "value": "b219be48ad6fb283e3ad859f795f058c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947873, "uuid": "abf2ee8f-8c80-4459-9b9b-b18b846e16a8", "comment": "Malware payload", "value": "ac3d769a4df5417729f70096f072556958fa4d23245f1f997a5b616268b5486e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947873, "uuid": "4d053ab4-a062-46eb-bc38-be6b13b02a68", "comment": "Malware payload", "value": "488552a4aedf516afb1eccb6cfb08afa810ecc45", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947873, "uuid": "4002f7eb-6670-410b-8793-8757f07049dc", "comment": "Malware payload", "value": "cb5277e1a0adf99afe57c546babbf6ed6dd18685656b2c9296615751a05cbb754527af3ba909526eb95eb5dccb4e39fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947873, "uuid": "dcc46ca4-339a-4a43-b9dd-6486437d70a0", "value": "T154A1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947873, "uuid": "1d61799d-eab5-45fd-a5d0-bc95570746b3", "value": "96:gRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:gRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947873, "uuid": "761fa6a5-8a58-4f45-a9cf-92341ad24cf7", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947873, "uuid": "333aad13-a840-42a6-a17b-5d56f78a500e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947873, "uuid": "9e065dd3-2059-4eb6-8823-02f377b64851", "value": "ac3d769a4df5417729f70096f072556958fa4d23245f1f997a5b616268b5486e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147642e8-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948860, "uuid": "fe43fee0-7d2c-44c4-9cea-160e1a878464", "comment": "Malware payload", "value": "ee2f36da72516ced0a12c285716e6b31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948860, "uuid": "8085356d-2cd0-4688-b298-e4a7939ce0f4", "comment": "Malware payload", "value": "ac472103786ef5f505c6420e6ca9837dc6c2b9d33b08d7e921f54faa60d7db4d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948860, "uuid": "8ac50da5-21e4-4fb0-85d8-64ad2accc5c8", "comment": "Malware payload", "value": "3bbdf5614c25f062b9cc772ddf59ee6f56ce49c4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948860, "uuid": "a1344ea8-6514-413d-91a5-e344c25f28be", "comment": "Malware payload", "value": "d7784485c4dbbca4b0a337b157ade6d1bef3bcadd256d6c51e2ae47125e39527c86e1e858963099d2764450a234ff58a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948860, "uuid": "689bdd15-8b4e-4acf-a51e-43aaa1156e12", "value": "T189A1F750112C1AB07746697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948860, "uuid": "523ab2b2-17f4-4b28-a14e-09f88a018de8", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948860, "uuid": "f3ac68f7-6885-4fb2-bf70-8c904cb10245", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948860, "uuid": "956e46da-b992-4097-a65b-75bba35bf440", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948860, "uuid": "12322011-068a-4e13-a76b-0965310ea2ac", "value": "ac472103786ef5f505c6420e6ca9837dc6c2b9d33b08d7e921f54faa60d7db4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f03c8b-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1657971406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971406, "uuid": "9f8c96a6-4b5e-4155-9638-4f0a3d1a53dc", "comment": "Malware payload (NanoCore)", "value": "dc4e2e5a78e627a3244702ee288f6b7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971406, "uuid": "2688bafe-7321-46ac-95b3-dc934f89d29a", "comment": "Malware payload (NanoCore)", "value": "acbd9f1abe68277b68a402193c1ca46993d45a594b077a79d1f58c4fd399183a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971406, "uuid": "d53b04be-529b-4a14-af19-b0b3e61550a4", "comment": "Malware payload (NanoCore)", "value": "e54e4efc6371d59bb5ae36018f8e83fe1d5fe11c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971406, "uuid": "3e62a199-5484-47d2-b54a-a394553ca808", "comment": "Malware payload (NanoCore)", "value": "d6c1cb97fd9962a450c2759b1965505b04ed290606a2c1c171d4d2d3877af1af90ac6c6234d333b7e8ccbf1dec203ae7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971406, "uuid": "4104d905-59f1-427b-9c3d-bd769b7d0abe", "value": "T15A24C0157BA88A3FE5DE8A7970125202877DC2E399C3F3DF28D454B68B623E506471E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971406, "uuid": "f9e946a7-336d-4825-80ea-47ed8a179293", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971406, "uuid": "6ff19810-c033-4c5d-bf3e-81b03e527f1d", "value": "6144:gLV6Bta6dtJmakIM5BJOgj8+eJmJ865/sb:gLV6BtpmkGvj8E3sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971406, "uuid": "27c1dbb9-fca5-4401-8e5c-44f46d3fdecb", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971406, "uuid": "d8343fe7-ae7d-42ef-9c3d-316aeac611af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971406, "uuid": "ebe78e4d-2ac5-46ff-ad05-2d8d39d72ffb", "value": "scotch spoofer plugin.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11efecd8-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948426, "uuid": "e2e0b9ad-3e11-46f8-84de-5e251cf75143", "comment": "Malware payload", "value": "cf2fed1a6018f3899204a2afc80c0dab", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948426, "uuid": "619bb1b6-8330-4005-9909-ad83c1978411", "comment": "Malware payload", "value": "ad060e565ad12ae4093bdaf34c1b61250a06179e554a6c8e1679c4bf66f2b63c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948426, "uuid": "84ccf7f1-079a-4d0f-95bd-9fa5af0d030a", "comment": "Malware payload", "value": "61e342c0c85c2f36a3315d9d5af6583854891690", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948426, "uuid": "df0e0446-0031-426b-9827-300409ae499e", "comment": "Malware payload", "value": "853d57b4abcd51e8a7b95d315eb6c161fa3b5ff77866f67a78b580cb41fc2c91a10da3826188c6a93b542b9e8cca989c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948426, "uuid": "5f7011f2-c3ae-4169-be93-5dfc8c39f172", "value": "T197D5330C13BBBCFDF99E052837238DE1C5A951F0E58251A2DA6819981C3F5BE17CFA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948426, "uuid": "e6389a8a-f778-4b74-acc8-153b5cef107d", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4o:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948426, "uuid": "9a032d5d-4acd-40d1-aa7e-233cbac6f41d", "value": 2838528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948426, "uuid": "37503a37-af4c-478b-a186-715fedab0d8b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948426, "uuid": "a81e6f73-3043-4bcf-8c54-414a4548b289", "value": "ad060e565ad12ae4093bdaf34c1b61250a06179e554a6c8e1679c4bf66f2b63c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13601709-04b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657942416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942416, "uuid": "7aec5520-fc32-4701-afea-788aba80ad13", "comment": "Malware payload (Mirai)", "value": "28356ded7f8c428f4e67c307ed439188", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942416, "uuid": "64d9d4fa-33cd-4630-8720-1425a71ec61e", "comment": "Malware payload (Mirai)", "value": "ad0e25546cea316950f65f36e227aa75a0757b8b0d207cf00458112b213c69d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942416, "uuid": "db2d46a4-84ed-4281-92d5-60b2e5a7fe13", "comment": "Malware payload (Mirai)", "value": "300d71ca16f1384abf86e4b4e30d1d95b5178e45", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942416, "uuid": "c019163d-c3ea-41ea-880c-ed41f56a2995", "comment": "Malware payload (Mirai)", "value": "7ed737fbb2f51def618c519e42d4e9bda0ef9289e2b81e4587b236484396e1d72396f0b500c68238f0b81e5bd7fe3f11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942416, "uuid": "6d08af3d-6725-44dd-bc7a-e1f39e09d5b2", "value": "T1854318C5B851AA25C7C15B77FE2F018E33199BC8D2EA33128C192FA0768BC5F0D26756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942416, "uuid": "5f757beb-9c91-487e-a291-199908cc5050", "value": "768:BTaH0BgoykjbVFglkRq+MPO/kq/yuDz701rBPj3NyytAit61W04pGin22d7+YXPm:kHwRykjbrKeEkzU31MlUsRdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657942416, "uuid": "35e4b2f6-0e32-4f45-85d1-fe7237b0bbc4", "value": 58364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657942416, "uuid": "8031f947-4334-4e2f-b532-5895b8b86948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942416, "uuid": "ee0e0bba-4f61-4bd2-8e5a-4c4702f7e385", "value": "Ares.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22297886-04f8-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657969928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969928, "uuid": "a06fa010-e219-46cf-b95b-c306e08b9dec", "comment": "Malware payload", "value": "3fd6ba92bd9437821ebbfddf2607d0a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969928, "uuid": "d2b4408d-c6d0-4563-b97a-7c4bf693ac08", "comment": "Malware payload", "value": "ad5df1129e2fa869f3417d53d337100e2622bbfbab41c87588a374f08de04926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969928, "uuid": "05417eea-614b-453e-a022-9acda2db24eb", "comment": "Malware payload", "value": "ec1df4a35b9e95c180e51ea341fe9c31cee5249c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969928, "uuid": "ab558329-eae3-437b-9b19-9ab867920961", "comment": "Malware payload", "value": "6b655f634c184de6ef92b546c6d53f58b41781ec71c46d35fb589e5ea94a51c534229ef067c82978332f827bc76fde9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969928, "uuid": "e6fc73e6-b0c2-44de-a256-d942c650eb0c", "value": "T14C25025F35598599DCCE80B0CBF1AFB4B0E5A6603DA8E36E2FD3865D2711922C623353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969928, "uuid": "03966c7c-b885-4f27-808b-a716a870bc59", "value": "7a195ad20dd0c44e24aea9fff812861b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969928, "uuid": "4f8c0616-f93a-4367-b036-ea9a89e59ac4", "value": "24576:sC0FMBxw00XY8r0v5dzOxFZARM8w6eFWcO/zz8dZ13S9+:NLwjoe0hd0ARMvWR/zWko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969928, "uuid": "561be588-e599-44bc-8c23-7c00199b3cff", "value": 987632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969928, "uuid": "3e20bbfb-be17-426e-8942-18336da34ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969928, "uuid": "755b97db-5952-4cdd-8236-4931fa4ea9ab", "value": "virussign.com_3fd6ba92bd9437821ebbfddf2607d0a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee84ece-04d3-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1657954273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954273, "uuid": "0ad43b5a-fb61-4f6c-8b9b-1c06c5be4e82", "comment": "Malware payload (SnakeKeylogger)", "value": "03f7e3f52f561dd4576892205403399d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954273, "uuid": "ee5fbf01-cf00-4a3a-ae8a-557bb9a28823", "comment": "Malware payload (SnakeKeylogger)", "value": "ad68e3a0d4524a1be0bd9f9ecb46bfdde56c10257529e7b5f4ea35e7b8fa10cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954273, "uuid": "66db94ad-3f30-4f8f-a3f1-9a8127554be8", "comment": "Malware payload (SnakeKeylogger)", "value": "fbf530cb10403523acfaf40aedc48d0414160a9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954273, "uuid": "9443a4ca-d253-49c1-b7ac-c0ec275f6e40", "comment": "Malware payload (SnakeKeylogger)", "value": "f90d87dcf770e890a529b504b1e965d6ad2b14333ebb6340fb183e3df27e51879ee04a7c869ec6c07f29fc4708f4bde3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954273, "uuid": "2f56243c-cb0a-4148-9833-1a6f227a4ae3", "value": "T13B15F182F9F4BB45D5B887F5824E40500FB5166DB66FEA158CDB66D720A0F098AC0FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954273, "uuid": "fe464ae9-6713-4e17-a6f2-0b7adc3b9e71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954273, "uuid": "e1bc8092-d303-4075-9be9-1ede842da2af", "value": "12288:XUjnh7q1DHDvw6LIN4WhKPTgbWGI5BT4Pvq0WW/iczlzXpX34:kjhu1DHDI6LrWEkbIx4PvqAr59Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657954273, "uuid": "1e2b2948-2bbd-487b-b4f4-178bc99b9ff7", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657954273, "uuid": "c100f09a-c251-4d81-bdb0-f87b189edff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954273, "uuid": "c9c723ed-be5a-4841-b45c-3fedf159a9eb", "value": "CC_eBilling juli 2022 xxxx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04de2cbc-04f6-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1657969020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969020, "uuid": "72c5d8b0-bfde-4447-b389-978dc84763fb", "comment": "Malware payload (IcedID)", "value": "35fd39286d8a77613d0ac64e61031b91", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969020, "uuid": "4539fd69-78af-4e33-ab14-8d7ce6ca5f40", "comment": "Malware payload (IcedID)", "value": "addca7f05d7f58f49c256f311aa336a7576ef7520ad3e266f82efbaceac0aef2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969020, "uuid": "9268ba94-8828-4254-a017-60dc8805e1be", "comment": "Malware payload (IcedID)", "value": "87ca321d429c59f37eab0ccfb936321480fc9889", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969020, "uuid": "c535ad3e-7c32-4a48-b0b2-6673baccaec1", "comment": "Malware payload (IcedID)", "value": "9c9cfd1e3f2b14b8c8d84e079140c4dd3737612e4d54421af134e0f8c1503e737ae779f5dd59bf45cc93c07d63e2f364", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969020, "uuid": "3b5ea26f-db3c-49ca-9031-c86c5f5ebb71", "value": "T11CE533A544925CE0ED9740B1C3E52E9A3B7F50DE0EB28C46FC9C47D2ABA72839F64345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969020, "uuid": "3e241a7c-8510-4322-b90e-76d11ec9eede", "value": "49152:zN9mpHiFvDzf9ZcVtee/ocIRK+jnd4wow/HYH7PPjwfL9uCGzrNYZ+:xgpevHlve/CKsKwvM7PPsDpG/KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969020, "uuid": "5f91fe88-9830-4421-a8b1-cd9d56784456", "value": 3139584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969020, "uuid": "1affa505-75ce-4596-a55c-ec95e63bbad0", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969020, "uuid": "1e3d1991-5c27-4657-8bf7-e91e120d1588", "value": "document-130722.21047.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee35a7af-04b7-11ed-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1657942354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942354, "uuid": "8bf586de-57d0-4a28-8398-d991dda1638c", "comment": "Malware payload (RemcosRAT)", "value": "9fdd27f115f1e89c06b2477e116df550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942354, "uuid": "ff9e96f5-0e46-4238-9773-422a35e74fcd", "comment": "Malware payload (RemcosRAT)", "value": "ae2b548546f132b1f60c06f9661027c56dcf4b0e5bf3517ebe834a1d6b3f6dab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942354, "uuid": "1ca4c4c1-f6d1-4e09-9fdd-31a3ab6ebb8e", "comment": "Malware payload (RemcosRAT)", "value": "369dc3600ef230447e9a4347d7d475a65d9385d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942354, "uuid": "d46182ff-6ced-47df-8584-f8f047ba36bc", "comment": "Malware payload (RemcosRAT)", "value": "f436ec5adcf4ec6aede7296f4c81eac44986f95334ec2d3c8fb2f64833f3b8631e78edc4ba0ea6cbc6b5db0fc1646f2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942354, "uuid": "043286ad-0608-4438-9b97-a22c76953686", "value": "T136057E66E2F084F3DD6A563D8E0B82A5D4257E106C2CD8876BE83EC96FF4A4135271D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942354, "uuid": "841067f8-a6d3-4aa4-b17b-24c97c5cd921", "value": "077780b656ccb18d86eb00528cd56a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942354, "uuid": "db11b404-b8f3-44d0-8f96-4a6fcc5c5235", "value": "12288:wmgi3VtzPY+ji70/Gm23P+SraklRm9Q266cY4s6JBCbRJ7T:wvuPY+h+hP+KaklRm9stY4s6JBCbR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657942354, "uuid": "ab23fd20-a140-491a-b21c-0713ed654382", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657942354, "uuid": "5b3e4013-178b-4624-b9fd-42f555ab20e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942354, "uuid": "3b5d9e3c-c3f4-4ad4-8924-81bf41a0432e", "value": "SecuriteInfo.com.W32.AIDetect.malware2.3091.12223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdaba0bf-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948285, "uuid": "6839a945-00a4-4516-a300-9aa3a6e791d9", "comment": "Malware payload", "value": "22b39cbfab67ab4491e9d9b034ecd41a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948285, "uuid": "a10b0843-b7be-4c28-a500-c9f71cd5c345", "comment": "Malware payload", "value": "ae6d308fae42abc06ec22ba816c3b8e1edf59be08d454362416effc726b31cee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948285, "uuid": "a9bbd967-60bf-475b-8a32-0e9415e6df29", "comment": "Malware payload", "value": "4f48fdd354f8311865171992eab28e59eba8ed7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948285, "uuid": "f55a2d3d-f1d4-4925-8ce2-0e2514d19969", "comment": "Malware payload", "value": "cd52c1df35a831b877781972d55084db736a30a0eb759c5afcfdc681dee4e5d45e5e0fa2d971c72833f6bfc24331d32b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948285, "uuid": "3f9ac642-8f3d-4fce-832f-ad795432afbe", "value": "T18D27CE73910738E9E5A98CB4D41425426DAC38875738A3C7BAC871F667FA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948285, "uuid": "061ce605-a3ce-4253-b77a-16cb078d8899", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaI:sXyWSpV+Wu7rI3JE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948285, "uuid": "0ebe0667-771e-4f55-a94a-1caca7b11a04", "value": 20938752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948285, "uuid": "d363b4a1-e3cd-4da2-8b85-23d06bc72a06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948285, "uuid": "fa3cca04-43f3-42ad-87b0-2df46f2457f6", "value": "ae6d308fae42abc06ec22ba816c3b8e1edf59be08d454362416effc726b31cee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43677408-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657948080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948080, "uuid": "99712764-888d-4d9c-a199-d0aa8bb7b9b3", "comment": "Malware payload (Mirai)", "value": "ad9989102b48a493c4b98705a79f34c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948080, "uuid": "cf64b59c-d5a0-4330-a528-ea5649edfc22", "comment": "Malware payload (Mirai)", "value": "ae8dfd0c2f7e45d09a01d7982773628ae575ea535345ad18f51263ac162f3b50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948080, "uuid": "a28a83fd-4166-4943-af80-0730810d9944", "comment": "Malware payload (Mirai)", "value": "9bbd52ad51ed5cdfaa513247a2b563376c17ab07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948080, "uuid": "e12fe381-4797-4d33-bfa7-b3853e7aaaea", "comment": "Malware payload (Mirai)", "value": "47e055755ea291d4583bc1630d231cb59a874472e6c4a89f33caa8d52db81a74f6ffb14e88b834b7d46eb4a3a45639aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948080, "uuid": "e15e0cdd-9796-4568-9f5b-bc32feeb0d98", "value": "T16D634907698181FEC19CC1B44B7BB93AC423B47D073CB6966BC5FE1A6C46E701E2E585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948080, "uuid": "bad10862-87b1-4547-b789-956b9f47d7b4", "value": "1536:UyhO7R+gDlcj1aC+B6gYAWAaUN2RimsnKngTQ2LsRmBaHX/8br32S:PhO7RNDWj1zo6OWAQzsnKnSnymBaHX/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948080, "uuid": "84d4a3c1-52f8-495a-a008-ad9663e4bb17", "value": 68448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948080, "uuid": "bbee765c-19b9-4092-96d7-cc745d9ec9fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948080, "uuid": "a6c589cb-2e77-4787-ab94-5770cfd31e02", "value": "ae8dfd0c2f7e45d09a01d7982773628ae575ea535345ad18f51263ac162f3b50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a82875f-0555-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658009993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009993, "uuid": "9474bd41-4341-4d6f-9eac-0f7114e0530d", "comment": "Malware payload (Mirai)", "value": "8519718e1e4627d0e3539915abb7eeff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009993, "uuid": "7e5c6604-9055-4c4b-ae40-349eff9db96e", "comment": "Malware payload (Mirai)", "value": "ae942ea6f049a5f63a7da2bb4a6922932ae15e47225864dfdc4994b82c53ce21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009993, "uuid": "4a07043e-3913-4573-969b-fbf8a9892ce2", "comment": "Malware payload (Mirai)", "value": "f67c95b122408ef2722069ff46924d6a8e8078f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009993, "uuid": "9fcf9a4a-3ee1-46fe-bb03-8efeeb8acb0c", "comment": "Malware payload (Mirai)", "value": "755c1a9a160b4e60b4ae150ccf695cf8076e169d50c1659f851f8905d4c86771b54b4151e82975bea0433db8e96a1d97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658009993, "uuid": "053178c4-dd5e-46ca-8d24-b20c884752f1", "value": "T122739109AFA14FF7E8AFCC3749A81B4524CD651A21A83F76B934E418F34B64B15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658009993, "uuid": "dc366f9c-08eb-4e8f-8254-f2a27d3f31a3", "value": "1536:LMtt1/QQ7955S1oayfDnXz3b9cZjZ8aaBmqs:gtt1YQ7P5+PGmZjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658009993, "uuid": "1984a491-a34e-4317-9119-862ddbf6d859", "value": 80584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658009993, "uuid": "8e5343e7-78ac-4e3b-aa96-d8746b664197", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658009993, "uuid": "351594a1-b6ca-4aca-8ad4-c580fed4292f", "value": "8519718e1e4627d0e3539915abb7eeff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68e6981-04dd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1657958608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958608, "uuid": "e1142800-932d-4ad2-aa02-a6c2a1c95aba", "comment": "Malware payload (Formbook)", "value": "e25104b004559874cf22fbfa97532f8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958608, "uuid": "b770c0c5-b2d5-429f-981c-b2490dde3fb8", "comment": "Malware payload (Formbook)", "value": "aeed24451d7a1f78825d1493b066abca5da5073e7a4ae5af5dc8ed05eea53f56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958608, "uuid": "7b7eb1a9-e9f9-4bb7-abd5-0186bf5ff2ae", "comment": "Malware payload (Formbook)", "value": "a847dc42b6df83db18ab7e89d8fc296eb9dcc6bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958608, "uuid": "be9fc20e-60f4-48cd-b52d-f9fb9f56a82e", "comment": "Malware payload (Formbook)", "value": "dc5a9e6fd1e86a3a96ab4df10d354ac4b3e1c9302ed7a4761df6b776977d54a80febeb9f004a953dd09ce4036226bc0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958608, "uuid": "3d2c6b10-48fe-40c7-806a-2f990db3a801", "value": "T17EB3B552368D8333D14E84BABA4501761B722D236753C77AE2D5BF789873302A776B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958608, "uuid": "7d198d65-066d-48b3-8e50-afe5958fbd33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958608, "uuid": "87b09c64-4383-4d64-b413-1a4899879d67", "value": "3072:NmHfp4dUzPOHb3vGsx9vXt5Wn6DIBnO6+jqDAhB:E/p4dUDOnY6sk6+WD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657958608, "uuid": "9abac8d3-222b-4fa5-a407-1d150d5206a5", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657958608, "uuid": "9659f4a7-2c97-4908-94a9-cf9e67b9a1f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958608, "uuid": "a59b8283-65d6-4dab-b1ca-f3db50f94147", "value": "e25104b004559874cf22fbfa97532f8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3997b67e-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948063, "uuid": "60fc8eb1-0beb-4474-a7e7-ddd40dc8ff5d", "comment": "Malware payload", "value": "83729884b886a483ab3cbf71999f8ee1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948063, "uuid": "f517b1cb-2356-4c4c-9cfa-600e7df85f53", "comment": "Malware payload", "value": "af32ae5c37ea109da30d06482219fce8bd7964b40462684a265c3fdf2c2543cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948063, "uuid": "316592fd-5f06-4811-b016-bee78f1ecbfe", "comment": "Malware payload", "value": "fb1270650bb68b1b4137ad9015e38ff3ac173c6a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948063, "uuid": "f6254d11-57f9-4df1-82b5-3a18860cf8b6", "comment": "Malware payload", "value": "42a069ef0dbf8de47cd522a6fb17ee428c483963e46f664a281bfc0c7ad41f1c44bba2e7a8adfe6139a62cb6d0eac2f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948063, "uuid": "795a5157-8e54-47e0-bd02-490342d916af", "value": "T186A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948063, "uuid": "71d09588-0056-4ddd-a3a7-52f6595e7f44", "value": "96:PRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:PRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948063, "uuid": "2e0b2272-50bf-4918-9ba0-9cb092a70a44", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948063, "uuid": "ba1b0870-1ec8-4d63-b809-50093bfc13f2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948063, "uuid": "d871fa7e-e85b-496c-9511-6045443b64a7", "value": "af32ae5c37ea109da30d06482219fce8bd7964b40462684a265c3fdf2c2543cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25847812-04c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657949748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949748, "uuid": "b548aebe-a500-477b-a330-6e00fb3f974d", "comment": "Malware payload (Mirai)", "value": "079fa3c11e05cbc0c9ddffe01468d2d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949748, "uuid": "71f359b3-44c2-422c-9c20-78c43fae76f2", "comment": "Malware payload (Mirai)", "value": "af6042113e06cfaa0e4639731e9484465b820007a39b96c3b12932c74c87c66c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949748, "uuid": "1aa728a4-f3ce-4eaa-8f8e-6c894d98f3b5", "comment": "Malware payload (Mirai)", "value": "5f799f877ae5e7065265495d3dd70d9b1fcd9c4b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949748, "uuid": "0c9ff476-6981-41f3-90a2-993f1ff03a2a", "comment": "Malware payload (Mirai)", "value": "adb9636e0669dff2a4de0fe192ab0e867338d698928ed75a89a8b40c1991d10946e842b653ca4f1c5e96e61014a24bfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949748, "uuid": "167b138e-8427-4f30-9493-44ae4b8e702d", "value": "T15A934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949748, "uuid": "80dc2e0e-22b5-482c-9b05-6110fed361d8", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v3qphauH/SPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGdqphaE/AVog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657949748, "uuid": "49b40b9e-3b2d-43c7-9693-c712caa4b658", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657949748, "uuid": "e3c6cf3f-316a-4ea9-95fd-0b2f3b78e5a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949748, "uuid": "0ae9ffba-0c02-4bf8-bd43-a2ca4822b186", "value": "fuckjewishpeople.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7def635b-0557-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010885, "uuid": "0ba355ea-50c5-444b-b329-33f45be42be9", "comment": "Malware payload (Mirai)", "value": "9ec73528f0b4d94715c8282ddd5597cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010885, "uuid": "406085d1-5ff4-4217-8920-9e67acdecff3", "comment": "Malware payload (Mirai)", "value": "af8c3093fe3c5ec68138477c18365b24952becdb9747aa433ef6b4d31bd06754", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010885, "uuid": "52bfc59f-4eb7-4f31-8a68-8ae036d21feb", "comment": "Malware payload (Mirai)", "value": "630588aa3b6e833fee311114a9357e8e0b95c85f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010885, "uuid": "2e4b2301-76b9-42f5-87ea-90a7ad23165d", "comment": "Malware payload (Mirai)", "value": "1a875811493c0c2b315afbe6211695947380e5dee8f20772bccb535191ac33a60b87422c334fd18c56019c56fea8472a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010885, "uuid": "d27d50a5-611f-4d1c-823d-bf3c4e3a8da9", "value": "T1F6634B366D7A2E26C1D0A43E21F74764B2E11B5E3AE8CA1E7D730E0EFF50A5060176B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010885, "uuid": "97e02fc3-106f-44cd-876f-2e1b0e02f754", "value": "1536:JBzRB3V+zrUB5HdS5Z0ClBZJEeN7OpTW1:HD85RLTWpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010885, "uuid": "cf8ba2a7-4315-42dd-9eb5-d3bc65d19c64", "value": 72880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010885, "uuid": "cf3ed425-d938-45b8-9e38-f02810bd0626", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010885, "uuid": "6143a950-8ade-4b6e-8886-d729ca05220b", "value": "9ec73528f0b4d94715c8282ddd5597cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37193178-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload (XorDDoS)", "timestamp": 1657948059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948059, "uuid": "1559304f-5f38-4910-80d5-46459961edcc", "comment": "Malware payload (XorDDoS)", "value": "1f7eaddad3a0502ff9bb349183d52331", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948059, "uuid": "0414bb70-d80a-4e4e-9b3d-6620d29c8fbc", "comment": "Malware payload (XorDDoS)", "value": "afd78465d9e05a615c0c47ef308e1d4db56b7a1135b790957fe15a3d8f304c14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948059, "uuid": "ebe68ec4-85c2-4e48-9635-2a75fff932fd", "comment": "Malware payload (XorDDoS)", "value": "4332c5473b34fdf110d5117f5b810925766e3821", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948059, "uuid": "f26c20e3-ec63-4b90-907c-4eefe83d377e", "comment": "Malware payload (XorDDoS)", "value": "3555cd57f8490dc1e7e87a2d082a38fd06e10fcc6e8f0eb4cc47da17bfacd1aba6b0242aa675357930be24e0c57de81f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948059, "uuid": "d1fbe162-b637-49a5-8ebd-19fb6d0621df", "value": "T1B2B34B06E14390F2DC2B05B11297F7BF4B209235D820CE95DBA49D4DBE77CE22A4D7A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948059, "uuid": "c4c17f16-bf94-4314-9760-d8cc19c110f9", "value": "3072:8TTAhQjrd7bvx3jAJxU9RGBJMIlcXdD0y3pO:VufRvuKqCdDVZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948059, "uuid": "2446b18f-6eef-4712-8a94-3800aefeb342", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948059, "uuid": "fdfe45f4-aa25-4dd8-a121-c7b476b1660a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948059, "uuid": "e81a9482-58cb-472b-8ee5-c1e9724bd978", "value": "afd78465d9e05a615c0c47ef308e1d4db56b7a1135b790957fe15a3d8f304c14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a621648-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948199, "uuid": "241bb3d5-c90d-444b-89e3-8b33c144c838", "comment": "Malware payload", "value": "82def0771bbe0b7780c87838c4deec74", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948199, "uuid": "bdccee72-9fc0-408f-9c7b-a282badc15ec", "comment": "Malware payload", "value": "afdebbe55c60ec1e24ca77006e216caa516e3da25aa6a1d3c892b696f3b1c3ba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948199, "uuid": "9598de39-23cf-48e2-9511-9b322997dd75", "comment": "Malware payload", "value": "6cf3045d232534cef9de0a261b2b62d963cba870", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948199, "uuid": "2d42fb50-4c36-4574-8a53-28c76894af66", "comment": "Malware payload", "value": "3e3ed7325c89d047d8d6671fc25178e66bec95bcf22474b796de3dda614f19499afa573c866afd22551c6c04b868d485", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948199, "uuid": "78bc81bf-c596-42ca-af70-c1516ffd7a12", "value": "T132E02236FCC184BB253EC55AFBE7AC4E640F2226464B053C97E95843B8BCC449021C37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948199, "uuid": "862e4726-9d5f-47a3-9832-47fb6c772f9f", "value": "12:/QbHhmLOY3NitgrZi1sgrZiyTyigYtPi5yii1:ahmT3SWbW3fRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948199, "uuid": "3c5c2bb9-a9c0-42c8-974f-a6a08d3c4f22", "value": 407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948199, "uuid": "4d54a2c0-5e99-40a2-8b61-0decfb314652", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948199, "uuid": "5485779b-c71d-486e-97f8-f508876bb403", "value": "afdebbe55c60ec1e24ca77006e216caa516e3da25aa6a1d3c892b696f3b1c3ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d27bae-0501-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657974015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657974015, "uuid": "27a5de64-6c63-437a-8cb1-dbcc662458d2", "comment": "Malware payload (RedLineStealer)", "value": "f1d0e11b862a34f1a2f729ee0e2b3bc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657974015, "uuid": "9b52c93b-597d-4e43-b1ce-79ee43bbc54a", "comment": "Malware payload (RedLineStealer)", "value": "aff97bf7891782cdedcffb0f52c0ad168fc654e7c1a0e97e0de7cef8d6cb0145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657974015, "uuid": "b4ab2e9f-17ff-420b-90e8-e0c1781b5849", "comment": "Malware payload (RedLineStealer)", "value": "b117148640ecbf48ad03ff4cf192c0c47293f41f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657974015, "uuid": "4d1c88ba-d6a2-43a3-8d4c-23acccdf539c", "comment": "Malware payload (RedLineStealer)", "value": "969dd3c1b56ebe7dd2eaab1ba0b53bb470f0be517dce6c843b1cb975ccf829319410e598d70500af7491db59224b8029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657974015, "uuid": "eac96737-f10a-4419-afc9-1733503f0bef", "value": "T1F294C004BBA0C435F5B752F459BA8368BA3D3EA0576450CF62D56AEE1B346E1EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657974015, "uuid": "7a32def8-0073-4c30-8076-ef3806835d65", "value": "363debf0ff85eb6df1e94b75eacd8b61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657974015, "uuid": "42925bed-e3a2-408d-af76-2a5d8ab3e0f1", "value": "6144:4j69P1AtFHUiRb6gcCCz1R5tjoaNWMXe0iR16Xd7NiFD2Y3orOvJOlMphhz:4j+MF02eRCCz1R5t7N9448R2Y46ElM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657974015, "uuid": "a51328fe-b434-4f78-bccf-cbf07ec8d5ed", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657974015, "uuid": "d4fbbf72-ab6c-40ef-b924-d9bd68b18b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657974015, "uuid": "4c0a88bf-8439-42aa-a5da-edd4785d8ee6", "value": "f1d0e11b862a34f1a2f729ee0e2b3bc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84625f0d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948189, "uuid": "501cd86d-69b9-46e0-bf53-8f1b2d9ae3df", "comment": "Malware payload", "value": "a53efd25ca4d465c076aa5f094d566b1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948189, "uuid": "48c7e5a0-3d88-41e5-bcc2-194608339088", "comment": "Malware payload", "value": "b02073e14dcddc91b7720beee17b866e88966d9e252a4df262e7a6c55c400435", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948189, "uuid": "228d9540-b57e-4efa-ab9b-f48c2524773f", "comment": "Malware payload", "value": "68b7a3972ed561e00634fc93dea2449b1e6144c7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948189, "uuid": "8cee8155-54eb-4115-a3c4-e7c83d8a58b6", "comment": "Malware payload", "value": "5d0ec7bac5d77fc63e289c6085f10b2aee81bc794e3c82dd77dceefd2066c0d451eddb56d55817c8d06c6a1e75c36603", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948189, "uuid": "7c35de16-c7ad-4f5b-8b8f-4b616818cc49", "value": "T17BA1E650112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948189, "uuid": "88126425-f0de-4d2a-b97b-875e2815f713", "value": "96:6RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:6RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948189, "uuid": "f9354b68-3116-47f4-aa45-a57c5edc0a1a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948189, "uuid": "ee65567b-87a3-45b1-8b27-38cd00d94c20", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948189, "uuid": "561ebfdf-831d-4ac4-bbe2-76ee95ae1d1e", "value": "b02073e14dcddc91b7720beee17b866e88966d9e252a4df262e7a6c55c400435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b98660-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948037, "uuid": "6450f727-db01-4df5-8509-c05086195b31", "comment": "Malware payload", "value": "8c0aa5f0440bda9e0efce462631620f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948037, "uuid": "b035024e-694d-43cc-a4cd-7fdd6cebd1ad", "comment": "Malware payload", "value": "b0a5d4882d3c8a301f4652376f208110e323d5a5365b0d4713ee7aeb8d586ad9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948037, "uuid": "f48ca4d9-c415-4fd7-b3e9-cdb5a7559207", "comment": "Malware payload", "value": "5aea4c9afbd66a150b26f5de5247d712b635af33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948037, "uuid": "b82ec213-419e-4f22-a41e-bd5f8ea9aaaa", "comment": "Malware payload", "value": "9ca69ea640c415295e6b73a5430534a371fc9aafb25f0144e81f88f8c1a91156c6ed170e8536e589c51cad436510a365", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948037, "uuid": "b072df4d-96cd-4d89-8776-f451ee025b8e", "value": "T1CE27BE73910338E9E5A98CB4D51425426DAC38875738A3C7BAC871F667FA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948037, "uuid": "cf901fa7-ef97-4827-ae98-177de82f4ad8", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaH:sXyWSpV+Wu7rI3JEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948037, "uuid": "0be0c11a-e754-4b6f-9260-a658def7fab2", "value": 20447232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948037, "uuid": "851f20c3-afb8-4909-bfc2-0ba187037c7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948037, "uuid": "134dc506-b559-4026-8b24-d1dabdf49266", "value": "b0a5d4882d3c8a301f4652376f208110e323d5a5365b0d4713ee7aeb8d586ad9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f7edb8-04e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1657961070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961070, "uuid": "0442c259-3043-4c42-9020-f38f1b9971b3", "comment": "Malware payload (AgentTesla)", "value": "b5b95612a1717b0941f5b10d39415ff2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961070, "uuid": "5b676c1b-2620-4906-a663-56b87405a74c", "comment": "Malware payload (AgentTesla)", "value": "b0b4d749317091c81d67ec20fbb4387c4814115e7e336448b1f4270b4e89824e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961070, "uuid": "788e4b3f-ea7a-4245-9029-e01413d4ee45", "comment": "Malware payload (AgentTesla)", "value": "5f36bf7efedec31d737dc1d79181d2cefa6adf7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961070, "uuid": "2a2f061a-0be5-4e1a-9a0c-ff52b9b64ae1", "comment": "Malware payload (AgentTesla)", "value": "41c50228f0459065c0b9de127336ee26a62587202e1cb86b3a3b7fadb6926aa1011cd9e323547d7bc7028c4331b200a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961070, "uuid": "ea31a7e8-b726-4980-9160-8967a380b70a", "value": "T1691512227614476BC47D87F1E03298E013B2AEC66113FB954DC4B9E729737509A0EBEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961070, "uuid": "b782ad29-68d1-4ba3-98da-1c6386b94c8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961070, "uuid": "9ae52cfa-b1de-49dc-8e86-4b03324fd35d", "value": "24576:UlhLuyyhnsbVv8ssEm0eT5S/9kr0afrWEr659Y:wLuyyQsEmLtQErtGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961070, "uuid": "99238667-089f-4400-9ddc-ea039ebddb23", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961070, "uuid": "bb1d3ba1-dfab-4153-9952-4f1ce84e2483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961070, "uuid": "7f614f0f-c4c1-4bdd-b262-d0cd64be3f43", "value": "b5b95612a1717b0941f5b10d39415ff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90aabf57-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948210, "uuid": "099d3006-112f-4f4f-9e8c-38cea73702dd", "comment": "Malware payload", "value": "60b02390c40315d4fee8b21daa0488b7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948210, "uuid": "ee99b1f5-3903-4cdd-946d-d226a09bc64c", "comment": "Malware payload", "value": "b1b0b687508f4712bed3897e8c71408b4c98dca30faab4c86cbf86d239b36198", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948210, "uuid": "d09ad562-0e36-405c-b8fb-e2206eaa42d7", "comment": "Malware payload", "value": "d58df0b26f13e6a7f8f246fa00fec9c65e77f86c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948210, "uuid": "ef8cdfc9-8d7b-495c-be36-9c47970ad307", "comment": "Malware payload", "value": "f998abb0f0574474b229021647d47e4f4d532556de46f834a02f20e75cb446ef4f2f12b1d73211b0235744b64b3e3963", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948210, "uuid": "a51cd8c2-1a52-41b0-aea4-a8b6bae75641", "value": "T1B6F02749E888C8FEA03FC89EFBE63DCD110F51200A8B2E2CD6B65D02B4BDC585091833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948210, "uuid": "89011107-2eb6-4440-b4f3-e86a7111b9ad", "value": "12:/VJ+TNLI5SVCYfBiuy4gX6vsesFrFBEGgX6vgu+hYuTyisJF8EpASNyiiuyw:NwTNLI50Ri6krTBEGi6JnuoLpvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948210, "uuid": "f74114f4-8adf-42eb-a919-1e0be1beb197", "value": 491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948210, "uuid": "e8d1632a-6b7d-48f4-a92d-54be2b7d4ccb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948210, "uuid": "73acc1cf-904c-473e-99e2-7e408586a8d3", "value": "b1b0b687508f4712bed3897e8c71408b4c98dca30faab4c86cbf86d239b36198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe2dbbd-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948665, "uuid": "0309916d-dff6-41a0-98bd-a8898871c43b", "comment": "Malware payload", "value": "6273265f6524fb17cfb2c115715b9b8f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948665, "uuid": "97ece06c-dcd6-44b7-a416-76dd7af130cf", "comment": "Malware payload", "value": "b1be3880f0005b4c1e3d6872a5990c196aafa8c5d369cffd6f944b033371f0ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948665, "uuid": "09c80818-03e6-419e-8aac-12746235f773", "comment": "Malware payload", "value": "8d3fe13b0ba285b38e859205f437e35462118cb1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948665, "uuid": "2a1183c1-244d-481a-b29b-808e38fbe908", "comment": "Malware payload", "value": "ad18a9284400854870b80a7af5ac32687a2968496fa1827e91b418099a1ea32081740bbf415f439975da4efdb682806f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948665, "uuid": "f620bffb-1363-4534-bfc2-573cc9ebd938", "value": "T1D0A1F850112C1AB17246697AD26FFA92B40EC81B0A7B7B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948665, "uuid": "bbb81173-6d41-41cc-a0a5-c5c542771667", "value": "96:RRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:RRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948665, "uuid": "e4728ea9-acc0-4055-bec8-de1d4c0e8efc", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948665, "uuid": "ec917f2a-b8a0-44bb-bb45-ed8363f0d812", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948665, "uuid": "48c2b9d9-11d5-4a70-9ef0-ce319f74bd3c", "value": "b1be3880f0005b4c1e3d6872a5990c196aafa8c5d369cffd6f944b033371f0ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4bb3ba-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947986, "uuid": "60751aaa-9b67-4de6-a083-c41d59cb6edd", "comment": "Malware payload", "value": "ec8e33a7fcd21261b576ff992166eaae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947986, "uuid": "ff99c2b0-1e93-47f9-9b33-aa426a4ac6bb", "comment": "Malware payload", "value": "b1d05e6e289cfdab11383a15859f563352b6245613869cdee25bdc32abdc5f8d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947986, "uuid": "c9760751-a51c-42cc-8596-8877483ab523", "comment": "Malware payload", "value": "1a920a43e2569fb8137532c4df6b0d06f00218fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947986, "uuid": "6cab87f3-9cd0-4d68-bab3-a84333b4b920", "comment": "Malware payload", "value": "94f37b564b7cdf7fea39f8410307aa3eff9862d99f79dd9545df85a9b4dae5f9a6355d145a8db58caf80e3febf876edb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947986, "uuid": "2bb62e65-6194-4a0d-ad2c-21a8b9f2e7ea", "value": "T1644139D710914AF2ACA4ED33336E5480B5D0E19695CA5F06AEED3DE84CBFDECA444682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947986, "uuid": "cd6e196f-545a-4a8a-b1e2-9ea5287f67dd", "value": "48:vsd8jDttQdMqYNfRf78T6eCKIpL1z5NKIRxIT:vsd8jDttQdMqYNfRf78T6eCKIpBz5NKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947986, "uuid": "b22be406-4a6b-45a1-a41e-b206e8341d5d", "value": 2111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947986, "uuid": "14cf40a4-9b18-49c1-8986-bb0911343838", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947986, "uuid": "0f8fa309-04d2-4f9d-b054-f851238cf9de", "value": "b1d05e6e289cfdab11383a15859f563352b6245613869cdee25bdc32abdc5f8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ee05d1-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948010, "uuid": "9fc89e02-403d-4119-a1b3-ae074732ce07", "comment": "Malware payload", "value": "302a9888612858e33084446eef400fd3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948010, "uuid": "c0b47c1a-7c6b-4551-bf13-83f4380b9ca0", "comment": "Malware payload", "value": "b24ded624496888697bc0d2906b052bb1de9ca3ef6fc909f41e05e4e820b5818", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948010, "uuid": "748ac5a9-7302-4ae9-bb72-5bcb0efc6301", "comment": "Malware payload", "value": "a5bc71a2d191d1496158b96785f6d522c59be60f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948010, "uuid": "a554b5dd-be2f-4f56-b9b3-82c3835dec9f", "comment": "Malware payload", "value": "4c6faeef3dc431defc43dd7c9c02bb6f53b6d74994553fbae3450d56a20f43c7bf6331a75de9efea795844249b8f40f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948010, "uuid": "edf5d8a7-c962-48d7-a76e-8f019bfa6f5f", "value": "T1B0A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948010, "uuid": "3c5e9049-29c7-43a4-bd6b-99e7cacbec5f", "value": "96:CRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:CRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948010, "uuid": "6feb490c-ddc7-4775-8f32-f7b3d0737232", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948010, "uuid": "32a9a69f-19ce-4026-a608-586368f3dbb1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948010, "uuid": "bae75309-5833-4123-b942-1a29b8a3380f", "value": "b24ded624496888697bc0d2906b052bb1de9ca3ef6fc909f41e05e4e820b5818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3a1888-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947957, "uuid": "2923f0f0-dd59-4b12-b4c4-af744991a7bc", "comment": "Malware payload", "value": "c41f72b1a9e4a4b57d9df90000cf3bb5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947957, "uuid": "7af8b4f5-0bcb-46d7-84a1-5c1b1dff48d3", "comment": "Malware payload", "value": "b26540479ded524cff3557baa0d036af832cc9dc814880223a1c899e74dc3a3e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947957, "uuid": "16cd92af-787e-486d-ba9b-ea73d6a86aed", "comment": "Malware payload", "value": "b276cb7ab9d17184f050ced378b003a51814a89d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947957, "uuid": "0a330cc7-ea4a-49e0-a8d5-1664644b8779", "comment": "Malware payload", "value": "2ff89b1abc1fac80c58702037467eb5bd4787e8833030574265ae3a366870eba524a9b756814ddd359d2e0f8b9b77f11", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947957, "uuid": "84ccaeb1-7da1-46bd-919d-f757c30a79ad", "value": "T16EA1F850112C1AB17246597AD26FFB52B50EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947957, "uuid": "72632e2e-0c16-4af0-a6f5-5d73cceb54d9", "value": "96:cRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:cRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947957, "uuid": "eefeb6f7-c9bf-4f31-a993-8eff1359259e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947957, "uuid": "5a0f2da6-5608-494d-8304-dd150a392d66", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947957, "uuid": "ac794d6a-5208-41ee-9bb7-a7e071f5b355", "value": "b26540479ded524cff3557baa0d036af832cc9dc814880223a1c899e74dc3a3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732944a5-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948590, "uuid": "f4b523cf-e573-4e69-bf4d-7db43ea2e0a8", "comment": "Malware payload", "value": "5cc9eb04db9f4568054729919a33dd33", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948590, "uuid": "e57fb58f-b142-49b0-a768-eb722e6504dc", "comment": "Malware payload", "value": "b2b7eb4ea6cbc43691504f29eddc627903569b61879e3a46e7f759b863e63315", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948590, "uuid": "77f119c5-88bf-4bd2-88f0-a6554394fd88", "comment": "Malware payload", "value": "d46015f8c9b4f9a2869b9305c05e2bdbd5962aaa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948590, "uuid": "af8ab97c-03c2-4f6c-882a-daada52d019e", "comment": "Malware payload", "value": "984453b9437aeb38e3d73300fffc18156bd19960cbba03d79c890100d2aff437227d5112c2f0e9c5dc14553c3171ea06", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948590, "uuid": "648c03ae-aa38-4763-befc-60137697fe29", "value": "T1C6A1F850112C1AB07246597AD26FFA52B40ECC1B0A777B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948590, "uuid": "a5150350-3a0e-4235-9db9-a9897475b3f2", "value": "96:kRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:kRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948590, "uuid": "96bc9d44-b1e9-433f-9074-9f95ed7ffd50", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948590, "uuid": "6d26e207-9c03-4735-a1b7-4dd00bbe0f50", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948590, "uuid": "d1d03886-d0f9-4d92-9f97-b3c2980069e8", "value": "b2b7eb4ea6cbc43691504f29eddc627903569b61879e3a46e7f759b863e63315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdce741-055f-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1658014238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658014238, "uuid": "0639f21b-f742-424f-acd4-9a6065683106", "comment": "Malware payload (DCRat)", "value": "74e57bfab8bb68d9a8874ef4145df83f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658014238, "uuid": "eb5dd842-a67b-44aa-93f8-c625c7a458a9", "comment": "Malware payload (DCRat)", "value": "b3236219bd0c9d0410e8a017160927a32df469709f4314776034380bbc7f3e40", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658014238, "uuid": "68dd231e-66cb-4a42-8bc7-576253669647", "comment": "Malware payload (DCRat)", "value": "3d2bc70a8e1431e8b549885045effc04e4f63019", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658014238, "uuid": "bf99417a-6a83-4964-a4af-ef5a118390c7", "comment": "Malware payload (DCRat)", "value": "fc13fb6d5e12e32b12404120921554df9d61417d83ed1c86689485e5101e5c6e262f5e3f09e5409c21a5181267762102", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658014238, "uuid": "ad6a3e55-4985-4239-b61e-d73008906b3f", "value": "T18E354B027E44EE12E4241237D2EF594443E0EC4266B6E36FB9AA37BD25413A77D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658014238, "uuid": "2fc52964-fd9e-487b-a956-c1da050abe53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658014238, "uuid": "1e8c74f7-0805-4ee5-b54f-2ce7ed685e97", "value": "24576:LBsIhRnSwx0Xdw3cnJggi2/WYUli3vOur7saEf:dssnBlgi23X3vOU7saE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658014238, "uuid": "495eec5e-65f6-4cec-8ec2-029609b65597", "value": 1140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658014238, "uuid": "464eec0e-24e1-49b0-99b9-7d2834b1bc07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658014238, "uuid": "aeffe5da-696b-4004-9a67-a6d0b06b16b1", "value": "B3236219BD0C9D0410E8A017160927A32DF469709F431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b85f076-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (XFilesStealer)", "timestamp": 1657971421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971421, "uuid": "582cb4c7-fc9c-4625-a694-3b777882396f", "comment": "Malware payload (XFilesStealer)", "value": "bcc100240ed4a967db81fe5b102a2469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971421, "uuid": "56ef96ec-45a7-4d7d-ac47-112a6fb8b2fe", "comment": "Malware payload (XFilesStealer)", "value": "b3531e773edc6a85ae062b2a592fdc9cfa9e58594b0dca944fb932bfb10e9eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971421, "uuid": "c857ef09-e35f-4ba8-8ac7-67fdf0dedea6", "comment": "Malware payload (XFilesStealer)", "value": "6975a1102cbc5054dc6609eb2843c39baa69f17b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971421, "uuid": "05207429-3010-4df9-8cab-148177a978dd", "comment": "Malware payload (XFilesStealer)", "value": "15cfdd767dfdf9ad94444d0bf43bb5977273ac8059237fd318f83e3372f27896407d6b119f3844a63ee3f903cf799e34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971421, "uuid": "872f9862-de83-4a76-94f5-b19c0f0ad1ae", "value": "T1FA05C9625492B800D9188776FFA51810DBAC978EB4DFE4BF64EC536E3E7DD2EA100235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971421, "uuid": "18c95a5e-13a8-4f08-bd26-8e996265732d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971421, "uuid": "27c4d2fc-b233-4560-9490-6a4218b6d4cd", "value": "12288:6mEwV6nBJviS0JLQ7UX4D9klPbZVDcBzxSM+JIDtoF3NF312VB:Uwk4S0JmUe9kcBzxSRIto5Nf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971421, "uuid": "200f66bf-39c6-4ed0-9f5d-1fbd7e2ed6fa", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971421, "uuid": "effd7ce8-9fc0-4de8-a550-e91e55cc8cb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971421, "uuid": "492567f2-bec6-4625-9745-ba28ecd8e036", "value": "WindowsDefend.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305efad2-04f0-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657966516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657966516, "uuid": "2d29b419-11af-4c17-a931-e064339640a7", "comment": "Malware payload (RedLineStealer)", "value": "d1739352e03bee21f127d7d3c210127b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657966516, "uuid": "45678d41-4533-4443-8612-dee6e5f47c8c", "comment": "Malware payload (RedLineStealer)", "value": "b3954d1c138ab6df51925cd6153b2120f078eb0353e3a7ddf57c8dc357618af7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657966516, "uuid": "1403c4fb-9044-41af-85fd-cdaab8d859e5", "comment": "Malware payload (RedLineStealer)", "value": "23a0cb42e57a55c8ae1c19dcc64a730b2d7fe2dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657966516, "uuid": "91805ccb-930a-42a9-a47c-03b6bb8c0aa2", "comment": "Malware payload (RedLineStealer)", "value": "f7b3920fd7b6cc9c6a93c4cd97e26b4d72f28781b02cb4845e9bd6237e36c4eee77d1d8521c76fbaa4b96b03b73b8f12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657966516, "uuid": "aa9a2c08-65f5-466c-933c-3014c1feda17", "value": "T18394CF00BB90C436F5B752F85AB69368B52E7AA0573450CB62D16BEE5734AE1FC3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657966516, "uuid": "4b690a31-f100-4903-a473-b18422c98fd4", "value": "149733ffc6fb8cb84df8287483828e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657966516, "uuid": "e72f444f-8c0b-4f1a-b428-393d9f46486f", "value": "12288:fNHPCjuemeK7AWhRI6VRypR187fG0ZV3:VHKj9GnIfkfGG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657966516, "uuid": "aa489a4d-7a45-4fa5-9a4d-4fff783fddfd", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657966516, "uuid": "cd3bb85d-7dcb-4979-bd89-256886f13912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657966516, "uuid": "35775cba-d816-477c-902f-a18a68767f01", "value": "d1739352e03bee21f127d7d3c210127b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beda7158-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948717, "uuid": "7fd293cb-b437-40c5-8d8f-e1c7553bd965", "comment": "Malware payload", "value": "50cea58b1766003d3b3bed26ab3bb238", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948717, "uuid": "a11182e0-9b77-4a90-8d89-5d421bfa34f4", "comment": "Malware payload", "value": "b39ef4c6b5c1fbf51b856cd1e77f5173ea8d78c6e73c4f73264115469d09d313", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948717, "uuid": "8076d653-e653-4806-8b45-2bffbdbcc09b", "comment": "Malware payload", "value": "5cc43d187c7424d62ecab81fa0e753b0d8c984f2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948717, "uuid": "03ad4b92-643a-4ff4-89d1-c5f9746642d3", "comment": "Malware payload", "value": "78e9eee78568f2a5d88a7fd41435547a8c06618709b99a5210a304b93a91e821f2b0ef0452f10340d814c060de2e7658", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948717, "uuid": "5e9afcc8-ff4c-48a4-92f0-5ba820971c82", "value": "T1D9A1E750112C1AB17346697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948717, "uuid": "8ecc05f1-c3a7-4d19-8735-efbfb3599b17", "value": "96:BRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:BRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948717, "uuid": "f21b9866-5b79-4974-bacc-76c6f1714a54", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948717, "uuid": "b4219273-f785-488d-8ac8-8a5adc83d0f8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948717, "uuid": "fc9d8a97-08a2-4d59-a984-e02daa84dc90", "value": "b39ef4c6b5c1fbf51b856cd1e77f5173ea8d78c6e73c4f73264115469d09d313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94dd3cf-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948815, "uuid": "64e3197a-d472-4824-8505-3abd14074070", "comment": "Malware payload", "value": "5855f3bed205e59f3c64965921b51c45", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948815, "uuid": "9f8c3a82-d061-4bb7-bfcb-23f22ed388bf", "comment": "Malware payload", "value": "b3bc710dc4748d598e360caabb948c760167dd86f0d244f9fe7e531963fb7718", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948815, "uuid": "c65c9079-6db5-481a-a7b9-d42bc1b4c941", "comment": "Malware payload", "value": "afd99b1a5f299bf9d62de62af8de76750ef1d34d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948815, "uuid": "a66d93ba-cb73-474d-b8cb-7c7ecad0e34f", "comment": "Malware payload", "value": "33b335ebc7cd261df4d760b4641dfcbb2c6dc9b29a44275f6f98f8bafaaa052bd0dfc94b812301e6892bbf2725f07770", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948815, "uuid": "30a8028e-c365-4b1a-b89d-d3673a2b7110", "value": "T106A53336F0FA78B43A05FBF64940D6347AB6C38A39FA33221EF89CCA55281577675058", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948815, "uuid": "c3f62e0f-17a9-4a5e-baf1-b8f5c23607e9", "value": "49152:ijoGN5J3sAs+aa8d6q3RKNhvqa87NXcHnSySdkOFOd+LgEBf:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948815, "uuid": "948e1096-a9a1-4480-b561-b5c79f7be380", "value": 2121728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948815, "uuid": "a0a04d48-3359-4d67-9e53-6a4fedf37cfd", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948815, "uuid": "fcf907ec-852d-4bc9-9907-2575552b74d1", "value": "b3bc710dc4748d598e360caabb948c760167dd86f0d244f9fe7e531963fb7718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3623527c-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948058, "uuid": "bfffab00-16eb-4dea-9155-673c06f1c5f2", "comment": "Malware payload", "value": "34a78f9f8eff8b177c078370eafb5596", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948058, "uuid": "dc3bb15e-19e6-4fda-b04c-b537da24ff25", "comment": "Malware payload", "value": "b4fd39eaded4d3ad12795fa82f05f4a185cabf1c4ef3c6183772a9083e9268be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948058, "uuid": "5965f5b2-a942-42e9-b4ad-a7320e42fc95", "comment": "Malware payload", "value": "6878c8849a9d07c3f93a6fefbc080c990ce44761", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948058, "uuid": "77e775cf-af83-4394-b5e6-49f0bc614d3d", "comment": "Malware payload", "value": "1babc14aef6d60f11b5be0157350b19e12df8b1a67d94318705c69eae2d8e5ecfadcbb8a751e5c6813d83e3475d1c3d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948058, "uuid": "50eb77b9-01b8-441b-89b2-9bfec9b9a4d7", "value": "T1BAA3F787A895A0E4D5FED074CA26A202BEA17494073427E77F6186F10F27FF96A7C314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948058, "uuid": "e5aa2e9d-ac42-4a69-b8e9-d8ebc1eb9268", "value": "1536:AHbMwjc63iemxVwTYBgTxNJn4VLi+ei7lQSeE2syK:AwwkMYBINJ4i6lQHJBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948058, "uuid": "775cb6e2-585e-4d34-b3d4-14c9956e481d", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948058, "uuid": "3e97d47b-4c10-4974-8bae-5532737cc93c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948058, "uuid": "76d2d748-8212-4697-8f68-4d99c5710b1c", "value": "b4fd39eaded4d3ad12795fa82f05f4a185cabf1c4ef3c6183772a9083e9268be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c9a48a-0520-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657987437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987437, "uuid": "0f91d689-765f-47fd-8349-fcf74e35ca01", "comment": "Malware payload (Mirai)", "value": "ab0f8857fe744d128d210d7a83faab21", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987437, "uuid": "6db5e0ab-5097-4c84-af47-ce47078b78b2", "comment": "Malware payload (Mirai)", "value": "b52cace77d5075b6134d8344d373e75ee96df622ca6685598574f30f7a074833", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987437, "uuid": "0b2ebf25-17f9-4e24-90f4-d24df833b4f4", "comment": "Malware payload (Mirai)", "value": "c788c588e16b9cf10747716b5a01b111682608d3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987437, "uuid": "d7bca13f-6214-418b-a0a1-69ae386b4f11", "comment": "Malware payload (Mirai)", "value": "fdaf0fb192bd63e148bbcbb2b2c1be9da03a0429e14a05aa45d7f82ee29733ed446a6504acc09544a58048d252db433e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987437, "uuid": "a95a0c20-1ecd-4056-bb9a-a51281a72191", "value": "T1DEB2D03C1B151AA8DE1EC0BD83AD1B213CB41B3591829E4B6207FDD7AF968747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987437, "uuid": "ef71e5e0-47c1-43ed-ba8e-5ffb71d05a64", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiImdzJgGlzDpH7uNj1JA4n:neD8ZSWvZHZbs1row697qohQvg9IizJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657987437, "uuid": "8f83be2c-a840-45c5-b3b1-a909eb25687a", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657987437, "uuid": "07eb26cf-5133-412f-8f71-a1cd007e5a51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987437, "uuid": "f37bc563-e284-4919-bf91-40aec18bb472", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febe957e-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947965, "uuid": "f12e2cfb-61ef-49fe-b632-74bc4c4b2268", "comment": "Malware payload", "value": "39273347c2001210762fadcf990de133", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947965, "uuid": "46bff56b-d6a5-4303-ad42-a92aee709842", "comment": "Malware payload", "value": "b5c933f69a45425ba460d404a96cbe77ffebcac5949bc021001eb3504ce12ea1", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947965, "uuid": "7d0d0b5a-d700-4c9f-af94-8a1801951cec", "comment": "Malware payload", "value": "1a02a86761df03c533fab31a515fe77194178535", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947965, "uuid": "56a840ae-d9e0-4176-bd78-ef6c58ec6f1b", "comment": "Malware payload", "value": "934a2efbbd99b394cb21bf7bca65fe7c7c8889ae6db60f03412ca3264e14ca1593c88656e14a7f22513bc47040666233", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947965, "uuid": "cca97a27-b167-4d1a-858e-a4771237e8ca", "value": "T17F75334822BA7CD4F5AF162937624CD4C3ED32F1E441B49676881CA61A771FD039EDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947965, "uuid": "a3b22a04-110e-4f3e-8177-df3c851e9d28", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8L:IDSTOhnXSI0Wk5jG2nfBtkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947965, "uuid": "b4a0ebcf-222d-4b3f-99e1-abf86840d878", "value": 1650688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947965, "uuid": "6dc8ea9b-277c-4a54-b5a3-6ab2b302e876", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947965, "uuid": "a024ef06-7560-4f7a-880c-964257aa97d8", "value": "b5c933f69a45425ba460d404a96cbe77ffebcac5949bc021001eb3504ce12ea1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c589427-0557-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010855, "uuid": "94faa876-cd3c-45ae-913a-bddce36cf932", "comment": "Malware payload (Mirai)", "value": "95e5a3945af4749cff6423e98f56155e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010855, "uuid": "e854a799-9d53-4771-9935-cb37e260fa1f", "comment": "Malware payload (Mirai)", "value": "b5d4702646efb373e326ca5a2f74b06da4637a2b206071fe2d0622eade11d261", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010855, "uuid": "7837b6e7-e84f-42f9-85f2-e7edd5be1739", "comment": "Malware payload (Mirai)", "value": "f84006ffaf750825405086ae81d3a47260578dcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010855, "uuid": "46d2d79c-d8ee-42b4-ab22-d32737ea1101", "comment": "Malware payload (Mirai)", "value": "b37029bc1a00b44999e8616b699abfc94641a22093b4dd2845e51a990564499db4fc23a5edb0fc0b4bfdc87d2bba22e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010855, "uuid": "c32a7994-2ec3-44fc-bfa1-0190e933334f", "value": "T1A0633B4272280E47E5A20DB4253F17E093FFED9024F4B688694FDB5A8A35E771186F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010855, "uuid": "f8281919-b22f-4679-b60a-08a7cb73f589", "value": "768:mt4qbTHRxVTewRnR/qPYTS1P6ehqG+HMdR6kF92sj5rQJU/ZHpRuQmFMJMSYOEQV:4Iw39TS1P6SPjdp5X/ioY+ZIYZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010855, "uuid": "5c47e7a0-e1b5-4f45-96fd-6174d9a49071", "value": 66880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010855, "uuid": "8647e8db-43dc-4794-8dad-300c519c689f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010855, "uuid": "882f4d79-5253-40bd-8322-883759609739", "value": "95e5a3945af4749cff6423e98f56155e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3a5d01-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947961, "uuid": "75f06f80-ff32-466a-8c2a-d297dec0070a", "comment": "Malware payload", "value": "67a0b4d96eb8939420c377f5c09cc7b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947961, "uuid": "692bdfef-65a2-4472-9629-d515305458eb", "comment": "Malware payload", "value": "b67e5ec1b1bfcc87e3a0d491140dfd8dcfaad6e6882038ade831f01bbbc975b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947961, "uuid": "422f772b-32f2-4998-9b18-edb727046409", "comment": "Malware payload", "value": "46f56ade5fa780222731a4332b121d7d0f7b073d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947961, "uuid": "af8471a8-83f9-4e4c-82f4-62762fd4f91d", "comment": "Malware payload", "value": "a12b5a8663506dcadf6b3a29e15c5d9285f571631a4aae3599c7379e5b817ac8ce24f1a65d23e9e466493070c30a8ffb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947961, "uuid": "436b0fee-2617-4990-a0a2-3189b6756b6b", "value": "T17FC68C73905238E9E5A98CB4D11415426DBC388B5738A3C7BAC471F667BABE48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947961, "uuid": "93e5822c-c29e-4d6d-a11f-90318bf4692b", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVna6:sXyWSpV+Wu7rI3JEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947961, "uuid": "f96bc3ce-feb2-4770-938e-3520ce89c4f3", "value": 12091392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947961, "uuid": "ee98e829-e5a0-4d31-9374-c7a4b0bb33a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947961, "uuid": "d0e58b7c-4530-4e9b-a60c-63f75d923b65", "value": "b67e5ec1b1bfcc87e3a0d491140dfd8dcfaad6e6882038ade831f01bbbc975b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cf90c2-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1657948520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948520, "uuid": "2baf4adb-d28c-44f9-9b1c-f0d95c0bda8b", "comment": "Malware payload (CoinMiner)", "value": "9dc864de874afebb3089b97d63ca4921", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948520, "uuid": "906c9504-0304-49a4-b0f9-dbd06e264e37", "comment": "Malware payload (CoinMiner)", "value": "b68435ab3f68fed660c2e2ba3ef5148199a502b5fc1fd49388889e26955566e4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948520, "uuid": "1e8a7200-39e9-4f12-82d8-9c4551a3294f", "comment": "Malware payload (CoinMiner)", "value": "fa753e12a7ba39ea9f7c9644b0bf7bcdc2f0db36", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948520, "uuid": "6e217634-e3e6-4cff-badc-521f9138f5eb", "comment": "Malware payload (CoinMiner)", "value": "16a4f319c9668c625197f00f675eb7930f36e7cf422e015fa2bac8420942d7c51c6eeb820d0bd9865e6c31050556fa23", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948520, "uuid": "c2e01127-2adf-42ab-a1b1-8578541aa285", "value": "T12036334A2362E472CCB3530F5447689B3AB77BDC60BD8D634CC0B6C34A89536FB496A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948520, "uuid": "60b39fb5-b4a3-4acb-9469-0c37f00bec3d", "value": "98304:q13V3a0rqRIZ+wrvNoGRtKzIVLplxsVmHOx+IK4Wpi5WVHpC/tBYVZpaLEi:q13V3HrqR4NlEzIJprsVmHUWkQJC4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948520, "uuid": "540d14a4-b10b-4125-bd04-298b5d7fb9c0", "value": 5324800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948520, "uuid": "6dc82bc7-8c0e-499b-aaa0-ac9670062c1b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948520, "uuid": "c829a5b9-0536-4964-b4b7-ab21c6b0bdb9", "value": "b68435ab3f68fed660c2e2ba3ef5148199a502b5fc1fd49388889e26955566e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1239cb85-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947997, "uuid": "bd371097-ebdc-4377-91d0-f1e586fe1bad", "comment": "Malware payload", "value": "2052945710dea18cf999e87722819bf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947997, "uuid": "9c3759c2-4904-46f6-bee2-dbc81e16319f", "comment": "Malware payload", "value": "b6b055e873603eddad0b123881a43f18611f27dab3324e678048c89739d3225f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947997, "uuid": "66d005c8-b5c3-4021-b447-c1bd98183f2c", "comment": "Malware payload", "value": "b65581b428b7cb9e62081bc3fa3f7e087fb31ce4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947997, "uuid": "4fd1942a-e396-497a-8dfc-c436f6e483f6", "comment": "Malware payload", "value": "99b0cf955a39b3431958660490ebcea57456e8ad97917039bac92065b46be154003188661376e01d04f71cb6ac3fac2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947997, "uuid": "604742f8-537b-4434-8119-1ab55e98ddf6", "value": "T19CF2E1352766A6EDF83258B105644B883E700FF481E3E8039263E1D7AF8556DA493BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947997, "uuid": "4239d73c-7ced-402b-9484-ddc80fa8327f", "value": "768:yHkmWBWfJ1WnzqzmH81AnYgq2XLDjp8JgGlzDpxYsR:yHz1OGmH81AYg/jp0VrYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947997, "uuid": "f097cf5e-3a0e-4630-8709-25ce52051e68", "value": 37280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947997, "uuid": "f2d4266b-fd8a-4684-9d4d-e6f114d4a0a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947997, "uuid": "b5f6d6cd-9218-45c4-8e51-f0066a0c0913", "value": "b6b055e873603eddad0b123881a43f18611f27dab3324e678048c89739d3225f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249878e9-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657948458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948458, "uuid": "ac0bed22-d0a8-49c6-930c-35f055f52e8e", "comment": "Malware payload (Mirai)", "value": "ee13ec68e2cb0dc3018a5bd8d83794c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948458, "uuid": "952fbc1d-ecec-4908-8415-5ad8513d2107", "comment": "Malware payload (Mirai)", "value": "b760425543538a2fa71bfa62db69196e9014aaf7d35a68d533b675e07b592b4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948458, "uuid": "8672f3fc-9645-46de-950e-dfed12e0c1aa", "comment": "Malware payload (Mirai)", "value": "28ea18abbacb54387c8734a7194019648d0d515f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948458, "uuid": "7d21dc19-2e5b-45b9-a56e-50b7897960b7", "comment": "Malware payload (Mirai)", "value": "1069ed7751bcf5bc69890c452d06c0b4a6c2e131ceb33dffe493c307d272c63b000fcbeaf475afa3ea881623e4fc4baa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948458, "uuid": "c9bbfeb6-c7de-4298-a59e-21d3c26e4ab6", "value": "T1EF72CFF8A17CEE93F8B1E073F716EA030039B92B4F5C45149A084E8676955EBE72E091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948458, "uuid": "42bce6dc-608b-4746-9809-daba95e3ef54", "value": "384:+fYHsnhrUu61AZvr1gwoHsm/5cZLkYmxxMN22M5B7hc4lDpuA961:+fzxUu6101SHl/5YIdMNpMR7961", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948458, "uuid": "8cdddad6-28e2-4100-b35c-22b537472b18", "value": 17084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948458, "uuid": "1d2fd329-eab6-4749-912d-aef65f93d8c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948458, "uuid": "3b647698-e034-47eb-a75e-8fbe60d09074", "value": "b760425543538a2fa71bfa62db69196e9014aaf7d35a68d533b675e07b592b4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6f11b1-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947911, "uuid": "41a1fd81-19df-45f5-85bf-b8680a14686c", "comment": "Malware payload", "value": "1c8acabd4bc7e59f48bf77eeec3b9355", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947911, "uuid": "5ab6a82f-8064-4a29-bada-fc74dda58faa", "comment": "Malware payload", "value": "b78ccc0d9b7cdcf052a8cd0e1089c4271f44bce9a87872eaff82d304e6b13a5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947911, "uuid": "f4b9dc1b-74bb-49d9-b4a2-fa6140ca69c1", "comment": "Malware payload", "value": "4ef73de9c496e90b939e94ae2342b09c91818236", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947911, "uuid": "8f4088a0-a48f-4992-b4d3-1e9dc3911ace", "comment": "Malware payload", "value": "2577db9ca70cb189353ea5508ceabc0284b40a7edd69a1222d4c267b3ebc489111ee94a57f6beb838a71dee6caf90b29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947911, "uuid": "6fa68f77-7615-420a-8c2c-d5035e6dc9c4", "value": "T10F866B73945664D8E1ADC974D51412127EE8384B673863CBBEC476F61BBABE48E38330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947911, "uuid": "218a8574-1c57-4104-b281-25dd57e6044e", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnau:sXyWSpV+Wu7rI3JEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947911, "uuid": "7b111f6f-89aa-44c9-b4e7-509477c86f0c", "value": 7897088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947911, "uuid": "736afd8a-c7c4-4489-8995-cc4863ec9887", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947911, "uuid": "b3510d48-be17-45eb-9e0d-c6ca39e4a4ca", "value": "b78ccc0d9b7cdcf052a8cd0e1089c4271f44bce9a87872eaff82d304e6b13a5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74688938-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948162, "uuid": "602b5fa6-167d-486c-9147-ef8cf8af19cd", "comment": "Malware payload", "value": "845281fea04ed5934efb4622d333bce7", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948162, "uuid": "dbdbca9e-7068-4bde-9fd9-a47a5e64ff46", "comment": "Malware payload", "value": "b7df04d5732483b22af88ef23a65f22613aaddcd413034ee7ff23347340050fb", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948162, "uuid": "fba53bd4-9fd2-41e7-9108-e73ab17e2d48", "comment": "Malware payload", "value": "6ecdf50377bd74ad18fcc9cc912bb92be4e848ba", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948162, "uuid": "706243cb-7c79-47b4-aa69-39c07d89e029", "comment": "Malware payload", "value": "da536e26d32174e557e641b4c36e0dfcac9c0cb64b2d9e03b9e7eabc83afda7c8e74f2aaec145cc79e8ca1150d099a01", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948162, "uuid": "ce7f7138-47f6-46a1-b23b-ca7f559daabf", "value": "T10BD2E1BDF7DE21D3EB95508FB3914E57929B41E29C5B388B013C70A8B44BAC53CD1A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948162, "uuid": "90877b46-4ae3-495e-8dc9-a7cfb722a1ed", "value": "384:VvmZbYvbmfP4ri+vnQhqfHxLs+kxqg/zkmWWH8SIfPt1vOIswhCjESJcNcE:cZbYTc+i+v55s+kxqgbr1cSIfzb8jEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948162, "uuid": "b90e2ccf-d0f8-4d67-95ff-40cf77d139f0", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948162, "uuid": "713280f1-bfe0-4d60-9f92-0f708767c45a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948162, "uuid": "b0e5d86b-46dc-40d3-a0ed-9a477e2b4e94", "value": "b7df04d5732483b22af88ef23a65f22613aaddcd413034ee7ff23347340050fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959045d1-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948218, "uuid": "1a725d68-663e-46d6-9c51-32fa65d73270", "comment": "Malware payload", "value": "4fe261ca0672fdf0a58649126a143229", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948218, "uuid": "262ccd98-9f71-4b6d-aeeb-86eda6c826d3", "comment": "Malware payload", "value": "b80f914e380ea0ab6f14e2f4557db719bdf971fd7095df2cba561bd64a13a60d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948218, "uuid": "7e0daf8d-d6e1-437f-9c65-f2f5f6d49eb2", "comment": "Malware payload", "value": "ec09db18caf379bd0f9f98b7f18af7cebd838171", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948218, "uuid": "5e3a7ddf-357e-4449-b46c-92df0a204ef0", "comment": "Malware payload", "value": "b63c4087aca271ef43b2fbd617fffbdc72be8c15b75c8839ae66845b98b250b8edbe26c887b9888d8fbcc5a27b2ffe7a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948218, "uuid": "bae3d61e-7bea-4966-9888-e349a39aa385", "value": "T169E07D1FC80380BF6104897AEEFCFA48754E22A7138A12941EBC45138CE8CC87061032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948218, "uuid": "6f4fbd4d-c697-4c74-bc8d-c8408fdf3a47", "value": "6:/wFEXUVWkSW7i1uVYKs73F5kJVKE6LsVKE6NiVVNDV2uVf6v9yR5:/xB9i3Fg5sguTh4yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948218, "uuid": "709a4d71-ba24-4acc-9410-93934720c25b", "value": 317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948218, "uuid": "149babcb-89b3-4494-bbb0-d2c0872b9c3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948218, "uuid": "f7c9deaf-5a02-4007-8c0b-3d556a3d654e", "value": "b80f914e380ea0ab6f14e2f4557db719bdf971fd7095df2cba561bd64a13a60d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e84c52-0529-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1657991240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657991240, "uuid": "cd1ce95f-e197-40f1-96de-db3a04aab9a1", "comment": "Malware payload (njrat)", "value": "b73984062282fbe1c09bb14415159a39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657991240, "uuid": "b99f702a-0f0c-4b9f-be12-e0c5358a79c9", "comment": "Malware payload (njrat)", "value": "b873c4fa6ef7f4d56d1f347bd88468fed658fb77b948d50a6f1f719cbc4b781f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657991240, "uuid": "8907ebc3-31df-4df8-a52e-9c5623d1141e", "comment": "Malware payload (njrat)", "value": "106709e5611ba9bfae948c55c8ba1bd3195bf4f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657991240, "uuid": "3bcc3e66-934a-4648-bbad-b8f45312517a", "comment": "Malware payload (njrat)", "value": "c9f1cae2a8e9716ef7a84ee5f204df0e745fc20d265bf6c3f897f1a326447afb301b835a3a06c9ab38dd047da929aeba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657991240, "uuid": "6d5315e4-eb13-4282-ad62-2a35d08a6cd0", "value": "T122F2181837F68221C5EE17765962D32322F1E2236523E71D0CE5B8EA7A336C90B49DF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657991240, "uuid": "b7736b5c-42ee-404e-ad4e-d01b8a9b3112", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657991240, "uuid": "89d8b93f-774f-4b4d-a575-156070ffc3a4", "value": "384:iNWjp7PQ4NbVevimq2EZLUtvl87e+mzPLTCn2Ie2UewVvodLtIanrEp08:B7Y8micEZo/87TUS1hner", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657991240, "uuid": "b0df1455-8c09-4f13-a2ec-346817f65d5d", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657991240, "uuid": "ff569eef-c03c-4a93-9905-a72cfd6cc9d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657991240, "uuid": "26fc0d6f-fadc-4bba-aef5-1df50984cbdb", "value": "bD15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72efebf4-0555-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010007, "uuid": "96029f44-66f4-4967-8003-70726ab4d1c9", "comment": "Malware payload (Mirai)", "value": "626cb3a44f1c06f8d5ff2e20c8fd9938", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010007, "uuid": "2a88c9a5-6bf4-4008-abe3-b3757c0df801", "comment": "Malware payload (Mirai)", "value": "b8f3635604b52f8bf17276d0de7de5abc1bfd710bda523c71a8b77d8c94d48b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010007, "uuid": "1980c07c-31e2-40d1-a622-f4f8e582d7b3", "comment": "Malware payload (Mirai)", "value": "0862ed3c0818d8168444f88d641384ec94713c20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010007, "uuid": "af81360c-c2c2-48ed-a479-28beb8baa84b", "comment": "Malware payload (Mirai)", "value": "9e878d057f035c4d420c3bde01d7f8d94220a931945b7fbb81a65c9984f0c23af80251b9f2ca9ffcd81e8ece7c1538d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010007, "uuid": "ba2f75fc-4ab6-4271-94c1-8ea262fd0749", "value": "T1E993B30ABB740FF7EC6FDD3749A92709158C650A22E97B357930D818F64B26F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010007, "uuid": "1a11324d-8136-4f5c-a572-ca5f88108c5e", "value": "1536:zahaNVXMHWjJBOjzIgXvu43L4/0B/BWDZi7RLTe:zahGVcWTO/bGmnWDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010007, "uuid": "ba1ebd46-0239-4b83-b1c9-921f32f80041", "value": 92444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010007, "uuid": "3a60a6b6-7dad-4231-ad8b-2caaeaeb887a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010007, "uuid": "2e6aaf96-ce23-4fb7-b3ee-8b9c37c39503", "value": "626cb3a44f1c06f8d5ff2e20c8fd9938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09e7e95-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948666, "uuid": "1a4dc93f-4217-4038-90e5-ad39a9552cc5", "comment": "Malware payload", "value": "0375dfd7d23f7b894903fb6cee9d336f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948666, "uuid": "c9c1ef88-2ee7-4738-acf1-d89d34539445", "comment": "Malware payload", "value": "b98127040733c960f9c3c8003f249bc9cecb4d804bec93f9fd4a5d7cc2232980", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948666, "uuid": "00a50461-05cf-4bca-acec-8ac2f8b4c075", "comment": "Malware payload", "value": "01f4e56d301d7b9f929f109be02073a2af6f246a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948666, "uuid": "2e63640e-4152-4412-b494-0d5d19f87e5d", "comment": "Malware payload", "value": "862a164e81c9f44c76a699d6500f8b3bc91621fffbc365bdffea0356bd57ce0850a07834ad3ae2326de3648e18ae064d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948666, "uuid": "6a671778-b4de-4c96-bda4-d957ba4299e7", "value": "T1CDA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948666, "uuid": "e50241c4-35bc-4a2d-83f0-6c327ae27f90", "value": "96:zRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:zRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948666, "uuid": "352af4de-b908-4f7c-abea-9ffdc2519a22", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948666, "uuid": "1d8fe030-dda0-43f5-9d76-23d0e981af20", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948666, "uuid": "283d1e35-26d9-440b-959a-817f270ac590", "value": "b98127040733c960f9c3c8003f249bc9cecb4d804bec93f9fd4a5d7cc2232980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11ecb3d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948345, "uuid": "92a3dab8-2f2e-4b27-a519-e7af18749ae8", "comment": "Malware payload", "value": "b4ecc7b0e089dc8a3a4cc3bf710d153e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948345, "uuid": "58a211a4-627b-448f-af28-78cace977d9d", "comment": "Malware payload", "value": "b9910f2acaed6b7e118d14964b5c3c9a26290d19b7dd17a8ef2594922cc30826", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948345, "uuid": "af179225-1b09-4288-b79e-709dcff33ae3", "comment": "Malware payload", "value": "3eb56911a9f9847a203588d455299245b932715b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948345, "uuid": "978160bc-93c0-4181-a92e-ac4db0d5d8f7", "comment": "Malware payload", "value": "bca622fc5417de1aab047250a5e5691df4e41532fe5d6cc63660047fd95e42c29bca1ebb90a33f318f3b4deb5b83909f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948345, "uuid": "3dec10d0-d791-41d2-b70c-268b8b7b7822", "value": "T195517984B1A124B03EA2A8DFA3251CD031C0D0657C855FF4ADF8F8A449ADFC576A43EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948345, "uuid": "0b6e7c1d-fa67-436e-b036-fdbfb2e71732", "value": "24:cKMhM4MSbMSMvKLpoJee7HpsI0JNI2k070tE/Zmowd0KFUOurd+HB7edq2aaC7a6:xObxhhLpoJeedMuTFUOuB+IrJoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948345, "uuid": "77df22f7-4ee6-4b27-a23f-22ac37dbf9e2", "value": 2908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948345, "uuid": "36a58772-dbba-4486-9685-12d967dad27e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948345, "uuid": "24fccd9f-2b1a-46ac-8376-b53b7b56775b", "value": "b9910f2acaed6b7e118d14964b5c3c9a26290d19b7dd17a8ef2594922cc30826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb8d7c9-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948659, "uuid": "da1310e0-e603-42e3-a2ff-3a119c966d85", "comment": "Malware payload", "value": "22313e46f50a44c9698259026d8c5dc4", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948659, "uuid": "ba19fd69-abeb-4175-82ea-d0cbc08344d9", "comment": "Malware payload", "value": "ba215d74c2984c897649ff6adebb411f6160a402d915e9c1d5a03f5a0cae468a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948659, "uuid": "6dea9840-dbf6-48fd-9a48-b186d565914b", "comment": "Malware payload", "value": "3716d8a711ce4af7ce31c88615577c795fc096d5", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948659, "uuid": "cbac4d0e-ac9d-4ca9-abae-20f831662e01", "comment": "Malware payload", "value": "04718ada066764a1ad2db94dfbc8375c38a4772f75ffba41162886fc63bc036f40bf7d6bff88a5a4483b89c102d65c23", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948659, "uuid": "56d5e6e3-f351-4a69-ae48-4a998342f4fd", "value": "T171C5330C036ABCFDFD9E052927638ED4C1FAA1E0B54260A3D66459A85C3F57E13CF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948659, "uuid": "70a15fb4-1816-41b2-af3d-22b80f94c049", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4j:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948659, "uuid": "178c54d4-1cd2-41ea-953b-7f8bcb01bde4", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948659, "uuid": "a743f156-79f7-4755-b127-20f17091606f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948659, "uuid": "6015118e-52e5-4d0d-b48f-ae0fe7940757", "value": "ba215d74c2984c897649ff6adebb411f6160a402d915e9c1d5a03f5a0cae468a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35658bfe-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948056, "uuid": "1d4bd376-0678-49b5-9206-bd3aa74eb0a2", "comment": "Malware payload", "value": "79f393fe8a06462e407a9298a2ffa196", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948056, "uuid": "f9ce4ade-c432-4905-bef9-a00e01099ae9", "comment": "Malware payload", "value": "ba520de5f129f6803423976d908c3bc74d330d978cd3d67362e58afe77586236", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948056, "uuid": "bb5e088b-2c49-4fc5-b95d-868a63b16766", "comment": "Malware payload", "value": "f6745ecd0a390c7f0fce8dfa7fe5fa6fefa59c2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948056, "uuid": "52ac98ec-f265-4f89-a518-85b251775935", "comment": "Malware payload", "value": "16c181ab3e623798049ecdfe27de7e2ea136bb67158793ced4417a1116c16b442caeb73ce04d4783edf62d962710a43c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948056, "uuid": "c2e65c9f-69d3-44ef-a4c9-7ca41ef6f3a5", "value": "T13D07BE77810338E9E5A98CB4D51425426DAC38875738A3C7BAC871F667FA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948056, "uuid": "bfe59592-aa3b-4f13-8803-584e76d09be7", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaQ:sXyWSpV+Wu7rI3JEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948056, "uuid": "602f57ba-4ffa-47ea-9b1d-9e0b9b7d4b0e", "value": 18219008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948056, "uuid": "8a89356d-65dc-48b0-925e-a57ef6154aaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948056, "uuid": "c750e8b4-ee27-49c6-a1bd-960e17dded8f", "value": "ba520de5f129f6803423976d908c3bc74d330d978cd3d67362e58afe77586236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbf99b6-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948315, "uuid": "02bd0903-dcef-480d-b1bd-c69d8098554c", "comment": "Malware payload", "value": "9a483a0f97c951b32ce76d8bf82a4e61", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948315, "uuid": "0f7491d1-5361-4ba7-b6d0-b0b9b72f514e", "comment": "Malware payload", "value": "ba9ebd1a5c134c0d9199a410652caa5067da026526b53f174704453e3dec9957", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948315, "uuid": "415f32d1-97d2-4f32-8ea3-66376fcf028e", "comment": "Malware payload", "value": "0681ffe114175bf90e4251ee457893aa6439b0aa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948315, "uuid": "fc9aa420-5e3e-4df2-86ab-7b3d953944f9", "comment": "Malware payload", "value": "5eaf847186d2e493263a4152470c8ea281bfde85cdf05e145c166cd74a57e122bef60d08af7665ea5317fb58db593ac1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948315, "uuid": "929271d6-3c95-4418-b1a5-f531017d978b", "value": "T161A1F850112C1AB17346697AD26FFA92B40EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948315, "uuid": "d44d080f-608e-4a34-93c1-50af569ecfec", "value": "96:0RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:0RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948315, "uuid": "926c2cbd-3e29-48f9-915f-6dc05b7c9434", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948315, "uuid": "d1e7a410-98f1-4f36-92b2-122537080ecc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948315, "uuid": "70711cfe-87e8-4a82-9a62-7489d14b00d7", "value": "ba9ebd1a5c134c0d9199a410652caa5067da026526b53f174704453e3dec9957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9294228-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948251, "uuid": "1c2387ed-9a7e-444d-a854-f64ddfeb697a", "comment": "Malware payload", "value": "9f1ae9525cc2c505cd3287d23752cce5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948251, "uuid": "613e067f-c763-4720-9b95-73d92e4ae1b5", "comment": "Malware payload", "value": "bb27e56fd35ff37461cb8dd3f8c5da7f99c6c87d14805670833a599ad08562ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948251, "uuid": "dec65953-2247-4dc3-8587-bd8d4bc34108", "comment": "Malware payload", "value": "a6bcc3e8128479b58c6c6743de2d8753986265b3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948251, "uuid": "9af12931-259e-4bf2-ae56-a5fedbbabb1e", "comment": "Malware payload", "value": "0ddb72e63a49280987e9775fe832c3a119f189c58d85b0dbeb799e41c38d11702aa92df40fe68e10d71254a784d35ecc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948251, "uuid": "c11a4751-15d6-454a-a750-a8b43e547ed7", "value": "T1D55311094DE3595173B3B0BA97DE945A7AA7C0C74F8B9E203C8D439AEFA103485F85D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948251, "uuid": "178d16d7-b7e9-488c-8013-9dddd723139b", "value": "768:lsJEryYUeNMZeZr2H3iFF9J50A8XZqP99pJW3gObz/P:UEr1UeNsc2HEBGBZqNigQ/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948251, "uuid": "9c62e56b-28c0-4cf1-b3d2-91ddf9c9f4c3", "value": 63177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948251, "uuid": "5dd119b1-0db1-4257-9145-a6959818419d", "value": "text/x-perl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948251, "uuid": "bb7d9903-43df-41df-97fa-786382733b91", "value": "bb27e56fd35ff37461cb8dd3f8c5da7f99c6c87d14805670833a599ad08562ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006210db-0544-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1658002514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658002514, "uuid": "b50e0f34-75d6-45dd-aaf9-4f2394e64e0f", "comment": "Malware payload (RedLineStealer)", "value": "c083351ee158d9a67ce032e477ee3be5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658002514, "uuid": "2ee23401-30d4-4e44-a3fe-108a3d49d81b", "comment": "Malware payload (RedLineStealer)", "value": "bb35ee18dbde7b993e7023838092a6cd40fbf313576f662d5953b9f46f8ac3ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658002514, "uuid": "ab5339f1-8aca-476f-a162-0be94314207f", "comment": "Malware payload (RedLineStealer)", "value": "e159a2ff57c2994104f6d4d0334c00df8cafc625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658002514, "uuid": "7bbab8dc-a8a5-492b-9dec-5c62bcb8de1a", "comment": "Malware payload (RedLineStealer)", "value": "6854de959ff3f4e3ea94b5bbdb5b8e6fcdf0e94fa26f44f3a93c5e01d6b10491475ca3f1f07db38909764628c5c4bf8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658002514, "uuid": "62fa7d96-9421-4a8b-882d-39a47065b095", "value": "T1F594CF00BB90D035F4B752F44ABAD36CBA2D3AA05B2450CF62D56AEB57346E1EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658002514, "uuid": "69d71bd0-d88c-486c-baf0-3a16053e6ae6", "value": "67b6405ac99a13af0fddde5923fb8811", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658002514, "uuid": "e91cb186-df93-46f8-a6a7-fd17ee08710b", "value": "6144:n5ec3Dg+xscvRFWPgZFGzNeMGVjMMGC3Oz6th5MbWqAJ2/yqYM:nTgYsoPosFGzNeMGNz3O+tbMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658002514, "uuid": "181b6415-0771-479b-8d1e-b3090f8f382b", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658002514, "uuid": "693d8e58-11e1-4fe2-849d-c70fb61dd5fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658002514, "uuid": "66996716-73de-404d-a445-f37d045a8ea0", "value": "c083351ee158d9a67ce032e477ee3be5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431f89ad-04d4-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657954522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954522, "uuid": "9a86b35b-1afd-4cdf-8597-c6bc59ae8246", "comment": "Malware payload (RedLineStealer)", "value": "c860c9ad72d942568c59ca6f68757fab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954522, "uuid": "925c4ec5-865a-46a6-bd79-0b855a4a62cf", "comment": "Malware payload (RedLineStealer)", "value": "bb3fc2c2e7f03a347fc3e0081c620c859c622deba99bb451d5273d737699b936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954522, "uuid": "a4d0c431-10f4-4709-8961-82a15bd6f0c8", "comment": "Malware payload (RedLineStealer)", "value": "c0975dd3ce42a5d3ec9c21ff4623f9e46b6e7974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954522, "uuid": "e676d22a-a7bc-4c09-bf81-e5f453858806", "comment": "Malware payload (RedLineStealer)", "value": "9677758f13805070d6ee1501e950f0871c5592fc6f2a748a5b950296b1bfdcb1dd73bce61f78e8cb05a45ab578e6c944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954522, "uuid": "8877ce61-f474-4678-9465-2304ce5c897e", "value": "T18B94CF10BA90D035F5B712F459BA836CB92E3EA15B3450CB63D16AEE17386E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954522, "uuid": "a64dbff6-ad49-46af-98fd-c9b2e7a138fa", "value": "149733ffc6fb8cb84df8287483828e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954522, "uuid": "2b89f36f-034f-4376-9179-08289490e9c5", "value": "12288:fMc8iqLUv0H3Em/6IKRrtXlIZ5IjYB984v9Z:ElioUEz/ErtXlqE4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657954522, "uuid": "ecfcf1f0-2c04-4966-a2b6-809034846949", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657954522, "uuid": "af5606d8-addd-40ac-b5f4-43ba4161fdab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954522, "uuid": "02bc9f71-6e27-4c0a-9ee1-4f6707888bcd", "value": "c860c9ad72d942568c59ca6f68757fab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e08d0b4-0555-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658009999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009999, "uuid": "68d6d7c4-0054-4f84-9703-34f18f68dc86", "comment": "Malware payload (Mirai)", "value": "601e0a8f6ee9b1aa002f63cc4cbeb72e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009999, "uuid": "0d225650-ff59-44f9-b23c-5798cfaa5147", "comment": "Malware payload (Mirai)", "value": "bc4e94490dfd7c436a5aa9069990ac880399c1e23f400523acdd7434c815ddcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009999, "uuid": "87cd1887-2fcf-44f4-bb03-1b617da9dbd5", "comment": "Malware payload (Mirai)", "value": "62990c9a82b29c9466c0e2d6e61f22adab863581", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658009999, "uuid": "04d07801-8f12-499e-ac8b-179490909276", "comment": "Malware payload (Mirai)", "value": "cc5b6277faab5d34dd28ed7066db243d997b357cf98853a8bde5aed89147a1adbb91fe9f42110f4c347cc4d118aa2048", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658009999, "uuid": "0b7497b4-8f37-4f83-a7b5-b2a11823c784", "value": "T16373524D6E319F7CFFAD863447B74E21964823D626E1C984D1ACE9011E7074E342FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658009999, "uuid": "5f973c0c-f9bf-4228-a9b8-b36c7254f5f4", "value": "1536:fWnhQSxDODnNTr+uq1baZGsbvzr7ghqjYa6YSG0yrg+sM4LvXKEzoU:OhVDYTapZsMUSG0yrg+sM4Lv1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658009999, "uuid": "51a96ac8-32e4-4e8d-9b0b-3f432c5661d7", "value": 80184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658009999, "uuid": "cbf346e6-ca17-4d2f-92d9-9a792c303da6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658009999, "uuid": "f2bf5f1f-cd05-4cde-a382-f56b85ce75a5", "value": "601e0a8f6ee9b1aa002f63cc4cbeb72e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccae922e-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947881, "uuid": "4097979b-8bd8-494e-875e-7eccbe22243d", "comment": "Malware payload", "value": "687c85ba015cdd429c8156c41ac98435", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947881, "uuid": "47301396-9998-4600-8425-c79377c175ac", "comment": "Malware payload", "value": "bcfda42954a10f2f194bd4dc5bf385c740b68c08bc08e3a00bf83a588205b8e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947881, "uuid": "f83d2e10-7bde-4590-ada1-3e47ccc52db2", "comment": "Malware payload", "value": "8620cf5ee31707dffc22e6c720c1b9ed9be1af7b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947881, "uuid": "a7c18ace-4b8d-45a2-90e9-810f87fd3b7f", "comment": "Malware payload", "value": "eea51f08a381e654e321030c57157a9a897591958baea981b8b459ea56559fbc38639891e5e923d7dfa53c0d362eece9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947881, "uuid": "4e894a06-85bd-49e5-a7a9-00881cd6cb2c", "value": "T1F9512DEA55A18A71BD99AA53336D4844B270B1CFA9D5DF0C9CFF75EB168CF447000A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947881, "uuid": "4d70c542-c48d-4c8a-8fd5-1edc89244132", "value": "48:TSe3p7e9vKehfzBeRvceLVqeb7pWeBj9em2XTe1/OeV1BGenhN1eN7/+hepSepkA:TSe57eFKehzBehceJqehWet9edTe1Oem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947881, "uuid": "792fe1cd-8475-4735-b1d1-452ed50511eb", "value": 2981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947881, "uuid": "d2b28ee4-0d67-4216-a4ca-4cc47dfee968", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947881, "uuid": "a89a21a7-c57b-4bc1-92bd-ad48493273e9", "value": "bcfda42954a10f2f194bd4dc5bf385c740b68c08bc08e3a00bf83a588205b8e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adaa53a7-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947829, "uuid": "d913d0c3-71fe-472a-b393-6d7ad2a37579", "comment": "Malware payload", "value": "156b3f2f0bdd2e90adf28c247448aee7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947829, "uuid": "d83567aa-4540-419d-b43b-4a37c8e6ced0", "comment": "Malware payload", "value": "bde9b3214c56ede4d8d88ca104ab25034576e851a8bbb5099829b799613df76b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947829, "uuid": "3386b2fe-c796-4864-9754-f39e604ff314", "comment": "Malware payload", "value": "eeb35914b7b933c15d50937a164d2bdab1b114a5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947829, "uuid": "2d56fc5d-f3ae-4a00-9864-8ce62b24b398", "comment": "Malware payload", "value": "e37031ee36c030e4f8214b1711da2fd8791dc568bcb123e9a8ccf2ff6f5e652ad6bbd2ffd13aa88d7083bfdbd6c0a691", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947829, "uuid": "c8cc21e6-f722-4ffa-9f09-2d2e9698025e", "value": "T1CFA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947829, "uuid": "6bf38912-4fd0-4de6-bfb8-d11236fa1ba8", "value": "96:zRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:zRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947829, "uuid": "305f2ad3-0e20-452f-9dbd-f6158d577e3c", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947829, "uuid": "fbee7f9b-3932-4138-b14c-3515d0218980", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947829, "uuid": "976f343e-975c-4627-8490-8af10b21375c", "value": "bde9b3214c56ede4d8d88ca104ab25034576e851a8bbb5099829b799613df76b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3030138f-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948048, "uuid": "3ff3c486-0988-43c1-8f20-c011c8b047d4", "comment": "Malware payload", "value": "b206127d742bfc155265cb194cea34e9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948048, "uuid": "43da5e6d-87bc-459d-bc80-20cae9aaff4f", "comment": "Malware payload", "value": "be488d4189e0556e68fd7a3c307ae57356240b237c61405fe27f6b55706353a9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948048, "uuid": "0ba3af8d-343b-418d-bcbf-49d623390599", "comment": "Malware payload", "value": "908c19f52553de5312b33b3b210dba47e0b0c80d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948048, "uuid": "690fc12b-b692-4664-8f80-f0873cf9c99d", "comment": "Malware payload", "value": "1c0161dfe3f1ae7a05da43124872be7422f8487b4abebf661f0c338f1d22803addf55c83c74ff0212a68978b76e08ffc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948048, "uuid": "d0057cbd-d86b-4514-9140-de661382a473", "value": "T12E1165ED8966FA7B0B431DB0BB23706887B58E8B7CE3DD1D5EB0425430068555314281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948048, "uuid": "2947da91-b942-478b-8e06-1a4b2ffb121c", "value": "24:KWPan94FfSyNnumVPRO0VYExuEYpMqyAk9GfdaMGIutdfv:KWPacSFmJU0Vf8l6qO4dh8tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948048, "uuid": "ea82614b-a458-4944-aa21-e0ee877500b4", "value": 1019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948048, "uuid": "21a8ba54-c602-4b32-ae1c-aecc099c4ab0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948048, "uuid": "edbe5cb5-3342-4c99-9a1c-322c38818bc4", "value": "be488d4189e0556e68fd7a3c307ae57356240b237c61405fe27f6b55706353a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c67a4f-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948515, "uuid": "6c7b9b3a-cc6e-4ebb-8524-e4e411501dbc", "comment": "Malware payload", "value": "9ac68b7a3633785f351f080638914314", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948515, "uuid": "018549af-4f6a-4750-83ca-dc1609209c24", "comment": "Malware payload", "value": "be54efa3b2fa2d1ec9215c9f0c02f4626f727c16e2ed04bdced186e251324c68", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948515, "uuid": "17bce832-3776-48b1-a52d-e589bcbe4f61", "comment": "Malware payload", "value": "4251217c51b659242c29e81aa07d9ea191abe5c7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948515, "uuid": "262f6cb1-c224-4e20-b00d-0259fd05a446", "comment": "Malware payload", "value": "b3d4ad4154a0210b8f22a582949c8765f2c96c8df4077736a098146d974676bf33fafa6507baad76dd214a53554e3df4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948515, "uuid": "9815875b-e33f-4974-84b3-965d6b899090", "value": "T110A1F750112C1AB07246697AD26FFB52B80ECC1B0A7B7B358433A63C74F9DB8E0796C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948515, "uuid": "64ff757b-66b2-4fab-8f34-488fb9c4e619", "value": "96:vRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:vRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948515, "uuid": "86469f43-d5b8-40e7-8ff4-2bff72646018", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948515, "uuid": "ea7f5167-0740-4d60-9ec9-c43306f10f1e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948515, "uuid": "829ed03f-0da5-4bbd-993b-988387cf7e7f", "value": "be54efa3b2fa2d1ec9215c9f0c02f4626f727c16e2ed04bdced186e251324c68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1948b3-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948574, "uuid": "b983cb4f-f394-4925-a1a1-77bcdbdfd2db", "comment": "Malware payload", "value": "96a6ecdf5157c1c7d7b85cb4191dca48", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948574, "uuid": "b5dcd6e6-c218-4da4-b145-70642259242d", "comment": "Malware payload", "value": "bfac72f312b99550d17bd0d0f988f809e2ca772d36cd144570cfbae9b1ba1ad9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948574, "uuid": "e1bb0737-ca9a-4794-9f42-81bc614c6717", "comment": "Malware payload", "value": "90f9b0ec85b461c287a2b1a551c868e957f30cd1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948574, "uuid": "0e3e8d6e-6cec-4683-b6e2-95ba205e3cb1", "comment": "Malware payload", "value": "ac877e3ec97cf9517523db1ca09937d0fe0e4a1561956e0e769bef49f09ee55ae75b19ed30055788879dcdddae2e919d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948574, "uuid": "e75174c9-d2ec-483e-a483-c168d6272793", "value": "T180A1E850112C1AB17246697AD26FFA52B50ECC1B09777B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948574, "uuid": "64072036-de6a-43b4-bcdc-5648a1004bac", "value": "96:/NRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:1RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948574, "uuid": "815446b6-c8ab-439e-827e-d2c865777584", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948574, "uuid": "98bbeeda-979d-4b3e-85ee-8b391527ee47", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948574, "uuid": "926c2c77-fda4-4cb5-bb9b-bfcd9174e910", "value": "bfac72f312b99550d17bd0d0f988f809e2ca772d36cd144570cfbae9b1ba1ad9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766fcec1-0555-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010013, "uuid": "7c1453bd-b76e-4be4-97f5-db51939e6cbe", "comment": "Malware payload (Mirai)", "value": "26db6806142a4718972ce20686bb4ccf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010013, "uuid": "32e110aa-2a2e-4c30-9c88-50977eae4d75", "comment": "Malware payload (Mirai)", "value": "bfb9548300da05d1bfabcb22ce574b2e3899497e02987e3c74d6e35add5f79b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010013, "uuid": "4c107a36-a8f5-4536-bad4-48369583506b", "comment": "Malware payload (Mirai)", "value": "559d0e64ab017afea2d1820ddea6c05a1394e83e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010013, "uuid": "c87eac5e-39b4-4b5d-b35c-1fa0f5fac8ab", "comment": "Malware payload (Mirai)", "value": "016c5cfe3b47f064df10d3e9b67704f638838bb7a298e8c7302e16be16c07114bb0e0c06face2cf8840fa12ff3148fdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010013, "uuid": "f38e8113-987f-419f-998f-246f8327978a", "value": "T10C93B71E3E258FBCF79D863547B78E229648338A26E1C545E15CEA011EB034E741FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010013, "uuid": "c1cc797b-e340-430c-9fda-427a62e6f919", "value": "1536:SK/QR3WWT0Aea6U8QRA8NG0OVTWZ8H/XOHP0hI/Mqy:fe37TPtVBNJOVCZGXOHP0hIEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010013, "uuid": "613b00a3-5e44-4f3f-bedf-f722189d59d3", "value": 89692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010013, "uuid": "84780f48-7776-42e9-941b-2afbe55a8c52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010013, "uuid": "1885f3c0-616e-47dd-ab5b-356a0ac6acae", "value": "26db6806142a4718972ce20686bb4ccf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96903e4-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948707, "uuid": "349f11a6-df5c-471d-8350-cabd22873d0f", "comment": "Malware payload", "value": "5a225773f43d1ab58e4333b0e639b64b", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948707, "uuid": "99a2b606-ab83-4b56-a2af-b6b7cbe02aec", "comment": "Malware payload", "value": "bfc34f34acf96f555e89fd80214c7a0cd1f5170901a8a9c3caf11a865f1f07b6", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948707, "uuid": "e31107f4-4bf7-4629-abdd-5bb37c19eef0", "comment": "Malware payload", "value": "4a6a71d0cfc461033a4146849f4a059ec3c28f05", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948707, "uuid": "25fc1c9a-e566-4d17-9fad-f5d3f9f3eb54", "comment": "Malware payload", "value": "bfe0f262c2ce6649d651836bffb396594f1107962558355883d1e7a32b386256d9cb68aed454c3520d9caa7d1e76a986", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948707, "uuid": "0069a0a4-4dc8-4ff0-8d75-269fde4c7791", "value": "T141D42342BAC03DC8B498AE072E5D550D8096FBCAA478F7874184979A245E75C6FF333E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948707, "uuid": "64fe8659-0e44-4618-aaf6-c241863c8de3", "value": "12288:G1Hx+tbbZpxMj3urJSwvhgUXrgt6gmVB0xuP+GDlZN6O1qyQjZ:G1HxKBpxMjuBd5QUP+GDxDQjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948707, "uuid": "089733ee-457a-4b3b-b6b4-5d39affd28c7", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948707, "uuid": "bebbb61a-98ff-4455-802c-5180ca746bcd", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948707, "uuid": "abde1d2c-bee8-4093-a66a-3f66d879ae20", "value": "bfc34f34acf96f555e89fd80214c7a0cd1f5170901a8a9c3caf11a865f1f07b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58032df-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947842, "uuid": "912c31af-9edc-4e86-839a-6e92206fdf4d", "comment": "Malware payload", "value": "6ea7e781dd1d825b40d77e539a81ec39", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947842, "uuid": "f8e4f4fc-411e-455d-95ac-f3b9693256eb", "comment": "Malware payload", "value": "c0bed85d9e638100db89d1b18ce48f4efeb7e47c9d4754abc4135e1fdfe3dfb1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947842, "uuid": "c9b19d8b-b538-4379-8a46-7460618d6b44", "comment": "Malware payload", "value": "4a0bea788a3f764e1ff81c61e5c64f0458d3a317", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947842, "uuid": "4a0c8f02-16e9-486f-8723-2a76d4005d6f", "comment": "Malware payload", "value": "038e13b36c404a7c0a63fbb62dc1df2cae174bfb770e5a65cec12e521c591b20adea94f9e30c17f368d88300aeba1690", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947842, "uuid": "d7b24094-0f96-44ac-b166-8df131a15f0b", "value": "T137A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947842, "uuid": "94f3b7dd-dd3f-479d-8dd7-4a822199d57f", "value": "96:8RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:8RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947842, "uuid": "6021a9cb-c5ed-4cc3-a927-a6516246ab22", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947842, "uuid": "9b70beb8-ad24-427c-be04-bb7e39ddb62e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947842, "uuid": "79a363e2-8a63-46d3-9a26-a66ca799aafa", "value": "c0bed85d9e638100db89d1b18ce48f4efeb7e47c9d4754abc4135e1fdfe3dfb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9e437c-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947985, "uuid": "e325ca64-c882-467d-a151-c6a8e5637ddd", "comment": "Malware payload", "value": "8cab83ef8f8c8e0e2ae0979891b87fa6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947985, "uuid": "f4c957d0-941e-4638-8384-5301e822ff56", "comment": "Malware payload", "value": "c0c1a9d148456c4fab03acb9d2bfaee2783b3abe3770ec3270b35043eefb2025", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947985, "uuid": "6dbacf2b-cd26-4bad-87bd-d6cea9cf7972", "comment": "Malware payload", "value": "7cdb0ed4f07cd11ee3380207dce7f38b316bb116", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947985, "uuid": "62102c5e-399d-4284-b804-a475e700a604", "comment": "Malware payload", "value": "265b2262b043a2411a7eb82320dae18dce442095b9c978110dbbbea8580a9b7db21ac5889254829e88a5513943326a28", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947985, "uuid": "874267f8-850e-4138-a8ef-e298a70d58be", "value": "T1D5A1F750112C1AB17246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947985, "uuid": "162103a0-f15b-41e4-a88c-e05f282249cf", "value": "96:TRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:TRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947985, "uuid": "6f062f0b-b04b-4121-805c-aa291f22a5d1", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947985, "uuid": "81efc0ae-02f3-4d9e-a2e7-5d7f86501202", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947985, "uuid": "2bef1a1c-0ea2-4d37-b913-161a06f28a2f", "value": "c0c1a9d148456c4fab03acb9d2bfaee2783b3abe3770ec3270b35043eefb2025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1825586d-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948437, "uuid": "6755a628-29de-4a19-93ef-6a2d0f04a25b", "comment": "Malware payload", "value": "d654f6cdceb45479e1f46c0d16b11f1e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948437, "uuid": "6bee9c56-06f5-4420-9ce4-ccc2e274b8ab", "comment": "Malware payload", "value": "c1904035a3ab39a26de9625f698b639f25431f9fb7bde7bad6e78d8275ca1289", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948437, "uuid": "3c3dca3c-6807-48e5-a5bc-06d2b1d56ed5", "comment": "Malware payload", "value": "1c8c2d74b966cc78879f6db45e435d42fa4d0dfe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948437, "uuid": "c2227b93-8cba-4301-acde-82380ade1892", "comment": "Malware payload", "value": "dc30322275d09aaa13e8443a8bf804242495973c51b7ae698ccab6f541d316e24ab4cf5c104c425754eca76703aa6cac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948437, "uuid": "7edfbf55-eac6-447e-9615-63f41db04116", "value": "T101A1E850112C1AB17346597AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948437, "uuid": "0ad8c7ce-4182-42cc-80fd-23644a72b0ba", "value": "96:nRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:nRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948437, "uuid": "a5893a51-d958-40d4-b588-6beb7912993d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948437, "uuid": "9e86e4ba-627d-4dc2-9800-ab96f2236182", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948437, "uuid": "3e1a6fe5-398a-4ab4-ab8d-18ae9a5880b6", "value": "c1904035a3ab39a26de9625f698b639f25431f9fb7bde7bad6e78d8275ca1289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d80e94b-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948500, "uuid": "0a0ff1ac-4eb5-490f-982b-8be03516b5c3", "comment": "Malware payload", "value": "dc5e6821953325fa4f9f0716643e4917", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948500, "uuid": "75a36356-09a1-4951-8b51-e3af7509fa5b", "comment": "Malware payload", "value": "c1c138037d32a9c2a051e6bd2e1a528457f51c865b4cbf87b2696fbf9148064a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948500, "uuid": "73b5a775-4e9b-434e-b6f6-1d0e306840ad", "comment": "Malware payload", "value": "bd4d62f62460a905950497ec8283c4ccb4b45005", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948500, "uuid": "4033914a-48af-4b8f-b452-e3c27969e432", "comment": "Malware payload", "value": "25c55e9825b600d4cb057a5647f01c8f6256177b9ea7079c6b88525757f0e0e1d871eec9b52e0aa5f4a72b500f1bca3d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948500, "uuid": "e071d687-6630-49fd-b55d-e75da791287a", "value": "T11E517FC5B3042A306FF35E6BB2B68C44B0C0B662AEC5AA45D1ED78B99C4CF487490F53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948500, "uuid": "fae7a808-1ea6-464c-8da3-ed70f47461de", "value": "48:vvPORvYmRvySRv0CRvqyRvsaiRvDtoRv6SRvlKRvkqRviURvA5aRvzGRvGUe:vYT1btwQ9uDP4KcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948500, "uuid": "7d6e7594-e287-423d-bb18-7126b56d8957", "value": 2751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948500, "uuid": "5052bc77-79f2-48ee-8d4c-a2c6b1a07dec", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948500, "uuid": "bc6e5ed3-c8f4-483c-ab2e-d266d166635f", "value": "c1c138037d32a9c2a051e6bd2e1a528457f51c865b4cbf87b2696fbf9148064a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fe2726-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948781, "uuid": "09b9f861-8041-47dc-9001-479a67ddefa0", "comment": "Malware payload", "value": "8834ec823ee9dc2a952c766c7c7de308", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948781, "uuid": "3ef2e8c3-b714-4336-a4e2-2da0207cb576", "comment": "Malware payload", "value": "c1c65d0e191f5f9946c3556251f5e346ba9cf31de4916dcc2c2378d1312f4a1d", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948781, "uuid": "3ea3d191-8e94-4c3c-9a14-18a0ca694112", "comment": "Malware payload", "value": "d7a8d754a4e32707c43e70bd56ab2395c8930c2e", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948781, "uuid": "7056b251-afda-48ca-b8e9-1c3b0acc6339", "comment": "Malware payload", "value": "f86891b1cdd448749a1041957c797ff7d27778cc05d3687139ed02cbf61e9cae237e138231f27faaaaa96412ff58bd38", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948781, "uuid": "8cc8f09d-07dc-4b03-b0d0-cfa57c5b6d54", "value": "T199E5335099D106C8F598CE2F1B9C6536153FEFCA74A8ADE792D287F1000FB82DA72578", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948781, "uuid": "f42dfa5c-3367-421a-b699-c9a765b534bb", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqE95:G1wwAjzIQOMK2GNKslgus10Y1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948781, "uuid": "fa25468e-53ef-46de-bc15-d2d98bd16818", "value": 3104768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948781, "uuid": "15177522-1524-4ee2-831a-0782713ada72", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948781, "uuid": "e9fdf8df-ec06-46dc-af49-68465e9d5802", "value": "c1c65d0e191f5f9946c3556251f5e346ba9cf31de4916dcc2c2378d1312f4a1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b24401-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948429, "uuid": "3b23a142-4c1f-41b6-8bb4-60e4ae25a977", "comment": "Malware payload", "value": "630f88766660d3c60d28b7fd9b54e8e1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948429, "uuid": "e67d82b9-1d78-4065-ad3d-af8daf322934", "comment": "Malware payload", "value": "c1f13f3dd588e88651f428b7e2f7be4582d808bc8b0b684715279fe9e0677a27", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948429, "uuid": "519edcac-13de-4c4a-bad4-e28b4ffb008b", "comment": "Malware payload", "value": "8c038f6a99248b939af3873af66e4491c6f04bb9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948429, "uuid": "33982b1e-4b85-4515-97b3-ccc77ff1cfd2", "comment": "Malware payload", "value": "82efae1ac3394252f6192da4a663ff3985c7d15da839cde365d9b9a54461bdd46e49929535d34ab8def03eed830f9e68", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948429, "uuid": "a5c792cd-6f85-483e-96dd-6d7f946e4bba", "value": "T166A1F850112C1AB07246597AD26FFA52B50EC81B0A777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948429, "uuid": "f636ff2b-8379-4a50-811e-3b79790ee9b3", "value": "96:YVRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:SRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948429, "uuid": "af7704d6-b3df-406a-be2f-6c74f28b531d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948429, "uuid": "dcceb022-fe7f-432e-a4cd-963e7fb2cd7a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948429, "uuid": "5b294eef-48a4-4d3c-b0a8-83ff491e5db9", "value": "c1f13f3dd588e88651f428b7e2f7be4582d808bc8b0b684715279fe9e0677a27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b75da5-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948027, "uuid": "58b6db98-a32b-4a40-a4d5-c6414d99a9e3", "comment": "Malware payload", "value": "978a9d0fc981e2a84b7390aabc442cb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948027, "uuid": "b468d75e-d3c3-412b-a7d1-34fc94f89375", "comment": "Malware payload", "value": "c29bbc54a46c03fb0894ac9617e96c7d67791ff50c273ca925dc25cc08f9e657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948027, "uuid": "0becf3b7-3c8d-46e8-b326-6ed86215cf9d", "comment": "Malware payload", "value": "35ec51135882f2175769d6f4bafef78d32087451", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948027, "uuid": "7040ae0f-043f-46b6-9623-d042ee07820e", "comment": "Malware payload", "value": "0a0adf9391c30243cce9944367df5107e1a469be6a731d0aa1dd1800e9ac8ded1e1bc9995556e9ef9106602b5639b1a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948027, "uuid": "56e5406c-0109-4175-beaa-af114bf40454", "value": "T13027CF73910738E9E5B98CB4D41425426DAC38875738A3C7BAC871F667EA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948027, "uuid": "18d9c6f0-561a-4684-a541-0f24e7199eb4", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnan:sXyWSpV+Wu7rI3JER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948027, "uuid": "553484c0-94a2-4906-aa6f-ee4ecf209e42", "value": 22282240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948027, "uuid": "fcce906a-7fa6-4c73-b460-26b10583b562", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948027, "uuid": "28bd6d36-0db6-48c5-a79e-9b0afe15209b", "value": "c29bbc54a46c03fb0894ac9617e96c7d67791ff50c273ca925dc25cc08f9e657", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b57c12-0520-11ed-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1657987348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987348, "uuid": "af64f04e-9fe2-4d49-a42d-f5df86351bd2", "comment": "Malware payload (AsyncRAT)", "value": "de245d97e4893545e2f3ba157782c71d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987348, "uuid": "79fa0bb3-52ec-46e1-a101-75a566ddd6b3", "comment": "Malware payload (AsyncRAT)", "value": "c4a4f67f97cbb15eabf06808d2125c7234790354e995a8a48920bf088ac8f762", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987348, "uuid": "df8ab630-05c6-4537-b712-fe0734ad6472", "comment": "Malware payload (AsyncRAT)", "value": "a09d9d29b66686df9973b0a33a36185729ec733e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987348, "uuid": "bf6c18a2-e621-4da8-a3c4-b00bc34490ad", "comment": "Malware payload (AsyncRAT)", "value": "d6b3baaba6ac389f3e80a28d7d6c0e6d22086159e9250cf4a809ca6c78dda3d9da02ab8daedabb9fa4ab9ad079760c4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987348, "uuid": "eb854a9a-311a-4ede-bfe6-5785aa0fdf4b", "value": "T142234B4037998136F2BD4BB4A9F2A180877BD6176923CA5D6DCC10EA1B13BC596037FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987348, "uuid": "41a3a23f-3c5d-4c26-93b7-578d0eb4e75e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987348, "uuid": "7ccbca42-817a-4e21-9763-0a74275e9c16", "value": "768:XeICljTILmCKi+DiBtelDSN+iV08YbygeGGJUFlJZvEgK/J3cVc6KN:XeIYdmBtKDs4zb1rm23nkJ3cVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657987348, "uuid": "8ac82ef8-fcbd-4179-aa1e-f49d133b4def", "value": 49682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657987348, "uuid": "e60a64e7-76f5-4e30-af26-67ccabe8b3ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987348, "uuid": "6407e4b3-80d4-4939-bc4d-fe56e354c82d", "value": "de245d97e4893545e2f3ba157782c71d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff35e7c6-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948395, "uuid": "5bfd985f-96a7-4521-a7b2-9cc95d0f12f2", "comment": "Malware payload", "value": "b63719f5a934daaf13346519cb182ac5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948395, "uuid": "a263c25e-9f68-485b-98d4-2c881ff32b56", "comment": "Malware payload", "value": "c4d5793e737ab8c0281ae4e0353afa7d300423914ed030c6e8783622442866e4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948395, "uuid": "b4f0910f-43bc-4c70-a5d7-760c97d112c3", "comment": "Malware payload", "value": "a1ac47e70bba3a57a68b82348bdddb199d714fe6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948395, "uuid": "9664e7b2-d98e-4c52-ac00-6551191821c8", "comment": "Malware payload", "value": "5747ad9383722097bb8bac79d299fca388022aaa6547101486c3495504b4a0072acada2f487b14634b437bf2c626c0f7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948395, "uuid": "c584305b-4133-4ec0-b0ef-f79d6869f7c6", "value": "T1853194CA61A14B706CF5AD2B32AAD81471D8E5C716CA1F98ACEC38E9488DE147061B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948395, "uuid": "c69e6224-2099-40d3-87ee-b4f5f8a4a2d9", "value": "24:vkp+k8kvc4kkv8ask0krskd+kmEskMk6Jk0kz:vfDj4kPbLnk+zzhJT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948395, "uuid": "3072af90-0ab6-4b01-a1c0-7436ebedfa0b", "value": 1504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948395, "uuid": "2606df10-4cec-439a-8f51-8a2a5e182311", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948395, "uuid": "7ca0dd7f-bd49-4a55-b095-d695f709a8a1", "value": "c4d5793e737ab8c0281ae4e0353afa7d300423914ed030c6e8783622442866e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afafd800-04d3-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1657954275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954275, "uuid": "f2599264-3d62-4b52-9f68-f4e8429f3ec5", "comment": "Malware payload (SnakeKeylogger)", "value": "1d7f153d80575e402fa82a6d72dfec4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954275, "uuid": "558cf87c-aa9c-49cf-9434-0d1c6c437381", "comment": "Malware payload (SnakeKeylogger)", "value": "c5009f821e656237501821184d675c1da97cd3cf3e74117f4dd33053be1f6137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954275, "uuid": "f0927109-d975-4100-8392-d33c9a705006", "comment": "Malware payload (SnakeKeylogger)", "value": "f09456d01900deb9783d20c5c6e48ffeb71f8b11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954275, "uuid": "24dbc784-dfa0-4252-b03f-8a2c7eafebd3", "comment": "Malware payload (SnakeKeylogger)", "value": "e209596d09f7247309a6d86dd10b0f08525dcc240e63ef67a122788588aba54c1ddfa5bc67ed78e78c1ef61eb522d841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954275, "uuid": "9254d74d-46e8-49d5-a8fc-55ba256230b4", "value": "T152547C8972A431CEE863D6319AB90D64A7727CA7933E820B405B315D5FBE943CE147B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954275, "uuid": "07513d87-5581-4c55-adfa-cce31e3c4312", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954275, "uuid": "01da1f28-c452-4dd7-8f4b-fe9d7fd0150a", "value": "6144:0sgRgIHaRxOLNF59FO68lEGGcCwgkZJkK9dK01su09x/A6CoKczF3f3:0nWIK+FARlEGdCwgQK8S9lCoKczFv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657954275, "uuid": "641407e3-e2da-45b8-8b0e-9abfd2e9f3b1", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657954275, "uuid": "22a6d75d-40e5-47a5-84d8-1fa0a1a98e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954275, "uuid": "492ea07d-309f-459e-8bfa-81df10f751ed", "value": "1d7f153d80575e402fa82a6d72dfec4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c538ad-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948807, "uuid": "3d8f8241-0f3b-4c6c-af7c-06b96192f82f", "comment": "Malware payload", "value": "e5e9dc681ed161a8179e7e79db160ec0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948807, "uuid": "6cce0427-a506-4715-9638-274a1e04144e", "comment": "Malware payload", "value": "c5228e3792b2c3b43a4e42160de1fdfcbf6d11c7382dffae51d40c5893d4790e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948807, "uuid": "ef2c701b-5656-4717-9c5f-6c996fcf8f18", "comment": "Malware payload", "value": "d6739e6c129d6c24e79b66808cc687a9df1054af", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948807, "uuid": "13e93d6f-ca02-474e-ba31-bbebbd254724", "comment": "Malware payload", "value": "a9ba579ff008c33553d51377fa9c7cd563a1928e902b8d151288d9f00dd08499a6f756b4d16db993f9cd8057a54f5fee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948807, "uuid": "64d2f807-208d-433c-90af-fbd2cc97baba", "value": "T1BFA1E750112C1AB17246697AD26FFB52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948807, "uuid": "89176251-a376-48f8-9f91-4dd422e8c3ae", "value": "96:DRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:DRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948807, "uuid": "92155bad-df36-4073-92ac-c3b9b67311b3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948807, "uuid": "ae25fdfc-867b-44f4-a0c3-ee09f600f705", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948807, "uuid": "7ee4bf81-4b32-4a6b-a593-f0cea7f78fc8", "value": "c5228e3792b2c3b43a4e42160de1fdfcbf6d11c7382dffae51d40c5893d4790e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21143ed1-04e4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1657961337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961337, "uuid": "da65fa08-ab68-457e-97d4-6a53b0a7802f", "comment": "Malware payload (Smoke Loader)", "value": "ee9cd7bd8f14f22b989258931396dd25", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961337, "uuid": "dadc153d-b808-4697-8ca7-0dd4ee0daf26", "comment": "Malware payload (Smoke Loader)", "value": "c52891732e84256e4bb48322cb4ea01c2c9c3fccf965574735153550597cbba9", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961337, "uuid": "0daeb2ad-428b-4731-8fbd-8a9733169007", "comment": "Malware payload (Smoke Loader)", "value": "038281f840bbfdccb406e066510d09d475375eb0", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961337, "uuid": "88345cf9-fd9f-4273-9dd9-80053c74dc1e", "comment": "Malware payload (Smoke Loader)", "value": "7de8193ed9a12e0916448fd36bd1673fff7a85acdded340e7957a3edceb939a903bf0f4d66e9a8fd34140e311dfb5eef", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961337, "uuid": "92dbf2e5-79c2-4ab1-873f-768765cfd808", "value": "T18704BF20B3E1C072E1A3063458B5C7A15A3BB923A77495CF7790DB691D703C1EABA367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961337, "uuid": "022790d8-8349-41f2-aad9-ca3e9f8a3171", "value": "1babba8ebf028e1ff7cbb28d85574e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961337, "uuid": "1c08b52a-45fb-480c-b0a5-c88735692d37", "value": "3072:bC+fA7dPIZ3gWizC+Yl0ecyNNR85lrgYS8+wetgCEz1+QzQUblmtHvyB5i:Em2WJlbjNu8nPAC8+xU5OHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961337, "uuid": "f02b4871-5453-4cf0-9dce-d8658ae771e8", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961337, "uuid": "204f2be3-9f2d-401f-a5f3-b3fe7a2208d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961337, "uuid": "835873eb-848a-4051-bd6b-e4f93470ddad", "value": "ee9cd7bd8f14f22b989258931396dd25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2779d15b-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948033, "uuid": "e5e22096-a0cf-4d40-910d-793f8ba1f052", "comment": "Malware payload", "value": "08efc69241a0501829c013b178110358", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948033, "uuid": "391578d7-162c-485e-8174-6e2682e2dd58", "comment": "Malware payload", "value": "c5322830fea2ebec09514301990eeb78d8f4208408d66b1c9a0be85c51680b01", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948033, "uuid": "d3626bdd-7633-443d-be23-2c51f242af2e", "comment": "Malware payload", "value": "f13c58180245811df41ba4c080dd4f358a245e89", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948033, "uuid": "76141a38-71ad-455c-90a7-47bc99460314", "comment": "Malware payload", "value": "9e8c0f398db7ed0c3f4351b0aa18870d4830199de1840f3d30231e7e0184aee177ba7a69693da3afb4ad53f757428c1b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948033, "uuid": "a6fa333c-78ac-4fad-bf16-076a4e2212bc", "value": "T14BA1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948033, "uuid": "48022ae9-a413-466b-ad86-85a37dbc9f62", "value": "96:dRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:dRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948033, "uuid": "b0da34f8-deac-4351-abc2-3fb771e3f40b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948033, "uuid": "314da633-f20a-459a-a408-63152f942da4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948033, "uuid": "87eeb661-71d8-4b52-b96c-85c59d3415b8", "value": "c5322830fea2ebec09514301990eeb78d8f4208408d66b1c9a0be85c51680b01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fd99a3-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948591, "uuid": "1754a48e-dbbf-4692-86ee-d45653d729ac", "comment": "Malware payload", "value": "3c5ad72d4d50f29b42d6711938e0ae9c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948591, "uuid": "b3720eb1-c568-4ca0-a0fb-1b0b617b1dec", "comment": "Malware payload", "value": "c56c69519ca3f47a159838f45b98b689a3d0da0d904322d118c1ea8bdd00e0bb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948591, "uuid": "e3d9fb7f-af9c-47b9-8182-8c4f28d17c35", "comment": "Malware payload", "value": "c163180b6bf16c9d51c7666b6d7c857b3b97cdbe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948591, "uuid": "677d7452-9bf4-4f31-ad59-75ce90c9bb70", "comment": "Malware payload", "value": "d380ef48a6c314e227df6fc396535764156e7225104975f8cba62422f38e68db07b9aef735037669650d97e46b9405e4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948591, "uuid": "7ed85a38-9f9a-4a13-8087-dfe8f4b4485b", "value": "T1D83101C4B57139713C7B58A7A7A51C1932D160797CA26D4D6CE8B8F48DCEE8222C42EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948591, "uuid": "66ba6453-c2fe-4167-9a37-c9b5baa2e196", "value": "48:vFMR+mRZGhzKWR48ARvRER3/s8RJRyRFn:aImJWzAJiPvYzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948591, "uuid": "3dac9882-226a-4f42-bf44-cccc79b3fd01", "value": 1670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948591, "uuid": "fafcd40c-76a0-4c57-be45-b0bc98f437bb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948591, "uuid": "3ed1938d-9834-461a-b555-0e7b8d64cbe2", "value": "c56c69519ca3f47a159838f45b98b689a3d0da0d904322d118c1ea8bdd00e0bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd31c09-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948042, "uuid": "092d364e-facb-4424-90f3-9ec23d84756c", "comment": "Malware payload", "value": "016add31c82ef170cb4892b6c4b36819", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948042, "uuid": "3c7e0c6f-4521-4994-b1ba-aacc788e53b9", "comment": "Malware payload", "value": "c5a75f119ab776d85abf51efca7c882d5eb911501a0e011c0218da229e79bc3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948042, "uuid": "51c4e4ef-7e02-4113-aa8f-b30519390731", "comment": "Malware payload", "value": "e5990b4bf6c0dc1b9a3191a96f3b20ec7537d4b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948042, "uuid": "1add83a6-c389-44d0-9f09-f83898ab0822", "comment": "Malware payload", "value": "83101c13b6551ee521cae1eb9f8f43501617fc3e782e962244d0ba5f7145c11f330dd014da2529152b220ea6bd18971e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948042, "uuid": "84b3a895-0ca0-4436-b689-93e160da485a", "value": "T12325F657E89550F4C1FEE134C726A213BEA13499073427E76FA186F11B26FE86ABC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948042, "uuid": "e9f80e6b-5f23-4e13-8a09-c968e29b59e5", "value": "24576:cqfwj1QylLAE1phLrb/T/vO90dL3BmAFd4A64nsfJvWSIsWW1jgd:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948042, "uuid": "d749dace-ead4-4202-97bf-ede55fd34fe7", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948042, "uuid": "600051c8-4f0e-4e10-a45b-75df27c22945", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948042, "uuid": "89c10845-eacf-4292-b2f0-b311e362fb81", "value": "c5a75f119ab776d85abf51efca7c882d5eb911501a0e011c0218da229e79bc3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1786040-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947916, "uuid": "3f120a08-9b18-4d40-a441-bce275517110", "comment": "Malware payload", "value": "e086414fe570bbb051fdd26d4e9b77c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947916, "uuid": "df11b5ec-2455-4cec-a10b-eddbfdbd4a29", "comment": "Malware payload", "value": "c5f5fa85678921fe8a0bd263cd8a03f848c9e8eb88aa27b6dea7661b659ad7d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947916, "uuid": "6d8cfdee-bdd7-4db0-bf9b-c0147d7bfc1a", "comment": "Malware payload", "value": "99058502f3b29bc51a196e2bd9568094924fbad5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947916, "uuid": "4acdcead-caa2-4d9c-9cf5-b5bc7c7e52e4", "comment": "Malware payload", "value": "5d2beedfebfec543af9c8359d6d825b85db07fde029665771bcd77663577c3ac2d5ccd5c4a67d7d0b0809e2005acbd94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947916, "uuid": "fa18084b-ba31-4423-8721-b97a534e88af", "value": "T11E9423F31424B3738A2C3A3EFF609E05D7A9573CE55A271A1A1FDDEB0F2951209C8A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947916, "uuid": "8f8ebba7-22bf-4dca-ba34-0a38264cbcfc", "value": "12288:lQIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSm:N4/y+qaBUZJAdVtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947916, "uuid": "f07e8688-2b10-478b-a761-ce8baf433610", "value": 428366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947916, "uuid": "51c737e5-ee13-44f6-be15-383fd8fedc76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947916, "uuid": "90151e11-a871-4917-8d6e-e970d031dc32", "value": "c5f5fa85678921fe8a0bd263cd8a03f848c9e8eb88aa27b6dea7661b659ad7d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10426f1d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947994, "uuid": "dc893584-30f1-4d28-8a67-27ac3179191d", "comment": "Malware payload", "value": "7b75f85afcb4794e896c1b0bf66a2442", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947994, "uuid": "15c9fe01-f510-4d56-aadd-0195933092d8", "comment": "Malware payload", "value": "c61092aac44da170375acb5d356e1c217a0715584b4803883bc63438b005dfad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947994, "uuid": "b141c60e-513c-4820-baa5-d3f52fdd3385", "comment": "Malware payload", "value": "13447b5ac6468ac7078aa6fb20d7d7308cf7c742", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947994, "uuid": "1632c1b0-8f79-4e0a-b5f8-581896e1eb33", "comment": "Malware payload", "value": "300714ef5b7c32a6d450dca6593cd605f6045c0ada5be178d591c0f77456c53894c86d0ed351dbf75623aec451ea4667", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947994, "uuid": "031894bf-bf03-4b28-8410-2ca58fe7bc23", "value": "T103A1F750112C1AB07346697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947994, "uuid": "d31e700e-ec8e-45a0-aac8-efceb369fad3", "value": "96:uRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:uRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947994, "uuid": "11e1925a-351c-4955-b04e-700800964c17", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947994, "uuid": "ba44701f-40ab-49be-8e80-9fec049485a1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947994, "uuid": "1d7d53f2-6183-4792-b398-fec0f89c21e9", "value": "c61092aac44da170375acb5d356e1c217a0715584b4803883bc63438b005dfad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d05900-04f9-11ed-93bb-42010a9c0043", "comment": "Malware payload (BlackMatter)", "timestamp": 1657970441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657970441, "uuid": "68edc500-5756-41ce-92ab-f3c1827a80e3", "comment": "Malware payload (BlackMatter)", "value": "a8e0d56f8c67f1f7b6e592c12d87acab", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "lockbit3", "colour": "#A858FF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657970441, "uuid": "cc8b8a13-1044-4d8b-828f-fb581424aa92", "comment": "Malware payload (BlackMatter)", "value": "c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "lockbit3", "colour": "#A858FF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657970441, "uuid": "4f3c95b5-8794-4e70-8547-e3cb1af7aa75", "comment": "Malware payload (BlackMatter)", "value": "ed555f0162ea6ec5b8b8bada743cfc628d376274", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "lockbit3", "colour": "#A858FF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657970441, "uuid": "c959eeca-ffea-450d-9f7d-37301ea0869f", "comment": "Malware payload (BlackMatter)", "value": "4c1eb3948df7b359851c491b8f268ddd7c18c605d1a2531342488b781e04239f8631d1081ff7ecc0261eda819aa38c32", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "lockbit3", "colour": "#A858FF", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657970441, "uuid": "1dc8abd6-1b49-45c3-9933-56e7ccd3dea6", "value": "T1A3F38E22A111D077F4271DF12B3672B1B3EB8E2C15A7A417EAE40F58ACA7D632F14517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657970441, "uuid": "e1c816f8-7a1c-4b04-a34a-cb8d4c1da0a6", "value": "8365ac85490d89776a96737b801cde2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657970441, "uuid": "a8d3f511-bdcc-40c9-a5e2-452862754e1f", "value": "3072:wrQnZg2Bvu2K8/PzRanIzrQSsKQj+zXzCGRG2:wrf2Bm3cLRanKr5zRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657970441, "uuid": "2cc25efd-a1b0-4be1-8474-8b57efe05f69", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657970441, "uuid": "cc0b34fd-9c7d-4a36-8a14-4be4424ad8f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657970441, "uuid": "51b6031f-58dc-4fb8-b84e-84f9237b35f3", "value": "svhost.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55453c92-0557-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010816, "uuid": "0668b12e-6960-4771-95aa-7b50a8e71751", "comment": "Malware payload (Mirai)", "value": "8c12a40bda92d77c32c7be06e54e780a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010816, "uuid": "3247b6b4-00db-403b-8488-b3bd8434259b", "comment": "Malware payload (Mirai)", "value": "c6999565f437af1bbfc5a8092d78ac9bb7d142d0ad66d0584e07d765a0d6b8ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010816, "uuid": "7478f516-26a6-42bc-9729-8e3b4103a554", "comment": "Malware payload (Mirai)", "value": "9b26b63afd85732c79972ac86f08c077df955f27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010816, "uuid": "f14b99e8-ee1a-40ba-95e8-54136a551949", "comment": "Malware payload (Mirai)", "value": "bd9b1c08adfdae1945aa209ade0d8269b51062a1766d6c409b65fa801d0a76b82e3dec1cdc2c7d301b1b574023d83218", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010816, "uuid": "19e2abfc-b9b6-4fb0-a481-d404ac7111e5", "value": "T17F535BE6B801AE3CFC6FEABB84220909F922765046630F377277FC97AC720A55957D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010816, "uuid": "8faec1e2-e1bb-406b-af30-d91f5ecf561a", "value": "1536:Vy76zbMFy45au1d2ScpYSMiyQ+RihlEtZt1eu/86:03yu1S6RiSN17V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010816, "uuid": "ec990dac-f2a8-44ca-8ce0-d36a9119041c", "value": 62180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010816, "uuid": "7203ca27-9f09-420a-b1b7-c1a53b555d18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010816, "uuid": "8601d4cd-445f-4e56-8af7-261e20230439", "value": "8c12a40bda92d77c32c7be06e54e780a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619a5e99-0506-11ed-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1657976048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976048, "uuid": "3dba394d-62a6-4fa1-afc7-1c154438ed5d", "comment": "Malware payload (DCRat)", "value": "ede7f0991c44aec38b041cf4301a492d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976048, "uuid": "d55b0e5a-8fd1-4c4c-9f69-625224d9fdcb", "comment": "Malware payload (DCRat)", "value": "c709256808d07869ced7a73c9ea9d6959c952b235e7e1687d6263a1d204f928a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976048, "uuid": "46811f4f-4f31-42cd-97cd-b3d798ecce2b", "comment": "Malware payload (DCRat)", "value": "f7933ecb695d4de8c8df23b38c72d0764d26b7ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657976048, "uuid": "a6afa422-a298-4ef3-aac7-45de93cf30e8", "comment": "Malware payload (DCRat)", "value": "3b925207f8f61753f89dbc3f88d4c82913ec0fcc05bba976b209f961bf07eba233cf0601467708d88800108b7e494836", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976048, "uuid": "ac7f2be1-2a2e-4b7e-96a0-b387f13f0f12", "value": "T11A7486D832147B8EC867CEBD89B45C64AE607C67931B4103A55336DD9A3E9C7CF21CA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976048, "uuid": "79022865-010c-4075-8265-88ce8e8de5b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976048, "uuid": "cbd9fdd9-afe1-4fff-957d-e1be1fe81a41", "value": "1536:lrBP0DBoWAIBn2UTiJzGMIeaJ3rPDhbqE8wRysrpp65lDVclN:6SzKn2UQzGMIeaJ3rPDhbl1PvSlpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657976048, "uuid": "2448aa10-68b4-4296-988c-bd7525ee8b68", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657976048, "uuid": "b3436727-747a-4453-8091-186c6cccc51f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657976048, "uuid": "dbc05e65-83f5-4a92-bad8-6223594aa2a7", "value": "ede7f0991c44aec38b041cf4301a492d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6029afc3-04c1-11ed-93bb-42010a9c0043", "comment": "Malware payload (MassLogger)", "timestamp": 1657946410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657946410, "uuid": "5342cb65-bfbe-43d2-ab2f-1aaffc56c862", "comment": "Malware payload (MassLogger)", "value": "f021ebef445c4adca02629e5a81b9ac0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657946410, "uuid": "72536161-3576-43e2-a12b-efa7319e8ddb", "comment": "Malware payload (MassLogger)", "value": "c7e48650943dafd9b95d0e6530a10aa5eb77a229bd7b3cecb23c9e337490cc76", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657946410, "uuid": "850a2495-1d1c-434a-8965-99f9058a68b0", "comment": "Malware payload (MassLogger)", "value": "b41ea7556cd5dccc6b1171cbaf957569d0732a71", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657946410, "uuid": "242a8d4a-2caf-4e1d-b2cc-98677c4434ed", "comment": "Malware payload (MassLogger)", "value": "580d8bb61e406e3be023d85383b965557fff14a4026587d27cf8c6ad8a085b8196118d852bf86fab002a7ec8df0aff31", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657946410, "uuid": "b38441fa-a2bd-4899-a8bb-71c8519e8c3b", "value": "T15B3402B9970FAE6AD26A073788430741CFF67053D995A282FEC4563289127B0EEF0775", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657946410, "uuid": "765de740-0555-4a79-ae69-4f9550e51d6f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657946410, "uuid": "634dbe54-4df3-43cb-a746-e082cd09aacf", "value": "6144:sF0LtFa2T1Ah01Rt9v0TD84EYP6YfmoScbXk3p2P+PyMJ:swlY2z0Hx2IIcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657946410, "uuid": "3d5bac3b-70ca-4b53-8500-f63777584f22", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657946410, "uuid": "0d736c23-3f60-4337-91e4-9e341841ba44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657946410, "uuid": "b9d94836-c56e-4435-b56a-5aa2fd15960f", "value": "bv2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af4e6ea-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948576, "uuid": "7e61da4a-3472-4f52-8120-0f01f721586e", "comment": "Malware payload", "value": "1f547e893cedb2db306b0b05cbdcbfa9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948576, "uuid": "29926adc-6d49-4d4e-a584-b17ea98ae2dc", "comment": "Malware payload", "value": "c81bbd5cbe06789299b6d54c5123492a6eec065c2100fc2b4a46f08463e1f1d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948576, "uuid": "a73c6ac9-a862-4287-9e45-34b7d997b380", "comment": "Malware payload", "value": "be18df0f9bf5f1504a75bfa86e67d307deb88333", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948576, "uuid": "8549ea5a-08ab-4cd9-8b63-2544c022991b", "comment": "Malware payload", "value": "d0f113b1177302532cdc62f74db30bd0be70eec8f8fb1761a9cc45ba1005dafbf933145559ebba36dca6d73ee1261f43", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948576, "uuid": "2e7eda03-7ebe-4147-807c-9e2a3baa2705", "value": "T1E2A1E850112C1AB17246597AD26FFB52B50EC81B0A777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948576, "uuid": "8dcff237-d5e3-4422-930c-0ddccbbbb5f2", "value": "96:zRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:zRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948576, "uuid": "af43aefb-b0f9-4f74-97bb-837a3ac550c1", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948576, "uuid": "4f751906-2ffe-4a1b-b0e7-247c948fb714", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948576, "uuid": "408dc40b-a9cd-473f-9b47-05eb2f17f97d", "value": "c81bbd5cbe06789299b6d54c5123492a6eec065c2100fc2b4a46f08463e1f1d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46d94df-04fc-11ed-93bb-42010a9c0043", "comment": "Malware payload (RecordBreaker)", "timestamp": 1657971919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971919, "uuid": "0f9e6a7c-b6e7-4346-b9f3-b68966c9a34d", "comment": "Malware payload (RecordBreaker)", "value": "2f7dfe9a88a2197d3c36c5427778585c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971919, "uuid": "af26d1d0-0860-471d-84f0-8a82a5f99e9c", "comment": "Malware payload (RecordBreaker)", "value": "c85bb7111441b78c9a14aa094dd2994b4eb66db4ea4cb5a11bf248e8dade11d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971919, "uuid": "a4864128-9ff6-4dd7-bf2c-00ba6bf8f2e1", "comment": "Malware payload (RecordBreaker)", "value": "46d109df2d6bd2992bb2845d2c7508d518a3f9ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971919, "uuid": "e3666ff5-469e-4b40-bd3f-9b0cbce95a3c", "comment": "Malware payload (RecordBreaker)", "value": "dae06d85cfe4aab7421fff7e129fe6a7a93087e165877892d5d56e413a9407e31adcee742498ccc9bfc32af06bc22ba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971919, "uuid": "4914e650-9f01-41a6-9174-ba125cffdbe5", "value": "T1BF76332DB505437BE0D20E76D983D979B7F9D2060F7809CFDEDD086DADB2A102B6814A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971919, "uuid": "0e41a528-bc2e-43b1-b881-61f6cb157285", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971919, "uuid": "2196fb7f-5e4a-476d-bcc7-fbd56a1888ca", "value": "196608:itd5gXOfQdUa0xAE/JKuw3y/s7YMPqo60OpKVtO2khzdhx7WEiNQbC:YgXOf0Ua0xEuwi/s7YoqFFpYUzB7WEOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971919, "uuid": "bba97cdc-c114-4e63-a759-dcb89aeaec6d", "value": 7717966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971919, "uuid": "c9a388af-847f-487b-b2c9-b932a549f597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971919, "uuid": "3f7fe771-9787-4c39-a160-c35c28ba52dd", "value": "c85bb7111441b78c9a14aa094dd2994b4eb66db4ea4cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0aaba42-0508-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657977013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657977013, "uuid": "aa37c3c2-f5ae-436e-af28-d4bf00504be1", "comment": "Malware payload (RedLineStealer)", "value": "c5d601d6594ec182bfadb4c4646053e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657977013, "uuid": "e2421029-84c4-4c24-af81-88953bd69878", "comment": "Malware payload (RedLineStealer)", "value": "c873b38b7f987fe5fdd77dc70adb4c5293be1538096f9e683733718b623ef509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657977013, "uuid": "1cc387ae-906f-4f7a-9cae-e04aa0dc97ae", "comment": "Malware payload (RedLineStealer)", "value": "75fd29a31211dd03e7618b1d06429c0effbcaf2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657977013, "uuid": "82bb4a52-0ae4-4700-a809-249e67d924a2", "comment": "Malware payload (RedLineStealer)", "value": "c9e36819b2c0112a6aaf7899cb349242c46cab8c9d401beffaee4c42c6a96c0d247ff8683784f6f92045c127a4c2a5d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657977013, "uuid": "ecbebd5c-6646-4ec4-a088-8fa429c70d80", "value": "T16B94CF00BB90C434F4B752F849B6936DB92E3AA0573454CF52E52AEE5B386E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657977013, "uuid": "793a2d92-3492-4656-9e05-a89531313e4b", "value": "363debf0ff85eb6df1e94b75eacd8b61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657977013, "uuid": "0292308d-4d97-4a53-af62-43a5f094ebd1", "value": "6144:TzRZtSw+BKzE+b5pg5lEUWsktq69HG4rsdc+n3Ssk5Q7GVOx5PR5VbzZd:TzTP+BSVb/4lEUWsktPG4ec2xXfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657977013, "uuid": "3be2c248-3954-4188-a189-0a2135bd692c", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657977013, "uuid": "816f6868-a889-4d71-97e2-e5718f2f4a0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657977013, "uuid": "52ae8038-7f73-43bf-a556-4c3a60727a08", "value": "c5d601d6594ec182bfadb4c4646053e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e76233-0541-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658001260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001260, "uuid": "376a817e-9bae-4c67-8afe-ebbd8cb6a149", "comment": "Malware payload (Mirai)", "value": "054fd5d19677d96c9b93dadd9f362430", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001260, "uuid": "f05765a0-0c25-4a38-b155-519174d7f9e6", "comment": "Malware payload (Mirai)", "value": "c89f793fc9b6716ebd8949a33012311d837e06bfdc5adcc2804aca788ec12405", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001260, "uuid": "bfc30aa3-119a-42cf-9f19-5c15cb8fc7d3", "comment": "Malware payload (Mirai)", "value": "72176b562e01290f8a8c35643aa139d8ca86cb80", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001260, "uuid": "fb4186b7-252c-44f0-8922-d0f338127c79", "comment": "Malware payload (Mirai)", "value": "9004fc7b67aac571fdac6e4319b4c7e0182d7a7b3d831c5824d1ceb653f2702f328332fa620b13af4e44414bd33c9bac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001260, "uuid": "283eafe8-5496-4f55-b700-1ec85409fad7", "value": "T123C33C46EA408B13C4D51775BADF42493323E754E3DB73069918AFB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001260, "uuid": "96235d91-5326-41fa-98d5-81c116850375", "value": "3072:d8waJxrSnpaAgswpNB2uicE+8fCM/9ggC:d8DxrSnQAgswpNouC+86M/9ggC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658001260, "uuid": "91cdee8d-b611-4999-acef-37ac24af794a", "value": 124912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658001260, "uuid": "616a48b4-2e6e-430f-9cf6-eb924dbbe057", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001260, "uuid": "248b118f-f37d-4c11-9978-1297bf9c8dc9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6f7be8-04e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1657961198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961198, "uuid": "5568e837-aa25-485b-b93f-63398bcf973a", "comment": "Malware payload (Loki)", "value": "d19fca5689df26cd46dfb6db22e87f98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961198, "uuid": "8c231da6-6418-4262-815e-c483b245c1ef", "comment": "Malware payload (Loki)", "value": "c96c9e87d713af1196f7db75ecb71b7696011d0235e856a0946ce75c97d21cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961198, "uuid": "5203188f-59e1-49c7-9b47-fb3ed4ca8cbe", "comment": "Malware payload (Loki)", "value": "2c41117f6d2b5bb318beaeedbb4e601435b4fedb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961198, "uuid": "ac8ea83f-7103-4bbc-afdc-9e992c3e2d80", "comment": "Malware payload (Loki)", "value": "8bee83081b42393869c5d1c9b152ace59e6fdb6d2957026db953e311f46d0879a156302110b7d79aacde7df417eb4d58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961198, "uuid": "2adfa2c1-29db-40c6-8b0e-1f895d46af1f", "value": "T1D705123336445B9BD02E97F2E27288E113726E852A9AFF410DC172D719B37448A1DBDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961198, "uuid": "cab3c9e0-70ee-4c6d-8b9b-c0f9205b2c59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961198, "uuid": "ca38928a-bd5c-476c-a404-4d851834c208", "value": "24576:/ulhLuyyhurWExLGdo6faajRJPyg659Y:eLuyycrjKdo6fbj7ygGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961198, "uuid": "3bc4ae11-d31b-435a-893f-8698cea72466", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961198, "uuid": "d9cca747-2c81-4ef7-b944-4723f33996ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961198, "uuid": "bf608890-6e09-4435-b838-b0991dbfcf89", "value": "d19fca5689df26cd46dfb6db22e87f98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8a2b42-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948177, "uuid": "a3333a72-8428-40fd-8b19-ddff2421316f", "comment": "Malware payload", "value": "41a047a7c244157cb7ba844510c72840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948177, "uuid": "30d4e5a0-3c64-42df-93e5-521af99c8f50", "comment": "Malware payload", "value": "c972bbb9eada1f861e8eb91b08f067f90d832461997f3a34d88f6d7d92739c45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948177, "uuid": "b536efa2-9cf0-43fd-a3a1-7cc475883f7b", "comment": "Malware payload", "value": "101bff30673ce4acd2b7eeab33254c7d1fe9cecf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948177, "uuid": "1d2a1695-da64-46d8-930a-3435abf529ec", "comment": "Malware payload", "value": "785a43256c9d5b283849970df998d2d87471c1dcd49bebdcadc57cdbeb3cb23f526e19e8989043289a3c1f5c73395104", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948177, "uuid": "49f3518d-ca51-4484-adac-5476a412b2d7", "value": "T1FE67CF7791067CE9E9A94DB4841015816EB87C874B78A3C7BAC871F666FB2D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948177, "uuid": "3fd153c0-e59f-4e5f-82b8-59fe13d6d8a3", "value": "49152:+lBWMAkHDvkRrb/TcvO90dL3BmAFd4A64nsfJw2CQf+miVHXLPur3/RB39KptsnE:+b1+Wy+Crz9K4LME5WyOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948177, "uuid": "530cc0b4-1161-43a2-b779-8d71e86957a7", "value": 30312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948177, "uuid": "8ea0f73c-2de3-4d07-820f-f89523d5d9e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948177, "uuid": "497e6d7d-d2ac-458a-a276-59f1b822b37a", "value": "c972bbb9eada1f861e8eb91b08f067f90d832461997f3a34d88f6d7d92739c45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc99b64-04b5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657941251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657941251, "uuid": "9120904c-86e0-4a31-83f4-e6b63936cb1c", "comment": "Malware payload", "value": "739fa664e5dd312e0c911d6e6369f619", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657941251, "uuid": "ab813bef-e798-46ef-a8ce-f17292d282e4", "comment": "Malware payload", "value": "c9857019eba6f5cf315061862f26729b073766ada5084d067743c1526c86802a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657941251, "uuid": "b947b754-88bf-4138-bf6e-496049ea8cf6", "comment": "Malware payload", "value": "05082e18cae2d626781aadb67c18c21d6680854b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657941251, "uuid": "14ec821e-a5c2-4d75-be52-993a327b6ebe", "comment": "Malware payload", "value": "0326074279339e4fb0535ceb64009c3237cae3f1d11261bf47ca6bbea93385d0162d14723e59d122ec8c9c49fb438cc4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657941251, "uuid": "f3513eef-74cf-4ee7-8eff-56f0cdc06197", "value": "T18F853383FB34C842CEFB5B72A467034251774D389DA38A877B26B67D11B32F59742A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657941251, "uuid": "181cd7e1-7785-437c-884f-de8789a51268", "value": "49152:VqKGOObujgIOAzYTxDjRNKAbFD16Hhd6gpJPpLyUAmdR:VfpObujgJhTxfDP18XRo2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657941251, "uuid": "6047d0ef-7280-49dd-b06b-640fc9acbb7e", "value": 1847361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657941251, "uuid": "01037e45-869d-4db3-9360-a001d5321eba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657941251, "uuid": "6503053d-22f6-43fb-972b-7af7da79b12d", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148c03df-04b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657942418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942418, "uuid": "45015aa7-25ab-4067-beaf-81f881fd5856", "comment": "Malware payload (Mirai)", "value": "09c4eecfd710a6e7cead14cc06c36a2b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942418, "uuid": "15ee6cad-906f-4d16-b140-462a96d92f00", "comment": "Malware payload (Mirai)", "value": "c9862f1a9bab3ab0b3b19781134edbe36b0e77dc1ba2fc460d206102d6d0669b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942418, "uuid": "81e68f2b-a58e-40bd-a7c0-7554f7137e37", "comment": "Malware payload (Mirai)", "value": "bc03e1dab8612520b329df70f0e8e2b8bf7b303d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942418, "uuid": "ca1f0357-3817-4f68-8cb1-6dafa2d5598e", "comment": "Malware payload (Mirai)", "value": "1ae26458946558bf8b0e90f1b240fab90c816a86a4c05845b6255cfe7a97c83fdef8c55154ac34f58f03920e4141ab4e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942418, "uuid": "79065768-3d3c-4900-b8fb-fb0236c21869", "value": "T14543D8C1F9CB45F2C9074938609BF23FDB32D679407186ADDF8AAE23D927701521629E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942418, "uuid": "239609d8-3351-4765-af1a-95b9ce90a9fc", "value": "768:4QBaLIOa9sNdK8v4Ch4rxfhqaVgLF2bpDF0bMja0KR+J2JDI1PHsjgc6qYkSPPs1:4BIOaiTTR4VUia5IKIc6qYkCUxdAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657942418, "uuid": "96c113bd-9ff3-40b3-9794-f19abc4f8652", "value": 58128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657942418, "uuid": "28995f40-6c31-4200-81e7-171bada4a207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942418, "uuid": "e3ad46b2-0e92-45d5-b5bd-f23e9c506501", "value": "Ares.x32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7faf6f-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948580, "uuid": "8bc6b15d-988b-40ee-81fc-d4d502e47d7e", "comment": "Malware payload", "value": "59f7a21bc6d4427bda7e816c85610187", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948580, "uuid": "505bf748-72ae-4cd2-b198-0e16d8fe3c15", "comment": "Malware payload", "value": "c9e0963d55b442f888bba13d5f5bf06fffd4d86c778a3c2a550e8df851b965d9", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948580, "uuid": "285713cd-a87d-4943-9efb-a39669f96e13", "comment": "Malware payload", "value": "c2a3b091ae0fabc82981ccb84cfdb734a99940be", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948580, "uuid": "bbc97779-6720-4c06-b504-ef88846aa157", "comment": "Malware payload", "value": "83e8159b5fe823cb439a71a7ec4b791d67f6719bbfbd2517f99e51e8e8d1735296336815daac35d9cfa8b2edacc6e5ba", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948580, "uuid": "b74ced33-7366-43f8-b3a9-df3a3bfa4808", "value": "T1E714126700F3A334E6EBA7DBB4FDE240616931E401E8F2AC8160D68E457B35BDA5C9C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948580, "uuid": "a731164d-6819-492e-886c-b13a0b39d582", "value": "6144:VL5+rRLVGG/161T9VV5cMulRa0mTbQYFg+Vo:98Rhd/Y1T9bixObrnVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948580, "uuid": "c935f672-3dee-4948-ae1f-a0d16841ce7f", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948580, "uuid": "6612316c-18bb-4d59-b6d8-3d372136e225", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948580, "uuid": "932c1527-3646-4f7a-a763-a13891668910", "value": "c9e0963d55b442f888bba13d5f5bf06fffd4d86c778a3c2a550e8df851b965d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d6ac1b-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948727, "uuid": "c56b6d07-084f-414d-aa88-33f72fc4f01d", "comment": "Malware payload", "value": "56aa1be65932fbf8da98617cf530678e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948727, "uuid": "ba56c90d-6f87-4f0e-aa90-1f841bc96b8e", "comment": "Malware payload", "value": "c9e3d77ee7e559e758651d0554080435fb3c00e494bcdccc72f95039f7d255b9", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948727, "uuid": "572b9456-3e73-42a0-9eb7-9124859d0908", "comment": "Malware payload", "value": "f4da953128d633204a50599d38096c73aa018656", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948727, "uuid": "141ebcd2-7f5f-4998-aed5-40f8b7269871", "comment": "Malware payload", "value": "c55a48d408257db9a0cb14f941ba4604c546b9e7bd2432e01396504024c5e99fe7190725a7634d546dba2095179d0d59", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948727, "uuid": "bd82f623-3dc0-432d-99a2-f057c1c0cbfa", "value": "T12816335059C013CAF698ED1E17DC3A35123FEECF2878BEE3955283F1040EE89DA62656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948727, "uuid": "e0f2debb-a875-4b44-b255-5a293e8d3b73", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVX:G1wwAYBr21uQsJ7vTBAlYVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948727, "uuid": "6a030e1e-edd4-4306-8d91-ebd43a60e959", "value": 4079616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948727, "uuid": "29021032-da99-4795-933d-0b3a03d62c83", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948727, "uuid": "d2a2d5f3-7ebe-4eda-9176-f96cb7bc137b", "value": "c9e3d77ee7e559e758651d0554080435fb3c00e494bcdccc72f95039f7d255b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffec7933-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947967, "uuid": "f39db910-650b-47a8-964c-0ae31f3df8ff", "comment": "Malware payload", "value": "0c356c77890900851c52f0623381b959", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947967, "uuid": "1253a5ce-0836-4dc8-9a45-c4097083273e", "comment": "Malware payload", "value": "c9f17e4de67f16b4c3f95e6711d53f8516479c524ce6b931d25cd9bcb0a8ff36", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947967, "uuid": "0b15f00f-407e-4a7f-be0e-bab47ad1af3b", "comment": "Malware payload", "value": "992dc7f82785f8e39d8891c4e8e774e2f879c4b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947967, "uuid": "c900ec55-b7f6-4182-8f49-327d72bf678c", "comment": "Malware payload", "value": "a361d99918d7fb086e9e1b74004aab1b058eb6906b7d5fc113bf1609d96dc5dcf6a5733827f11dc9b676ad8dcf3d3b43", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947967, "uuid": "9af43748-84f7-4d72-9f5c-fa1018a469ab", "value": "T1C1A1F750112C1AB07246697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947967, "uuid": "af3592d6-1fc6-4e61-be0e-03aed5497224", "value": "96:ARYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ARJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947967, "uuid": "178f48ae-ff87-449c-9edf-3191256fe75d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947967, "uuid": "1ecdec5e-e1b8-4a8b-8a25-134da599baab", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947967, "uuid": "42f4ec5c-e1f3-49a4-8395-dc826dc2dbb0", "value": "c9f17e4de67f16b4c3f95e6711d53f8516479c524ce6b931d25cd9bcb0a8ff36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc6207d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948396, "uuid": "9527ae82-6dd6-46ae-a3e5-abcea95263b7", "comment": "Malware payload", "value": "b0c60e9deaf56886bd513e97e35a8c2e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948396, "uuid": "3f29e27a-4ec9-4a25-a25a-16f58b1f34e5", "comment": "Malware payload", "value": "cb2ba7a1f02b3dbf026deeff28e2aa4e19f105f9cc2dc831edda95d9ed605eba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948396, "uuid": "fa2d65f5-fcd4-44ec-b0ac-c1268907204f", "comment": "Malware payload", "value": "69bca909daf9ace1a4fbb38214d469b9c467e81b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948396, "uuid": "97c86222-ba88-4c0e-9edf-d54a27b8b41c", "comment": "Malware payload", "value": "093d798b26b8a58194c05f3dcd42cbc269087d29759026dd1c56df517b865c4a4db0bb130d13890bde7655010b464e3a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948396, "uuid": "5b9efe20-68ca-4f7f-9f3c-815547a0ebc7", "value": "T10EA1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948396, "uuid": "c21a529e-e940-4867-b173-2d4df911dd24", "value": "96:/RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:/RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948396, "uuid": "43e2e9a0-af44-4a6f-9537-4fc6703c20d5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948396, "uuid": "c85c1c6a-ff10-420b-84b5-a92636e7acde", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948396, "uuid": "204a961e-858d-43c8-9a86-f447b6fbf524", "value": "cb2ba7a1f02b3dbf026deeff28e2aa4e19f105f9cc2dc831edda95d9ed605eba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f73ab7-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948655, "uuid": "b3dc7b5d-0ec0-47ff-96f8-12d11b5ba806", "comment": "Malware payload", "value": "6cc2a59b303426efd2cb7867cd90e4ac", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948655, "uuid": "3f39f5ee-6833-4f18-b4f7-cdfaf0e8829d", "comment": "Malware payload", "value": "cbaf2ca77e35bd6a5938d6cd8451540edce0c9f3bdec3577e71d5e2e074e3ca3", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948655, "uuid": "852fdd15-6c0d-4231-8545-ba5ecd8684f7", "comment": "Malware payload", "value": "50328dd2bac1a1b10415cee6ef1fcac4094f62a2", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948655, "uuid": "47d2488f-dd94-485d-9d48-fe7bb918d86b", "comment": "Malware payload", "value": "aed2d68182fefde6e592afd076368a5cbd207b218beca46dee2bee09a93ad284958f6722b0f5c54d8f16f5f0f1262808", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948655, "uuid": "28fa8e26-31be-471a-8c27-1b729a2d4fad", "value": "T13AE5330C53EAB8FCF8A94529376389D1C5E852F1E88265F2D27C1598083F57E1BDFA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948655, "uuid": "53899cfc-4ff4-488d-ba2e-764d8872aa35", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmm:0XSxVJG2fLAqFOfT9sMYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948655, "uuid": "330b5a38-2d3c-4212-82cb-91943da34b40", "value": 3203072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948655, "uuid": "36a1404d-1d2a-40e5-becc-234da801066d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948655, "uuid": "d41da7a2-8926-4a1d-92b4-a00836708bdf", "value": "cbaf2ca77e35bd6a5938d6cd8451540edce0c9f3bdec3577e71d5e2e074e3ca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77485475-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948167, "uuid": "65029276-b9a0-4920-9121-ec8c42d58e7f", "comment": "Malware payload", "value": "ecabfc1924f28702271f34823be83c9e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948167, "uuid": "324805cd-79e6-44d8-a6f7-ed5ea7017194", "comment": "Malware payload", "value": "cbba10fe8b53f837693400af666433c0db41ad26f0cbe6acd6de4a64a79eb5fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948167, "uuid": "1c39ce97-233e-4537-b664-9aaab0be17b0", "comment": "Malware payload", "value": "2a81f16cf54cdd1cbc3eb11e290b1bfeee70638b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948167, "uuid": "e7fc36fd-cd4b-4486-ad25-abf27b60d0de", "comment": "Malware payload", "value": "09d941c36c3805a69877ee4bbd6778d6e69b853be2171472a11c5b60c726125d1078a73e1076a282825c9a1bf44ef9d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948167, "uuid": "da5e4a8b-e60b-4983-84dd-32844d77b9e0", "value": "T18EA1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948167, "uuid": "a12fe868-306f-48d0-9f20-e6514786e509", "value": "96:jRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:jRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948167, "uuid": "ed08c503-281c-4385-9b6d-c98a8e371844", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948167, "uuid": "b5a5e5e2-b58f-41ed-8a83-826b7e8ecdc8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948167, "uuid": "4916192a-e3c1-43a2-8aa4-187d5c3f5589", "value": "cbba10fe8b53f837693400af666433c0db41ad26f0cbe6acd6de4a64a79eb5fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e049d5bb-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948773, "uuid": "51ead8d4-19df-481f-b0ad-f34a68c9ada4", "comment": "Malware payload", "value": "a21cea7024e60459a31f87cc23f96ca4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948773, "uuid": "67b95c08-b587-4cea-8b87-f4609268a8dc", "comment": "Malware payload", "value": "cc00756e9ca753b65c8ee22ee13359e6571b5ec8a3cb1a8fdd3d8044df6de699", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948773, "uuid": "281b1aef-32e9-49df-891f-92f0da12e77a", "comment": "Malware payload", "value": "24bd2703018dc86dab52520d9630f3ec7808e3f2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948773, "uuid": "6b23639c-380f-4076-b97f-319fcf98d6c8", "comment": "Malware payload", "value": "25b8b42099be92de0bc527d3406e7875903c84bff9dcae37ede925c0a73dcc4e30aa2c37ddb9f0ad50ddfa6d45ad273a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948773, "uuid": "c96f9f0c-56d0-41c5-a823-e641171008d0", "value": "T102A1F750112C1AB07246697ED26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948773, "uuid": "d43608ec-e139-42a1-b2cd-352293fee051", "value": "96:IRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:IRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948773, "uuid": "2406aed3-769f-4782-b51d-6f468d6dec42", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948773, "uuid": "f63c74a0-1607-42d9-8b02-3e88a6e1a95f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948773, "uuid": "84aa1d29-a42e-4a37-b6dd-ed490ccef1c7", "value": "cc00756e9ca753b65c8ee22ee13359e6571b5ec8a3cb1a8fdd3d8044df6de699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f9eddd-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948546, "uuid": "589dd4a7-e4ef-426d-a866-c2ce7b6f0662", "comment": "Malware payload", "value": "a207d849c85fd516362306d176cde763", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948546, "uuid": "cab26a98-2c29-4ce4-a3e4-6131f0be90ee", "comment": "Malware payload", "value": "cc19884d0ae0a9a1938bbe330202647ced0d2ca50d6ff2e9f3d32aa6b1d78d8f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948546, "uuid": "997f02bc-f208-40ca-9b2e-84e8e113451a", "comment": "Malware payload", "value": "21ab1039e6f49f614b6d4da965ab8e937dcf89c5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948546, "uuid": "127614cc-344a-4676-b5fd-1ce0783973c2", "comment": "Malware payload", "value": "4f88293aa288051cf5f5f9d93350da054099b655f998e9c5f7d660318668a34d7bcab8cf053d0f67638bdea76a2693fe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948546, "uuid": "81ee2dfa-5b85-4ee0-adbd-fcc3810e2a30", "value": "T15DA1F850112C1AB07346597AD26FFA52B40EC81B0A777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948546, "uuid": "db2d6f24-7486-4e13-b070-9687b37e31cf", "value": "96:HRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:HRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948546, "uuid": "209a0903-b7ac-400d-90c6-c42e837c08a1", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948546, "uuid": "118f3539-c433-4ec9-83ea-1b0f8397aa27", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948546, "uuid": "6f756e4c-d18b-4626-beec-2fd43f26d937", "value": "cc19884d0ae0a9a1938bbe330202647ced0d2ca50d6ff2e9f3d32aa6b1d78d8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4501d64-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947813, "uuid": "75d6cf7f-6491-4945-9d56-6341f13c72ea", "comment": "Malware payload", "value": "cd92a87fc17be72a43a0e5edb139939d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947813, "uuid": "678240a6-2888-4eb6-8607-c9429d1f6161", "comment": "Malware payload", "value": "ccfa5052429ee77a077d1c8ad36ce89c839c3165e5023f77753884ce2260c424", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947813, "uuid": "9930a0b5-79f1-4e9c-a24a-ab6a9c2d4620", "comment": "Malware payload", "value": "5304be8031e82849a20a9ce5ffdd05f958f6fea7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947813, "uuid": "621bfa64-837d-48c9-852c-33c852aabe59", "comment": "Malware payload", "value": "36de1937d09d0f7683064c123341ee59ed93eb44c86f0ed83743593b65f3bb95f1826acc5a0ee9ccdeddaa41875afea0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947813, "uuid": "e12fd813-c09c-4273-904e-56afafd76141", "value": "T195A1E650112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947813, "uuid": "2403fcb7-8110-4b98-b89e-f6153a6cdb26", "value": "96:BRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:BRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947813, "uuid": "40c4960f-9967-455f-ac0e-30c37ce532a9", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947813, "uuid": "25ad7285-6fad-401d-a769-62fbeef97fe8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947813, "uuid": "8b382834-f4c3-4271-9ec8-d7bdc676aa7b", "value": "ccfa5052429ee77a077d1c8ad36ce89c839c3165e5023f77753884ce2260c424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48427de5-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948088, "uuid": "a7b2e3d6-5321-4032-937a-75cb5a821988", "comment": "Malware payload", "value": "0d231efd1ffc0ecab8489f0259273674", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948088, "uuid": "36687aba-a711-4b55-98af-f6d02de3ef8d", "comment": "Malware payload", "value": "cd0d6d483409fcb62faa6ff3f8158fe947aaa49c1ce6bab2d0afa1a17546ed0f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948088, "uuid": "c5142a06-6471-452e-9d8f-ba2e5d1b7d2c", "comment": "Malware payload", "value": "041407d6ecf9b05550408cad2b7a01600ceddfd0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948088, "uuid": "bdfd180a-a462-42ec-9311-726bf670a85c", "comment": "Malware payload", "value": "460c56abfcb44d23b775d739e8deaee97bfd11b14c1c133c11b3c9b0c231e38b9d3eec5838ad07e8f0956e56358003e1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948088, "uuid": "42c7cc1a-9b27-4142-bffb-e3207fca431e", "value": "T10C3196CE23B21574AD91AD67326A840431EAF5DB55CB9F182CED39F540CDE04BC10B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948088, "uuid": "42b60101-4e7d-4370-8cb2-42543471111e", "value": "12:q0FrV0Fw0F/tc43fX0FNOe89YkX0FWwqv0F+0X0FFJm1FZ0Fez9X0Fs9OU0FbVBS:vr+h/tc4k0zBsWUPsm+ez9ss9ccJXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948088, "uuid": "a585649f-9222-41e3-871e-7a114398ce4a", "value": 1729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948088, "uuid": "f8bc39bb-121a-4d96-b0a7-602c548a524e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948088, "uuid": "be97b9c4-d3cf-4fbc-a523-6c17a8bf1a0d", "value": "cd0d6d483409fcb62faa6ff3f8158fe947aaa49c1ce6bab2d0afa1a17546ed0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee3c854-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947938, "uuid": "6d4ed1e1-d1b7-4913-889d-f885a4f8075b", "comment": "Malware payload", "value": "5c01be9293a75ea49c95d51ea6228de7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947938, "uuid": "744e3245-37ab-4561-9b70-7d7672f6cd5c", "comment": "Malware payload", "value": "cd47ad86f89c306eb09656c771ac069d0fa6920eb958cbd0e2d80760306fd43e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947938, "uuid": "2b51f0e7-77fc-4fc0-9ef0-b6512c80e195", "comment": "Malware payload", "value": "f05b33da75d53e70de46f611a18bf1cd93726426", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947938, "uuid": "79f2edab-3cb5-440c-b604-6a2a51afff7d", "comment": "Malware payload", "value": "3ea04d38154e345749c85103f403938552ed8689f016ae6e6bd498c4e26208753ee756b9e78a9f0eed9242b25abb078e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947938, "uuid": "f855feb2-5deb-4b90-95f0-4c64cb2ffc54", "value": "T16AA1F850112C1AB07246697AD26FFA52B50EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947938, "uuid": "cdcec5c0-52a4-4e62-b5a1-dd0b6b8076c9", "value": "96:5RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:5RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947938, "uuid": "71e5bd5d-4eac-4c86-9834-2d669b90ec1e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947938, "uuid": "4c919bb3-1c63-473e-b73b-b1fb65dd8464", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947938, "uuid": "270945b3-e7b0-4d4b-b6b5-f788f9f6a694", "value": "cd47ad86f89c306eb09656c771ac069d0fa6920eb958cbd0e2d80760306fd43e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad511db5-04d3-11ed-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1657954271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954271, "uuid": "81d23bb2-bd04-4453-9820-4169c270703c", "comment": "Malware payload (SnakeKeylogger)", "value": "1faf636f3c617edb57cbbe5b888d3c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954271, "uuid": "7604eeba-fdd7-40cd-baf6-401a0eb026c5", "comment": "Malware payload (SnakeKeylogger)", "value": "cd7dd0f9c2c81f814cfb116687b545f77fef261ba64762b81ffc3ae7ba5c783f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954271, "uuid": "6624eebd-3b4b-4e55-ade5-fa9fa8512aa9", "comment": "Malware payload (SnakeKeylogger)", "value": "9ce8d9a74b63867ec1ae85ace89a65babaf1a9e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954271, "uuid": "d223d740-1da0-429d-810e-93287dc84b3d", "comment": "Malware payload (SnakeKeylogger)", "value": "f0f3dc72c033e7142b5b485b2e9e43728db492b45e17e71379806cad43f60d579b8dcfceeed92a76c1041b2167e8a6f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954271, "uuid": "9e56ff91-f5ca-4fd0-ad14-379bf7436bb3", "value": "T1CEC3081D7BF88900E6FF8A7311B24221C775B952096ACD0D1AC2F8592A7D690CE1BFD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954271, "uuid": "d795f955-8255-4988-93da-dfdfc3ce260e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954271, "uuid": "ede66da3-dd76-46be-a0cb-5342096fd4f2", "value": "3072:5mtcXlsuJAF/zB3joQzgObzu+NwB/ZFbYW:3Lato8gObOHbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657954271, "uuid": "e4a15fc4-10a0-46ef-97d5-ee00ef7a56a3", "value": 128032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657954271, "uuid": "b5dd0f7b-a8ec-4aaf-8d1e-a9b62967362a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954271, "uuid": "66e6bb6f-3bc5-4391-8ce8-802328a47d17", "value": "1faf636f3c617edb57cbbe5b888d3c6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9609f106-04f8-11ed-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1657970123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657970123, "uuid": "67f791e0-0adb-439c-9476-04a5d19c17c7", "comment": "Malware payload (IcedID)", "value": "7007b534a839143a3f2456d09fe4fc3f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657970123, "uuid": "61730ab3-f4fd-4084-8ca7-6d92d761df5e", "comment": "Malware payload (IcedID)", "value": "cda6e3247a765c9e4613cfd71e0ee0300abe5a3d68cd4fe0c9a76acb7a945be2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657970123, "uuid": "5ff88944-c6a7-4972-bf1e-ec308ce63f35", "comment": "Malware payload (IcedID)", "value": "5e492b0a94823e488271a94f03cf7b4c4a880967", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657970123, "uuid": "80cf7915-13f2-44f0-a669-af9f53b2dc32", "comment": "Malware payload (IcedID)", "value": "6f27a58afd0513dc68ca7161fef40cfd135a6ca99c5152cf028184e120d6809d65afeeb38e41f57a699a408849c7731c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657970123, "uuid": "ff607e3d-e373-4334-b1b5-abc2d0f05009", "value": "T184439E29F68105E1E57D4276C28679EA327273A28EDDDDCAE0787ED305B3E70EE04600", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657970123, "uuid": "eaa94097-4285-4d30-8cb7-6448253da18e", "value": "1536:4VxB8YGodPJfc+nMhrL0iD0/69fZGUh0X842p0rAUd:28uPJfc+nMhrLzQ/6vf0b2p0rAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657970123, "uuid": "0f8b3f20-4060-413a-be3f-e3643e10869f", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657970123, "uuid": "667e11f2-c2dc-45ae-8401-8d5e7ae04804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657970123, "uuid": "b1dcd265-19b5-4092-a9f7-6fb494faf8d7", "value": "mVi4x9m3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f0958f-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948061, "uuid": "d0b22230-d130-4ee4-af3b-afc605c4fc91", "comment": "Malware payload", "value": "0f59b923b552573a5680e933a1b01642", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948061, "uuid": "aa10d4ac-58be-43e4-b11e-6c436487b826", "comment": "Malware payload", "value": "cdf550e869e2c6080a783965c71781653730cf54823ad86ae2d33e9747a8281b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948061, "uuid": "c90b69cc-0c85-4d26-b2bd-fc49eb2439af", "comment": "Malware payload", "value": "0cc2b05789ac6a08d198abaae2a517c6e953b229", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948061, "uuid": "aa369d71-3ac9-443b-ad85-74170bafced2", "comment": "Malware payload", "value": "75dacb14042bf8ee2c5902d88b92ce7c0b6b7fa8572fe69dc624622a005719170333eada0ef05633d13f7815ca932684", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948061, "uuid": "f66c261d-58f1-4ba4-9111-e12a26281e21", "value": "T1ECA1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948061, "uuid": "81145114-8cd6-427a-9da8-1342031fb6e2", "value": "96:WRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:WRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948061, "uuid": "f7e4e7de-4da3-495e-b834-6fd0ed3a6cbd", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948061, "uuid": "f79a23e8-b706-4495-8de2-49f9b8ae1f7c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948061, "uuid": "a00d69b3-e619-40b2-a562-8127bc078962", "value": "cdf550e869e2c6080a783965c71781653730cf54823ad86ae2d33e9747a8281b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fbd431-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948032, "uuid": "341bc4ab-7a72-445c-9475-c6b9a3f03558", "comment": "Malware payload", "value": "15c915206337359d55ff80c14872053f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948032, "uuid": "ecc2f81a-1159-4c82-9d9f-7bbe1ac67c60", "comment": "Malware payload", "value": "cdfeeb0183010d49156efe0a995c8a5be266f6a6a6b698cf2224333aea74e6c8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948032, "uuid": "fec68d38-4654-4df4-87c8-6ca06829df63", "comment": "Malware payload", "value": "cd189a3f080db9620dcf60f59f521ba78a05726b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948032, "uuid": "427294db-a2c7-4378-aefa-dba653e0098b", "comment": "Malware payload", "value": "f5a298cc05b2a48513309a92f2e5888c278a72d0a7dae4d34d57ce533c1cf6e62fd0e7abd1af2d294dd75a038e69ee9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948032, "uuid": "d5d393f5-b55b-44b0-abc9-5aa1543a9bc4", "value": "T135A1E850112C1AB17346597AD26FFA52B50EC81B09777B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948032, "uuid": "a64b1039-19f0-4d26-a7a0-a35f6498c06e", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948032, "uuid": "154855a0-cc9c-4107-9ebe-bee2dd25d7d3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948032, "uuid": "467be2d5-195f-47c6-b46d-b989610465ac", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948032, "uuid": "dfe6de7c-579b-440f-ba06-60b7fac42667", "value": "cdfeeb0183010d49156efe0a995c8a5be266f6a6a6b698cf2224333aea74e6c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf21c0a9-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948314, "uuid": "48507808-bcfb-4fd8-982c-d6d9d30e4d57", "comment": "Malware payload", "value": "069968a1480cb615538159e04116e3db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948314, "uuid": "12f227bd-ef26-443f-8492-f932d87710cb", "comment": "Malware payload", "value": "ce7b65a4c6f764369d5b196013e2cc90e1a44f13dcf4c15e39c60910a38a7589", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948314, "uuid": "7e515f33-0186-4381-a4a4-962e80d94fc1", "comment": "Malware payload", "value": "b58db7b8b3f06b5fe6252df43b84a6669f4758ae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948314, "uuid": "1f226449-ea2d-4f6a-8df3-8ddd4de8351a", "comment": "Malware payload", "value": "75de07a4ef7179e95cdf2476737b63844f55e818066f4e301ea3bc6c66ec28582f5b9cca867ace4c0de14dd7d4e45ef5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948314, "uuid": "6222a77d-c723-4330-8c4e-219891b6f744", "value": "T18DA1E850112C1AB17246597AD26FFB52B50EC81B09777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948314, "uuid": "67dd7733-8dcf-45d7-b76d-4cdd834ae9f4", "value": "96:aRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:aRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948314, "uuid": "7a6e70f8-e8e9-4e9d-8964-dc57b9411e78", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948314, "uuid": "08c6b99d-944a-43d5-86ce-478d003d8c6f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948314, "uuid": "a1a4a755-9e42-414a-a693-4383efec5731", "value": "ce7b65a4c6f764369d5b196013e2cc90e1a44f13dcf4c15e39c60910a38a7589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bb88e0-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948386, "uuid": "88a4929b-384c-4549-8525-a3c2043f42bb", "comment": "Malware payload", "value": "2233bff4c903e60b1dac4d6fdc2d4cf4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948386, "uuid": "b0b86e8d-4a1b-4596-ac29-b0b2dbf5ec75", "comment": "Malware payload", "value": "ced7ae59d6ffc44c227de23efdf59222ad0956f05d2837d40cced6963939c3dc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948386, "uuid": "06b7085d-2e0d-4a1c-9504-aa4978463a1d", "comment": "Malware payload", "value": "39626338f913590b41bc32ec5aabf9faf01ca5ac", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948386, "uuid": "45447336-2b32-4470-98aa-2575d1539ce3", "comment": "Malware payload", "value": "dc8bf566f0b718c038ce952ea3f20882cce658a2ec71ca0daacfbb8996951e9ca4418c98aad5695f3eef83d8b9b39232", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948386, "uuid": "3c358725-e7cf-4682-b506-bd67755025b1", "value": "T18AA1F750112C1AB07246697AD26FFB52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948386, "uuid": "16f06df7-5e17-44b9-a734-210b3df3209d", "value": "96:bRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:bRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948386, "uuid": "aa18e507-4f1a-4c43-80c2-8604a85f1226", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948386, "uuid": "7ca4b63f-fad3-428e-85db-19fd9a1a4762", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948386, "uuid": "6534201e-35b2-4519-84cb-1b34fbd175aa", "value": "ced7ae59d6ffc44c227de23efdf59222ad0956f05d2837d40cced6963939c3dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862937c4-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1657971385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971385, "uuid": "e73b1ea8-7e0e-4d16-8439-0826874653aa", "comment": "Malware payload (njrat)", "value": "67188b529c618802561ff131dad6af1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971385, "uuid": "13bdb370-cc32-4417-b7d9-290f5ed99c30", "comment": "Malware payload (njrat)", "value": "cf21599bdf338be9102b5b6df4180b0673855d89ecbf99f6fdb30943da4e7dc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971385, "uuid": "1d9c11cc-7681-4684-b333-eae218cc555e", "comment": "Malware payload (njrat)", "value": "1e542dbd578aa6ab7b66321f685b64b459ec17d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971385, "uuid": "1a3fde8e-3a44-4df3-93da-4e9d9339ed64", "comment": "Malware payload (njrat)", "value": "7e6721a0410833fdd8274cbf169973395985a7661ccb71d7cf2eda0cc05fdad554b2a36c4637da92d70d1433041e41f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971385, "uuid": "7df4f33a-066d-4e4b-8b5e-5d73793344a0", "value": "T12E032A4D7FE18168C5FD157B06B2D4120BBAE10F6E23D90E8EE6649A37736C18F50AE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971385, "uuid": "45fe9da4-ba93-4f55-9397-db911b244ca9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971385, "uuid": "c1b11090-359f-45f8-9a91-428ca975ff27", "value": "384:+MmBkiyJnDNGRn5IyUvwIFvthI/im1xbrAF+rMRTyN/0L+EcoinblneHQM3epzX9:9h5M5jUvFFwqmPrM+rMRa8Nujht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971385, "uuid": "816f9968-f6de-4136-92ca-dfcf33751318", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971385, "uuid": "048f5983-f759-45b6-9ed6-fe47be0eb213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971385, "uuid": "a0e3cb87-a535-49f7-804b-833feba9a38a", "value": "lau.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2682fbf9-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948031, "uuid": "345643d4-07f7-489a-b34a-4bb764e4a0a7", "comment": "Malware payload", "value": "6fe6014a09d29b3535f99b55deb7fa71", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948031, "uuid": "b8fe7f44-bfc6-47bc-8f74-ebc83a2261e6", "comment": "Malware payload", "value": "cf9d6319e9a3624c649a2d935ca9c07617a8814998e8d41dc5ccacafba940370", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948031, "uuid": "1db6361e-493f-44ad-9042-08983a8a952a", "comment": "Malware payload", "value": "b0a56dd2051ad02c1a02cc7723c800ca282bfbca", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948031, "uuid": "710f476e-9b1f-47cf-8fad-30869565850b", "comment": "Malware payload", "value": "626caffdef140421a9327407233369506a75ab89da55e7df1af00a898872c26967a078b7288e286b590d1434d5c07909", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948031, "uuid": "c4378177-dff4-41d9-9990-2771291597f9", "value": "T130842308A1F33199E1AF6DB4627326949A8FE4E190FD65BE938C58D900B6B7D33433D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948031, "uuid": "6860a9c9-76f9-491d-8677-403761b0fcd8", "value": "12288:IV19zIoFyUS1omjXhObEq88LhnnE12foZIB2Z:IVbRYvjxOgOhntwZIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948031, "uuid": "5701e282-c5a7-41c1-9641-6dbd66a9b7af", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948031, "uuid": "accbc997-08d1-4803-ad5a-725244a0ff4e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948031, "uuid": "d9c50574-a13d-41b1-a1a0-f30f9733f873", "value": "cf9d6319e9a3624c649a2d935ca9c07617a8814998e8d41dc5ccacafba940370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccd3de3-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948069, "uuid": "59482202-3d4c-4058-8636-bbe361e369d3", "comment": "Malware payload", "value": "e8c5a1abeae3083653c232888233776f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948069, "uuid": "6797066d-6e60-4d85-ab65-4d0d5aa79ed4", "comment": "Malware payload", "value": "cfb311377ae602331881c00441309f08a0f0f1914152c54e9cfb2c6479d542c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948069, "uuid": "85303fea-c810-419c-8219-4f92e9cd8ce5", "comment": "Malware payload", "value": "e6e29513e9a8685403fcd3c6d7cab5284dbab42c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948069, "uuid": "f6ccc0ff-d68d-4ab1-bd8f-b53e4bc7f552", "comment": "Malware payload", "value": "d27ad2e30d62f328a15651e1bdfde1f022a5d70653bc4056522f93aa20185ef75bf53df828a9584ca055ac349f00cff5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948069, "uuid": "8a3428f7-1b8a-40dd-9b75-687d8399c622", "value": "T17EA1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948069, "uuid": "c26bf9f5-bde7-44b2-b881-6bc51456b2cd", "value": "96:hRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:hRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948069, "uuid": "cba375fd-1384-459f-aead-6be8581c3f19", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948069, "uuid": "d9597684-6a5f-4b24-9906-e35ea15d00fc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948069, "uuid": "441fea0f-a8ce-4701-8e35-db0c2f70684f", "value": "cfb311377ae602331881c00441309f08a0f0f1914152c54e9cfb2c6479d542c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5437dce-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947895, "uuid": "9e661762-5272-4394-ad65-d759ab4c7d15", "comment": "Malware payload", "value": "814d4cdf685952e8e32fd5db908f8480", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947895, "uuid": "739c4509-4d8d-4556-b055-b4cb93a708f8", "comment": "Malware payload", "value": "d006cdcddbe6496f21f5f9e199b7573db4c5df5b518cef6a5e088b3f6f9bbcd0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947895, "uuid": "f4cd8907-f21a-4d09-a7d5-8d72977f731d", "comment": "Malware payload", "value": "8b46f83b1a49d467bb9882fa00861c9e530835e6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947895, "uuid": "884963ee-e81e-4a3a-84c3-14353231bee7", "comment": "Malware payload", "value": "c725a57a7c3fb312c53c7a18bd51a4ac2b5a8df2cd021ecc123008235b6d4899c25eb2590db23777ef12a2b1ba42ac6c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947895, "uuid": "4f59c2b5-96db-4b81-a013-836905d77e50", "value": "T16EA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947895, "uuid": "a156a9ac-223e-4ea4-b04e-eaed28e39246", "value": "96:tRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:tRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947895, "uuid": "b547acd7-ecc2-4f02-8565-a41f94e8cb82", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947895, "uuid": "3669fba3-f742-40b0-bb15-94d08909a35d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947895, "uuid": "858059fa-2728-47fb-8fe3-b20652535595", "value": "d006cdcddbe6496f21f5f9e199b7573db4c5df5b518cef6a5e088b3f6f9bbcd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc70bdc-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948577, "uuid": "debd1982-75ea-4b3a-b31e-d12ad4fe80d8", "comment": "Malware payload", "value": "4fababdf9c02e595dba43abf4cae7c6e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948577, "uuid": "4b7f2205-d187-49ea-8951-4f7efbcbd068", "comment": "Malware payload", "value": "d09439c71385a357461235a1f018cd446fc95d18e6c21f962eec18b594025935", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948577, "uuid": "157587b0-867a-4e2c-8459-321eea068968", "comment": "Malware payload", "value": "2cedf028c2a2852d5d915d8b85d8b172845ec27a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948577, "uuid": "e3d7da7d-fe61-47ec-ac8a-2891b61495ab", "comment": "Malware payload", "value": "530f206b1ed32fa24c297c5e023fb203f4f69665810ddc4160d8a8d2a668f34c34a187ef1dc10bf6a946c86204311f93", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948577, "uuid": "a9c72d55-c94c-40fc-abfa-636192a2cd36", "value": "T17841848521318E363D979923F3EB4251368059E698D6BF06ECD93DB088CDF54A4ADF82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948577, "uuid": "a4b61ffc-0052-4019-b078-d5c9f94fe766", "value": "24:vE2MsE8A8dEqn7JEDSoUlEljoLEknDNksE999oSUEZ4EKFESyEEUbE8XDEtR:v1PzdNlUAlYoLPNJw/oSUfLfxxDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948577, "uuid": "b9adc8fc-77c6-4932-93fc-66396282dc68", "value": 2388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948577, "uuid": "bacafcd2-8014-4d79-aabd-555963202b01", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948577, "uuid": "7443a839-6910-462a-a373-a4c60fdf4ce8", "value": "d09439c71385a357461235a1f018cd446fc95d18e6c21f962eec18b594025935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e52f09-0557-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010839, "uuid": "2945da6d-eeb3-44b7-987a-e400ad0bfdd7", "comment": "Malware payload (Mirai)", "value": "2f34c6a4e1e6da200048f00dc57a7cf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010839, "uuid": "845c0483-d455-4342-896f-a843aeffeee0", "comment": "Malware payload (Mirai)", "value": "d17a66ea508e9d60670ef5b78430471ba240cfaf506d7040a1f05818cc4a9904", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010839, "uuid": "e697a92e-9592-4b16-8072-33cc152924c1", "comment": "Malware payload (Mirai)", "value": "0c1a2f29522d6d6b21f04d19d5b4b8acd68cedec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010839, "uuid": "d531c6be-34c9-4b4d-bcbe-3b6d6473c355", "comment": "Malware payload (Mirai)", "value": "50af3ac63106da9383b6b991b058c294e94b4e1ebe85c882d5aaf16fb2c62aef6e74eba92827b7d690c74da7b90cead4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010839, "uuid": "ab822696-079c-4174-92d5-13555da98d72", "value": "T1ECD34B46EA818F13C4D6177ABAAF42493323E754E3DB33068D18AFB43F8665E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010839, "uuid": "ecfa0515-70b1-4610-ac5c-877cce3f39ba", "value": "3072:+D96aROsN/9CQIHGxrj0T4OKnJEdLvKWBSbM/9z2syAw:+D96aROsN/9CRYv0T4OKnWdeWBOM/9z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010839, "uuid": "6bf4e276-909b-4beb-8251-c6d73a264c7a", "value": 134432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010839, "uuid": "bc843b89-42c9-45e2-a553-77141b16462e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010839, "uuid": "ef38afe3-5c4d-4aa4-a67e-348cbc5ecdcc", "value": "2f34c6a4e1e6da200048f00dc57a7cf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13eb6672-0541-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658001258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001258, "uuid": "88de064a-9e92-4e80-8fbb-75b4169a766d", "comment": "Malware payload (Mirai)", "value": "58b8c2b1b9b12aaf7765460ba40f4329", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001258, "uuid": "6d132c6b-ffc7-43b4-8cb2-4d647616e18f", "comment": "Malware payload (Mirai)", "value": "d1f337dff5f6cfe26eb560c1f51859ea8c3fe36c1f61862cd6d9811123ab91ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001258, "uuid": "c0e3dded-9a98-42c4-a61e-565806ecd6cf", "comment": "Malware payload (Mirai)", "value": "20052e9228375fd22ca8b97be3c894184d6ef106", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001258, "uuid": "ec900562-51d9-4667-9d0d-eb13486af276", "comment": "Malware payload (Mirai)", "value": "b5762b649d22f92deee7a6987c30b5c52f2d44fbfa0c6fb1025495fdd4e3ca1c2e7f0a8bca4ae72e0f194ae5f118fdd9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001258, "uuid": "384c3325-2125-42ae-8557-d2bfcce08387", "value": "T1F1C33B46EA408A13C4D51776BADF42493323E754E3DB73069918AFB43F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001258, "uuid": "70bed0a0-f68a-491b-9d95-1cb3d020cd9a", "value": "1536:1tnPV8EGQnaMNt4x0iS8WpaAgswpNcF4dNlHFiRuiPkf5pm3+Xrpd7JMu2VlyKsF:d8waJxrSnpaAgswpNB2uicE+XjSxVggC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658001258, "uuid": "591183ab-63ef-4bd2-ade0-1dbed0e7e752", "value": 124912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658001258, "uuid": "03bda837-7e00-40ff-a461-b907a6053bea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001258, "uuid": "3e13a2fd-405a-4815-8cee-8e20e9d2bdf3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c193781e-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947862, "uuid": "f2f66cd4-7ef3-4b60-9298-604dbe34ff4c", "comment": "Malware payload", "value": "5739763eb48fcab49ec9bd36df0f7c31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947862, "uuid": "60d2d587-cba4-4f64-8326-5db1044184d8", "comment": "Malware payload", "value": "d243d54304b2e042f270eb3df93d75ab97d987e99d2f5e8f031cd0222f0c342f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947862, "uuid": "00d59db2-a4be-4509-85ac-7e9b0663a41c", "comment": "Malware payload", "value": "896780f9872892f14ae465a4fc52dc81d7f140c4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947862, "uuid": "1114f114-c7f8-49ef-a0b8-4ebb40376efb", "comment": "Malware payload", "value": "2804a15fa262bb4b2e5c8a317fb87c07bb15b57ed363ecd7b7e613938da6ae98c7fd7a1449a69fcb7b30cee565f5ae16", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947862, "uuid": "d87c6feb-de0c-42b3-aae1-642a9c507076", "value": "T179A1F750112C1AB17246697AD26FFB52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947862, "uuid": "3d8da54e-4069-45de-b787-fbc39aacfa07", "value": "96:kRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:kRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947862, "uuid": "043e3412-8d01-4857-b1c5-f7100bccd1d4", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947862, "uuid": "63d7769b-f426-48df-b2fd-3409d0d1057f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947862, "uuid": "04dc281e-141a-41fa-8c31-dcb14a7be0d9", "value": "d243d54304b2e042f270eb3df93d75ab97d987e99d2f5e8f031cd0222f0c342f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd5f07f-04e4-11ed-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1657961304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961304, "uuid": "b78803d7-bb1b-4268-8168-87e552ec8499", "comment": "Malware payload (Quakbot)", "value": "4267c9ed353695a75438c73ca2f708e5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961304, "uuid": "7dd85360-fd7c-4cf8-a123-fc790b14d503", "comment": "Malware payload (Quakbot)", "value": "d2e25616b35d56ac0731c8dd034b9c682fd031fc83f04094aceb034f5ce2bd2a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961304, "uuid": "77f4e36b-7adf-4068-910d-d93eb9e225c4", "comment": "Malware payload (Quakbot)", "value": "d323d4730f202c7e913660f7c330acc627057b6c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961304, "uuid": "a0cc88b2-9919-423b-a458-87a349a001fb", "comment": "Malware payload (Quakbot)", "value": "7257935f2a54a5b2493c1e284271fa1759f52c5db18f717d2837bc56ccc0f71a2cbeda047f574a62572ce9368fc331bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961304, "uuid": "be0d40d8-e335-4801-92e0-5d3bd0eae91b", "value": "T15184DF88F5C061B2F8DACBB29A10EEB511DE3C76361FE8CD9289174486577E39321D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961304, "uuid": "a9e55fd8-f3e4-477c-95a4-55357336aaf1", "value": "ffdc99de3f62839ef031468113b11858", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961304, "uuid": "5229315b-4cd1-40ec-99a8-284ae5f9eb78", "value": "6144:gxtQOrCMUHbAVDL4Z5CQ3u6z2H220Dg14nm7hm7eRLYAjyfc6rcwc0PKlK0Dpu:7Y6GLO5v+6z2Hf14nm7dRJyBcwcllbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961304, "uuid": "06121add-dfd5-407f-b57e-c002ab0e7bd2", "value": 395272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961304, "uuid": "40c2541e-3f69-4d64-bee4-b8a5990cb63d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961304, "uuid": "7c5831c5-1590-404d-9a68-1e39e306b5b7", "value": "4267c9ed353695a75438c73ca2f708e5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f32a2f-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948811, "uuid": "b6a3cfe2-fec9-458f-b13a-ab8997b06637", "comment": "Malware payload", "value": "90054e321a142dec5fe439e200400637", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948811, "uuid": "b0f265b1-f0ca-472c-a988-61d9fc51c059", "comment": "Malware payload", "value": "d334f674f061ecc67108c36c46a220ac1396596d0bf768e76656b030efdcbb3c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948811, "uuid": "f44771ec-654c-4bb4-a64b-635176f7bd2c", "comment": "Malware payload", "value": "dd972b7cbb3dae5b54afebfe8456c467c55d0e01", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948811, "uuid": "79e5b812-d45b-435f-bc0b-34c6305750ea", "comment": "Malware payload", "value": "0edf0a5a1bfd19e69f80b74b18f8b6a31e8d7d728ca47cef15e87da70311d072c0ee7ff868389e0ac336d9569d6785ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948811, "uuid": "2884ccad-dff5-457c-8f62-5ad2e183ed96", "value": "T14E317EC432B135707C7B94AB7369591C32F510186CA8AE46E9DCB8F489CED4966841FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948811, "uuid": "aa63c488-50ad-4895-b13b-83b309c4ad89", "value": "48:cGgDGgUGgXBGgdlGgyGgbGg4GguGgNGgSGg4:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948811, "uuid": "869ca700-dc04-4e22-8b76-895493d834e4", "value": 1871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948811, "uuid": "e68c125a-5fc6-4fe5-9e76-e8dc57e12217", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948811, "uuid": "73add685-9e91-470e-9453-04a878e4057a", "value": "d334f674f061ecc67108c36c46a220ac1396596d0bf768e76656b030efdcbb3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ce5cef-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948156, "uuid": "8713a406-4df6-4223-9102-418d09428be4", "comment": "Malware payload", "value": "c0b9cffbc487142a80fdbdb3c3c8721e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948156, "uuid": "be636d57-4661-44d6-b58a-288cffddf2d3", "comment": "Malware payload", "value": "d3c85a6329125d4c325f58973e862be14e305c9908ffa7439818ea668ab5dda1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948156, "uuid": "41400dbf-3d7f-454c-b92e-72e3a64e4f52", "comment": "Malware payload", "value": "e4bbd786af86867f65259e72a93b54e9213d9b4a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948156, "uuid": "c4b6a223-6acd-4516-a5af-be0a296fd91e", "comment": "Malware payload", "value": "6d481b6dd61c513bbe446d326eaa00bf433e5395595bec443eb48adeecd3d47cd4ebb336087644ddcf526b9196f11429", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948156, "uuid": "6cae481b-f648-44b7-b1f9-141b0314784b", "value": "T101411ECE1177C4F0ACB89857326A548074BBE08628D65FC6F9DEB8E828CDD8578457CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948156, "uuid": "e93e0691-bc0d-455a-9d81-67a9dd6e8c10", "value": "24:v8i6jzLyzLLenMqzLBO7zLqzLf+zL+zLiTzL+HzLEbAy0KzLiTzLSzLJe9emefeW:vh6LoLenMgEgfMMw+XEbAy0AwIJ238V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948156, "uuid": "46075a3f-ec6a-4923-a59e-b7fb11945280", "value": 2163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948156, "uuid": "fb029365-46ae-49a2-b1bd-345227563ac3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948156, "uuid": "af7c2706-fb03-4fd3-b1c5-721458f4ce39", "value": "d3c85a6329125d4c325f58973e862be14e305c9908ffa7439818ea668ab5dda1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493a5816-04c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657947231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947231, "uuid": "a1b2ff83-f588-4083-9b10-6de1df393a80", "comment": "Malware payload (Mirai)", "value": "226313a29442aef0653eee522ace48ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947231, "uuid": "ecc94598-a5d2-4f8c-b8d2-69cc4ee83707", "comment": "Malware payload (Mirai)", "value": "d4e2d47ac4ae46af2d19df35dd242743ce28f25255e0f6a54a6b097b60f1bdca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947231, "uuid": "7ffe794f-c500-4987-b688-0784865014d8", "comment": "Malware payload (Mirai)", "value": "4be2e0774c68cd44d31e9e57c0a055c1a545d93e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947231, "uuid": "7ec35d90-7061-4020-867e-adc22ab0897d", "comment": "Malware payload (Mirai)", "value": "9b301e2bda878058297958f10fb1c1aaeb38f5bed286079ef585f4a57221c38d969691aafa6474148d715b1370bd1920", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947231, "uuid": "1455c643-f0ba-40df-a3ab-755584c14f1a", "value": "T102431917B58281FDC499C274437BBA37E82334FD2239715A2BD4EF266D95D612E2CC84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947231, "uuid": "483dc174-7d2b-467a-acb2-979027a9ae82", "value": "768:RzNytaOrlYSIzCBo0Q1rwzHELw2Utf4pUkOvk5wGhhv71FuFWjcscm3oQLD57:KXpY8rUMrEysuk+GhhXuFWj4m5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947231, "uuid": "602cd1ef-063c-4002-ae38-51315183269a", "value": 58624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947231, "uuid": "0bfd1bfe-00ef-46a5-904d-706bf3097f00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947231, "uuid": "3316769a-6a7b-4c5f-bf9c-1c2f4de41539", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5ffd14-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657971373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971373, "uuid": "e1ee8e0c-0f3e-4604-980a-8f16e3f9eeab", "comment": "Malware payload", "value": "05828a6473e9116ddc4ec48e5e222924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971373, "uuid": "6cff9de2-2964-413b-8358-85f6d5253570", "comment": "Malware payload", "value": "d50231ce3a97198df82ea52b14c0953a7e02bac5311eba123c5d39e71000598f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971373, "uuid": "237d5ae1-446c-445a-bbf8-f66bc429269e", "comment": "Malware payload", "value": "66dfa782474e01e834c6fb6b8f863769de92968b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971373, "uuid": "5687304f-4834-46da-abcd-96351e006d60", "comment": "Malware payload", "value": "db0b4b42995f5ae78f0ca6cbb0c4372bf48ab1de269622fb74d4ecdc582133e885a312892d0b531301fcd63102d0c8ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971373, "uuid": "ca69f247-13c7-43f4-8c6f-e9029a172793", "value": "T1F4157B32F2924037D5765A398C5F93A44C3ABF512E38691E3BE43E4D5E7938928D42E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971373, "uuid": "da5f46ce-6b2b-482d-b336-31d783097640", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971373, "uuid": "fe8dfadc-0883-4f65-a1f7-8e4d7ab03051", "value": "12288:ZMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V982YyX+:ZnsJ39LyjbJkQFMhmC+6GD9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971373, "uuid": "8b41c991-ed14-431d-b7be-314b692ad810", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971373, "uuid": "c3e54ccb-e1f3-4eaa-96c5-36bfff22c42d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971373, "uuid": "e3cf5705-dbf0-4369-906a-a11c31746f51", "value": "File Explorer.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91efe19d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948212, "uuid": "de0272e4-9825-4cb3-8185-9350d1aad17e", "comment": "Malware payload", "value": "aa547b633967460466153b12bcbf9a7a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948212, "uuid": "abf2da5f-9eaa-41ac-b163-505d46993937", "comment": "Malware payload", "value": "d563a4b65db7b084f1220b38fe533d5e5d65a8f875e48339d7a25a28bc4a97ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948212, "uuid": "b25ac5c5-b932-4c5e-8e76-ba4c775812a1", "comment": "Malware payload", "value": "f47bdd9093d51530a6a642828bfd49d33de74c39", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948212, "uuid": "a4b71de3-27ca-4d64-b785-6f74677b22e0", "comment": "Malware payload", "value": "718a08a72b100f241b26b9451870f22d9c95b14fb37fe3a89a695d5534c52b8402becd1afd67c31176136998baadcf18", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948212, "uuid": "7a7c1220-8733-45af-ac39-085ce8691215", "value": "T1E3A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948212, "uuid": "88eba26a-e65c-4f37-84ee-1e049e0bc4ed", "value": "96:hRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:hRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948212, "uuid": "da5a364e-4501-4699-ac20-7c40f2016f4d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948212, "uuid": "810e7453-0d1b-4714-9ee6-54c27b2557ab", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948212, "uuid": "b29cde2c-b19b-4d79-bc83-3b314928a3cb", "value": "d563a4b65db7b084f1220b38fe533d5e5d65a8f875e48339d7a25a28bc4a97ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5c8a57-04d3-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657954324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954324, "uuid": "cdd2726a-493c-41d7-a195-1d479af063f0", "comment": "Malware payload (RedLineStealer)", "value": "97398c5a8572c035792636d41af354f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954324, "uuid": "89399efb-e4ae-4c39-a41f-9275316bc209", "comment": "Malware payload (RedLineStealer)", "value": "d5855d9d236f849cac393305c9b441c5f7d66ce01fdf45ff19b5dbad94070051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954324, "uuid": "57f0cbe3-6945-4775-bac4-c72bd7281253", "comment": "Malware payload (RedLineStealer)", "value": "4f8aa881b6371634fcfbf2a795f1028f866d81e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954324, "uuid": "58171546-2ecd-4ece-b8e9-eac8fbc15b3c", "comment": "Malware payload (RedLineStealer)", "value": "2c1d2f4ecac2bec5774828fdf265a9a55462cae8c1eab672e34c1291628f5347a08d06fc9960cb60286b76be6e56805b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954324, "uuid": "841d6ada-3294-4ee8-bea1-0dff7ac25fc8", "value": "T1F0C52B136A8B0D75DDD23BB461CB633AA734EE30CA3A9B7FB609C43559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954324, "uuid": "f54680ae-6e73-443d-a3bd-865486438731", "value": "2bd4b8620ae035f6bf279b34fa17fcf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954324, "uuid": "b96801c7-9ca3-4578-8dd2-9f56098509b5", "value": "24576:b8fNBnO0YTYLYSf7lBbTMjsed/Y1eF1Uaq8FCwLBFll3RuQ553135v:b8fNZOQHM1Uaq8FCwtFll3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657954324, "uuid": "8f970a32-b43a-4f47-8fd4-afeef279aa14", "value": 2575429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657954324, "uuid": "9a0a1253-d890-4244-af1e-2360720f300f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954324, "uuid": "89c560bb-21b7-47b5-a512-837b36514ba5", "value": "97398c5a8572c035792636d41af354f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453cad91-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948512, "uuid": "d60e7e72-fca6-4249-840c-2539d3a22327", "comment": "Malware payload", "value": "61003892427c5bd292d6a115da8ea229", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948512, "uuid": "9d6be469-8c2e-454d-b8a2-c674e9fb7246", "comment": "Malware payload", "value": "d59893924928283e6c4e21f20777fc48a2ebcf43581a54adcf12aaa1488043a0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948512, "uuid": "8287c59c-4c0f-40cc-9d37-31b0ea0e2605", "comment": "Malware payload", "value": "265cd4ef5eaa143b6dbcea57669e653bc9e9779a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948512, "uuid": "bb62b839-fdf7-424d-89de-59346c20d991", "comment": "Malware payload", "value": "c690a1cfbcd234b9ed2f2a01a7ec4bae9764515459500e12951932a306f458b38161eee39a4baac116dc9a4fdbea20c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948512, "uuid": "4c7dcdfc-97f1-494a-ad91-dcfb0fb344b0", "value": "T1DFF02709FC8844BEA03FC89EFFEA2D8D010F91100A8B2E3D97B92C02B4B9C4850C1437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948512, "uuid": "3bdd1f43-c28a-472f-9e2c-4aaaee8a1cc3", "value": "12:/VJ8HPI58HYNiuy4ghsesFrFBEGghgu+hYuTyisJF8EpASNyiiuyw:NqPI551ZrTBEGCnuoLpvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948512, "uuid": "f7c95d2c-e134-4541-9092-4032b18fa385", "value": 471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948512, "uuid": "a32d78ce-9023-43d3-b15c-a1ddae22e5f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948512, "uuid": "78043512-9451-4388-a664-c5f850821c94", "value": "d59893924928283e6c4e21f20777fc48a2ebcf43581a54adcf12aaa1488043a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484fe23f-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948518, "uuid": "91263574-a3c4-4af9-bb34-e876147ae165", "comment": "Malware payload", "value": "610d2c7416aa3f0e63f1d1288d288e1e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948518, "uuid": "24da40e4-bde2-4284-b1d6-a22dedcd303a", "comment": "Malware payload", "value": "d5e161c9156e57ad84c24dadc5cb1d5c97ac63f734873756ede8fb28b5f7c981", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948518, "uuid": "1dcc9fb7-b6c4-4bb9-94dd-e775f018e58c", "comment": "Malware payload", "value": "425b7da22a46e02159b735f83ee0afb32a84cfa6", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948518, "uuid": "daf8036b-8db7-4a19-8aff-278c45f5d280", "comment": "Malware payload", "value": "81e8d0aea6a89d8946ad375c69191349349cde54fda4ca0c65c6b0731013ea98049b9c92c6587e2007e3a31a5e1437e9", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948518, "uuid": "29c087a0-f80e-445f-849e-70f598b69b4c", "value": "T148F312CC617BC9BCDC7DD2C71985DA6E3189B71E833309CEC1845369492C6BA1E2C6B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948518, "uuid": "bd1689e2-0dd2-4b13-9d9f-f9f271beef1c", "value": "3072:xaKPGwKJ4CR8IbAUeshmFPQPJCfXpDD+kyKN/fPnN34iHlrHC654KeIINkH4W:xaKPG1+oXcXpDD+LKZNIiFmdKeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948518, "uuid": "94a7dce1-b5b8-4faa-b77a-4dfc7f9417e4", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948518, "uuid": "c227b8ea-7dc3-46a4-a62c-f6a36c60b4be", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948518, "uuid": "ff2ba1cd-c417-43ca-8a3c-f9c1cd583ded", "value": "d5e161c9156e57ad84c24dadc5cb1d5c97ac63f734873756ede8fb28b5f7c981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc469f9-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1657971347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971347, "uuid": "f3ff98d1-1a51-4a30-ba28-cfa17b99da6a", "comment": "Malware payload (njrat)", "value": "7e63e5ea604dfebe160cf6bacb034080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971347, "uuid": "709c76d4-f5cc-4813-83aa-8c6acf937956", "comment": "Malware payload (njrat)", "value": "d615e5ee56ba34e06f8ca0c30e207578b4762da50d422fb3b07b56eb4e7807ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971347, "uuid": "be5e0184-48ce-41e2-b48e-dd50a83fd6a5", "comment": "Malware payload (njrat)", "value": "5c5bcc527bd6b800ed88158f2c3faa44da741aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971347, "uuid": "db45582a-11c9-484c-b5a9-eff035d77808", "comment": "Malware payload (njrat)", "value": "b3672e97213792bd392c1c785f724f81a3650bbccf6529535b0cb1489763bd628e5133cccf323124c7600df06d77b0a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971347, "uuid": "4324669b-9af2-4ad9-804d-cebea40c3f5e", "value": "T143752312F9C2C973C423087317255762753DFE202F6A8DCF67986A6DD9212C1EB31AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971347, "uuid": "98e07401-4d5d-48d7-9995-cd404746baf7", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971347, "uuid": "40099499-e1aa-4a6c-8c29-d31c74caaea1", "value": "24576:+TbBv5rUlIfye3v3kS8jEvgTPlv7NNKEpaUHi32cB0iUf8AV6pn7xqlt1Ci:ABRHMG4TPleki3FGiUf6J7Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971347, "uuid": "1561d791-831b-46b5-9d7d-cf93e10ac446", "value": 1599082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971347, "uuid": "ccf75596-6891-4d17-9993-d066d503104a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971347, "uuid": "ed9ba7e2-b7e7-4fd1-ad47-d90342c5815b", "value": "BrawlStars.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04d8bfb-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947860, "uuid": "ec02e90f-74a3-4f7f-b8cc-df23af77fa14", "comment": "Malware payload", "value": "75d4f4969338aa4c283c1313448b3e9a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947860, "uuid": "77b9090c-f0ff-49e8-8e6b-8b7eb9f81d45", "comment": "Malware payload", "value": "d6528bab8c5559c68312285c0c214744f0f33ba93a51942bcc6d9d2770476e26", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947860, "uuid": "acf65a72-3438-423e-8927-7dad1c19fe6b", "comment": "Malware payload", "value": "47e7063095f95b17e02cb7f3ccfefa5eeda3cf6a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947860, "uuid": "be912a57-101b-4264-83be-b3682fd72d0e", "comment": "Malware payload", "value": "5e9a0a938d7c9e121475c5b838a1da86500374d50ecf1b971550979f4114bcc875c0845a442912012a126f8aa12907df", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947860, "uuid": "bd3d84a2-0f47-416a-9588-a2d572eaa933", "value": "T150A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947860, "uuid": "2d7f6940-9725-4df0-961a-1c1fe2deb3b7", "value": "96:dRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:dRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947860, "uuid": "caf1ebcc-d543-4886-969e-ec6ad7f4af91", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947860, "uuid": "ce87c87b-082b-477b-ab2d-d6e56e883540", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947860, "uuid": "7e79d14e-3630-4fb5-ae87-09c38df5025f", "value": "d6528bab8c5559c68312285c0c214744f0f33ba93a51942bcc6d9d2770476e26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b226215-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948630, "uuid": "fafaf169-10ed-40fb-9a80-3b62828038e4", "comment": "Malware payload", "value": "6acc8f5e4d20f60158273eee20102698", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948630, "uuid": "557bd0aa-84b2-4f10-8262-5fc349624aea", "comment": "Malware payload", "value": "d66b654e68a26a3f7ed1c66b52e66686bd4d7c22df8336eef61b1843b0b32bbc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948630, "uuid": "b085993a-bc18-4597-90bf-db7a351e2326", "comment": "Malware payload", "value": "ea0868003c8ffabc4eef1b20fecba17ab21eba35", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948630, "uuid": "62a54c97-12a6-4558-b372-12c329f7d52d", "comment": "Malware payload", "value": "44d8725039db2223c9b52a0023ac3b6074bf2f77783d623c25e7c55c75bffc19924d67b0dda7ec6bede311919745f8cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948630, "uuid": "fb03b752-1c24-4e48-8210-1157d0ef9d1d", "value": "T1E6E02236BCC184BB203EC456FBE7AC4E640F1215464B053C97E91843B8BCC441021C33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948630, "uuid": "57ea9cef-831f-47e8-9848-f688ec18f5c1", "value": "12:/Q1eLOY3NitgrZi1sgrZiyTyigYtPi5yii1:CeT3SWbW3fRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948630, "uuid": "e460f193-3c07-46f9-9707-af9be82a88e2", "value": 389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948630, "uuid": "93f7230c-5c67-4a83-ac14-3673587f7266", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948630, "uuid": "f63dc95e-2c85-42eb-8de3-4541bb6161d7", "value": "d66b654e68a26a3f7ed1c66b52e66686bd4d7c22df8336eef61b1843b0b32bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d1dfda-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948784, "uuid": "feabc063-c8e1-4177-bc16-7c99dfc96bf5", "comment": "Malware payload", "value": "fdad9f2811198a243a99d0db0133e769", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948784, "uuid": "714ec83d-0890-493a-ab4f-c3832b9f0692", "comment": "Malware payload", "value": "d6e715d0e613cdb842337f6561fa5cef05bd4db2b93b8ba6b54b23b92b808069", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948784, "uuid": "fbaf807c-9825-415d-ac8b-c99b5b147bcd", "comment": "Malware payload", "value": "e027a828405af2cbe8381367e99d91007451c25f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948784, "uuid": "d8cd99a4-4630-49cb-9aa7-6786137c0615", "comment": "Malware payload", "value": "fd08affe7cdfd71eea0e3b17615717885ded5eab55ac2359d01954e4df91aba835f282a696587e3e0b79c069b8d10d42", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948784, "uuid": "5a5f2ca4-57ab-43ec-9607-5e7018fa5974", "value": "T1EAA1E850112C1AB17246597ED26FFA52B90EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948784, "uuid": "1e82a28b-6e31-42bb-8e88-d8fadd47e840", "value": "96:5RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:5RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948784, "uuid": "0e379119-3c45-4c58-80b9-26f70ec573c6", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948784, "uuid": "f875b958-3b9f-4fa3-9195-af7d0020fcb6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948784, "uuid": "0fbc8e2d-bb10-4964-bf5f-30d5019fab35", "value": "d6e715d0e613cdb842337f6561fa5cef05bd4db2b93b8ba6b54b23b92b808069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb168913-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948308, "uuid": "b41efd5f-cbde-44cc-9505-f9d24cff9edd", "comment": "Malware payload", "value": "7c50857c4e829f5b5b043834a724866c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948308, "uuid": "05756b0e-bfa4-44d0-bbf2-059540a01c5a", "comment": "Malware payload", "value": "d6f1c35d1d166871bd612064739cca97fb2207eebcd5b7e19d3719eff1829964", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948308, "uuid": "ced4df9c-518b-49a9-997f-52cc3a113b37", "comment": "Malware payload", "value": "c089e183a754aa83cc66dda0dba2f329dc2de2ce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948308, "uuid": "71da96e6-0b9d-4a72-b5ad-0f8e43f45558", "comment": "Malware payload", "value": "33bbf487142564dc861c6d2f85039c7c38de94c44f400294404d0217679a7e7883471951aae05ad4c0eaeafe1115d5b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948308, "uuid": "d43f28f6-660b-482f-9c74-f361a1b2ec8b", "value": "T1E7A1E750112C1AB17246597AD26FFB52B50EC81B0A777B358473A63C74F5DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948308, "uuid": "e1da372a-e0e9-4448-aed3-701a57ddd933", "value": "96:GRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:GRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948308, "uuid": "dc2edc91-630d-409b-a24f-ca8c8a2c3e02", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948308, "uuid": "67a90a85-f5fd-4e16-ac71-053bc98584f7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948308, "uuid": "6e1b2575-f95c-445e-baf1-0bed4b067f63", "value": "d6f1c35d1d166871bd612064739cca97fb2207eebcd5b7e19d3719eff1829964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452380d0-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948083, "uuid": "d705bb65-c0f3-4136-90a1-cc70e65ed5ef", "comment": "Malware payload", "value": "bceab62008495c530d057ed7fdd0c0bd", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948083, "uuid": "358642a4-a583-489e-8262-745ff2c4ea0b", "comment": "Malware payload", "value": "d6fa0a3eeca7028f05d15ec4d32e413e6d6d4b768cc7d0f9bee63a3fa220d54a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948083, "uuid": "c8fe826d-cff4-4303-a82c-893884ed21f1", "comment": "Malware payload", "value": "cd64fa88c8ace3409da8b2d1ea40edd49920a025", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948083, "uuid": "6b9591d5-849d-41cf-9e82-9316c7aca6cd", "comment": "Malware payload", "value": "c534d0a4201f3f235a4d0d40921b2d92b6797e88ece21068c65c1b5361269cceabd444542be4e76c2fecbb9771d653a9", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948083, "uuid": "48f6edc2-e5f7-4fbe-bea7-ad384a1cbd5c", "value": "T150E5335099D106C9F598CE2F1B9C6536143FEFCA74A8ADE792928BF1000FB82DA73574", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948083, "uuid": "37247712-d0eb-4151-8e57-d4533ad72e5b", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1tXGfYQvqE9U:G1wwAjzIQOMK2GNKslgus10Y1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948083, "uuid": "05e9caf8-d6ca-497c-885a-6df5f556a5fa", "value": 3117056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948083, "uuid": "a530a060-0423-4173-beae-d7054b477d51", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948083, "uuid": "af9cbdf4-a3f3-4268-a874-442830cee69c", "value": "d6fa0a3eeca7028f05d15ec4d32e413e6d6d4b768cc7d0f9bee63a3fa220d54a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58624ba-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657948298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948298, "uuid": "ec492ea1-cdf4-444c-b72d-b60de5be2e71", "comment": "Malware payload (Mirai)", "value": "91f3304b7eb5820ef692bfc612825cd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948298, "uuid": "3fa8516f-cd6f-4a30-ae49-19655b3f9b24", "comment": "Malware payload (Mirai)", "value": "d70c70f24d2fa5285098a8036dfe25e33a890248c1f661133ef9e92f4023f2ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948298, "uuid": "95f5cfa6-664b-4192-924d-19fbfdec252e", "comment": "Malware payload (Mirai)", "value": "b68e66f77bacc5c0439dc4499b51eb7e4dbd1cd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948298, "uuid": "9272852a-131a-4112-a54f-39227f0091fc", "comment": "Malware payload (Mirai)", "value": "523f91a94823ad16794d080da4865138dab26dd5f12d2a411fe4d83294d8d6202b774aa810d29206ad76e415334fcf47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948298, "uuid": "baa12d9f-8d84-4226-b9d4-9a6bc10db7a2", "value": "T185534BC4E587D8F9DC0509752077EB3296B7F13E2124DAA7D7DAAE23AD02E42D11328D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948298, "uuid": "94e08bc3-078a-49a7-9549-ce2655464f85", "value": "1536:1kbc71BBduThxDrIgIPChkDmIebE3lFQxR1grd:1kbc71LduThlrIgIeomImE3XQx7Sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948298, "uuid": "a85cacb1-0410-4da2-802c-da730d9c2df3", "value": 62268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948298, "uuid": "25304fcb-625d-46d7-9121-4872144768ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948298, "uuid": "036bd088-465a-425e-8404-2ce9884d69bc", "value": "d70c70f24d2fa5285098a8036dfe25e33a890248c1f661133ef9e92f4023f2ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13931c04-04c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657949718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949718, "uuid": "fc6ec7f9-38eb-4193-a295-333a3e38c95a", "comment": "Malware payload (Mirai)", "value": "923b0183a79d199411d8cd7ef6ad18a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949718, "uuid": "876a178b-b8a2-4758-bf42-074c8c424ca9", "comment": "Malware payload (Mirai)", "value": "d83fb4bafa29cccfce069ce8ee37fa40ffb8ce8e823594de4c210b29304037d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949718, "uuid": "cb00bb76-4d33-4b6e-8018-593a8c7004b8", "comment": "Malware payload (Mirai)", "value": "4ff7c2ffca9209ebfb376eea2bcfdc4e005b44c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949718, "uuid": "e7f28184-ff09-44a7-9b00-3b70e385db85", "comment": "Malware payload (Mirai)", "value": "bb66868d3b262ac920204dfc680729dd4a9969f8195aa2007c3cb551eea0bf627aa95059642881131a503c3ea19de987", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949718, "uuid": "b52a08c0-9e4b-442b-b13e-fb5e6e40d5e1", "value": "T121E34B09F6408B53C0D32776B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949718, "uuid": "91838562-990d-4219-906a-b146d705949e", "value": "3072:tdntU2haO5H1XacBoGmh9H5i5hDiGRvEM/9f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9H45hDiGRcM/9l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657949718, "uuid": "7ce3e41c-defc-4164-b650-7cfe52831d0e", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657949718, "uuid": "f7aebd16-7bf1-43b0-977a-4be9296c6172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949718, "uuid": "b3448d63-a6c8-4205-b204-67048b28d83f", "value": "fuckjewishpeople.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5cf84e-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947966, "uuid": "318ae15e-0cf1-41a3-b701-d715e2ec6fbf", "comment": "Malware payload", "value": "094523be582c2606af02d002e4838191", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947966, "uuid": "46294e22-3fcd-4663-8bf6-e1b74de494ca", "comment": "Malware payload", "value": "d8cec1c1679c85dcf6cb7dbf8eb6e4d28f9b46eb69620c46c406f0db1acd1571", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947966, "uuid": "2e2ca308-98e4-4ea8-aaa6-79d769846b97", "comment": "Malware payload", "value": "0238a9946f509ec4e6dca225fb4b72088020b5a6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947966, "uuid": "9f89b3cf-4a75-4aea-9e03-b3cdb9c9b4dd", "comment": "Malware payload", "value": "58591a5d6e3e56513d94a76d1ff42f71b4ce9ae92d36bd485cade2fe3c5f74c35e5552074f7f7630da6fa0ca063903a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947966, "uuid": "f0d8db17-8e5e-4685-a538-99fd552e48f1", "value": "T12041A34B73CBB721EEE3E872749524242382C498D0ED5A4CF6D835DDD0ADCA472799C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947966, "uuid": "9ec937b3-cf8e-400d-a88e-e7bfce38e4b6", "value": "48:K2fgNeVbKzAHN54tCZaLc5qSTERBY1D1A1V1a1hkBaX1mTwFqOYgXfvYNI:K2fgNeVuzAHN54tCZaLc5qSTERS1D1AM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947966, "uuid": "f0a575da-7b50-4c88-9094-19c89b9ded32", "value": 2005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947966, "uuid": "90d435e4-0f54-4f11-b607-2ad9118afb08", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947966, "uuid": "04b81c30-c390-4f66-8df4-ecae1f3e6ad5", "value": "d8cec1c1679c85dcf6cb7dbf8eb6e4d28f9b46eb69620c46c406f0db1acd1571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a224a9e-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948091, "uuid": "a4c48d3b-e006-4b7d-aca0-2d8b7df537bc", "comment": "Malware payload", "value": "3109614476595579bbabaf45e80e0c4a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948091, "uuid": "02eafec0-7e76-464e-a3d7-8974745d9992", "comment": "Malware payload", "value": "d918effd89ecbe77dfcc1bbcf6ac893203b44d8d3785ce860d86e25287f9e318", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948091, "uuid": "9b9a304c-4928-409f-8430-cfd19fb18f01", "comment": "Malware payload", "value": "738ac3352a836079255605c0d301807d12ab3447", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948091, "uuid": "1001ef4e-4839-40b7-9b85-ef9434c7d21f", "comment": "Malware payload", "value": "b6c08918d9274b6545e1aa918a774a33b10cafbec5f324ff41342777f696479033c4e86020a63dc9705c38c20f74a2ed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948091, "uuid": "6bcdece9-4540-47f6-a2df-9a05f02d6793", "value": "T166A1E850112C1AB17246597AD26FFB52B90EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948091, "uuid": "bb21b31f-f0d1-4853-a04c-5dd66c0ce5ad", "value": "96:sRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:sRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948091, "uuid": "026eb354-e328-47a6-b517-597667b059da", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948091, "uuid": "1f249d17-da9b-4fc4-87ac-1514c582fca4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948091, "uuid": "d91dec2b-720f-4cfa-86a6-a540d56896ba", "value": "d918effd89ecbe77dfcc1bbcf6ac893203b44d8d3785ce860d86e25287f9e318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90f7a9a-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948277, "uuid": "d59e712e-8a49-4033-902f-d3f104e1d5c7", "comment": "Malware payload", "value": "31a32a54ecb8daadb6e72424c1437b0b", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948277, "uuid": "d4626ba5-c480-423d-8c06-79c347cd8264", "comment": "Malware payload", "value": "d96e85501f3116b1e1d12a040eeb8a209e1aae223da98ed84895c33b3a0110e7", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948277, "uuid": "87c83d17-47eb-4f1e-aca0-cfc3f3abe260", "comment": "Malware payload", "value": "40f54f2e254ef5769b3d81f35b9f19a648169c78", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948277, "uuid": "1423a374-7184-471e-8683-25a3014b16dd", "comment": "Malware payload", "value": "67c1b3cf4aa6e0bdf51c861e9059c1b1c919b180a9aed5bb2fab6ee685b38e7d495fea59303ca3209d5675800986fa83", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948277, "uuid": "72052150-533a-48fb-b655-e3f7379a69b0", "value": "T1DAC5330C13AABCFDF99E062927638EE5C1F991E0B54260A3D76449985C3F57E13CF922", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948277, "uuid": "b5f848ba-ba2a-4dfa-ada1-acdbd390f272", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL46:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948277, "uuid": "0a4cd59a-d56e-4bca-a321-70bdec220168", "value": 2686976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948277, "uuid": "0dab3693-ca3c-4978-a455-d336acf3425a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948277, "uuid": "74b59d25-01ef-4e68-bb69-b2687a485352", "value": "d96e85501f3116b1e1d12a040eeb8a209e1aae223da98ed84895c33b3a0110e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffddaff-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948021, "uuid": "869cd345-bf5c-42c2-b183-8ec71376c51d", "comment": "Malware payload", "value": "8c44b4c9b281db46feccf2030a89740d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948021, "uuid": "284d805b-f923-449b-8dc7-116d350acaed", "comment": "Malware payload", "value": "d97a73b121a77690b9781c0e90a7f218272aa3b155b752bbff7532c2f53a00b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948021, "uuid": "c9b06373-6408-4b75-a76c-6bc03921b038", "comment": "Malware payload", "value": "a1a1feb7860b77494fa486b4808618d6f74d54ba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948021, "uuid": "b7d4c32c-6ebe-4feb-9b6b-39c6cd9e7e3d", "comment": "Malware payload", "value": "26279d27f1af6d8132eda4cf0dd1d89192ea28ada715e581dfe438f5f7a55260071ef71661e944e3aba9b3f2a2bca8d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948021, "uuid": "d933d892-7c8e-4a33-a080-eb376b2e35e2", "value": "T1FAA1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948021, "uuid": "a9c71eda-65c2-413b-ad65-7283061fa2b9", "value": "96:bRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:bRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948021, "uuid": "0311544f-cec1-495e-8b40-77c170cae42d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948021, "uuid": "8335e413-7faf-4fca-ade5-75bb1ee4261f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948021, "uuid": "eecc2efb-1851-4333-b7c2-e2c40fefaf92", "value": "d97a73b121a77690b9781c0e90a7f218272aa3b155b752bbff7532c2f53a00b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9284d21f-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948213, "uuid": "9a92b3ad-8551-4e53-8d26-f0e754b772cd", "comment": "Malware payload", "value": "56637985857f626c27d20a5af33cfed6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948213, "uuid": "a61622f5-1041-49c5-abb5-d561eb527c10", "comment": "Malware payload", "value": "d9b8aded3068a0eb0e1ccd9174fff8866c35aacc38c17babebb5eeaaa747e68b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948213, "uuid": "b2acf861-9aa0-4a87-b85a-d35ac1d8c15f", "comment": "Malware payload", "value": "c9d2c6a86efb62cf80584454b0a1ab3bc2043570", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948213, "uuid": "5824b467-d19b-4dee-ab67-2ee3335f9754", "comment": "Malware payload", "value": "a02fb74632fb9f52c68e230cb61610e13a394a1a609ef08a2a5ff0b82c482e17522dcb4bb0c6151a9a4a5dcee027b2df", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948213, "uuid": "3df40530-7e1d-4b75-92d9-e0724c52932c", "value": "T10EA1F750112C1AB07246697AD26FFA52B80ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948213, "uuid": "620177b7-b655-4259-8658-6698c787598b", "value": "96:zRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:zRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948213, "uuid": "84f0a302-3a8c-4d44-9ffb-16a053f77590", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948213, "uuid": "b46fe3eb-32b7-4629-8bbc-0db366a23b79", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948213, "uuid": "1e08f7f4-9ced-416e-b84f-533e8485cf5a", "value": "d9b8aded3068a0eb0e1ccd9174fff8866c35aacc38c17babebb5eeaaa747e68b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85173f9-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947820, "uuid": "eb1822b5-a51f-4caa-ad20-2f2f5cb7c6c0", "comment": "Malware payload", "value": "c0d61169afa8012ee511c4998b93294b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947820, "uuid": "08175b33-81f2-4764-b6f8-4c535efad4c7", "comment": "Malware payload", "value": "da362aa4ce1053e89e7bbd250c4420471bd936b8d85d5f806c9a059b18789727", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947820, "uuid": "1aa3945e-8e9d-464d-8726-915ba3413425", "comment": "Malware payload", "value": "2da37dd62a0c2ce97e74b5133b8861d7dc050914", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947820, "uuid": "68cbca2f-cab4-4fa1-8dd9-d1ece1490b5b", "comment": "Malware payload", "value": "6332d0b8b981f5c8930392d6091e00da5f4110d80f7eec16228e1debbe0524f903ff91edfd1569261ada2f7d39280ede", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947820, "uuid": "adc4d254-03ce-4dbc-b899-4ce2014b9deb", "value": "T169A1F750112C1AB17646697AD26FFA52B80EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947820, "uuid": "f81f0a76-a42a-433e-887c-178d089cd4cc", "value": "96:RRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:RRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947820, "uuid": "0ea18846-9b2c-4c19-b8fd-9b5fe2d973c3", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947820, "uuid": "fae15952-5772-43bc-9a34-b7cf912d1fd0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947820, "uuid": "6257e752-9846-4688-912f-07404beeca64", "value": "da362aa4ce1053e89e7bbd250c4420471bd936b8d85d5f806c9a059b18789727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a414d6d-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948118, "uuid": "58a6bd44-e971-4ab2-9104-1d46e88e2407", "comment": "Malware payload", "value": "0a9b856389f425a372fac2aa76659a9c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948118, "uuid": "6afa9e6c-b65c-48a4-8aa7-ac65e5fe98d5", "comment": "Malware payload", "value": "da79bb17463f5e5a75ae48ebe4bc85917fe2d1cfc81ea49e12eec38c5224ae58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948118, "uuid": "988b65df-a20b-43d2-a9b7-93abd7b4103a", "comment": "Malware payload", "value": "894a949ac7449392a5e99694500e5235b5e35ee0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948118, "uuid": "6532205c-6b13-4521-8264-fe8aab6e3daa", "comment": "Malware payload", "value": "9313cecbddb0de0b3ee0c9ffb3d68adeb27fc6d161e629fdff81b65cad6b9ebf292dfa383cf05032acce8153e700a919", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948118, "uuid": "645c2b12-a199-4c59-bfc3-616727ae0459", "value": "T191A1F850112C1AB07246697AD26FFB52B40EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948118, "uuid": "b150f3c4-172e-49d8-aaab-e38ceda9c0be", "value": "96:bRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:bRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948118, "uuid": "cae24a64-afe1-4270-96b9-0f2f70c816b0", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948118, "uuid": "1743d47c-83ef-409d-8ec1-85c356703c12", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948118, "uuid": "6e3e2d41-277c-4efd-a755-772c520d38c7", "value": "da79bb17463f5e5a75ae48ebe4bc85917fe2d1cfc81ea49e12eec38c5224ae58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde0b84b-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948393, "uuid": "0f3ae1d3-2295-47a4-8dcc-a2bd6ddfcd34", "comment": "Malware payload", "value": "8373ef66fb10f0f1461c4063b46a7019", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948393, "uuid": "f65201d8-e892-461c-a824-bfac5564a23f", "comment": "Malware payload", "value": "da89e2c487c50828b1750cc5d7705cbb10e3997373f5b0d9f879cef3db3e8756", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948393, "uuid": "1595bae7-9698-483b-9c8a-eced7ee363ea", "comment": "Malware payload", "value": "d3614d8ce925e19478ecbc53e8ad4a1345b03477", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948393, "uuid": "b0cecfe4-939b-4940-8091-200d9a62275e", "comment": "Malware payload", "value": "213976d0dc98427f518b6113dda5ce25ea7fdb51eb0a6c75dc1dd0b5b8f6a784c5ca5e2f72181e020df8e2a312818f0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948393, "uuid": "d2ff6aba-cd0d-4a41-a524-1db08c493aa9", "value": "T1D2A1E850112C1AB17246597AD26FFA52B50EC81B09777B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948393, "uuid": "43415cc8-26c3-4915-8117-ccf353b0a288", "value": "96:TRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:TRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948393, "uuid": "b9dd9dd7-5e67-4f01-bc23-9dd15d549639", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948393, "uuid": "f3b49bf0-05ec-413e-915d-8c4753efb4a7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948393, "uuid": "e71775d1-0978-4206-a004-8ec298a34ea5", "value": "da89e2c487c50828b1750cc5d7705cbb10e3997373f5b0d9f879cef3db3e8756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdd9ac1-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948740, "uuid": "7e74174a-a4ab-4d02-a5f4-0ced83ad4812", "comment": "Malware payload", "value": "fa1848ca01aedc4dcabc01f7d2c7c4d7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948740, "uuid": "80947d4c-d52c-42f2-a271-e15f90749521", "comment": "Malware payload", "value": "da9550aab8e4e06b6563ea029298f6ecb656caec959cfef072c716d37a5e9a00", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948740, "uuid": "ef6ecf4b-bd03-42c6-ad3c-17f8169905cf", "comment": "Malware payload", "value": "8f278095d4c23e1084155991c598afb8a7cc877a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948740, "uuid": "18d5deb5-bffe-4fb7-8abd-e9c7b964a7ec", "comment": "Malware payload", "value": "c506a5cff04779fe0920889e8a65399235140bb01b7fae8dc6a14dd539c77cb5d156c3f1e437798a2ab21729b4754d57", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948740, "uuid": "4a33c8c3-3a86-4277-a6c5-7c72c6d1f4ac", "value": "T1B63160F830A575347CBB68B7E36A5815328250552894AE4468DEFCF489CDE0131C6EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948740, "uuid": "1a40eadb-1f4a-433a-80a0-a835299a2e82", "value": "24:Ijcmh1myxsammtmo4RmGm/mjmV8S8/miRyR3REId:xoRSaptl4R5A6y8S8/ZRyR3R/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948740, "uuid": "f3f41abc-608b-4c05-821d-276e24ad625c", "value": 1870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948740, "uuid": "5a70487e-2db3-4176-8d36-ce4e7334789d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948740, "uuid": "83670106-0f25-4abd-ac36-d0c6766ea197", "value": "da9550aab8e4e06b6563ea029298f6ecb656caec959cfef072c716d37a5e9a00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd610ec3-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947855, "uuid": "f0531a9c-1a9a-48d3-8520-3ab331a6ed1b", "comment": "Malware payload", "value": "eccfa929da3e601ff6666605d60bec12", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947855, "uuid": "9d140663-6c9d-41b2-adb5-7e22c245120e", "comment": "Malware payload", "value": "dae56fc21ee3e70917e4c160ffb7ee08b0fcb8709d0d06d8fa7d90ef5cebe1f8", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947855, "uuid": "4faea497-f6f1-4322-9972-aa863b4fbd0e", "comment": "Malware payload", "value": "effc09a21dfd650396007f602b9b06dce937ba2b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947855, "uuid": "99e0584f-8edf-405f-9d3d-a9251fe396bb", "comment": "Malware payload", "value": "0138b23c0e2a97c8fed2a34989eff168290fc5a79d1cea6ba3fe985604c197438d7dc713ce2ac16f63973aab71571238", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947855, "uuid": "acf818eb-78d9-4adb-bdea-a0d957b61820", "value": "T13CF42356A9C03DC8B0ACAD1B2E8E85095099FFCAA078E64B01E497D7105E75C6FB733D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947855, "uuid": "3d2eb9e6-0d7c-4024-a4e9-5ab650722178", "value": "12288:G1Hx+tbbZpxMj3urJSwvhgUXrgt6gmVB0xuP+GDlZN6O1qyQj7d8g+Sn4hocnXjj:G1HxKBpxMjuBd5QUP+GDxDQjKS4hoczj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947855, "uuid": "91eb98b8-fbc2-4fb9-89b4-321059222f02", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947855, "uuid": "8faca437-0f74-4ca0-b293-95f45c10436c", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947855, "uuid": "430a0fa6-be95-4a96-9861-21ad927e250e", "value": "dae56fc21ee3e70917e4c160ffb7ee08b0fcb8709d0d06d8fa7d90ef5cebe1f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2b866d-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947858, "uuid": "052decb6-5dff-49cb-8c22-5ba17d7cee25", "comment": "Malware payload", "value": "e1dbdde51eed3bbfe568a9cd4ae0c421", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947858, "uuid": "13bb0675-992e-412d-b962-8ad115608540", "comment": "Malware payload", "value": "daffb8af3c3bf12a1fc4584d2a0b12372d0312b6ee08a22338c2dc7cade54693", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947858, "uuid": "c27f11c7-ec84-4844-93a2-a046495299a6", "comment": "Malware payload", "value": "052c1894898f90a77f680d2b96d319cdd5894533", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947858, "uuid": "5446d7df-9e2e-40d4-ab88-56452021829a", "comment": "Malware payload", "value": "aa6474aab9cc0064bd0e3cda9be56c114e528539c6468b6a46a61fa8bdf1d6b924b33b9ec12aa6e659c3286f5e68a942", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947858, "uuid": "86501b52-e6e2-43ca-b830-3701a95669a7", "value": "T168A1F750112C1AB07246697ED26FFB52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947858, "uuid": "20dde404-6a3d-44e4-aaba-23551b40b7a1", "value": "96:3RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:3RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947858, "uuid": "00214e66-7fc7-4399-80c2-6e12cc0b0e92", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947858, "uuid": "3f4300f2-94f5-4513-b668-5d5eaffd61ad", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947858, "uuid": "8f8bbd17-af9e-4faf-8ab2-0206c7798282", "value": "daffb8af3c3bf12a1fc4584d2a0b12372d0312b6ee08a22338c2dc7cade54693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5a87e7-0510-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1657980519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980519, "uuid": "7c7b0342-e8e6-4d8f-af33-0c6af3b78ef5", "comment": "Malware payload (AgentTesla)", "value": "4d5b4e15db05d0843d77ccc2d1315623", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980519, "uuid": "0836a9bf-7ddd-47bb-9e16-92d033971836", "comment": "Malware payload (AgentTesla)", "value": "db42e08f15af1530f509f6b1c4778b59e2cde3a1d10732700d97e792d5ceaf88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980519, "uuid": "e4654015-aedd-4d16-b6fb-5b45ac518b52", "comment": "Malware payload (AgentTesla)", "value": "81edd3d6b59291220fd0df784bdc4ce1ea567533", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657980519, "uuid": "d984712b-e7f6-4cfa-a305-c46bc92ba174", "comment": "Malware payload (AgentTesla)", "value": "300013192d17a7d9e446e98081d6e41199f0d39c852c9961ffa4091f97b78aac5b527f1852c7d8074fc0336cdb65f693", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980519, "uuid": "2aadb5e7-bfd4-4bfd-b199-471e62b49628", "value": "T15105231123A86D82C17D8FF114E2A4E03FFA69C15652EF64F880E9E59FF1B50AD1168F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980519, "uuid": "091a1cbe-3647-4b24-8f5d-b7613446898c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980519, "uuid": "7f20b4ca-e591-4636-b76c-43325337212e", "value": "24576:r5wrWEkjV5zG2WGAUPj42U4RUT4+I3tH/bBhnE/3659Y:irm/PHU4RC43x/bPnEfGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657980519, "uuid": "0d820021-94e3-46ec-a7c5-080579a7dda2", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657980519, "uuid": "b7bc6f47-2c39-4533-b2b9-a0d94a0e78fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657980519, "uuid": "b356343d-a741-49c4-865c-9d3eeeae298a", "value": "Ordern.no291521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a60493-04dd-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1657958630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958630, "uuid": "f3c139d7-53c6-424c-adcf-a6ed509192d1", "comment": "Malware payload (AgentTesla)", "value": "8855ab7397733821a7a6a5f7a29b4633", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958630, "uuid": "486c1f4b-080a-439c-be62-3fb68a29643f", "comment": "Malware payload (AgentTesla)", "value": "db980a1b258b7cb62a1213dba446ff3ee364841af2134c3c92db93599a5ff980", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958630, "uuid": "bd81eced-5964-43d3-99d9-cd92fcb5a415", "comment": "Malware payload (AgentTesla)", "value": "1f9c0d642681568c573e5e905519d7741e3a397c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958630, "uuid": "efa6f7ba-0d41-48da-89e9-c6941dff3c6d", "comment": "Malware payload (AgentTesla)", "value": "74f02b9b8b49f10223a2cdbf2bf142f608412017467c940c135b905e1333f662706126d1f63299046255da81aba9a965", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958630, "uuid": "e5f2d00e-b1d8-4b3a-a860-c96fea48e2be", "value": "T1AAA3C4053ECE0C16C1FF89B9ACD46C346A7D79D7A176877DA8CCC1BE98262801E0D95E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958630, "uuid": "bddabe3d-6cd1-4ebc-810b-97982a9b5826", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958630, "uuid": "295c8e52-554a-49ed-8f27-6e7f2e123910", "value": "1536:lHWsv4dmtlEuPUnjVOIv3vGsx9veeleHK5A6kB/:lHpEQUjVOIv3vGsx9veeleq66k5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657958630, "uuid": "ae69e30a-f436-4fda-9c10-d3b6fbbf8aaf", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657958630, "uuid": "3b69ea4b-be04-420e-a42c-a554a180d87f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958630, "uuid": "c12ff5ac-8d49-4570-8ad6-e0a3b348d315", "value": "8855ab7397733821a7a6a5f7a29b4633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f8eee1-04e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (GCleaner)", "timestamp": 1657961157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961157, "uuid": "b842141a-3346-4efc-871e-c17b665e1c70", "comment": "Malware payload (GCleaner)", "value": "86ea545475c796b13a371f4c72dc56a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961157, "uuid": "de0574e5-8276-48cc-8fda-457becef6806", "comment": "Malware payload (GCleaner)", "value": "dbb81f992fd7112d5077052e4a30c5afe4fe3dd45ead4ae30a00c3b6daa849ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961157, "uuid": "4e337246-9c3c-4765-a8af-fef1a4dd9308", "comment": "Malware payload (GCleaner)", "value": "ce8870ba1526e98f030e18b3f2c0e6cb3ac617e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961157, "uuid": "135c4497-fb34-4d26-a20c-ab30b6016dce", "comment": "Malware payload (GCleaner)", "value": "275f17ed4c3738edd74b87d7dbf3a0da4352e4ecfc7b0f023d1f19818264af8cfeee0044c1971524f0a354292a9d7a4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961157, "uuid": "e7ba4223-d745-4f51-8d52-596ae87d3876", "value": "T1DE44F121B6B0D832F4F731308AB2DA606A7B78636574A48BB7F4136D1E323C05D757A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961157, "uuid": "2ba442b0-704a-4e0f-93da-152607ca1516", "value": "1babba8ebf028e1ff7cbb28d85574e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961157, "uuid": "1b24174a-85e8-4220-840b-e38fa06acd1a", "value": "6144:OgODT4ELOFZUa8fORTlGyfb/Fjdr6YdZ6+/G:OzThLOFZZvTxnr6YdZ6EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961157, "uuid": "290eb0c1-ae7e-48bb-bd66-bd6921e18ffa", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961157, "uuid": "27eb04f7-16f1-449d-bb43-5051a775f01f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961157, "uuid": "38fdb8b9-ca63-496f-944e-a15a07c4f06c", "value": "86ea545475c796b13a371f4c72dc56a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bf8821-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948030, "uuid": "ddbef0aa-bb9a-4b52-b359-a5382496588a", "comment": "Malware payload", "value": "3538248d386ee7b3e2d62ca5662ee10c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948030, "uuid": "c0765214-bf2b-42fd-970e-ca6677be7b50", "comment": "Malware payload", "value": "dbf4dfee6a379fe7aa4921fb8c1390ef3fbe2cdbecd45c42234aa00929530678", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948030, "uuid": "b6ca463f-8bdc-455c-a4d5-6c5e59eff09f", "comment": "Malware payload", "value": "7b288584e3cfd6613f45a1878720ccb29fcc76b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948030, "uuid": "a017ff30-ddf5-461d-bec4-075e1bfa1407", "comment": "Malware payload", "value": "8aac6a54afcc8e9adb794655360e52b2ce0538fe9b09bcbe220dafb9cb74abe8111292326d235303c881ff399921ab9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948030, "uuid": "6016b632-9cd6-40a6-a863-cd586dd383cc", "value": "T18EA1E650112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948030, "uuid": "f80d595b-d304-453a-bc3c-c8f429b0755b", "value": "96:WRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:WRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948030, "uuid": "9d33b9a2-d1cf-4a6e-849d-1dc1d09d21b1", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948030, "uuid": "a4922951-d9ad-4bef-b946-f7b1cf380222", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948030, "uuid": "409f6208-9939-48e7-a19b-bafba7a99376", "value": "dbf4dfee6a379fe7aa4921fb8c1390ef3fbe2cdbecd45c42234aa00929530678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf69affe-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (XorDDoS)", "timestamp": 1657948744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948744, "uuid": "3150cb90-2f8e-42bd-948d-ea4bc19f69b9", "comment": "Malware payload (XorDDoS)", "value": "0e24ef5dd32e19c0c89c90da895fd4ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948744, "uuid": "d8ebd5f7-6f1c-474f-b1f5-2a0438af3309", "comment": "Malware payload (XorDDoS)", "value": "dc2279cbb01ed9d179c6914f1a72ac2c1f9218920d90904b02d1f7781c10736c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948744, "uuid": "a62eeebd-a38c-454c-be31-6eb266d6cff7", "comment": "Malware payload (XorDDoS)", "value": "0fc75afe50fea37f08854f131a9f47e1bb358004", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948744, "uuid": "c2fb92fd-f795-4bd2-ba14-206d0c8d0ef1", "comment": "Malware payload (XorDDoS)", "value": "8de38cf1ff990226360a2d895bb8550158ef94a2ad018ab6b9070f24025bb61a74ce6c8fe74f9f0dc865f5a2b7321746", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XorDDoS", "colour": "#98AE48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948744, "uuid": "deb94f73-d994-419d-aee2-13e4f9e5b2c8", "value": "T1CF444B16E24390F7D82705712387F7FF4620A235D420DD8AEBD4AE4AB9739E2664D363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948744, "uuid": "6b5fec5f-78df-496d-89f1-77701c330988", "value": "3072:8TTAhQjrd7bvx3jAJxU9RGBJMIlcXdD0y3ppIa8OmlJsuEn5M16YbQ/5OkKqSwkq:VufRvuKqCdDVZssuEn5MorhkmKADpPnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948744, "uuid": "336ab084-7f4c-460c-9788-9abb60790215", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948744, "uuid": "1e80a6f2-d58d-4bf2-850f-fccac990e03a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948744, "uuid": "b86ce266-3dda-447e-bc71-1d30af3ff776", "value": "dc2279cbb01ed9d179c6914f1a72ac2c1f9218920d90904b02d1f7781c10736c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978031ee-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (EternityStealer)", "timestamp": 1657971414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971414, "uuid": "e75fb0cd-71f6-4715-82df-91292354550b", "comment": "Malware payload (EternityStealer)", "value": "ac438353703394d1884341acbbe46dda", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971414, "uuid": "ba785464-3826-4e71-8b30-f492e676c17e", "comment": "Malware payload (EternityStealer)", "value": "dd0ebb1754536db3622a591fa76c6a8d66ebfdb5fa5327ef2737601dedfa2818", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971414, "uuid": "6fecb231-ea7c-4d19-860c-13f5202fc311", "comment": "Malware payload (EternityStealer)", "value": "046a02255ee90b674e01fbfad8370088e6e8fc00", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971414, "uuid": "3b1c1316-1646-415e-a79c-a5dd3923548e", "comment": "Malware payload (EternityStealer)", "value": "759a7cbe0b2485e87b0fbe57d4e049c72c4d0946acb7edb5b0b1eee5d8acae1292e776d08f0f2f32570ff23e0a6ed190", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971414, "uuid": "0d58ba2b-b2c5-4ed3-9515-7ec8074589e1", "value": "T1CAE418213BE42129F1F2BA3D99FB2A32C3BD76631B17772A740622C61E12591CD437B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971414, "uuid": "e67aa524-65bd-42be-8b04-e971bf3add18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971414, "uuid": "739da089-a436-4c02-8def-2bb12d7a44df", "value": "12288:q1j07yxkWJleX1Q+01FUWF+exatpyF/XM9wIe8onFSESHgE1C:I07WAHtpIAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971414, "uuid": "1c0a718d-ad89-40a7-bdea-a321c7752eff", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971414, "uuid": "9cc39e3a-9c28-4c37-8a85-de1009a7f232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971414, "uuid": "88fdd4d1-1d73-4d54-8750-d6e8e2a47597", "value": "Stealer.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6911708-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948273, "uuid": "16bf8ca2-7f79-4a9e-8d2b-3bf3420be6f7", "comment": "Malware payload", "value": "3cef4db2cb237cda075711fe4f4a44ee", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948273, "uuid": "5c8a6cd6-0f20-4c6e-b56e-916952024890", "comment": "Malware payload", "value": "dd4c3f7cf1ab8e2f70ed6f9de4daf914a32baeda087ff372d9a58cbb8a81bd6a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948273, "uuid": "cfa596c0-7402-4383-89f7-894c5d43cd39", "comment": "Malware payload", "value": "05798bccbb535139f0416418ac5224aaeb2d2b2e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948273, "uuid": "833da893-636d-49ae-be80-ba365edaaf76", "comment": "Malware payload", "value": "8cd23c0788599b8bb87920b38ef90a2e25929f1f38da065a181aaebb7c412692767ece20721f9255f65132833f32af39", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948273, "uuid": "9211906b-a5b9-4297-8996-c1098d3e21d3", "value": "T16DD1AFC534B235387C639CDB232A2C18359390562C869EC56ADC78F88CCEE4636942EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948273, "uuid": "b9718e82-4b23-4c31-9619-0a69fcccce5c", "value": "24:cBDx8S9qRgraWH0ipk8xcsACfzEwxH7pBy3+InBDx8S9qRgraWH0ipk8xcsACfzs:A9PdPXYGDw9PdPXYGDw9PdPXYGDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948273, "uuid": "4e3d03ad-864e-4a23-8274-1966b18dbe17", "value": 6276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948273, "uuid": "c79e10fb-2e54-44b4-8dfe-327e6929f22a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948273, "uuid": "9510f9e2-5274-4f2e-b007-608f8dd655eb", "value": "dd4c3f7cf1ab8e2f70ed6f9de4daf914a32baeda087ff372d9a58cbb8a81bd6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08116cd8-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948410, "uuid": "763b1931-eb73-4d19-b9d2-f9bcd9ef055f", "comment": "Malware payload", "value": "53c67bae0d30d7c40471a43f181e110e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948410, "uuid": "4a4f967d-023a-45ce-b77a-f2701d0aa273", "comment": "Malware payload", "value": "dd5976bfc32e7999eae496decf4728b8c452e728ae792446a00a04be1587cfcf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948410, "uuid": "6ab4ef1b-05d6-4c87-91f1-166224b42894", "comment": "Malware payload", "value": "9db122b9e2d02484d11cf778a511dec991229b19", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948410, "uuid": "ef45ee57-07f3-4730-9f83-e3099a175337", "comment": "Malware payload", "value": "dbfb899643d5e76638461b1469630deec7487937fa67f83905d2739c645dab2e673173575d2f6d222e3239f02b72f9ed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948410, "uuid": "678247b3-9d1c-44ec-b586-4df7559f0e12", "value": "T1ACA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948410, "uuid": "e7268503-8054-4953-b719-2d7133a3d030", "value": "96:fRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:fRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948410, "uuid": "40ff8785-41eb-4727-b176-42415a5ce40f", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948410, "uuid": "46deb575-033b-4656-90e1-effdef393ecd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948410, "uuid": "bc3d2de0-2bfa-4c3e-ae1b-27bb77f7037c", "value": "dd5976bfc32e7999eae496decf4728b8c452e728ae792446a00a04be1587cfcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e508b71-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948662, "uuid": "f22042ee-efe3-4fe2-bb9c-d5dba8ccf313", "comment": "Malware payload", "value": "d1c74e22520c5db0ccd40ebd82520981", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948662, "uuid": "02e20d80-6838-464b-8c03-92b43720ee7f", "comment": "Malware payload", "value": "dda0bca202d4ca0fbb0bc92297228c4b9fd9a5ab95f94fa48f3430e4221746af", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948662, "uuid": "a0273a09-c2f0-4a15-af5a-7ad57ec2ae78", "comment": "Malware payload", "value": "c24efc25435ee301714343ae8fe5db60f9b47066", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948662, "uuid": "d540d763-99ee-41de-9679-6bbece0b4663", "comment": "Malware payload", "value": "0faccf734cd09647c1635af7f9caea381bed22021cec42e131a5a2fb175a666989231dac3998f55d2eaa2b45cd31a21d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948662, "uuid": "a1a5a299-2d9d-479a-b868-6176d7445fa2", "value": "T1E2D533AC71ED39FD82D4B672B6EFED283016A58D707143906DB3958E0C16232D5EAE1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948662, "uuid": "63dc2326-97e4-43c1-a952-494244ac8ade", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5Ig+M4hh:tos909Qg6ecEZHyEexmLaI9MYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948662, "uuid": "6172c1c0-c012-405e-9d8b-fc79224f1834", "value": 2920448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948662, "uuid": "0370f52f-49a7-4a9f-9660-819e826d01c5", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948662, "uuid": "cf4f49d1-191a-4d17-b135-0d6bd8d61903", "value": "dda0bca202d4ca0fbb0bc92297228c4b9fd9a5ab95f94fa48f3430e4221746af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fc20d1-0541-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658001263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001263, "uuid": "811c1ba4-35d5-4d3a-95cc-0f5a456275a6", "comment": "Malware payload (Mirai)", "value": "46c2b0aff1b477dfba1587060b02a86b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001263, "uuid": "6d913d02-36a5-4d63-93c9-0c0b6755a84e", "comment": "Malware payload (Mirai)", "value": "ddde0bdc687222451fa9fa9f2007376f7c9de99b425a45cc34196e47dedaaf5b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001263, "uuid": "0fc57a79-bfc9-4911-b478-1f5d40d41f6b", "comment": "Malware payload (Mirai)", "value": "740dd74fe3d25b4c30c4dd76f4687f2ebc3923a3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001263, "uuid": "9b83ebd5-84de-4aac-839c-ac97b9d7c85f", "comment": "Malware payload (Mirai)", "value": "db227a64dd659691df7fc03f4671bb4ceff7e7a5fcb5b06812e94bda2b745b405533d3e73a73b1716d7139e1575df551", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001263, "uuid": "129f499e-42d9-4fab-9f39-ff8fb64d526c", "value": "T107332982BC919A02C9D46377F62E01CD3B2163A9E2EF32079E226F1177C9C2F0D67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001263, "uuid": "3292059b-68dc-4e0a-a584-8b798b7ff80d", "value": "768:bUdjUpPsdKlOiy+1YIeSV53b8+oLASV0ObFBNOq9EVl3kMqf:gjUpUcK++IeSV5rm0SqE9VH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658001263, "uuid": "fd664e25-3635-4de9-ba3a-72650bdd6a03", "value": 51600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658001263, "uuid": "8da60d91-8869-425d-81b8-124933b08b40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001263, "uuid": "f785b2cc-e8e3-437c-94fb-e2f3f1342f17", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f6c7d8-04f2-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657967687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657967687, "uuid": "c4d7448d-8d12-4c60-979e-79196a216544", "comment": "Malware payload", "value": "6e558938a0406c6477fe816917667c70", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "PDFMalicious", "colour": "#873FA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657967687, "uuid": "52621a80-2422-4ca9-97f6-1cf96fd10935", "comment": "Malware payload", "value": "deb0fd8d9af039cf78b7883c0038679076c170c0ba3c83c163c7ee51c416ee55", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "PDFMalicious", "colour": "#873FA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657967687, "uuid": "400f75bc-1670-4699-a495-73ccb7ce19df", "comment": "Malware payload", "value": "9918415bd32e6ae8a367241ebc08fcc327d9cebd", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "PDFMalicious", "colour": "#873FA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657967687, "uuid": "c56e5d45-991b-49ff-8912-7dd6c9859168", "comment": "Malware payload", "value": "740f19fa5dbb9744aa4b80603d5e7af4ecb30f6e28d03d81576fa74228f0e96923790267b1eefdce9bd70998ebf753d1", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "PDFMalicious", "colour": "#873FA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657967687, "uuid": "7e5b23b3-ca14-4a25-bc9b-f9114986021c", "value": "T18543F1413A4D8497EAD64BB0281634335A7DBD73ED9583A7A1F40F21B081F7A7AF21C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657967687, "uuid": "0989a46d-0eb3-432e-92f7-97950edf1ed5", "value": "1536:3Tx9LDzuHdZK6tKM1CvDRO6d7NoZl519LRz0fz+:D/Lb6tzwvDxJNoZvZ0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657967687, "uuid": "9e812f88-71f5-474f-ad20-797d1377a077", "value": 57442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657967687, "uuid": "7942a3ca-b387-4a3f-a726-ee1df8d77010", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657967687, "uuid": "67b5c6d0-df37-4d46-ba01-8cdb3f273c38", "value": "QuintoAndar - Anuncie ja3438.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7efc0a1-0525-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657989614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657989614, "uuid": "92e5e777-8461-4a1e-8fe9-c40c1dfec099", "comment": "Malware payload (RedLineStealer)", "value": "2be29a9777a5679bf474bf370a397b3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657989614, "uuid": "b4629e4e-d6ab-4115-a088-34a64ac265f7", "comment": "Malware payload (RedLineStealer)", "value": "df3865cb8587b8a226b80d18217edf02298648d2dc77c36299d2e9a4d4ad58c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657989614, "uuid": "827c2041-3d8d-43d2-9e7d-a25516e30872", "comment": "Malware payload (RedLineStealer)", "value": "e17e29307682e367147a82f92bfb1ee7c7b843a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657989614, "uuid": "fdec209f-20c4-4ed7-88ab-7c74700c9ac4", "comment": "Malware payload (RedLineStealer)", "value": "bd77ffe3998af72af1ae4f36875d5bf931d9fbb42a566251510b958f8544ca2b77a8d998ef1f5f46f629c2db459ab6e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657989614, "uuid": "72fd771e-0c7a-4d01-b7af-9088c7dd91bf", "value": "T19394C000BB90D035F4B752F846BA83A8B53E3EA0977454CB62D56AEE17346E1ED3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657989614, "uuid": "5d7ed3cd-7799-46c6-b621-c76cd1a60aa1", "value": "363debf0ff85eb6df1e94b75eacd8b61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657989614, "uuid": "e6cb937e-1404-45e6-866b-f2fb64a62398", "value": "12288:QWFhVhWJJnTW3MCtIm6geVIF0XoAflhLbtwpbW:xFXhO5CleuSYAzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657989614, "uuid": "087c62e5-8454-4dca-b9c5-73b272b7ffe2", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657989614, "uuid": "8207490d-8ed2-48cb-9844-c694ccb514ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657989614, "uuid": "1c4db554-ed2c-4053-9b8b-9de7adf165ed", "value": "2be29a9777a5679bf474bf370a397b3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e85e800-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948474, "uuid": "8a4d83e9-e385-4626-86db-b41c999e0b6a", "comment": "Malware payload", "value": "312f08fdafaac6dedfb3dd87e8b9aef8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948474, "uuid": "8ec9cbe3-ce30-4701-ac94-bb314ff48507", "comment": "Malware payload", "value": "e057cad7047cc1dd90c4cfabb9889d02f3530f9b7598a95c5c40ff9e6157db90", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948474, "uuid": "6ba84b64-d558-4cb8-81b6-9852cc812ec0", "comment": "Malware payload", "value": "106912810cee79b31edcdcc4676b47de40bf49a8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948474, "uuid": "68c54415-759e-4e01-916c-27c04f788055", "comment": "Malware payload", "value": "9a5fa2cfeeb7b485c5c837f5ebcae5a90b7b7630aa20026185281d5f1c4659b1d6071e98bc5c28ed71e938e58d25df95", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948474, "uuid": "5f1de12f-52b2-49ac-96cc-77f6cf03176c", "value": "T16516330C13A6F8FDE896095C37628DF0C5E006F59D4215E2CAB91158493F9FE1BDFAA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948474, "uuid": "a631978c-89ac-4af7-8d7a-82d39280bf6c", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAFE225K1:0XSxVJG2fLAqFOfT9sMYNM29SAFN25K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948474, "uuid": "05b0a87c-b5ec-47be-a374-484502b0d54e", "value": 4186112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948474, "uuid": "ca6faf78-f753-40e5-9a06-192cb25f4a88", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948474, "uuid": "05aa9acd-c45a-4eb0-aa55-8612aa41ae22", "value": "e057cad7047cc1dd90c4cfabb9889d02f3530f9b7598a95c5c40ff9e6157db90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6599baf5-0519-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657984215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657984215, "uuid": "c7c5cd5c-a1ee-4822-b207-622362918da0", "comment": "Malware payload (RedLineStealer)", "value": "e0b66309d82d9bd6129994913b2bab6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657984215, "uuid": "11c735f3-f925-44a2-8bbb-d833c4be5abc", "comment": "Malware payload (RedLineStealer)", "value": "e07b6ac282e5159d5f34b1816286e265ef83150b3a15e3d52218ef2ab0634071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657984215, "uuid": "9ac62108-b329-4019-b005-d8bf056daa81", "comment": "Malware payload (RedLineStealer)", "value": "299f6625b4475079f21ad75977ebc48a6f84a6f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657984215, "uuid": "f1d87405-ebcc-4c14-822b-66ed051cfa59", "comment": "Malware payload (RedLineStealer)", "value": "3e4004051191108f1d5978d42360d3435beed79c5251553e5a17f9569d5b89f19c8e3be6fcebb4f40a5dbb6a91d0ba6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657984215, "uuid": "f4f4c46f-7d72-4f19-916e-74438cbcadcb", "value": "T14294BF10AB91C034F5F312F84ABA9368B52E7AA0573464CF62D66AFE57346E1EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657984215, "uuid": "dc1a16ec-f502-4799-9afd-e4f890f63e14", "value": "363debf0ff85eb6df1e94b75eacd8b61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657984215, "uuid": "c5e439b4-f98d-470f-96fa-2b3d3838b6a0", "value": "6144:aoqDwiFlmU5Ai6lgCHkiXq0tgTdQjLzodwxiyfInvamwqx4QgYavV++:alxTd+jlnHkiXq0tbL+nyfIva4DgYaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657984215, "uuid": "8d66b1a8-b0f0-4720-a9e7-90abca877a16", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657984215, "uuid": "6c2343a4-89eb-4f71-9e5d-76f26391758b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657984215, "uuid": "b51a05a5-848d-4601-ac83-b9feba367031", "value": "e0b66309d82d9bd6129994913b2bab6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11be2c1-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948693, "uuid": "f9a60a6b-ccae-47b8-9d7e-b5189abf6d2f", "comment": "Malware payload (Panchan)", "value": "ff612a637867ec97cc153e3e3ba11486", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948693, "uuid": "7a43c3fe-ec6a-491b-9137-23f8423ff019", "comment": "Malware payload (Panchan)", "value": "e0c8ba2ee944ced70e259eb253b030485e77223737ca3ee7c1175cec5d95abfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948693, "uuid": "cdc32008-a660-48fd-a38e-02f757855980", "comment": "Malware payload (Panchan)", "value": "ce3e9c27c670493a63c184eba332fd7442917b45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948693, "uuid": "d907dae4-769a-4e6c-98d5-5181ab0904c1", "comment": "Malware payload (Panchan)", "value": "0d517b7d1d728d7389d967f6d791317ef40ee0bcdafbab9b4100f2c87b2c61dec255c0d26c499413b59b2cf42f6f04a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948693, "uuid": "0cf4d790-4e64-41d4-b994-7525270cbeaa", "value": "T104564A73904554E8D2AED874C6256113BEE43897673823CBBBD076F11B7ABE49A38334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948693, "uuid": "26e5fa5d-1fea-45dc-82aa-cebc8e0dae84", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaf:sXyWSpV+Wu7rI3JE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948693, "uuid": "a7be80d6-19ae-41fa-9328-38448935d858", "value": 5898240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948693, "uuid": "110ecd68-580f-4ea8-b86f-e6cae94fcfe6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948693, "uuid": "c5af69a9-2b12-428c-ae9b-bf0a2be1d4ca", "value": "e0c8ba2ee944ced70e259eb253b030485e77223737ca3ee7c1175cec5d95abfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b1ca84-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948854, "uuid": "ae84b574-c71f-4b5c-afd4-42dca02fe49d", "comment": "Malware payload", "value": "963fbd27f59c9aa767a6409a6cf26954", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948854, "uuid": "98e46f70-9193-4e62-a9cd-a2286351c080", "comment": "Malware payload", "value": "e17da92a1ce2ae3505d0f4a9fadd070deeda6185baddd16959224c3bc765b57e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948854, "uuid": "1c4816c9-96e9-4ed8-aab6-0f51438b1f01", "comment": "Malware payload", "value": "3373971ad0ed7887a14e8c3ac93b53873351fd4c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948854, "uuid": "648f595a-9c00-41f0-9239-3caf18503941", "comment": "Malware payload", "value": "7e4dbe51be17fdca5abecb3139d7d163eb32a8f99a9873a82d11b3b6cb917785892fa86f13c00ca3a8050a9ae3ff593b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948854, "uuid": "c02c2b7c-2091-42e9-978e-c90776a49b3a", "value": "T162A1F750112C1AB07346697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948854, "uuid": "615e565e-5f7f-4e23-a664-aa7f363ec1d2", "value": "96:9RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:9RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948854, "uuid": "5c993ce0-e2cb-4df9-bee0-bc2d3f7cd9e5", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948854, "uuid": "81e420c9-13ef-49fd-8072-c63f5565e1df", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948854, "uuid": "09a57e71-0d68-4979-9987-2c0e09e9b3cd", "value": "e17da92a1ce2ae3505d0f4a9fadd070deeda6185baddd16959224c3bc765b57e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a985c182-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948681, "uuid": "b4046632-33f7-4366-a302-e9848d2600b4", "comment": "Malware payload (Panchan)", "value": "d66d5a3b9442293fff85d5b1f52bab7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948681, "uuid": "35b12368-6358-4353-97d3-16f3067f12f3", "comment": "Malware payload (Panchan)", "value": "e1daee3d91329776a81e2a2eebfdccf59cea9b1e958228666d829156b0ff9f58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948681, "uuid": "7638411a-900b-479e-b65f-ed673b825f72", "comment": "Malware payload (Panchan)", "value": "22e2e997fd8d2150ec351faa2cae6fd722e74548", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948681, "uuid": "b3ce5b4e-3b7b-40c2-a414-99e4d12e2061", "comment": "Malware payload (Panchan)", "value": "c6cb7f7f4eec6f16bbeb4f5b4d81141255872d268f6e1525f941e0badd5662b87f09b919f7920c403cab90f5767b5863", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948681, "uuid": "8516dc50-4a0a-4718-bc47-ae5deb6c740e", "value": "T14E261833A45554E8C2AED574C6256213BEE0389B273423DB7BD0B6E10B76FE49A78334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948681, "uuid": "e0338e3d-069d-464f-ae6b-e7264bf66043", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnah:sXyWSpV+Wu7rI3JEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948681, "uuid": "0160d922-9337-4c11-9c6e-0d690e3a3015", "value": 4685824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948681, "uuid": "60b40dd5-43e6-487c-a6ed-703e529f0931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948681, "uuid": "bd560e8d-288f-4b4d-bf64-0e5261467e62", "value": "e1daee3d91329776a81e2a2eebfdccf59cea9b1e958228666d829156b0ff9f58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10271664-04b8-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657942410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942410, "uuid": "a7da2fde-01fd-43b0-9710-37f75f73e946", "comment": "Malware payload (Mirai)", "value": "94f42e870b47e9a433c1356aa76a6a7d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942410, "uuid": "71d76cb3-67d3-4091-9709-31baf85b37c4", "comment": "Malware payload (Mirai)", "value": "e1fe4cbcf4e8d9f66fb6f9f28a2de34dd34cc25abbcf7cd6b7886e27a3dffb91", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942410, "uuid": "3cce4ce8-a32a-46e6-b61a-72a704e8655d", "comment": "Malware payload (Mirai)", "value": "9e9fe6a230eb00036a2f49b9bd4916f86d6003b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657942410, "uuid": "996677b8-c259-47c2-b454-5417eabf07a3", "comment": "Malware payload (Mirai)", "value": "90fe8339f61b1e2cf754b2eb83bd0d9ad0fa14c6790ea300c55ebc593e83fb1464fd8ab2303e2df8eb092de52d5c9f77", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942410, "uuid": "6f32deb8-88dd-4b22-bfb8-4ba79ba0f288", "value": "T10023F9C5BC41A629C7C09B77EA2F408E33159BD8D1DA37538C181BA4BA8B90F1D66B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942410, "uuid": "9a454fca-0153-441f-bd2c-7734bbc0ee4d", "value": "768:UCQOglr5mcCUsOZO1xRDiHTdMAuBs2JPtkq/yuDz701rBPj3NyytAit61W04pGiD:UCwVm7JOZO1xRoRL0lzU31MlRQaKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657942410, "uuid": "27a57391-c85f-44d1-9233-c87403193bd2", "value": 47272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657942410, "uuid": "912c9ec2-1623-4d9b-af3b-4c5a227252f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657942410, "uuid": "5f16e07b-c778-4bd9-9931-80089b496ecd", "value": "Ares.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3526ed58-04e9-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657963518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657963518, "uuid": "0c47bc98-6ea1-441d-9511-aa51bd0fec4a", "comment": "Malware payload (RedLineStealer)", "value": "8707f03f849d425f5098520ccc1bef2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657963518, "uuid": "b070efb1-49fd-46e1-828a-25700ec2ca63", "comment": "Malware payload (RedLineStealer)", "value": "e20920a7259cabe4f4bbef5bf983181ad47fb8c075d7f32fb53e769af2148521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657963518, "uuid": "ce1958e7-19dd-4fde-96eb-3f5e8d22eace", "comment": "Malware payload (RedLineStealer)", "value": "7ce156435749ae6d65a08e3a48e99504255a0c62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657963518, "uuid": "720d01f8-547c-4dc4-b351-29f389c77240", "comment": "Malware payload (RedLineStealer)", "value": "5ca61dd4e94d2ce6eac0d0f3e0717cbf681404059484f4f96271659c8dbd3c3361602efffef7823be65d3bc0e63cb776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657963518, "uuid": "95d799ba-95cd-4184-808c-a22b04af7450", "value": "T1CA847C8CB91D2394FD1D3F7C151C21859775F6AB0B2022B82ED759CA6F6B9C98E0E4E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657963518, "uuid": "53532f00-9bfd-4624-9048-2e15a7e1a6e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657963518, "uuid": "d586358c-4438-42bc-bce5-17dc2f304c33", "value": "3072:sLHH6IispviIWHVQcZ4C7BaRfuRan9PkM6/o1MCkGGzRsf0JZ84Olq6ogsOaVy68:9IfdWa9ZtkGgsf0b/r95IOv9KI2Lfii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657963518, "uuid": "f9fd6b45-449b-4623-9094-62e52750a67f", "value": 392592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657963518, "uuid": "35c829e2-4211-4290-8fdf-fb1676de84dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657963518, "uuid": "8ee95874-eee3-475a-bc02-3f7914f00d28", "value": "E20920A7259CABE4F4BBEF5BF983181AD47FB8C075D7F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6469de94-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948135, "uuid": "ad0844de-f1dd-4b5c-9c21-d2615bd26951", "comment": "Malware payload", "value": "e7ef88c85e6d7ec802c6909823181a3b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948135, "uuid": "7efd0016-d3e6-4088-b544-c18941d0350e", "comment": "Malware payload", "value": "e2a676e2ee132d388573efbd52164dce81070cb7bfc3df77d533f7a6531527ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948135, "uuid": "2c8999e4-c15e-46fe-9f96-59b65daf3bf0", "comment": "Malware payload", "value": "db174f52afaa71562993367a169d6c6d62caab24", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948135, "uuid": "b4e78abd-8df9-4b76-9e44-84bb62f43798", "comment": "Malware payload", "value": "1bde62cdcb0ddf4cb9ae87debdda5b0c9477f6b1370abc9bb3c66e9bccf8f5ebc3965631a14dc52779c40f5fd97e7291", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948135, "uuid": "3524fcf1-d7d4-4747-ab0b-44e1f5afcc94", "value": "T1E7A1E750112C1AB17246697AD26FFB52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948135, "uuid": "f753b464-95c1-4ae6-8dee-9e76ec2a32c3", "value": "96:2RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:2RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948135, "uuid": "5fd73a54-983d-4bc1-99af-78c243819dd0", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948135, "uuid": "e0f653e2-92a5-4d29-9e2f-24f8ad4a77b6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948135, "uuid": "0e275518-f47f-46b0-b1bc-252384dbcbfd", "value": "e2a676e2ee132d388573efbd52164dce81070cb7bfc3df77d533f7a6531527ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c6f6f1-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948403, "uuid": "65fc51cd-d30f-4eee-b62f-b7cce251aac9", "comment": "Malware payload", "value": "c4228d34a8204f2c632f021f62134b5e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948403, "uuid": "700882a5-de97-4c3d-bf01-03da6530a75f", "comment": "Malware payload", "value": "e2fb79b26fdb441a25b570c0856d86ea781cbf4006adc73dbfe2ea26ba5c9422", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948403, "uuid": "dda62104-705f-43a5-9d67-cca69274df37", "comment": "Malware payload", "value": "56de2d53d859ac295c7ba374968d7224e04ae0ce", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948403, "uuid": "10b2545d-1b9c-4ef6-b9bb-68cfc4401800", "comment": "Malware payload", "value": "c90664cf80fb76bba788e097eea833fda035d7de28cbb54dbef81b5b4ee36b05b8870ed7177ef30de25ce87af8d1cf1d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948403, "uuid": "d95faab3-5ff9-4e3a-84f1-cdb7b413ffe1", "value": "T17EB533B975DE24FD96D8A277A7FFDD28702BA6CD601187A09C7241CE1807231DAD8E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948403, "uuid": "b2e0be44-ff4d-4118-9b34-78211161cc74", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexu:tos909Qg6ecEZHyEexu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948403, "uuid": "495224ba-5bc5-44f3-a377-180b6c5aa720", "value": 2347008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948403, "uuid": "e1e88f5f-dcb6-4960-93dd-592c80945576", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948403, "uuid": "7bb1718d-607b-461e-92f9-e8e076328d78", "value": "e2fb79b26fdb441a25b570c0856d86ea781cbf4006adc73dbfe2ea26ba5c9422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491a2a1f-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948089, "uuid": "4e40300a-ccea-4763-bbce-33730314690d", "comment": "Malware payload", "value": "c4a1c0655924c52a279ad8dc5f459365", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948089, "uuid": "036d1b64-e8b5-4320-a4a6-3cc60a1c5e8b", "comment": "Malware payload", "value": "e37609a7535aa6d624ea852291540707a17ddedb1f96f3e7b1e796942fa69f46", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948089, "uuid": "67e1e93c-bdcf-41f9-afe1-9cb712483677", "comment": "Malware payload", "value": "c78e9e90ba24714b33756ffad7a894b73be9e61c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948089, "uuid": "b83e948c-2962-4e52-9236-57e67d38a4c4", "comment": "Malware payload", "value": "93afd2d52f2dbf3c5ca93b717c759204dbea84538b1425883be31a9664f7a9fa2bb44b0d45af5a14e0c699696ba73587", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948089, "uuid": "14ec5049-3454-4d39-b0b2-879f27f131d1", "value": "T1A7A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948089, "uuid": "814a002a-963c-4bbe-904a-aa1f947d5fd5", "value": "96:qRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:qRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948089, "uuid": "a1942ffd-0571-4c73-b189-c134172e443a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948089, "uuid": "8bb7c393-7066-4207-a95c-d7304c1e0409", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948089, "uuid": "0c442622-ed55-4d25-8ea7-14fa9c7ed588", "value": "e37609a7535aa6d624ea852291540707a17ddedb1f96f3e7b1e796942fa69f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29edc7f7-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948467, "uuid": "57d2e5e1-2446-4b7d-b47b-be08c51918aa", "comment": "Malware payload (Panchan)", "value": "64ef826b0027813e0895ea62d4c360f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948467, "uuid": "96fcb8df-2604-4d0a-8c54-6aeda8f57241", "comment": "Malware payload (Panchan)", "value": "e4c31dbb2d53a046bbab91bc5c0da45eca46e515ff1120f0a845a200279cd719", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948467, "uuid": "95d1902a-c67a-4b49-ba2e-659cccd1c4f0", "comment": "Malware payload (Panchan)", "value": "175c8cf547f4f228bf5a18eae35417d211c87fdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948467, "uuid": "7b302a37-1e9c-4b23-bca2-992df1907463", "comment": "Malware payload (Panchan)", "value": "c67dd2d5b260b69e8867c16092d15a673d618e0d26936bba4f461eeb83fa57f170784f5e88397d9c406e00fb1e688785", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948467, "uuid": "1d4e5e4f-1e06-4b3f-8771-9392b1f6c600", "value": "T19917BE73910338E9E5A98CB4D51425426DAC38875738A3C7BAC871F667FA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948467, "uuid": "9b4f7efc-0071-4137-9707-17f967cb887c", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnao:sXyWSpV+Wu7rI3JEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948467, "uuid": "47c0a13a-e133-47b2-b0de-0575988914b5", "value": 19562496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948467, "uuid": "0b4e2f11-fffb-4a5f-9115-0ff700eeb542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948467, "uuid": "c0969c57-0824-4ebd-aba7-be5d8592a605", "value": "e4c31dbb2d53a046bbab91bc5c0da45eca46e515ff1120f0a845a200279cd719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3190bff-0520-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657987432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987432, "uuid": "738eb902-7ead-4ba6-a7c6-7b5b5584790d", "comment": "Malware payload (Mirai)", "value": "57e81f2850de023a944089fc0499a4b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987432, "uuid": "529d5649-b5d1-4107-be2a-b3213840b15d", "comment": "Malware payload (Mirai)", "value": "e59925744d7c6924a9cf6094393e2165928e770a38c8c05802ad7d43fecf8064", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987432, "uuid": "3a200d54-340b-47c5-bb6c-056687647544", "comment": "Malware payload (Mirai)", "value": "4eb545de7e5c060cc45ec3ce80fe237afd7777a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987432, "uuid": "fcb59f43-e041-4fba-9106-947439c3793d", "comment": "Malware payload (Mirai)", "value": "3dd7e0f6b3194047113ad0647334b5dcde988d24a89a8265c5e1b098c477339b73d85275c24ae5b2e89a21dc80db2788", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987432, "uuid": "628b07ed-9b9c-40c6-80a5-467715e0221a", "value": "T19823F271850E9EF125303C32DA95D7936AE12AB1C6673023C6280A3C6F75A231E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987432, "uuid": "0fd706db-b250-4875-816f-e9ea879463bb", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3F9q3UELbUXfi6nVMQHI4vcGpvT:gECFd+A6YHAxYLRQZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657987432, "uuid": "38a31f1c-adfe-464e-9451-0229ac73c2e4", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657987432, "uuid": "ab1762e5-5892-4759-b039-bb792117f0ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987432, "uuid": "c419d1e7-d5da-45be-97da-d872ac318b24", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c5974c-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948265, "uuid": "6e9f0b99-83b2-4dfb-9527-fa4174b89dd1", "comment": "Malware payload", "value": "3f74fd2da37796dc1fa23c8582b87ed5", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948265, "uuid": "156e6727-ac90-4a56-af10-2618a4267f29", "comment": "Malware payload", "value": "e5d2409fcbc34ba6e69ef5c287c0ef03901e641804e0847844e52d89ac75a90f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948265, "uuid": "add21cbd-5926-487c-8f32-7c45d995af9f", "comment": "Malware payload", "value": "ecb692fb1743f173aa3fa550451ea77d9d7727f8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948265, "uuid": "d2097bbb-1e0c-4bf4-8e6c-0c37c8a40bb7", "comment": "Malware payload", "value": "3d7855a533efc08ef19e66d3bbc14db156d2fbd580a786a5716096ca79f1e2984e5f559dea6c7ffcd25cb58c9fb1567b", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948265, "uuid": "10feb4a5-6bbf-4b24-89a9-9c28a2fe535b", "value": "T1AA2633082261F8FDAC46192C7B7249F0C1E416F1A98129D1CABD5188497FAFF1BDE973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948265, "uuid": "44be03dc-1321-4ba0-a558-712e3dc42ef2", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAFE225K/g+7+k:0XSxVJG2fLAqFOfT9sMYNM29SAFN25KB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948265, "uuid": "0de953d4-1e1d-4caf-bd4a-f97ca58ff2f0", "value": 4558848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948265, "uuid": "6a98f0e9-0dde-4382-8038-4d5192897fe9", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948265, "uuid": "61213941-7c24-41b3-ba9e-d053cd53e982", "value": "e5d2409fcbc34ba6e69ef5c287c0ef03901e641804e0847844e52d89ac75a90f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2dca1e-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948657, "uuid": "e3da0209-6294-443b-8831-c64d9287acc2", "comment": "Malware payload", "value": "c91e4f62f4cf1aaf1051fe3deeb3be67", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948657, "uuid": "8d5fc34f-d92d-4a6f-b960-2119457d79db", "comment": "Malware payload", "value": "e606b7ba8f772c8a76227f13c66bacb647af8424079a2744329fc5fb4a85705c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948657, "uuid": "212731fc-72f9-41c6-9748-bdaed58deb7c", "comment": "Malware payload", "value": "6aa839fb9bae3c6d0f8fa0328d02a6816984bcc1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948657, "uuid": "1efcaa1f-7348-4449-9adf-68ea55964788", "comment": "Malware payload", "value": "6463f1d4a7bc5aa5338b6e01833d96a263b6350ee46a6097f10ed78226ae6f74da1cca7d87a89b6fc9218ee58c5f1c4b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948657, "uuid": "b4eba427-95e9-4887-ad98-1ccfa2a55b00", "value": "T18FF04FCE84516872500ACFADF453C5C01EF6D9C4E5D33E9C35A6416E4C98D00BFEDA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948657, "uuid": "acb80d67-29ce-49a5-b365-8877e96bcb1c", "value": "12:3WKpuKEzKwYfPuKYIKwYfAuK5wYfluK+wYfHv+uKOo4wYfKuKXW8wYfsh:G6EzRYfHYoYfQCYft9YfPWpfYfqYYfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948657, "uuid": "c45e1b8a-1e7e-477e-9abd-70ae60a29a94", "value": 589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948657, "uuid": "a8b71628-5740-417f-9da6-8d92f8ec50b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948657, "uuid": "0bdacf51-e846-4bf8-ae77-dafa9db7283c", "value": "e606b7ba8f772c8a76227f13c66bacb647af8424079a2744329fc5fb4a85705c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9afbba1-0517-11ed-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1657983604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657983604, "uuid": "fb21024f-d9e8-4958-8a3f-ce40f4a00c81", "comment": "Malware payload (CobaltStrike)", "value": "c7058945ae7fe85fec4d60cc551cac24", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657983604, "uuid": "03fe444e-dbe7-4a63-9602-c201d17911c1", "comment": "Malware payload (CobaltStrike)", "value": "e65e6051980701ae9bcd600fd08c7be44f8f299c8ad68d8cbddf704f9757c870", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657983604, "uuid": "9144a044-29ba-459c-a68a-acac45dae29d", "comment": "Malware payload (CobaltStrike)", "value": "03bceec136964f101f5f98ce07da9e1a566865e3", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657983604, "uuid": "bfb61bb1-d11f-4a5b-be0e-3112641e7193", "comment": "Malware payload (CobaltStrike)", "value": "e297c0299436f400f9c96f95fb4feab64541699633c12f38631f74090c0a19ee31fced9097ef36e58712d5f65785f597", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657983604, "uuid": "240f149e-ff14-402b-b3a7-3ca2d2441f93", "value": "T13982D61BA31348FCC916D6B485FB6B32B8B23D5146A1473E337CD6F51F216A02D9EA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657983604, "uuid": "6b4f8c00-a0cb-4760-afb8-0035b30b9e90", "value": "7d68a9be287b7923792fc63f65e9343a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657983604, "uuid": "fc2f7ae0-0cbb-4bac-b1e1-125ea036cd19", "value": "192:e0X9M+VvDVyaLjIy/hZFLKHGGfet4Wv/6Sbz2IpqqDF7FR1DMjjhh:1HVJyawy/h7KIvhhvDZh+hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657983604, "uuid": "35213ca4-8e06-4411-9383-9251b41c132f", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657983604, "uuid": "7d5bf446-8458-42e6-8da4-5f5bbd8216d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657983604, "uuid": "9ef23f44-e284-46b3-9b22-5ba7e62aba40", "value": "lsass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8855dd-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948067, "uuid": "9ae39ea2-99a5-492e-b6b8-d35ff824c537", "comment": "Malware payload", "value": "254d47aa25db8e89bf2b3f5a960f90d1", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948067, "uuid": "ce71ebdc-137e-43cf-97fe-41a93707049b", "comment": "Malware payload", "value": "e685406496a8c5c5037b6f986445bb44efccf22da606cdc00ab0b1b0221cda46", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948067, "uuid": "eaca8395-65ff-4e1b-b2ed-b2d21b7c8d80", "comment": "Malware payload", "value": "cdeb89f46143387bbe22acd75bc8a0c003025d22", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948067, "uuid": "a45bc570-84b1-4b48-8570-e3e2ba31b29a", "comment": "Malware payload", "value": "1e7c26799c326b39073af9d02d361b3c9f89e811dc22568142fc3081c3472a0adb23d1357e570ef2154bffc702be75ca", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948067, "uuid": "99530090-3564-4784-9016-6cbc102308bc", "value": "T15C65339129C016C8E194DD0B2F4C593750B9FF8234A8FAD362F1EAE6120EF95DDD2968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948067, "uuid": "b5b53bfe-5e17-4047-83de-723ddd722ca1", "value": "24576:G1HxKBpxMjuBd5QUP+GDxDQjKS4hoczMEPy0WeTOA/A3l2Ex1hGHqfn8Ru06JN:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948067, "uuid": "a51ae2ad-f961-4007-b068-e77a7842c351", "value": 1548288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948067, "uuid": "f8b18bab-303e-4eb0-8dfb-673c8e552542", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948067, "uuid": "9cf54067-bd12-4283-ba82-64db00ebc669", "value": "e685406496a8c5c5037b6f986445bb44efccf22da606cdc00ab0b1b0221cda46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3437a8ee-04f0-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1657966523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657966523, "uuid": "1376b15a-f468-4fcb-999e-a03d062f6466", "comment": "Malware payload (njrat)", "value": "8f7c7b6d31dc4bc5619cbfe9d5786381", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657966523, "uuid": "bc5245ed-96a3-4cf3-a4ad-f31d4e829dc2", "comment": "Malware payload (njrat)", "value": "e785998924e8c35658287081b0ced485a695c5af56404424be90747e798d1444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657966523, "uuid": "58be3fd1-1dbd-4985-aa42-db2b8c6d8956", "comment": "Malware payload (njrat)", "value": "fd51d23b15d6ecbf91512dab7de368f710f6b91d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657966523, "uuid": "df47aade-4369-4b9d-aec6-b19e61736261", "comment": "Malware payload (njrat)", "value": "2590575b48969290291cdf2469a96542752f706c6d55e5161e14849426664e00ea03599ce125a07fb6a627723733c892", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657966523, "uuid": "8c186d66-ad81-40c9-a044-ceb385b92cd8", "value": "T180A30A097A904018CFEF1FF608F59F2213FDB6C615029C2BDAA8325AB533EE8754B195", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657966523, "uuid": "cf7adb97-6f11-4785-8055-a3852577e59f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657966523, "uuid": "bf8e21b1-1bce-4881-b09d-80bd0dfe5986", "value": "1536:i2oj583jkak+gRJNtD1YvuC1UtUwgw545hZ:7oN8zq+yJ/BYvr1sPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657966523, "uuid": "34aa2dea-596b-45d3-8858-67af38b42df4", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657966523, "uuid": "b1000dbb-276f-4027-b003-f2c7dc8002d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657966523, "uuid": "076b6f6e-86cd-45c4-8dc8-5d8d788b3b17", "value": "E785998924E8C35658287081B0CED485A695C5AF56404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56548ba0-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948541, "uuid": "3f50fc69-ca58-40c7-a2da-7a7e5f85266d", "comment": "Malware payload", "value": "0350de834354d0db50dbed9f9a41b084", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948541, "uuid": "6d2ad180-aaab-4fb0-a452-eba0d61d8653", "comment": "Malware payload", "value": "e7cea44cf6d7ebc4be5b1a4e8b8b210863ac80bbc6fcd4fe03147737892cc6c6", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948541, "uuid": "ea3eeadf-e6f9-43c6-b2bf-3c29b038d38d", "comment": "Malware payload", "value": "1de2e81e6791248931fc64c61c17c80d9e89876b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948541, "uuid": "a39f6e58-1cb4-4427-a6e4-a254715cc562", "comment": "Malware payload", "value": "b295a4bc9c17612dd52935e1ac4e9c61d71fe97ce4fe1467d58072f3f63eee1509e83ddad4df9ea358e457b8bb3d3dac", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948541, "uuid": "d19de256-c2a1-4ee3-b2fd-24f53e26a4f7", "value": "T18D06336CF1ED29FE82A47672E5EAFF30302B65CC706153515CF7E589081A260E4E5E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948541, "uuid": "a37a6e9a-2791-4ad5-8bf6-302561cf6279", "value": "98304:tos909Qg6ecEZHyEexmLaI9MY7bxTE8SV:td69Qg/JFeQ5x7bhE8SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948541, "uuid": "b672b4b4-b7fd-47e6-baaa-10ce9534ea8e", "value": 3698688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948541, "uuid": "92e260d0-027c-4f2d-b493-7663b25340e8", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948541, "uuid": "b97dd81c-a8bc-4adc-9053-2e7e0f7367c9", "value": "e7cea44cf6d7ebc4be5b1a4e8b8b210863ac80bbc6fcd4fe03147737892cc6c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b0f31e4-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657948415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948415, "uuid": "97845e19-c22e-462e-9e16-ebff3e077c2c", "comment": "Malware payload (Mirai)", "value": "72a7e1c7ab3359d17fa4a6eeeafc5837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948415, "uuid": "66342950-58e6-493f-a6f6-15f0935cb63d", "comment": "Malware payload (Mirai)", "value": "e7d53667378a95e27a30892bc1a0a6f85375754fe3f9d15d31b261e757122408", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948415, "uuid": "b37fa761-ab3a-44fc-b897-6b46fd22f581", "comment": "Malware payload (Mirai)", "value": "aa6dd14fea4a8a85dd847da3a94c8590ac6335f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948415, "uuid": "e1599af1-7f3f-470e-8b93-393590c05627", "comment": "Malware payload (Mirai)", "value": "0465db14354961c068ae129d00a8d50138c84f9fc627f34f1d1a9d9257790d1bfa6c63f26401b138faafc20ab5936707", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948415, "uuid": "b15fe638-30f2-42a8-8b8f-49135d9934c7", "value": "T10A831880F5DEC4F0DC126D75402E77569BB67C2E983C9A2AE3E5BA90DED7910F0A420D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948415, "uuid": "99cb6727-485a-4237-96b4-b1d3cdd27ea8", "value": "1536:CxglGVFdh5ZM/HCj8F9+BC90u2ru3PIfNH4qOB06GrZ9gBbX14oZp/OZPpsw6D0T:CyQdhXM/28F9+Bru2ru/cNHDOB06s9wK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948415, "uuid": "f6f3fc94-0672-4c60-b606-9294fda991c7", "value": 84336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948415, "uuid": "69b30cd2-481f-4926-9d93-869b15a3b702", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948415, "uuid": "10082c1e-30d2-430e-a66d-45a174c44f2e", "value": "e7d53667378a95e27a30892bc1a0a6f85375754fe3f9d15d31b261e757122408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66f2c45-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948380, "uuid": "99f72e55-507f-467d-9895-e6f2d318f082", "comment": "Malware payload", "value": "9ece8be5aba4dc99b0d76d1eda94f916", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948380, "uuid": "bcddaaed-099e-438f-b52f-a7d0d7708e34", "comment": "Malware payload", "value": "e831d46311767be6531bd9eb6f8395d1b5ff6d4d3f6ebc5fa0fc0da4a2f9eb13", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948380, "uuid": "376a9cc5-19c9-4065-a21f-5659f2e93677", "comment": "Malware payload", "value": "531e22dd2c17cc8c825ff09ab4f6f1f82e821b8d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948380, "uuid": "655a880e-f9d4-452e-9184-b2713bbfb243", "comment": "Malware payload", "value": "4232bd3cfedb26db66d32f98481282a600781c478548dfd59246441d0096b6acfafc31602e144e044b6ad898e79881f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948380, "uuid": "7e2127f2-ee2a-44ec-87da-8ea60acd0adc", "value": "T1A3A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948380, "uuid": "cf542423-d9c5-4258-8e2a-7e3d3b550dc4", "value": "96:sRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:sRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948380, "uuid": "d738315e-93f2-46f2-9e6c-1f70c70b40b0", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948380, "uuid": "c439b3b5-8de3-4d89-bc6b-bfad15007954", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948380, "uuid": "1062ea9e-d6b6-436c-a063-2817338550f6", "value": "e831d46311767be6531bd9eb6f8395d1b5ff6d4d3f6ebc5fa0fc0da4a2f9eb13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19cb961-0520-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657987430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987430, "uuid": "fb836910-fafc-4bbd-91c5-9645d8ff6c9c", "comment": "Malware payload (Mirai)", "value": "5fc663ec78c4a0e2f6c91afea5fdaa9e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987430, "uuid": "f966bbd7-bb8b-44b9-880b-a3239d038987", "comment": "Malware payload (Mirai)", "value": "e8536b89fd0da24c2f8d9cc14a4575d9513f595e8d647f570228061203d93938", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987430, "uuid": "028c680f-8200-4126-9f25-a84f947ab593", "comment": "Malware payload (Mirai)", "value": "c37c693c196d6871992669cbb55a6b3098ce2aa2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987430, "uuid": "85a86605-fe7c-4ab4-b26e-e836712d7d90", "comment": "Malware payload (Mirai)", "value": "ca44ed42cb71683d4766c431de3cc373ff39ebe81e8951684e784eb514499e5f72a5f100ff885ee9ed936a37a24cb17e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987430, "uuid": "7babda4b-7ffe-4798-83c6-a6afa78d9f44", "value": "T175A2E17DFB34C18CF446847E1957167B065FF8A247A8430EAA15D0C702C39DEA49EEB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987430, "uuid": "a5caba0f-c7ab-461d-a77e-5dcab7ca2c9f", "value": "384:UDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chJTNifHhBJhpExUC03uhHB3QJmRxKE:UDZ5Dw7RjFjcU+O24sDSNifHhrhpEguj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657987430, "uuid": "b46bfa72-73ce-4f7f-831f-e0c1d2e0d328", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657987430, "uuid": "5ed77c4c-1e79-41c4-a27b-e4202fe6750c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987430, "uuid": "945ee100-faf3-47a1-b661-d3e0a1939556", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ffa354-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947848, "uuid": "e70b9258-fc10-42f1-b1de-2b6308f36a57", "comment": "Malware payload", "value": "c88436c955f849a1fe9acbd359baff04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947848, "uuid": "67865a83-21ea-4553-badc-c0786303c79e", "comment": "Malware payload", "value": "e8614c0aadf0f7d0db829bddd30bed61deae3634fba5d2fadd2321280efc6ae1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947848, "uuid": "c2fec48c-5171-4722-a22d-682355fa3a50", "comment": "Malware payload", "value": "c4ab02b693d4f0a6ee384a580b43288fc3976b0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947848, "uuid": "01236e2d-fdf8-4ad7-9a7a-bd9e3e0e0506", "comment": "Malware payload", "value": "537e0f7f5729d2d9d27dce39eb5502feacacc535078a5d67ba8faa4aa51a2ae32a41cc98a2c5275b2f295be03dd3cba4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947848, "uuid": "6ca000a6-1d67-4018-a0b3-6410c98d055f", "value": "T15445F657E89590F4C0EFE134C766A213B9A13489473437E76FA18AF11B26FE866BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947848, "uuid": "b6e1221c-eef4-4d6f-8664-405e6e96cafe", "value": "24576:cqfwj1QylLAE1phLrb/T/vO90dL3BmAFd4A64nsfJvWSIsWW1jgbzqu:cSk1vGE1pFrb/T/vO90dL3BmAFd4A645", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947848, "uuid": "22ca3d48-075a-4f10-9dd0-598b78b108dc", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947848, "uuid": "06392a81-fc5b-434d-95a4-f94c23922645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947848, "uuid": "499237aa-dde8-472c-80ee-a96d7d593e73", "value": "e8614c0aadf0f7d0db829bddd30bed61deae3634fba5d2fadd2321280efc6ae1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4836a013-0557-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010795, "uuid": "8435363e-4077-44a8-a8b4-7f5677d04fa5", "comment": "Malware payload (Mirai)", "value": "682bd59db24c2a124c18b683c6e0eece", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010795, "uuid": "1b016f27-843d-4537-8cb3-ecad337b112a", "comment": "Malware payload (Mirai)", "value": "e888e8415a3650d34f14751a6668c8beeb5e15d6272c057cd132024e1b5535ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010795, "uuid": "29936c36-e6d4-4c90-a077-cd224c23d319", "comment": "Malware payload (Mirai)", "value": "cc96124f0cdff54a91f43e628151e74a41ff9973", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010795, "uuid": "5e584164-0392-452c-b14c-71808e949d48", "comment": "Malware payload (Mirai)", "value": "3dc4b7f2c3d9a4a70c1da95618d66a26c18f3d42d02851d13bf6074360543eb4d061387c650d17059b4c0d592fbafc91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010795, "uuid": "7b91d4b8-7ab4-4fc8-9b0e-52f56e223f1b", "value": "T194434B02326C0E47D1671EF52A3F1BE083AFED9011F4F585264FEA468276EB7514AE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010795, "uuid": "30f71b97-13cc-4e87-8647-920e51e2e169", "value": "768:lGqPyX5IgPpazFGORFTWkV/QK/O/zuk2SSSufl08B8J6FZve6ava1/:HS5qzBN4y/BtveBv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010795, "uuid": "f786faa3-8f38-49c3-9d48-955cae36237d", "value": 58588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010795, "uuid": "c643d105-3860-4ab5-9a8e-e10b9aad4577", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010795, "uuid": "5bebd96c-49ef-4cfe-8f6c-4206f65aff48", "value": "682bd59db24c2a124c18b683c6e0eece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3dd7f24-0520-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657987433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987433, "uuid": "3a900671-110d-4fed-9b6f-328af16977af", "comment": "Malware payload (Mirai)", "value": "af12ab862a955cb405f56c26161bfb71", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987433, "uuid": "5d49199d-6863-4b8b-809d-3a3ca3b779c4", "comment": "Malware payload (Mirai)", "value": "e8c518175239d95460e39389533427f519ffcb33706aa008a64bd86cfad1b3b1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987433, "uuid": "7c8ffc8c-ca99-4b3d-ab29-5d7e9fc86f53", "comment": "Malware payload (Mirai)", "value": "b516d7bde4d04c6b18c5b51898539746555f13b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657987433, "uuid": "e2116ea3-bf66-42fd-922b-bb9185550068", "comment": "Malware payload (Mirai)", "value": "431e7475292aefdcec157bdd875f3a728aa18fafd398ae3e1d89115234bcb9a21c50c9dded946a4777c11454d9037f88", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987433, "uuid": "f4084d5d-e42d-4fe5-a051-5a04c8a9f5de", "value": "T14CA2E1257F1DD98FCC37A27886E5E5C252D17D30D29C85866781C12BABA36886C34E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987433, "uuid": "e38927c3-9382-4e83-9ee0-ecabffdb7c49", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtoQSyu:M98o08kxofBE+ZkXaT47C2Epitocu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657987433, "uuid": "5a20fcc7-dd21-470d-b6b6-34f24e6366a2", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657987433, "uuid": "dc9e0d43-5e77-4caf-8269-c3e204bbce16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657987433, "uuid": "e0e2e360-f2d9-49f2-a889-006c7164f6ce", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c3c139-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948626, "uuid": "4913ebfc-d5f5-4483-b376-3bf7aa9fb065", "comment": "Malware payload", "value": "7eedb01373b37777c6dea110a62495b9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948626, "uuid": "4a914ec0-4efa-4b06-87ae-2c36ecf164d3", "comment": "Malware payload", "value": "e8d61bf239634f5409061cbfefb3088d7a87da31a7b3b5953a88480bec45c084", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948626, "uuid": "18004b9e-50a5-4d5a-b137-7286b54c63f4", "comment": "Malware payload", "value": "13f8aebc79a51246efaeb1bd398620a1e0a5eb53", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948626, "uuid": "726bfa21-9e71-4998-9f8b-7e63931aeecb", "comment": "Malware payload", "value": "99e761829a3aee9bc00b94d54f75d2e585be8150e000037a90d70525989a18ae7ef0a7bf3f1103c116f66602ccd8179e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948626, "uuid": "c1c9630b-39a7-4d20-b159-bfaaefbfadce", "value": "T17BA1E650112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DA8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948626, "uuid": "9749626c-3b34-45c0-8238-9e73684cb847", "value": "96:vIRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:vIRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948626, "uuid": "f21e43c2-133b-48ed-a5e3-6e0f0c18d291", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948626, "uuid": "835b8849-20dc-4b22-8712-06c282a0c3f4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948626, "uuid": "95a12dc9-8660-4b1e-a33a-e6e65827dd67", "value": "e8d61bf239634f5409061cbfefb3088d7a87da31a7b3b5953a88480bec45c084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978b3637-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948221, "uuid": "3b77cced-e277-49e1-a283-559e0edac415", "comment": "Malware payload", "value": "9dc46caa0bf3d5628f5dc219318ab53d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948221, "uuid": "b34318c5-25f1-4838-a4f1-cfd81d86d736", "comment": "Malware payload", "value": "e8e48a0d7c5d6453395be192f7e33f579545b0c9b9c23c1dc73328c1fc10daa3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948221, "uuid": "32d9f53e-16a1-42fe-9867-a5baf8e9cf91", "comment": "Malware payload", "value": "3d31e0e70beebae983396bb517dac973de36436a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948221, "uuid": "76920179-1704-414b-bf93-ce4eb63f7af4", "comment": "Malware payload", "value": "5ac62be5b210b178da8e2e6a8a15c6557de7a2e1c0588411d3535026b4988af451feca79baa0b5cfa36705f6b2a81de5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948221, "uuid": "f5571c08-4b0a-471c-be32-034debd96d86", "value": "T1E9A1F750112C1AB17346697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948221, "uuid": "77c41482-92a4-4bfd-9d8f-eb7d8a152091", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948221, "uuid": "1579bcce-5e9c-4262-b85a-ef27073f570b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948221, "uuid": "b4d4a5b3-47b1-40df-a992-0c450eb409ac", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948221, "uuid": "ae650e45-0401-4417-990a-e3edf58be11d", "value": "e8e48a0d7c5d6453395be192f7e33f579545b0c9b9c23c1dc73328c1fc10daa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a9ce94-04f6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657969070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969070, "uuid": "b8ab4608-5ee2-4508-b5e6-43c87f699ed1", "comment": "Malware payload (Mirai)", "value": "de6deda6e60d4ad9b381bcdc087c0d5f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969070, "uuid": "c0fb2e22-e0bb-4650-bc92-6f6e9f09cdc2", "comment": "Malware payload (Mirai)", "value": "ea254d1312e2c82795c3ba57c408fd63acab8f381f8f9f78b16ea6b8fb9d4fdd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969070, "uuid": "58babdcf-10e7-4a57-84e9-5b35f1925eff", "comment": "Malware payload (Mirai)", "value": "e4e8303b6bac03318fac0921ab1a9d9d224fd661", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657969070, "uuid": "f4fad5df-d1fc-4c12-aa61-ede91f56e4d2", "comment": "Malware payload (Mirai)", "value": "aad077880f3a4f612784bc2867e6cd53976c78cbd5e6bac6e3961d6ee9910773923ee3b8b0549fb3e8a59e8ac4fd64d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969070, "uuid": "8aaa2c38-be10-4c1f-969e-234e0808cabb", "value": "T146332AC4FA8B85F6D90B883040A7F53FCF32D9798070966DEF9AAE35DA33502D215249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969070, "uuid": "c0ecc9b4-4537-44f5-bf56-a63054accf78", "value": "1536:hLCn0/kOMJQxgfmCcxjOMG9YhN1GkLQYWJJn4:hLCnfOMJQxgfm9i9Y1GkUFJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657969070, "uuid": "739c0718-61d5-43ca-bb18-9477014f9d64", "value": 51024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657969070, "uuid": "4429c506-25cf-4d99-acca-2cee83ad11a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657969070, "uuid": "16bc2518-9167-4a19-a533-5e46c6e30465", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6908707-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948729, "uuid": "bcbc91e3-92d1-4871-86de-abad986ae57d", "comment": "Malware payload", "value": "a00790da1e15f0c9e28d530b613509f0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948729, "uuid": "b3127ebc-05ad-4abd-9f0b-786821be7ee2", "comment": "Malware payload", "value": "ea4ba0bca9db89e29da6d99c5a35ef7d8e55e2578c1e47189bc04589770139aa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948729, "uuid": "5a89d287-627b-43f4-a787-8e96e8ae1765", "comment": "Malware payload", "value": "f144369486974f253bde84ac59c95f2fbf02e350", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948729, "uuid": "236cf69a-4fe3-4733-a49f-2347beb35b72", "comment": "Malware payload", "value": "4d8768074bfe8ffd0144edf63514e5a0e666d2e29705f8ad177682e339878487c579748fd00651458e59b6ed52564461", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948729, "uuid": "65a02259-d5a7-4098-aee9-e9e99799d8a0", "value": "T1F1E0C22EC50281BFA0548979FEEEBA58B50E229A038A022859BD51639CF5C98604513A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948729, "uuid": "b903ce98-f651-4bbc-8e47-a660f3a4206e", "value": "6:/QEpN5/3NRVYn4XQo3F5kJVKE6LsVKE6NiVVNDV2uVf6v9yR5:/QqlRq4ALg5sguTh4yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948729, "uuid": "7d969e38-4fd1-4444-8088-d7a4aa5b150e", "value": 300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948729, "uuid": "33514683-b198-4853-8ea3-679a28130353", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948729, "uuid": "940300f8-89a7-4477-a508-c2b46cf9bb57", "value": "ea4ba0bca9db89e29da6d99c5a35ef7d8e55e2578c1e47189bc04589770139aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb2ff69-04c2-11ed-93bb-42010a9c0043", "comment": "Malware payload (Phorpiex)", "timestamp": 1657946970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657946970, "uuid": "8e8eba9b-642e-4c33-96c9-9db58ecf510e", "comment": "Malware payload (Phorpiex)", "value": "5741eadfc89a1352c61f1ff0a5c01c06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657946970, "uuid": "b510ef7a-c4c2-436d-b920-6478d460b1c7", "comment": "Malware payload (Phorpiex)", "value": "ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657946970, "uuid": "79c0022a-0c3f-4359-9c77-14d02197da18", "comment": "Malware payload (Phorpiex)", "value": "cdff6ddd67f17385f283a0f9e8de76731f11a9b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657946970, "uuid": "91533283-92c6-4ac7-b5f4-d554e9242e7a", "comment": "Malware payload (Phorpiex)", "value": "a0c74cfde904b175ac08d4cfa739d4569361d93050efb73345b0da57f3b258e3205c92c098cb513cefcc84af4152692f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657946970, "uuid": "6a78dea1-a16c-47b6-b62a-406c91b22511", "value": "T143732910F6D0C03BF0F740FBD2FB05AA592CAFB4134698EB52D9A89B5B215D1B936463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657946970, "uuid": "8df19a4f-a440-4229-8a65-656bbd136e83", "value": "2f2316fb946682a102e453a8ae405904", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657946970, "uuid": "7c54d98d-fa15-4222-b509-5edcb7ee686f", "value": "1536:03Mz8GuoohIUXrtvWhzNmgrZBVnWw7V15FvV:vwGu/XpOh5mgrVnj7V15Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657946970, "uuid": "b17e2bb4-2903-4838-aaa9-26eabfbdfde4", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657946970, "uuid": "c4074a79-fdc1-43ff-8051-7d73178c0b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657946970, "uuid": "ca81f1a7-e4cf-4cbd-9ad1-0740ae042554", "value": "5741eadfc89a1352c61f1ff0a5c01c06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d128a6-0557-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658010863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010863, "uuid": "12c0e7b3-364b-4cf6-9c29-16e911a89914", "comment": "Malware payload (Mirai)", "value": "a4ae7bc5a5320618fe9d799732b0e609", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010863, "uuid": "56ec304b-4f3c-49ca-9ca6-702d43cd1355", "comment": "Malware payload (Mirai)", "value": "eac278560fae7b9b2940cb3af18698ecc6f41c204d06351e2ae48b9c21694c61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010863, "uuid": "3e8bf62d-c21c-4776-97c7-f512eeca6ac9", "comment": "Malware payload (Mirai)", "value": "093912e15ce41fe5e8ecb4bf28e91772758c92ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658010863, "uuid": "47973cb8-4cdb-4e3c-af8d-0c06e81cc274", "comment": "Malware payload (Mirai)", "value": "70dcad70f58213cfbf9512edc96ce27b75710b5af9940e4381b0b2ce1fa793178266a8b01b84c6b824249dc3c01b9651", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010863, "uuid": "222a6cf2-c09d-43d1-9d47-6b944a5ad4ca", "value": "T19D83E895B8C18E11C5D413BBF92E018D332267A8E2DFB2179D206F147BCA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010863, "uuid": "90a370e6-1bf3-47b6-ba88-215190fc6ae2", "value": "1536:uRnabgUZLKq/zB8dAm5UhNTzeRGq1SM2b/co71Tki6N17GKPw5e5O995LZ4cOIke:VgYLp/t815YNPeUqoMS/cg1ApNJNI0Kh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658010863, "uuid": "39f6bbf2-1771-45fa-bd7f-3641fae266a8", "value": 83244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658010863, "uuid": "eb50eaf2-0172-41ab-817e-771df3e0a27a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658010863, "uuid": "6a79af41-ba8a-454a-a35b-d050322c12b9", "value": "a4ae7bc5a5320618fe9d799732b0e609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4168c302-04db-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657957526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657957526, "uuid": "dd465332-c80b-4e59-824e-157ce2480694", "comment": "Malware payload (RedLineStealer)", "value": "1b83d860e32bfa8bb29e54d97bb99c4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657957526, "uuid": "8b22c4e9-5664-47d8-8b53-b826b0bf8d91", "comment": "Malware payload (RedLineStealer)", "value": "eb8c45aaec0a251b71ccb773360ed939171de7895157f4a3ca981dec1fa217d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657957526, "uuid": "fea5e828-4b01-4ef9-b83a-00c963aa7ebc", "comment": "Malware payload (RedLineStealer)", "value": "b8fe0366f812029cc581f67863806de44b4552b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657957526, "uuid": "b6f8215c-aa18-417f-b184-82e41f8909c7", "comment": "Malware payload (RedLineStealer)", "value": "75db8fb9f2542cd8ae51e3ca431667261d681df0d5caae10a2aea0112b5225e54c815d4a99fe5992e09c56175da4c937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657957526, "uuid": "f5279cd1-8e23-4f5a-8b58-307e3520f177", "value": "T15C94BF10BB91C434F4B712F485BA9768B52E3AB09F2454CF62D96AEE57346E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657957526, "uuid": "878f1d79-ffed-480e-b678-ebfaf4019ac1", "value": "149733ffc6fb8cb84df8287483828e3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657957526, "uuid": "5a8e2e47-436a-4b75-a6ed-287b33c7e2be", "value": "12288:+isI9NEYNmRSIZpt6w58XOML0a3N5d7wS:zV9WY2Zjk995p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657957526, "uuid": "7f0a3e78-0da0-4fb8-8efe-25cc5adce7ab", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657957526, "uuid": "23e7e05b-3b94-463b-840c-8a740f48f3ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657957526, "uuid": "3e240889-131d-4b46-bf89-0a60bd62fa5c", "value": "1b83d860e32bfa8bb29e54d97bb99c4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4fa65b-04dd-11ed-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1657958428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958428, "uuid": "493acd87-a6cf-4e27-a2c2-fc682d98a921", "comment": "Malware payload (njrat)", "value": "546b77e5690bff4b92ba4b8147049c21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958428, "uuid": "2b23dad6-4f3d-43ba-aa3a-c343ec8d57a8", "comment": "Malware payload (njrat)", "value": "ebe23c279471c00cb0c3ed550ae69450a59c8cdf3b1e04bf7efea65198843eaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958428, "uuid": "a605ebf0-38e4-4625-a96b-cbecef2525bd", "comment": "Malware payload (njrat)", "value": "15b79a4a9335e260d866e0084c58e90001e3ec2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958428, "uuid": "17d32fa7-d20a-433d-b56c-14b313278a71", "comment": "Malware payload (njrat)", "value": "d78ee99eb6c548726fe6c3c092925eb9cf404e4d89e6b4f2d65b8914c45d51b1e5b6695a57474c2b0d16764381fa9c34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958428, "uuid": "551f298b-f2e3-40d3-8fca-a7ed1c7ac7d1", "value": "T10875D1CA17F8785BE9895732E18C7C0AE29179416E51F2CB0F7935EA8D32DE90D1EE04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958428, "uuid": "6c2ea3f1-dfb6-45d8-8843-575703b87c93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958428, "uuid": "af925b82-da9a-43be-960d-281b4133c889", "value": "24576:m9o3z8r2QTGzC5U4WgunIxNS22rzENi2Bh3jLBO8X6ZZu/vDfdrXJWpkJE:mepe5UKun81cE3P3PBOm6Z+drXJWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657958428, "uuid": "647bff2b-e685-4bb5-86e4-a392ea1378b1", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657958428, "uuid": "c2216ae5-e624-4e91-88a4-541e25e58399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958428, "uuid": "0167a669-8ca2-4dd6-b673-16bbe7f08ec4", "value": "EBE23C279471C00CB0C3ED550AE69450A59C8CDF3B1E0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d802903a-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1657947900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947900, "uuid": "910f2ba4-cc4e-4bf9-958f-a58b03a33533", "comment": "Malware payload (CoinMiner)", "value": "3aef38df318c7803b0eadffbb7baade8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947900, "uuid": "4e096edb-f787-43fe-ac4b-841738819b11", "comment": "Malware payload (CoinMiner)", "value": "ec0945ca5ddea7363439a2f5e9499453bcbf3cc5bcd3f466ccae8623aa7983f4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947900, "uuid": "a1b9b307-8642-46d1-92dd-82303317b353", "comment": "Malware payload (CoinMiner)", "value": "1d3fd3afc183d196ab96f78c728b4a73862edec3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947900, "uuid": "4cd513cd-01af-4384-8984-261f9a44fe7e", "comment": "Malware payload (CoinMiner)", "value": "4a11f0c80e260df6f82fe6c42caef3ff2678c71704aea248c66c4f2b51f775520f086a75c2e4f5ab0a358cbdf0e0a568", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947900, "uuid": "2e3f8a9f-fc05-4aa4-8034-581c85a98fe3", "value": "T1C73633492362E5B3CCB3530F5447689B3AB77BDC60BD8D634CC0B6C24A89136FB496A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947900, "uuid": "024dd75c-f781-4367-8fb2-cd0dd3964a82", "value": "98304:q13V3a0rqRIZ+wrvNoGRtKzIVLplxsVmHOx+IK4Wpi5WVHpC/tBYVZpaLEu:q13V3HrqR4NlEzIJprsVmHUWkQJC4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947900, "uuid": "607f788f-36ec-4bf3-88f5-fd084a2203a0", "value": 5341184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947900, "uuid": "07945784-5528-4033-b1ce-d623bafb8436", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947900, "uuid": "96a23c45-3ec5-484d-bf7b-f43eb6b17ba7", "value": "ec0945ca5ddea7363439a2f5e9499453bcbf3cc5bcd3f466ccae8623aa7983f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98770d8-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948332, "uuid": "bc8d9b36-b9c5-4f0a-b2fc-b123bcca1752", "comment": "Malware payload", "value": "4609364888fb5ca130092fdd2446de2c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948332, "uuid": "bbde3ada-a494-42aa-ae12-ef1229990172", "comment": "Malware payload", "value": "ee3803260853413dcaed91a37836d9407738d7700c89ec992c705927aa5fd1b5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948332, "uuid": "73fbb4fc-1167-4c34-8098-8bc4cfe308c3", "comment": "Malware payload", "value": "6cf431373aaff95034c3d35e80ffd6705182506c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948332, "uuid": "aca12f0d-002f-44c8-bcc9-fd4438344854", "comment": "Malware payload", "value": "e33dd61f2dbf79ae80031c326110316e7a95e67c3547f671f52c037f912a0b346202ccb6a78c5f189ba1c5d02ec82664", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948332, "uuid": "0f3fb9d3-0406-4a57-a302-48dc1b25f64f", "value": "T156A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948332, "uuid": "5e49aaa5-a730-4e69-b54f-16eb613b8a6b", "value": "96:ERYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ERJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948332, "uuid": "c756c6f6-4fc5-4568-b4db-91751decbf7b", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948332, "uuid": "793b37d2-06a8-4961-854d-3a3dd36842b2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948332, "uuid": "cdc149d3-d532-42f7-ad0b-4562a021ebb4", "value": "ee3803260853413dcaed91a37836d9407738d7700c89ec992c705927aa5fd1b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc1bb1e-04c9-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657949735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949735, "uuid": "831fa1d9-f9e0-4376-8ea5-0958e96b92d5", "comment": "Malware payload (Mirai)", "value": "29168042be65670c48727fc2de894462", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949735, "uuid": "644940a0-fb15-481d-9cc1-0d28c9c52f2e", "comment": "Malware payload (Mirai)", "value": "ee8561c1921fdd502a7a836dfdb85cfab3e51acab5acaf009c4eb3bde573ad6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949735, "uuid": "328bb5e6-9b5a-4134-80a9-a52862c8b4a6", "comment": "Malware payload (Mirai)", "value": "326f5f1e5e6969812e3e6898516d2a1998d8edb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657949735, "uuid": "aa09fa9f-da24-4b05-a8b8-90fbb43925f4", "comment": "Malware payload (Mirai)", "value": "0b316caee3e467a4d7f720e683b12d1ee06505e692ead8a0b6d062ce7e707ff23d17e8c2a3dc458ef3fb6b5c9bf5ba10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949735, "uuid": "fdf82cf7-4e8b-43ed-8c03-d20add63fd7d", "value": "T134A32A05F9118757C1C327B6F78F47493B3167B997DB33026A34BEB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949735, "uuid": "35ea6f1e-e492-4ae5-85d5-600f0164e6ab", "value": "3072:7e9h9oZs5hvFfKufS2faYj0+rQ0Knm4XATe:y9wZs5hNfKfpYj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657949735, "uuid": "1f9636fc-02a5-43c3-8aa0-3edb2f7c3390", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657949735, "uuid": "4776cea1-9a60-4b8f-9584-d31e27ee8c74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657949735, "uuid": "bbc9acd2-335b-4e5d-9810-d5e564e04705", "value": "fuckjewishpeople.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f976a36-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1657948852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948852, "uuid": "ee8f423b-683a-4871-8aa4-ee30289e238b", "comment": "Malware payload (CoinMiner)", "value": "162ac84580841050d4dc57df3412221e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948852, "uuid": "3aadae2e-319a-4333-8fb7-630b2600b8b3", "comment": "Malware payload (CoinMiner)", "value": "ee9ba63c8a2449b46825dcb6302b0ad08e1052646b4a2adf87a956d520e75bf3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948852, "uuid": "8396d9d8-a97b-4916-916f-5f8442eb95ee", "comment": "Malware payload (CoinMiner)", "value": "a1ba4ec1b5adfe8ba3487e7d1b3f096991584ca4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948852, "uuid": "7ab59bd1-68ad-43fa-ac90-571d64bc6efb", "comment": "Malware payload (CoinMiner)", "value": "4561cfb30759aac9c78b98fd0861b46f8a737e0ff0b9d6fbe972abba70a5392953626d114023b02333503f750264c643", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948852, "uuid": "1c921a91-543e-44e7-bca4-68627ecb408d", "value": "T17C86339C51E97C2E4144DD7402E6DB12B5771ADFF1A2CB02F46BD91B1C0E332A8FA5A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948852, "uuid": "25855f21-6eb2-451e-b3ba-c8b7f2ff32f8", "value": "196608:td69Qg/JFeQ5x7bhE8SSdP8v+nV2BpA8lOkbnKj6EQiUL:acQ59Gd6P8vIoPwkbnuQiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948852, "uuid": "ad3cfafd-37a7-4ea0-a02f-9355c46582ca", "value": 8101888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948852, "uuid": "98d38421-0013-4563-8615-fbdf0d49833e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948852, "uuid": "2fdede07-b942-465c-bd56-62a950e83202", "value": "ee9ba63c8a2449b46825dcb6302b0ad08e1052646b4a2adf87a956d520e75bf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bddd7c9-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947987, "uuid": "89904ef4-1d87-4935-a577-1c4338f27f10", "comment": "Malware payload", "value": "08c5c5e77e704e9d3b5b5e357e53745f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947987, "uuid": "ba0a251c-7ebe-4410-86f1-67c345918ea7", "comment": "Malware payload", "value": "ef008fc13c112a397953e8faaf088482984544a0621667f095cb19db2825be35", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947987, "uuid": "b091b486-b2d4-414a-ae87-fec29c7effaf", "comment": "Malware payload", "value": "7f234ea32d5f9efa134f34ecc87674db06aa8344", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947987, "uuid": "64192b5e-7c93-4797-863c-7a6134011d08", "comment": "Malware payload", "value": "52859552b25aa5397bb7fa6b84d8db4004919d4781fda99509a870e28534026e0a31e3700b8d801dec3e829e1f3604bb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947987, "uuid": "d6128466-2a71-4c82-9437-f190c1a91fc0", "value": "T11B1181E816716063EB065E8AB253914871EFE2DE76CBCE24B8356F3340DA9007DE6794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947987, "uuid": "d2db55ef-7034-43df-bc54-a69c6eef0c37", "value": "24:3J7puwAsjxyp0Ohe2FL9hID5x2thO7K4vnL:tjeXID5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947987, "uuid": "9e845911-76a8-475b-b409-9a85ef0b9c9c", "value": 1046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947987, "uuid": "5b9aa63f-93bc-4f4f-b9b9-f596fa967558", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947987, "uuid": "53b2ea88-57e3-404e-ab52-4cefac76367b", "value": "ef008fc13c112a397953e8faaf088482984544a0621667f095cb19db2825be35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4762b884-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948516, "uuid": "e9441190-2532-4d5d-bc09-2bec5c744b98", "comment": "Malware payload", "value": "4830d24952de354103b7dced46e335f3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948516, "uuid": "756521f2-2bf0-43fe-8562-583ce8b76ab5", "comment": "Malware payload", "value": "ef8d6bbece58c8ebdb5d9e5723ed64c6545c3f2ee98d6f1bbbdb45a2b7fcd759", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948516, "uuid": "9b888723-1c36-40e6-bc7b-d4258bc00ffe", "comment": "Malware payload", "value": "85c94418ee8440e015fef80c2b7e7ee8361eb75a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948516, "uuid": "e116fb6f-b828-4fc1-a9e1-a71a75e398bc", "comment": "Malware payload", "value": "909649b376de2319b4c1edb3b7efab488f7bbf8b7bc8b37b611b275aca254101fa4cbf6638b5c7c84bed13cea9db181b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948516, "uuid": "d47fad01-fd86-44e1-a232-e0601daf2533", "value": "T12FA1E750112C1AB17346697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948516, "uuid": "ccc45b9f-dde4-48f5-9f53-17c7189a02f3", "value": "96:eRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:eRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948516, "uuid": "5de7812b-a900-4494-9309-7b1b046205a2", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948516, "uuid": "ff13bfff-80be-4ba8-a528-e968743f94f3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948516, "uuid": "65f5a7c1-f271-46ef-a0f9-94ae4cc54cd1", "value": "ef8d6bbece58c8ebdb5d9e5723ed64c6545c3f2ee98d6f1bbbdb45a2b7fcd759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da918ed3-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947904, "uuid": "1c70600e-4d62-4ff1-81b9-30d0e3d53aba", "comment": "Malware payload", "value": "9eae4e81a211ecaeb432d4a86e9f7e02", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947904, "uuid": "64cb7a49-bc8b-4a93-ba91-4ac50847b53d", "comment": "Malware payload", "value": "efc3bea6cad161bba677152d64a81672c0615e56f2ef0b958fb65f99b335e26c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947904, "uuid": "c78afa53-32a6-41a9-ab0f-eeb99441a00f", "comment": "Malware payload", "value": "1e7a48191d5214cae22378a191794064ae6ea84d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947904, "uuid": "c3761a93-d1a2-4999-afe3-e79fb15c4ef5", "comment": "Malware payload", "value": "ab72f5930c3140dc903a8224ab5ccfd53e258dab15eabfab9f511c6d3b900c54469305fb91cef9e168ddf99c3d09ffe8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947904, "uuid": "acab0fde-e625-45c4-9721-96d7e74102b8", "value": "T1B2D5330C03BAFCFDF89E052927238DD5C5E951F0E48255A2DA2819981C3F5BE179FA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947904, "uuid": "cb254919-0624-4bb8-b2c8-22d71b9f6cd9", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4H:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947904, "uuid": "dc34b283-4264-499d-90c4-6205f13020bb", "value": 2891776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947904, "uuid": "0ed5eafa-f005-4ffa-841e-b687eba6ea1f", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947904, "uuid": "97f789a2-e91a-45ab-b58e-23fe83927429", "value": "efc3bea6cad161bba677152d64a81672c0615e56f2ef0b958fb65f99b335e26c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947205d3-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948216, "uuid": "3d402e60-65c3-42e3-90c3-355080ae34e2", "comment": "Malware payload", "value": "4565e450fdaf9b0cb0ff750930d78201", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948216, "uuid": "90bd7e0d-153a-4e6c-a232-b819072d02a3", "comment": "Malware payload", "value": "f003714377d740d5ce158762761d017a3fdd1ac9e41dec251676d5aacd38d4fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948216, "uuid": "623fbc90-fd8c-47f2-b9fe-e0565b03be49", "comment": "Malware payload", "value": "b989165cc2e5b8ab2324114b8ae7eeb287f6a930", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948216, "uuid": "419a097e-82a7-4656-ab59-40635abdc254", "comment": "Malware payload", "value": "87a95d5693af528cead03710642412f80e4766a67729e62603762980efe1c8b63f31aee0400adb901f7257dc3bb57498", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948216, "uuid": "8f8f46c2-46ee-4547-9391-52321ee506ae", "value": "T1CCE012CD40069CE251428F4CE80384805EB1D5C7FDC3355DB26A495E8C40C40BFBD68D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948216, "uuid": "efea2512-bddf-4012-97f8-bcb5b6f41ec5", "value": "6:SXkUuKnsC5fQzTYJfmkUuKbYXsC5fQzTYJfmkUuKcVVbXsC5fQzTYJfmkUuKcVbE:+uKswYfY0uKRwYfY0uKkV4wYfY0uKkbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948216, "uuid": "ce58b74e-b73e-42af-9db0-93ff9f30a2cd", "value": 381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948216, "uuid": "93178d15-1b4a-449b-8a73-f9dbb2bd4925", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948216, "uuid": "9d0bc334-6a9e-4755-b4e8-65c992054cad", "value": "f003714377d740d5ce158762761d017a3fdd1ac9e41dec251676d5aacd38d4fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1961e9c2-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948009, "uuid": "920c73e7-4f8e-465d-9298-36048f88a246", "comment": "Malware payload", "value": "df13050cf224e96ca2a0075f51fd28ad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948009, "uuid": "4c23e1bb-6a1b-4fbd-acb2-bb8e53cee5e5", "comment": "Malware payload", "value": "f0640564280e68d069435830c49c8ea19ee27354cc1d62ae24ba478fc23dd878", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948009, "uuid": "3c575aed-acc7-4c19-b915-8132805aabdb", "comment": "Malware payload", "value": "01ddfcbefbe5a04dc42e1d50188b049abac2993e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948009, "uuid": "385fa12a-97a3-4b8c-8e55-80b8b412e453", "comment": "Malware payload", "value": "0ca994813cc00e459840fb8b23268639dd3f9501406d0edeefdebf1dd5baa01907bbbdd6477493a77c7fbd4b0966d684", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948009, "uuid": "68c1bd94-5ae9-480b-a2d6-7934148be5a5", "value": "T145A1E750112C1AB17346697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948009, "uuid": "9c85ba24-c666-4839-9f41-75f10d8459dc", "value": "96:/RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:/RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948009, "uuid": "6ffd5fc4-f606-4394-abb1-196e48114a9e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948009, "uuid": "fe5382c3-f08d-4d7f-952f-52cf283cc9d3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948009, "uuid": "326e880e-7904-442b-abfe-e5ccea3eeae6", "value": "f0640564280e68d069435830c49c8ea19ee27354cc1d62ae24ba478fc23dd878", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9d7f32-0501-11ed-93bb-42010a9c0043", "comment": "Malware payload (OskiStealer)", "timestamp": 1657974026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657974026, "uuid": "41fcbec2-68e9-4134-88c1-d3e76dce31a4", "comment": "Malware payload (OskiStealer)", "value": "2a66e1def724a506b4a456a573b76c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657974026, "uuid": "7702f369-4ce1-44ee-9667-f3628c3c4342", "comment": "Malware payload (OskiStealer)", "value": "f066b22440bc1fbf1d336c95531d7966ed2c6a0e21db7479d3eb7e61364a32e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657974026, "uuid": "86bcf067-62d9-4ba8-a2c5-e207ed2a9319", "comment": "Malware payload (OskiStealer)", "value": "ae8ea73f5754b4ca8a4ccf727e8db152c20e800f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657974026, "uuid": "4909f0da-ef4b-408a-a15e-ca9d3caf252a", "comment": "Malware payload (OskiStealer)", "value": "bf4dc54683a2d771a7f54f54512293afd1368699c2b0d5ea14c4e938e4176260ba64fad55ddcab2a56332331f1678994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657974026, "uuid": "9af673bf-0acc-439d-80b4-0c0de48d34d6", "value": "T18CE402207BD75589C33ECDFE282E520B767DD38C644DD2D82AA459B6203342AC7F66D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657974026, "uuid": "22d864a9-9aef-4f7d-a8bc-00de6eb071a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657974026, "uuid": "9a1ce977-244a-451c-bcaa-12e4acd33cef", "value": "12288:4+ixnF2pnDyCqlI6u4UJ6N9TY2jfuj8WSh3av8b1VDZ7eHEQC1Xo7D4JB:4TF6qlFpNLuARdaG1TSbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657974026, "uuid": "cdb83a16-c67e-4a6d-9f68-49e09e200563", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657974026, "uuid": "2986dbdb-6dfc-4072-ba4d-e1449370d283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657974026, "uuid": "b9438ab0-e126-4bab-a64d-0a92d165dad4", "value": "swift 6748.26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1bdd37-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948843, "uuid": "81dd96d2-97c3-4763-b701-5b9b553d4b4c", "comment": "Malware payload", "value": "912f9aeca8b23733db1545bea20871f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948843, "uuid": "716c27e2-ea39-4d1f-8804-4c9168396916", "comment": "Malware payload", "value": "f0a888ca7a0d7421ef819e462f04983ee781dc5095872d44b44a4ca731c62ce7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948843, "uuid": "97fea2c7-07c3-4e3f-b41c-782a475d7a7c", "comment": "Malware payload", "value": "a8a835228ff072fc55a7c424d724e6d09886866b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948843, "uuid": "298a5eeb-a8d2-486d-b049-378dd4b75b8d", "comment": "Malware payload", "value": "f523bcdc766f5c71cbbc733ca786ba3391dde2701b195670621ad42049cab2be85e010a5feb01e5bb8c89a1049cf1896", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948843, "uuid": "f79ccdd5-8d13-49d2-8171-b47ba6f1aeea", "value": "T18EA1F850112C1AB07746597AD26FFA52B40ECC1B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948843, "uuid": "ab06e765-3dcb-4253-bb9c-846b9fa68ca5", "value": "96:URYZxQOBpLyxIcymLKY8M991wuIaQPYPW:URJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948843, "uuid": "2102f8d5-d844-46a9-860e-2c9a96a744a0", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948843, "uuid": "c2762a2e-20ce-4536-9b65-a649ebc470f8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948843, "uuid": "f5b502b0-f240-49fe-9725-a0981117c785", "value": "f0a888ca7a0d7421ef819e462f04983ee781dc5095872d44b44a4ca731c62ce7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fb5825-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948354, "uuid": "6bf9403f-00b0-4fb4-8908-7941326a3e9c", "comment": "Malware payload", "value": "d5b3e0358f010810ae5ca2ebb7c0913a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948354, "uuid": "1a0215c8-4c62-47eb-9457-d1a334087eda", "comment": "Malware payload", "value": "f0c40c16c73dea72679945d1a9ac8eaf997ac1845362f755aebf2345bc04df63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948354, "uuid": "d7aa210f-34a7-47ca-9c76-a26439cba7a7", "comment": "Malware payload", "value": "c088ef5cc1c39a50f8281f0c6af471431742432b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948354, "uuid": "1fa7a540-6f01-49dc-936f-dbace8a0f2ff", "comment": "Malware payload", "value": "da07cb0ad57f293cc158a4dbf8daac4e05964e23614149b6ec03f842a2c8e6dcd7d5b10ec9d2b0a4ec15e68298ebeaee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948354, "uuid": "9d0b7aa7-9992-4036-a1c0-9e81cea62f8e", "value": "T164766B73905664D8E1ADC974D51422127EE8384B673863CBBBC476F51BBABE49E38330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948354, "uuid": "40c7d553-4e95-45d8-b2b9-4a30f7df0ba7", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaH:sXyWSpV+Wu7rI3JE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948354, "uuid": "53d0f1cb-7bdc-4ab2-890d-295863288cd9", "value": 7667712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948354, "uuid": "d7c4518d-3541-4a02-8a13-57a41087e71f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948354, "uuid": "3071875d-dbf4-42f1-9ff2-f802a3a17f62", "value": "f0c40c16c73dea72679945d1a9ac8eaf997ac1845362f755aebf2345bc04df63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315e1a8a-04c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657947191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947191, "uuid": "48233107-fd87-4981-a4ad-857eb2d8eb3e", "comment": "Malware payload (Mirai)", "value": "e04e47ceadeaa19260239c1c316b04a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947191, "uuid": "1cc54fbb-cd93-4ea4-82d7-0c156e12d1e3", "comment": "Malware payload (Mirai)", "value": "f0d75d3207f0772c6bef6fc3815b823e786a21b973b090066af5b42cd10fe694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947191, "uuid": "b1e11f30-d83a-4a7d-9520-4706fee5a193", "comment": "Malware payload (Mirai)", "value": "0f9d5f4503a83ddfafc5b0c5e00f163eaa963d14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947191, "uuid": "4d82561c-835a-410c-a218-0a13fb1ac3cd", "comment": "Malware payload (Mirai)", "value": "cfaf247282d019231da354eeb5e7bd9c10dd318825c35543570ae602151f5df0cb42c313022ed536403e7de53b05529c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947191, "uuid": "a046939d-0cbb-4398-b426-1800fab17f82", "value": "T199B3BE9BF74B2691C89347F007C78B9D6F2322119F57D5F76C0E623A983A2DE490A781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947191, "uuid": "3f3a99e6-f231-4525-9961-2f5b0ec8a4ae", "value": "1536:+uFRcYq41hqBG4Nogqf9wDE/JEWhCr+BdgBoD/LWW:+u/Z51IRaFwDjWg+BdgBoDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947191, "uuid": "9a54cbb9-c0bd-410b-b690-bd1e92194553", "value": 107808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947191, "uuid": "fd7e7cc9-6b55-488f-b803-27cd943c8a26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947191, "uuid": "92791d91-da37-4333-9417-b101aa15c6e1", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1e4694-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948556, "uuid": "7e8c3402-ad5b-4367-8995-dbbc657a1573", "comment": "Malware payload (Panchan)", "value": "8f47a2e1a789a29aaadec734c9c470ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948556, "uuid": "3518a2aa-2622-4a41-ba9f-6d30c28e3f34", "comment": "Malware payload (Panchan)", "value": "f0f8e00d31c75e753f79d3dc29f8c6207890f4b62bb10a74049415b862cf1c21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948556, "uuid": "8309ef59-396c-401a-a539-48ca38d40d63", "comment": "Malware payload (Panchan)", "value": "06c253e189a2f265bbeafcd9d142b5a646047b74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948556, "uuid": "0b3e2ca2-2308-47f6-a6fb-4850dc6af21d", "comment": "Malware payload (Panchan)", "value": "f71729c9317d9b8f589c4f38d5cfc65a857191baf283ec3fc2ddff56a9a937bbc232ce8f5dea6a9000451b71ded4dff1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948556, "uuid": "d5112502-b7a3-4adc-ba83-820c63f2519d", "value": "T15DD68C77910238E9E5A98CB4D11425426DAC38875738A3C7BAC871F667FA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948556, "uuid": "05d3948c-1e8a-494c-9448-9c02e26278f7", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVna0:sXyWSpV+Wu7rI3JEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948556, "uuid": "40a411dc-1fa4-448e-904d-fa9b9bd73003", "value": 12812288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948556, "uuid": "5bbf48fb-c8e7-49be-8a8e-726806ac9bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948556, "uuid": "70eaea9c-4eea-4459-bb12-6999705125f3", "value": "f0f8e00d31c75e753f79d3dc29f8c6207890f4b62bb10a74049415b862cf1c21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc03fd1-053a-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657998613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657998613, "uuid": "7548c727-4916-46fa-a264-cdff97f55e92", "comment": "Malware payload (RedLineStealer)", "value": "00194ef0c8ec1c04fb9965e80f1aced6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657998613, "uuid": "79f7f6a4-91fd-4697-8860-6d5842e636b3", "comment": "Malware payload (RedLineStealer)", "value": "f288d2fdaec7ef0e7051dbda9a9693b866171481194009c3ac04e07e2eb9c8b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657998613, "uuid": "4f089d9a-d329-49f5-ba5d-23ba40607991", "comment": "Malware payload (RedLineStealer)", "value": "ee1fa845ad50af81573395cb161a7c10192a9dd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657998613, "uuid": "85f26e81-a7c8-405c-aa2b-88c6c728f509", "comment": "Malware payload (RedLineStealer)", "value": "94c40aad82dcf4e8fcd01ef048a34b5ea00e64179899f88d42bfcde81085ffbe526d9dbf32536c6c009ea8cf216e64dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657998613, "uuid": "9624e5ac-5b80-4541-95c3-75c33774abc0", "value": "T18764DF1173E8CB32D1D20E30453CF6A06A7BBC516935964BF394BB6E6F7039166BA312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657998613, "uuid": "24fe194e-d62c-42a6-80f2-07aa10b9a672", "value": "fc0913c2ba6d5448152827702e238f32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657998613, "uuid": "8428543f-de96-4919-9b21-0fa01d539462", "value": "3072:hka4cFbGTSmBv54RRxfM9eYnwtMVpQycy50ergCDa27BQMEzCuxAJSpR+Cd15j9v:vJwYRRxM9e3FybNakCVjsEZW7iga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657998613, "uuid": "6b382ada-9af8-442e-9433-4d5ad3bb5cf0", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657998613, "uuid": "20e1b805-27d4-494d-8df8-3a269105f116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657998613, "uuid": "93ac62e8-af2b-4b40-866b-bf705ad62931", "value": "00194ef0c8ec1c04fb9965e80f1aced6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32363aa7-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948051, "uuid": "134eafe4-b9b3-4a55-a682-e85af76bdf03", "comment": "Malware payload", "value": "2ddfd05941decd301ebe1472783d8ab7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948051, "uuid": "b02dbc29-4fdd-4068-8674-42425e95a8ab", "comment": "Malware payload", "value": "f2e5b686ca5f910547ab6cdd10c638501ea3bb1ddba6c8056beb77f4cea4fbe5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948051, "uuid": "10aa1b20-74f2-467b-a9c5-d673cb520d72", "comment": "Malware payload", "value": "e9976ccd77c542bfa5a0a108082d2f98e5c5a588", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948051, "uuid": "3bc9e1e3-a327-44da-be1e-826d1403c497", "comment": "Malware payload", "value": "5216fff27aed8980ad08360b358e31e69d1633f2aa0c2bed2fec558cac4fe4f66ccdc9551f7a5ab7d895d9059433d085", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948051, "uuid": "f8499e3f-f26a-4003-83b3-8f73227190d7", "value": "T18FA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948051, "uuid": "79cab56d-dc0d-43d6-a898-1edd8595602b", "value": "96:BRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:BRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948051, "uuid": "ff7f22ff-6fff-43f8-b050-f62aa722739a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948051, "uuid": "6bcc95b7-f131-44e8-a500-fbdc86f07080", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948051, "uuid": "aaf91128-4f33-4b49-abe1-7804afac5c55", "value": "f2e5b686ca5f910547ab6cdd10c638501ea3bb1ddba6c8056beb77f4cea4fbe5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f8496e-04c3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1657947227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947227, "uuid": "6a757074-3d60-483e-b4ea-b3b4007cba36", "comment": "Malware payload (Mirai)", "value": "e15b6aa450a263f88d9f90a2d9b967c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947227, "uuid": "8a1f3307-567a-4ee3-b40f-0c57516a1244", "comment": "Malware payload (Mirai)", "value": "f38b1d363b457db0507208ea6f229da94c6d8a2f49f808e838295d3b76610b0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947227, "uuid": "c1c1c4e0-0a7c-4e67-9474-a3bb99ee5126", "comment": "Malware payload (Mirai)", "value": "f0bb3e99b5f277c0dbad23b35e18b35d79ec743e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947227, "uuid": "ab6ac9c3-13d9-4b3b-bf9a-bf36bfff2316", "comment": "Malware payload (Mirai)", "value": "569b8c307eac3a02deeb57f34def50e14aebd1c6e99ca0a1b6a4812c6245f75743cd1deb4162a1a14e73d7381118fe27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947227, "uuid": "fb082106-4acf-4b0a-be15-be4697091ffb", "value": "T1B7339D66F4682AA4D4460170606CDF3E5F23EAD1E7836DF313A986B214079D8F84AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947227, "uuid": "0eca87e8-802b-4be9-87f8-45d251e8f620", "value": "768:2Ng2/iSXkKcwKYMr3Q6Uqp3svOdlfsmc+QCrtoq9Fa5ZCGtsikZY10Uv:2Ng2/FkKZKYdEdIR6iqCvCGtWa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947227, "uuid": "26498435-d9c7-498f-abfb-6403afa6c3e9", "value": 52052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947227, "uuid": "8d296784-ea02-4975-a14f-b49e64fd46c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947227, "uuid": "5bbbd492-0417-457b-8d9b-b4cb39267048", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4f0bc3-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947852, "uuid": "73e36dcf-1d46-45e7-8af0-c6e94329a15d", "comment": "Malware payload", "value": "1d60a4967ecb2de3846a47215232142d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947852, "uuid": "dca56c61-2f41-4111-8dc4-da28071db262", "comment": "Malware payload", "value": "f3be3b8cb86bfb5836b4d4987777efb891040d80532888d3eacb9fe61572b262", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947852, "uuid": "ed65f60e-e5e5-4f92-aa83-3cac0f38ecda", "comment": "Malware payload", "value": "cb3f08345eee6af5a28c20812c722c83ceb5ead7", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947852, "uuid": "6345e50d-5042-40fc-921d-7454feb22d32", "comment": "Malware payload", "value": "b36df39142a1a92e170f762e57c3fc285acaee0cf85bde73cd8c716c09ab56160c33d4a280c2617fa9b239eb73acfa66", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947852, "uuid": "771ec971-1904-4231-8ee5-385203025641", "value": "T13A55330821F77CC8E9AF053536631C88C3BD62F2D459B09A3188489616776FE539EAFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947852, "uuid": "002928c1-1f83-40cf-b8b8-b631072e5a89", "value": "24576:IVbRYvjxOgOhntwZIdc/th82I0uDkbekANJLLT1mtPQwNDk2XD1h2s:IDSOgOhntWID2I0WkAfMtjNA2zT2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947852, "uuid": "65017fbc-958c-4918-86c6-d78b4f88a034", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947852, "uuid": "8c072a1a-e82d-42c6-aef2-9cf3bfa37447", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947852, "uuid": "fe2c4981-eb3e-4fe3-915d-86665a16933a", "value": "f3be3b8cb86bfb5836b4d4987777efb891040d80532888d3eacb9fe61572b262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccebb3eb-04dd-11ed-93bb-42010a9c0043", "comment": "Malware payload (Renamer)", "timestamp": 1657958619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958619, "uuid": "d76612e9-ff8a-489d-838c-4a720a0a0616", "comment": "Malware payload (Renamer)", "value": "b00b880cb831f3208dd4f237d16ba9f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958619, "uuid": "883f0e7a-e557-4369-86bf-abfe1ed93d31", "comment": "Malware payload (Renamer)", "value": "f3edd2cfe677d588db70b71b318a884b4551c3e9ccfb49d3c49665a48e9e4fab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958619, "uuid": "2ce5148c-6561-453d-a16a-48fa6b5d13e9", "comment": "Malware payload (Renamer)", "value": "e15f9a70d1d62f8c4127c8c12741ea1f5d14d168", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657958619, "uuid": "d3b5f369-bce0-4766-8ecb-bfcf9cfdb2b8", "comment": "Malware payload (Renamer)", "value": "b5523dedffa9e69637696aa379ce19664773498652f047fd5a9d14b61d4b3dedc6280364c20f5f6fdab945ff473a8c5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958619, "uuid": "f90bc3a3-7c2e-44fb-bf3d-385bfc67f740", "value": "T1842363E17B5C8326D65F41FBF68400BA17B64A33A3A3CB6DC8E69D75DC033409A2159E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958619, "uuid": "5a29c63a-d316-4a54-a3b2-22b40fb55d87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958619, "uuid": "5c50e3de-c284-41e0-b53e-f7eb99992c57", "value": "1536:oH5YvEFttx+5PUCjTOHZ3vGsx9vfXMLK/:oHRH+hU6TOHZ3vGsx9vfXMm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657958619, "uuid": "11d45c62-e3d3-4177-a617-543d4e7f405a", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657958619, "uuid": "b362e90d-a501-4c00-b75d-58d9a6981dfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657958619, "uuid": "84b45ac4-60ac-4555-b999-8bfd5f3781e5", "value": "b00b880cb831f3208dd4f237d16ba9f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae4dd31-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948844, "uuid": "266e7478-5c11-45ac-9ea1-4afe64bd1439", "comment": "Malware payload", "value": "fa3bb5fb421033dfd463912ddbe2a939", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948844, "uuid": "0b3d6f77-97a4-402f-bf12-f3f800a02326", "comment": "Malware payload", "value": "f44a6e01738ae0f5cef9a210d035a3f514a5b9b898ce69b37edb6708813ba2e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948844, "uuid": "7c8fa3c3-cbe8-4248-b792-54b27de94989", "comment": "Malware payload", "value": "ae25a5090af9a1a86a2434a09daedebd2e94e906", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948844, "uuid": "0aba37cb-43ea-438e-8f96-a0ebc58574b8", "comment": "Malware payload", "value": "f82419c001406439de5484536f44e4b7395af503b97067885339aa8e0b1671505cf44ffffdfe64881bd362aa41663011", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948844, "uuid": "d8468044-31d4-41ac-a085-422e6c80e7e7", "value": "T17CA1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948844, "uuid": "569d3ad8-2317-471a-80e8-99e8ad53524c", "value": "96:rRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948844, "uuid": "d5e69a23-cdd9-46eb-bbbf-884ef32abd79", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948844, "uuid": "b349b022-74c8-4aa7-a36c-b5658fc6dd49", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948844, "uuid": "12936635-f66b-458d-a9cf-fd976743d34f", "value": "f44a6e01738ae0f5cef9a210d035a3f514a5b9b898ce69b37edb6708813ba2e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f56e3df-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload (Echobot)", "timestamp": 1657948046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948046, "uuid": "e4f7c332-ad5d-422d-9887-159b4fe00add", "comment": "Malware payload (Echobot)", "value": "7541bac3d47140ba1c1a66ae8e535934", "object_relation": "md5", "Tag": [ { "name": "Echobot", "colour": "#970C7D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948046, "uuid": "d02f2afc-01fd-4c2c-a53b-d9d41af03e0c", "comment": "Malware payload (Echobot)", "value": "f477ef4bd15abb3a2f2bdc8519c10b34bd9b5447a3d7b21b6a9f79d97557fea2", "object_relation": "sha256", "Tag": [ { "name": "Echobot", "colour": "#970C7D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948046, "uuid": "a9640a79-eeb5-4d68-8676-a13c9a51dc76", "comment": "Malware payload (Echobot)", "value": "5c78e1410252b4c5ed0653d636ef7f84570822b0", "object_relation": "sha1", "Tag": [ { "name": "Echobot", "colour": "#970C7D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948046, "uuid": "4c924eb9-56e3-4230-b81d-fbbcfdab7c66", "comment": "Malware payload (Echobot)", "value": "983151c7bb373bbde16f0689e68c9d17328842c773d54dc36ee209cccece8d70ff3a63e338a74f5ba68a2c4880a73e1f", "object_relation": "sha3-384", "Tag": [ { "name": "Echobot", "colour": "#970C7D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948046, "uuid": "e83b64da-665f-4074-865e-e4141f7bb123", "value": "T1C493B61E2E25CFBCF79D823547B78E229648338A26E1C545E15CEA015EB034E741FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948046, "uuid": "7666dc31-4b8d-48bb-ae63-8ce6de2f847e", "value": "1536:iK/QR3WWT0Aca6I10QhI8dLDZJET2A7Kbxas+4xtON:ve37TPL/ZdLNJlA7Kbxas+aIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948046, "uuid": "0cc93d4a-cfae-4e59-ade7-8e19a5f41e6a", "value": 89692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948046, "uuid": "2e19db27-0b97-4cfa-a192-0b6eb25268fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948046, "uuid": "42dbf367-3624-4faf-b2ea-07bbbd100d11", "value": "f477ef4bd15abb3a2f2bdc8519c10b34bd9b5447a3d7b21b6a9f79d97557fea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7166b20-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948301, "uuid": "108adf81-08f5-48e8-a787-cff40ae5d943", "comment": "Malware payload", "value": "7d00e0eed4501ee6ba7f37f2140c26f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948301, "uuid": "a5f528aa-dd82-4eb2-b909-f01526ab4473", "comment": "Malware payload", "value": "f59ab26104f1271830dc1c413cd5a3e3d5af910b520226202c01737ad1f5de18", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948301, "uuid": "0f1c48d8-d2bb-44de-b473-4a4d09f3a555", "comment": "Malware payload", "value": "f7874926818bd04d8b3185efe545146e4cfed133", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948301, "uuid": "683db39b-bdd7-487b-947a-6d76ddf411e7", "comment": "Malware payload", "value": "296632000e48cb2e16f492a9dc27959e51b7b8fea94029fa64a4376014d7f500885f966787ff06d869cd32806645ad66", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948301, "uuid": "50c12483-9c6d-49f2-8850-65e14331ed4c", "value": "T17CA1E650112C1AB17246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948301, "uuid": "38e41030-8cad-4922-9213-4697ff2692c3", "value": "96:tRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:tRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948301, "uuid": "72e9e6f3-399e-4c2e-8566-cb222df93e38", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948301, "uuid": "20e5674d-09ae-4f51-961d-78e5023ca659", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948301, "uuid": "d0cdf5f8-5bd9-49f1-b510-aae6badafe89", "value": "f59ab26104f1271830dc1c413cd5a3e3d5af910b520226202c01737ad1f5de18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3512f9-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948710, "uuid": "e0ba00e8-ff75-4eae-be61-5949449c88b2", "comment": "Malware payload", "value": "768d24699f9c3bddffa5e4cd0d428b6f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948710, "uuid": "b70556eb-7ab4-42f1-9d49-903453285bc1", "comment": "Malware payload", "value": "f5ca79f590ada95b27c274a95da62490e4f0f69071ed60d62b3509430ccad1a9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948710, "uuid": "2ac2ce0b-b13f-44a8-afc5-4283760f21d1", "comment": "Malware payload", "value": "e00a617be872d373f066962eb9d231482d0c7650", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948710, "uuid": "cce12731-6e7a-4d8c-bf3e-1ed4e41ceefc", "comment": "Malware payload", "value": "cd856bf01afb3e9e35e342665b31e44cd5f27009398c10b422aac2389ea395edbfc581df1f4fdba82c242af15ed6efd8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948710, "uuid": "b9705f75-5e4a-498b-88e5-3af753bdf3fe", "value": "T1A892B53AAF61DCB00954473DF6EE542D5FDC044B0CB645A8B00EDAAC8F6DC5DA98834A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948710, "uuid": "80255c48-5b94-432d-8241-0e4846160abc", "value": "384:fGosGrHFHsv1TDKzHwMH9OHMbH75UbGcjpp:f3Sv1TDKrwc9eMD75Ubjpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948710, "uuid": "7c284450-3a09-4147-8615-92d81497e8de", "value": 19567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948710, "uuid": "e16b04fe-49b4-4443-97c7-762bb5925b02", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948710, "uuid": "7c8bf4f3-b9a8-438d-a0b8-56a678cecf8e", "value": "f5ca79f590ada95b27c274a95da62490e4f0f69071ed60d62b3509430ccad1a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36d5f6f-0515-11ed-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1657982735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657982735, "uuid": "c35bff63-d0df-4e61-9910-7871aaf9fcd2", "comment": "Malware payload (AgentTesla)", "value": "b1564f0f2d78466e6dfc8fa1b57c9613", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657982735, "uuid": "c2419fc1-ad85-489a-a2d7-8d050a058dcb", "comment": "Malware payload (AgentTesla)", "value": "f5e23cbdcbf36965b01e53f19105eeb7edf3c7a2c68aaa320fd666d19c193f32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657982735, "uuid": "be5eecde-ea69-499e-b33e-0bb2df4807c1", "comment": "Malware payload (AgentTesla)", "value": "14a7262a8fc27cf37fe09ec05236245e66f1b378", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657982735, "uuid": "83cdbc04-0970-49b7-954c-f112ebec0fb6", "comment": "Malware payload (AgentTesla)", "value": "36adff29ead198e30b979d270a697958c5e33de0bc3d4a57fcc4abbe07cc9ce8c7cf78a9f831290ee859897dc8ee7b13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657982735, "uuid": "1f7f929a-a5a7-4014-b482-3ac285e487df", "value": "T14BD36C2036E9C02AF1B7EA75C9D8A5F2A91EBE36E202940F14523F4B7733541DDD193A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657982735, "uuid": "df401f2d-8394-40d6-b17d-362009bc53f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657982735, "uuid": "87b71071-2a9d-41a7-9259-9d9255891886", "value": "3072:RwWP20M0zdwaGBU7wfNtJcZ6n4XNkR8zawX5kMsOxylt:7/zdw5YwfNgZ4R8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657982735, "uuid": "8005e096-822d-4a4c-a6c0-ca81115799f4", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657982735, "uuid": "d477a3f8-1c46-4fe0-860c-09b1a4df20a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657982735, "uuid": "2902e88c-7847-4148-9de6-ef7f4b7b3a9e", "value": "F5E23CBDCBF36965B01E53F19105EEB7EDF3C7A2C68AA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2cb2fc-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948093, "uuid": "35330cbe-ccf8-4427-8d99-5a2a9b430547", "comment": "Malware payload", "value": "af7f7ea96bffa716406b3736dc6d564d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948093, "uuid": "a376e4d1-fabf-4652-b9b6-4c0238f4adbc", "comment": "Malware payload", "value": "f610cb4a58e74e70c28eddd8d115784324579cd897fb85313de6825f91f0094f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948093, "uuid": "347522bf-afa5-4a7f-b19b-13a7abf06bb2", "comment": "Malware payload", "value": "00651edf8592bde7ca64f4c772a8c2196f5ef927", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948093, "uuid": "9d7022c4-9e87-4137-b615-027056f5cd3d", "comment": "Malware payload", "value": "cc8f8d2fca842514a0cc345e862ef6ebbedfd6933a7fa3eb22104488293a9fe36fc4c9cb120b60f682a4c53e798bdebf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948093, "uuid": "7f7b8df2-e78e-4c43-8d14-feee989a8b3b", "value": "T1F0A1F850112C1AB07246697AD26FFA52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948093, "uuid": "bdb5460f-a6ad-4d7a-9b46-082b3e48347a", "value": "96:1/RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:1/RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948093, "uuid": "86858586-b21a-4798-bf64-e9c6c23ca16e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948093, "uuid": "b6e5eebb-0b16-42f3-9626-1ab57c1a1ca6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948093, "uuid": "cdfd093c-3224-4ea3-96d9-9a1134cbecb9", "value": "f610cb4a58e74e70c28eddd8d115784324579cd897fb85313de6825f91f0094f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475c2425-04e4-11ed-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1657961401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961401, "uuid": "dcf5a021-c683-4328-957a-a41575001e53", "comment": "Malware payload (NetWire)", "value": "59b5570fd782ef0503a49fd7470200b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961401, "uuid": "0ad98450-acfa-4d3b-be24-9907992a9d82", "comment": "Malware payload (NetWire)", "value": "f621b17f07a862cf0dd4c87aaef881dc2a39e36f73900025169aa34c99d0a650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961401, "uuid": "bc027909-9f5e-4574-b45d-cade52ea33f2", "comment": "Malware payload (NetWire)", "value": "1738e6b2ecb79b85e950a9734469404002cbb195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961401, "uuid": "f0ebfa32-e04d-4ab4-b7ae-16432c2b02f4", "comment": "Malware payload (NetWire)", "value": "316a303df4262a6a0380d9f11818dec312cc8b62ffabbd4650002d8665f72b2ccd08513ae1f03460ace80820e5047457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961401, "uuid": "e9e376b7-33b3-4e04-b9f4-7d264b18b1df", "value": "T11973A6A215DC5295F6924ABD9C24BB30429F6D6284F267EEBBCC7393CB731D102533A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961401, "uuid": "d684072e-eea6-4d49-a758-6e00f3a8a10f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961401, "uuid": "20fcd6d6-309c-46dc-9a3b-cf5a362ec380", "value": "192:3mIEiyFI2IabrE/wYTqzOjmTeuQsMllqAPoBrUuC:3bEi8IabrEIYe6jmSwVAgBrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961401, "uuid": "7e40572a-f4e9-4b01-b6bb-775b68d72928", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961401, "uuid": "a9559749-8728-4afa-8dfa-fec20eff79ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961401, "uuid": "08591eb3-672c-47cf-836e-555f3b3eb816", "value": "59b5570fd782ef0503a49fd7470200b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51441e04-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948103, "uuid": "f6f28423-9766-44d4-8b18-c5129899ea50", "comment": "Malware payload", "value": "067a127329af7d53ffc1cced003566b0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948103, "uuid": "19f858e5-f4f6-4ea3-ab79-1d92070e2e52", "comment": "Malware payload", "value": "f73bdb6aefe849aa79b4ad4f0c5b25146bd045fb4ecd53b666c251ee85c6abaa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948103, "uuid": "1dbe64ec-a0f3-422d-ad31-797ad53b5798", "comment": "Malware payload", "value": "7021e82e50b858c489659e1bd80f19049006c5f0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948103, "uuid": "7c5817f3-d862-492b-a266-9ce852d9910b", "comment": "Malware payload", "value": "ab008db1ed98e4faa47dc56e4c7707c88ace404db661ae3be4a983642cf19837267df5d7e0dca4499e8e70cc6664b2b2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948103, "uuid": "20ba925a-73d5-4249-8645-5405f1afff41", "value": "T1EF92B53AAF61DCB00954473DF6EE542D5FDC044B0CB645A8B00EDAAD8F6DC5EA98834A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948103, "uuid": "80e0557f-8431-48a3-8b5e-b47d5ddb2db8", "value": "384:fGosGrHwHsv1TDKzHwMHrOHMbH75UbGcjpo:f3Fv1TDKrwcreMD75Ubjpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948103, "uuid": "b84644fe-64e7-43a2-901d-f0c2f765453d", "value": 19569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948103, "uuid": "333254b0-4fc7-4546-babc-2f8e361d9437", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948103, "uuid": "4cb9053f-1919-4bc9-a8c9-66c2d6fb0f4a", "value": "f73bdb6aefe849aa79b4ad4f0c5b25146bd045fb4ecd53b666c251ee85c6abaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e50f37-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948806, "uuid": "191a44ca-ffbc-4e92-baf3-05d2b8e885da", "comment": "Malware payload (Panchan)", "value": "cf344cb8596b55a7d8443b9b588ea7eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948806, "uuid": "7afdcd7f-33bf-4982-8d61-b085a2be3bce", "comment": "Malware payload (Panchan)", "value": "f777b76efee138bf7617cac54c5b75b21c0d66c4d4377fbbacb0420a920ee6cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948806, "uuid": "385aa9ba-8329-43c0-8f00-8568f89c14d4", "comment": "Malware payload (Panchan)", "value": "b9c672529ac67e54e300b27a74a5f697f5e18468", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948806, "uuid": "c2d33353-848f-4f4a-906c-a57a37dde606", "comment": "Malware payload (Panchan)", "value": "09e2caa5827c5c7fc4d3a0701ca6746eb3fd4daa64bc409f7c40d506afb41e9b0480328b5011455c99089f37df2a52c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948806, "uuid": "ca7fc3aa-2018-4797-b5ae-0c7a814c9c33", "value": "T1CF968C73945224D8E1ADC974D51416427EB8388B573863CBBEC472F65BBABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948806, "uuid": "e201fed1-eb13-48f4-af95-c0948a252a90", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnak:sXyWSpV+Wu7rI3JEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948806, "uuid": "b062e545-0aec-4adc-82e5-cda30070602c", "value": 9109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948806, "uuid": "e295746c-eea4-4031-a8dc-e5ccf58b22c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948806, "uuid": "8471706c-94e1-4047-8b5e-76d6ff57a9a1", "value": "f777b76efee138bf7617cac54c5b75b21c0d66c4d4377fbbacb0420a920ee6cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0502c74-04c4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947887, "uuid": "1e765017-5eb6-427d-abc0-674749e45571", "comment": "Malware payload", "value": "1a5e9f784e2c63f187716ceb7d6f8fa9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947887, "uuid": "2fa1d911-9411-41fa-bfac-8f0bcb5a2435", "comment": "Malware payload", "value": "f7a66f4b5e7a0dda219cabcc240e208388045d62c58edb024b2dd4dc00c77c25", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947887, "uuid": "68609dc9-a98c-4c3a-ba0c-5f80f15130e2", "comment": "Malware payload", "value": "42dfd10a28e32de61d4dc9ffc67948fb5d3b4b68", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947887, "uuid": "fa37be5f-2825-4fa5-b775-c34088003ed4", "comment": "Malware payload", "value": "a36a0093117ba4a0cb1c7888428e68032cdd7169b4220d91716099c5cddc58bb99da38965e87e48d787437f552fab3d9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947887, "uuid": "d87134d4-3893-4e2f-8742-1e236a212e79", "value": "T194A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947887, "uuid": "e58acd7e-bdc2-47e6-bff4-a61e28a1bbca", "value": "96:eRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:eRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947887, "uuid": "9afd6e5e-157f-4efe-8ac7-944637b1e759", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947887, "uuid": "22f12433-8ba2-4807-b0e4-45ac4022e561", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947887, "uuid": "3d25ce1e-0cb6-4858-bed7-0f3694bfed3a", "value": "f7a66f4b5e7a0dda219cabcc240e208388045d62c58edb024b2dd4dc00c77c25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163cdec6-0541-11ed-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1658001262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001262, "uuid": "395044ea-6a68-43cd-98e0-3f0418c5d500", "comment": "Malware payload (Mirai)", "value": "d1cb96f367afb089d4a7468ef0a1755b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001262, "uuid": "1ce570b8-360e-4f6f-9001-c47c4448c637", "comment": "Malware payload (Mirai)", "value": "f7be178f95275064829a377910ab8222879dcda451fc17cf27fafa67f0d945af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001262, "uuid": "0f66c128-53be-4394-917b-976e53c605bd", "comment": "Malware payload (Mirai)", "value": "a27df22bd692067ae2936b663538fd39c696dd2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658001262, "uuid": "9a0d3640-11d0-4d52-9670-6072bac5d979", "comment": "Malware payload (Mirai)", "value": "1a45b5a65bf55fd8b9043fbeb66199bf185cf4159b3648c42f2ce05f5f480e8b33ddcdd71d7c556bf8928dbd1ffd34bd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001262, "uuid": "72225c08-3c67-47d9-a411-5f876d17e690", "value": "T194234BC5A453D8F8EC160AB03072EB336BBAF53F2118D983D3A9D933D951702E14626E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001262, "uuid": "90f8e74d-0264-4089-b8b8-5d71887a4a83", "value": "768:4cFOLWW9wA483Amu0hqb5669QYcWm+MMdrgrMN2LDkA187/UxkW:44lAj3Amu0hqb5jrQ1MdrgrMoLDZ1kMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658001262, "uuid": "dd16d8f1-c8e1-4076-a2fb-4ee84cc2a39d", "value": 45840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658001262, "uuid": "7908ef53-a02a-4297-92f7-c1baf006c472", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658001262, "uuid": "a522b2bd-248e-4880-9968-3bee70ef6bdc", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1b4054-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948606, "uuid": "7ae63e0f-e8e4-4087-ba01-20ad9645d84b", "comment": "Malware payload", "value": "07696056aae44187142d10701054c062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948606, "uuid": "a096bfaa-10df-42d3-9ece-dd7fb3951a79", "comment": "Malware payload", "value": "f7d4330b1b245cb3dccaca726e9328537a569b0acaa9027137222596fdc10893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948606, "uuid": "0b356a07-4147-4e1f-babb-c651d80bd1fa", "comment": "Malware payload", "value": "072eff04da5eab333faf517552bf40b4a730160d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948606, "uuid": "5e875311-2f17-4539-8e4e-cfd5cafa95fc", "comment": "Malware payload", "value": "ea53d56826c3f9f870153fe5df570005770136b9b25cdb231c9fef932bc01091f06e412aba5473c7257375925557ce64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948606, "uuid": "5fcd955d-efac-4fa1-b4ff-48dd0c177e2d", "value": "T1A1C4E897A89560F4C1FEE134C66AA212BDA13095073427E76FA146F10F27FF85A7C368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948606, "uuid": "779772a9-5631-4191-98ab-354c1d6bf42b", "value": "6144:A9Y4akWCuX/IWkxjXQfdEr9lsWbujpJy5eT1g7VZfdKsaH4pPakAE1YIhisJ:qBxjgfdErj1Qy8T10IDH41AE1phJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948606, "uuid": "c555bd2f-8033-465e-82ec-1e713db73531", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948606, "uuid": "0c83b436-043d-42c4-b051-91a2800f37f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948606, "uuid": "efcb9347-4ae1-432e-9ba6-a1b28ce5efd5", "value": "f7d4330b1b245cb3dccaca726e9328537a569b0acaa9027137222596fdc10893", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5472e86-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948700, "uuid": "9ef07b1d-8c4d-41a6-a840-0532b9db399c", "comment": "Malware payload", "value": "d5a7eebd43aa99449836fad17b3c6d3f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948700, "uuid": "f6d4c158-2e36-4702-a59d-4d71a3078091", "comment": "Malware payload", "value": "f807fb4923ae01f7e4e09fc4d5941a484959e84288db8586eeaaeacb2f4f15ec", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948700, "uuid": "1d70d9ca-e95a-44e4-ab06-4998ebebdf64", "comment": "Malware payload", "value": "fca18790fac82f4ec12606e233e349a1bc3fbed8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948700, "uuid": "95f82088-03d2-40b7-92a6-dd79ea5ec682", "comment": "Malware payload", "value": "67c97e7b4dc1a66700636a0fc02f9825018ef37c1540540501d5c2e9926e5105fad05aabddf428a9abaecb277a130033", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948700, "uuid": "16749bce-d6b4-4282-9b29-94699347103e", "value": "T174F5330C12AEB8FDB8995639376388E1C5E952F1988260F2D77C14980C3F57D1BDFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948700, "uuid": "1b091b0e-d9fc-4ca3-a43a-8c3715ae0796", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGMG:0XSxVJG2fLAqFOfT9sMYNMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948700, "uuid": "8e1760d4-1e5e-4916-a7ef-08cc49bfd20d", "value": 3432448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948700, "uuid": "24896c3f-9e62-4399-b855-9596a332c4a7", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948700, "uuid": "3a073333-bae7-45e7-b60d-928107c41e5d", "value": "f807fb4923ae01f7e4e09fc4d5941a484959e84288db8586eeaaeacb2f4f15ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571028f8-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948542, "uuid": "1fa279e7-429e-4a2c-8df0-58f51ac08f3b", "comment": "Malware payload", "value": "a54fc56604573e2b9dea3989e6ee814d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948542, "uuid": "c9493d41-422b-4e8f-a2c6-7f7af0ad1853", "comment": "Malware payload", "value": "f9613b7dd4a1b41a41ef91ed8d27ba33d1aab9cd4d72e356fd9ff83edf0dbb41", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948542, "uuid": "f0469c0f-e2a1-4f35-8a16-575dce4099c9", "comment": "Malware payload", "value": "09f074da14877299686d14c19b1fbb3172967ce1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948542, "uuid": "8daa0124-bf86-49c9-a6cf-fbf935d45059", "comment": "Malware payload", "value": "a618cd30592879478b6d59e1002f3a5f9c4e9c25ea207833f22a0de867204c73de035c4ac544e2258f6551da74cad15d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948542, "uuid": "0e319d03-7ccb-40a4-830f-07b56f6fbbfd", "value": "T1CEA1F750112C1AB47646697AD26FFB52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948542, "uuid": "70053cc8-1c0f-4f9d-86b6-36cc51b66a16", "value": "96:5RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:5RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948542, "uuid": "be5399fd-fc0c-4110-b10d-b78a28759069", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948542, "uuid": "c98bdfb4-8c7f-4c04-9214-b093b0c82da3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948542, "uuid": "a4ac4d4d-9e45-49fa-bbc5-7dfd39ddd16e", "value": "f9613b7dd4a1b41a41ef91ed8d27ba33d1aab9cd4d72e356fd9ff83edf0dbb41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d7abb2-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657947973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947973, "uuid": "ac59cf02-567d-4d7a-af1f-d1073a061677", "comment": "Malware payload", "value": "1a7c52b94582c6f5ca3e29a9d27d2a7f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947973, "uuid": "90db9a9c-05d4-40d0-961d-709569244201", "comment": "Malware payload", "value": "f9981a6198009606540f61b26a759c519cee78be724bfe377b6be1b6d45a72fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947973, "uuid": "6861415a-776e-4a89-9fca-c2c8efbdadca", "comment": "Malware payload", "value": "3fff411ed293ce0d37f9883a6604430f601546f5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657947973, "uuid": "3f66a15a-a670-45a7-8ce5-03a86b9484df", "comment": "Malware payload", "value": "bd7297a661e82c37a1de5d0c07b4dad3f546bf3f3d5a0a915ecfea71f3498ab177584fd74234c928778d04cf99094799", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947973, "uuid": "d9ad2cb4-67fc-42e8-b0c8-fd42d699b8e2", "value": "T111A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947973, "uuid": "3fd18523-642a-45e2-9c3b-16b2d6d54e2e", "value": "96:FRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:FRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657947973, "uuid": "a49e40cd-c476-4059-9bb4-6e32dbb40f2e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657947973, "uuid": "b4c8f141-e897-4189-85ea-36e6a3a4b128", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657947973, "uuid": "5d7aefc4-e285-44dd-8141-5f4efd78acce", "value": "f9981a6198009606540f61b26a759c519cee78be724bfe377b6be1b6d45a72fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c74343e-0547-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1658003822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1658003822, "uuid": "82e91762-2eef-4a47-8d67-44814f5ed8f6", "comment": "Malware payload", "value": "7fb11398c5be61445bee1efa7c9caa31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1658003822, "uuid": "ecbb6f26-ff31-484f-b673-a120d8225949", "comment": "Malware payload", "value": "f9b9d45339db9164a3861bf61758b7f41e6bcfb5bc93404e296e2918e52ccc10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1658003822, "uuid": "99b30f02-5d04-422c-af92-5bdae3dfd3f6", "comment": "Malware payload", "value": "ced1c9fabfe7e187dd809e77c9ca28ea2e165fa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1658003822, "uuid": "554618be-4fa5-45cc-8b93-e43c34a9e8c5", "comment": "Malware payload", "value": "97fd86a09d2cbb35033d1ce9b7de68202601c03e226c77946f0aae590e871ce7248cd778e28e2c9cafdffdbaf4951413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit black", "colour": "#A9EC04", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1658003822, "uuid": "78f09598-eea8-4617-bac5-144a47dfaf3b", "value": "T1F7F3129F711A565FE84742FE5B05F89039857F8D926C81B0E2F88D7E721CF99C010A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1658003822, "uuid": "04d23e5c-c56c-4256-af37-554cf3790296", "value": "50e4645798779602979868f1b8517523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1658003822, "uuid": "b7f24b66-628e-4a50-8d67-5c5bf456452d", "value": "3072:hM38OugiM3koBZl6kpfxrgNYddVPkW8XeoSseFciJta6IR/o6BTREgDfBcKL8xDl:hjOugiM3koBDxrGyPktV1eRSZ17DfyKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1658003822, "uuid": "4870003f-0fda-4f14-a236-2f296aa2681e", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1658003822, "uuid": "7a12ee8a-1bcb-4c33-986e-a8ed2d09de7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1658003822, "uuid": "3b027c0c-174c-46c1-b98d-e7ecda38770d", "value": "f9b9d45339db9164a3861bf61758b7f41e6bcfb5bc93404e296e2918e52ccc10.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61627f2b-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948560, "uuid": "58e29523-45a5-44e0-b45a-7265d7ada551", "comment": "Malware payload", "value": "5dc3c449f73435d12c686c38794875e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948560, "uuid": "e1309495-595b-4f42-bf26-923a32d0416f", "comment": "Malware payload", "value": "f9dd7e02a76377e7e61e1283ac8acc44afc39ffcd71fac362654649e1f524831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948560, "uuid": "1813f5aa-9999-479e-83e9-6d9828526930", "comment": "Malware payload", "value": "6f2e80dba279f47760bf521039dbdfc3e252111e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948560, "uuid": "946306fb-650d-47d2-914a-43ca68c688c8", "comment": "Malware payload", "value": "1cbb622428414adba5275e5aca0b302af908e322a56f23699bddf2a4f5559d9d2e7833cbfbde15bf497672d57288cff0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948560, "uuid": "d28dcc66-0c5b-4aba-8a7f-eda2ea35d856", "value": "T11065F657F89590F4C0EEE174C726A213B9A13489473437E36FA18AF11B26FE866BD314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948560, "uuid": "bb82fb44-16bc-4f5f-a73d-4e619b6a2492", "value": "24576:cqfwj1QylLAE1phLrb/T/vO90dL3BmAFd4A64nsfJvWSIsWW1jgbzqJMJ/B0x:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948560, "uuid": "575bae76-56a6-41ae-84db-f1c6c91afbdc", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948560, "uuid": "57db0d93-3821-4039-ab08-49905a6d86ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948560, "uuid": "84a9c668-e0ef-4cd4-82a6-d8bcd63ea404", "value": "f9dd7e02a76377e7e61e1283ac8acc44afc39ffcd71fac362654649e1f524831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960701d6-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948648, "uuid": "a702ad03-59b1-417a-a6c4-0131f9869421", "comment": "Malware payload", "value": "537fd5ad69b08be6c6fbfc0113cee83f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948648, "uuid": "6784abf1-9f59-492e-847f-f1eb01acf4b5", "comment": "Malware payload", "value": "fac7cee1b67baba8e39e76cc49caae157539110ee671174ee172730cc3ec696a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948648, "uuid": "9c63ee49-0676-457c-942e-85306088d629", "comment": "Malware payload", "value": "f80af37dcd26f3220f3b0cfd2a4daa44874c83c3", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948648, "uuid": "ba920c55-30f0-49ed-905b-e6417ffd3f12", "comment": "Malware payload", "value": "112f4aae2cdb537e8691624b9e2200d1196736e4c33d5d3b69117f4dfe481b678e5b1f92e05217d035c911901c7175b2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948648, "uuid": "b8fa894b-17f4-4ed2-b03b-262fb417969f", "value": "T121C5330C03AABCFDFD9E052927638EE4C1B991E0B54260A3E76549985C3F57E13CF962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948648, "uuid": "0986398a-d641-4fba-bb1d-fce86da8b93c", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4V:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948648, "uuid": "a27ba74c-82af-4c15-b4f9-fce92be25e7f", "value": 2682880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948648, "uuid": "007e656d-b918-4c7a-9558-6ada6afb0277", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948648, "uuid": "f6fed332-ff96-46e9-a748-0a47133796f0", "value": "fac7cee1b67baba8e39e76cc49caae157539110ee671174ee172730cc3ec696a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d85d4d9-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948526, "uuid": "a356cd0f-c8e2-41f5-8d1b-7e85ba1f6246", "comment": "Malware payload", "value": "07d77e54ea95e4b63e85b6e5e3ba5d68", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948526, "uuid": "7d7cdf01-5825-43ca-a61c-9be54b9a10b3", "comment": "Malware payload", "value": "fae56f912f20f8317a682a5c850b2c835be81456b55fe0aa2f251c1d001638d9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948526, "uuid": "3ea2b431-fd62-4e01-bc65-cb9ee1f8f39d", "comment": "Malware payload", "value": "f956cede1bd28ddf516881f15c6b00ff0e3bbc3e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948526, "uuid": "671100dd-758d-42c6-9567-0944f81d45f5", "comment": "Malware payload", "value": "abcea69d5a3936e53bfd0522e81de3916d85c17836b23fb5d04d654444cbc1d16b2d42cb1125996f5e09a7d25d0db6ec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948526, "uuid": "410ba128-4fda-4801-bf8b-ba909ea465f7", "value": "T15131A2D435A13A743C7B58E363A91C1532C16075ACA26D19BCF8BCF85DCEE0126C42EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948526, "uuid": "9821c40d-dda5-4b5d-8373-2dfec12965e9", "value": "24:IjPMc8bic3Gl3zKWcG8Ac9cCbcd/s8cbcMcHn:gMvmUGhzKWv8AMf2/s88JQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948526, "uuid": "06401f5f-7348-448a-adf7-9830fe91e6bf", "value": 1680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948526, "uuid": "7ae049a8-6ea1-4240-abbd-6a46d2fafe68", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948526, "uuid": "b1d86c77-0d4a-49fc-ab9d-a4722ca58a31", "value": "fae56f912f20f8317a682a5c850b2c835be81456b55fe0aa2f251c1d001638d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bb3272-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948109, "uuid": "b1a6a6c3-4ab1-4cce-a0a3-68b30288d180", "comment": "Malware payload", "value": "ede202e6ad0b927c8fd1a1bb80eb7f3b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948109, "uuid": "57fe2dfb-0a42-4a0d-b0ca-3545b953a00d", "comment": "Malware payload", "value": "fb435f531d7f018f5dc82baeda8e122611d99ce7547d5fb726d8f98147791ca1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948109, "uuid": "fd8fcea7-e402-43ce-a853-cfba249bf0e5", "comment": "Malware payload", "value": "165f188b915b270d17f0c8b5614e8b289d2a36e2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948109, "uuid": "cf05a176-37a7-4aa4-8958-2ab0c49a1b14", "comment": "Malware payload", "value": "a0c6dd5ec5bf061aee30e95d8e79865984f844bf022554d4a563be1987f7aaaef0a0454643ac9621958484b331e29be7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948109, "uuid": "91e1fa4e-33b5-407b-9f7a-aa1a2ba13f3e", "value": "T1E592A43AAF61DCB00954473DF6EE542D5EDC044B0CB645A8B00EDEAD8F6DC5EA98834A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948109, "uuid": "023d3466-55cc-45f2-96e7-9381c2c24186", "value": "384:fG4sGaHFHsv1TDKzHwMH9OHMhH75UbGcjpp:fSSv1TDKrwc9eMJ75Ubjpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948109, "uuid": "9cafd1d5-0d57-4481-9b4c-9023455fcc43", "value": 19581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948109, "uuid": "4ac27fa6-0446-498b-9415-484d14ea119a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948109, "uuid": "7ddcfb64-0930-4358-889e-2a861f45bfef", "value": "fb435f531d7f018f5dc82baeda8e122611d99ce7547d5fb726d8f98147791ca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afd9508-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (SoranoStealer)", "timestamp": 1657971366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971366, "uuid": "c9d9aea3-97fe-42c8-89c0-393680ce3f10", "comment": "Malware payload (SoranoStealer)", "value": "a96610276169219daa181bf08d7e4263", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SoranoStealer", "colour": "#8FB47C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971366, "uuid": "fb456128-d15a-4f03-a905-4edc38c6a905", "comment": "Malware payload (SoranoStealer)", "value": "fbb4becd23074d4a26302ca8645fac81d73d733a758e2f9e5d552bdc03704860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SoranoStealer", "colour": "#8FB47C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971366, "uuid": "da48d49f-9e84-45c9-b87d-00e4f417cd41", "comment": "Malware payload (SoranoStealer)", "value": "d85d8dade4c0733a8a7700deb07ba7ec3914d949", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SoranoStealer", "colour": "#8FB47C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971366, "uuid": "67a5e86f-4d45-4654-8c49-26ea8d51deac", "comment": "Malware payload (SoranoStealer)", "value": "876bc9ee18d76d12127d1f2e51cdaa047cdf2a0d0a4cb11ec9480367dcbadfb0bbfefc930d4c14b4e0dcee31e15a16c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SoranoStealer", "colour": "#8FB47C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971366, "uuid": "d41bbf4b-afab-41df-bb1c-a17f77d6a52f", "value": "T1B5261242F3D28072E4BA267056B7573689B9BE115331DAC79BC06C49ADB17F0AE39343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971366, "uuid": "49ccd51e-b11b-4b06-86f3-5ca94d359fdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971366, "uuid": "d5d1b7a8-8982-4868-8872-472a5d7496f4", "value": "98304:YQf3s64R9ybzUcwti78OqJ7TPBF3ZlHHgkWJ0P39qXSaDv:tzUcwti7TQlF3ZxxWJSUnDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971366, "uuid": "f49aa848-cbbf-4d4f-baf8-38d092655663", "value": 4683264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971366, "uuid": "7cf408b6-8b63-482a-b451-1f1f821ce984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971366, "uuid": "fe731f12-958f-40fc-bf20-58337db2732e", "value": "DriverlessEAC.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c444201-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948417, "uuid": "eb162d12-bf40-4ae4-b340-10073f0b181c", "comment": "Malware payload", "value": "2a1a77283807bdbc8a184e3c84c7482a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948417, "uuid": "d39db9ac-29ad-4fa7-9731-3f69e646c726", "comment": "Malware payload", "value": "fbb755bc3df2e8b9358e7e51b2bb7b8b84c91c88e0d377e7c06ac4e9e277b791", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948417, "uuid": "a8fb1bca-84e5-41c5-91d3-87a39e57d853", "comment": "Malware payload", "value": "cec64a99f968941a9c02bb28a0de7af79448fd5e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948417, "uuid": "c4383d84-2147-4861-a789-585c1cbc16b7", "comment": "Malware payload", "value": "ef975009f5481e0a2d86a879c7d712cce83c16b2e548e2a766a53602fb8ad14d8d02c6cf2a711f211979b56570c9a0c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948417, "uuid": "b976d5c4-3348-4787-863e-4dbb2d514ba2", "value": "T105A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948417, "uuid": "81b98e51-d5b3-4f8c-81e8-9ca4cab44b1a", "value": "96:LRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:LRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948417, "uuid": "71f80cb8-ceb9-433f-a69e-cb54ae487cdd", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948417, "uuid": "0b73c6ad-db9d-449d-98cb-db337ed2e29d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948417, "uuid": "a39d45e3-0f6e-4169-a9cb-6d2d311da330", "value": "fbb755bc3df2e8b9358e7e51b2bb7b8b84c91c88e0d377e7c06ac4e9e277b791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09670d59-04c7-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948842, "uuid": "311a5ef3-ca88-4ef0-8b44-10c4006c622a", "comment": "Malware payload", "value": "7f4f2668d4900cfd24bf9bc942e689ae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948842, "uuid": "1cb49838-7d2f-47e7-91dc-9dcd1509f6f3", "comment": "Malware payload", "value": "fc17d48d378a9be23def0012d43c93a64ca7f56ad626ca086557ac0d55099d54", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948842, "uuid": "21e1b489-9e2c-4dea-ada5-053c17d510fc", "comment": "Malware payload", "value": "43b392e2e9a987efae2747167589419a83ed078c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948842, "uuid": "5a8f69c2-dcc8-4619-9ca9-e4e20ab67fca", "comment": "Malware payload", "value": "f8c18f5a908da421c4f7ab9e050a8c9b35733016eeca740838e14ff3a2c6a0d92e0804cc19f73a624dcf761cb60c6f67", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948842, "uuid": "bb19127a-a633-4f6d-b20d-e15843c53ff4", "value": "T1783140D435A136753CBB54E767791C0632C15026BCA06D58A8E8FCFE5DCEE0526C41EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948842, "uuid": "a964067d-e3e1-4fe2-bcea-41180b4700a7", "value": "24:Ijtc1ic4iKWcn7kNRAcnQLtcnZqcbcnu5bcGlczlca1n:O7yKWtXAtYDl8lb1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948842, "uuid": "45711c83-90b2-493f-b382-6b464279cb27", "value": 1650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948842, "uuid": "fbb49077-0a23-41fd-a577-f4ddc7c0298f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948842, "uuid": "a5dc26f1-4b38-498a-94af-164d8c1a1dbc", "value": "fc17d48d378a9be23def0012d43c93a64ca7f56ad626ca086557ac0d55099d54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f9918b-0527-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657990331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657990331, "uuid": "306dfeaf-d0e1-42b8-9e91-fb410cf3cc11", "comment": "Malware payload", "value": "60ed30bea0f9e2db5cc1f45241c7473c", "object_relation": "md5", "Tag": [ { "name": "Darky Lock", "colour": "#10BF2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657990331, "uuid": "2a42b502-626e-4436-a578-4c56bd45f7c0", "comment": "Malware payload", "value": "fc28d2eaee1fd3416fe3e0cd4669df3ac178c577e3a8c386b1c34c3146afb8d6", "object_relation": "sha256", "Tag": [ { "name": "Darky Lock", "colour": "#10BF2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657990331, "uuid": "cbe7c649-5126-45c4-aef7-4fee3dff3a7a", "comment": "Malware payload", "value": "62b33edc9682bc780bc68d34ae7b19eaf429e42d", "object_relation": "sha1", "Tag": [ { "name": "Darky Lock", "colour": "#10BF2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657990331, "uuid": "a0f15e1a-3088-4464-b7c4-343a25915384", "comment": "Malware payload", "value": "0f10c5f923162b54685ae99b6e4a1b5d96bfea5171946de645fdaf6e5c52dce0b268a28fa03bdd835a70a49be03455e3", "object_relation": "sha3-384", "Tag": [ { "name": "Darky Lock", "colour": "#10BF2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657990331, "uuid": "5203fbaf-212f-42b3-93f0-a34931eaa4d2", "value": "T12A759E13B29511F9C06AC1788BA75152E971BC510B34BADF17A077262E32FE06F3DB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657990331, "uuid": "19f76af4-2dd4-4847-8e24-de768330e450", "value": "9222d372923baed7aa9dfa28449a94ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657990331, "uuid": "5cf52827-4845-4f0c-82d2-d9a3fd15b642", "value": "49152:Dn3kKc0rJdjgqsLqf3ZfM0Pa5kLLcatsXkjbGDGe0VM:D3k1nkLiDxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657990331, "uuid": "053fe0e0-8b5f-405e-8205-995b25a0e847", "value": 1598976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657990331, "uuid": "39e1c726-5b63-48d8-81a2-4957d1252ad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657990331, "uuid": "2905085a-b87e-4256-a0cc-53c5d2a477fc", "value": "fc28d2eaee1fd3416fe3e0cd4669df3ac178c577e3a8c386b1c34c3146afb8d6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b04374-04e3-11ed-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1657961210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961210, "uuid": "a49b0a39-17f7-4702-bd0b-a614db7cd9ee", "comment": "Malware payload (Loki)", "value": "350260296bbf6f2cd7510790137f7fd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961210, "uuid": "e90abed9-d256-48f0-aab0-b7f458240876", "comment": "Malware payload (Loki)", "value": "fcc3926bc72ee73c7709cfd06720728aeb742cdc9d38d9c4e1ee83be7e1ef7ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961210, "uuid": "fed76fe4-e077-4f03-a5ad-21c336149211", "comment": "Malware payload (Loki)", "value": "c7ec82a09754257302b83569a7629f25d82f1514", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657961210, "uuid": "56a92d13-0a84-4302-8399-e7d17509d3be", "comment": "Malware payload (Loki)", "value": "85809723bcf4379d8e4aab13dcfc0dc15f2eac5e67e90d72821b44fc8168ab53e9976f5d7814d83f8bd88335c9af3ac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961210, "uuid": "49630d21-7d7f-4d40-b002-fb5e0cc747fb", "value": "T17164AE00B750D439F1B712F49AB69378B9397EA1972450CF62E42AEE57386E0EC3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961210, "uuid": "9b00b50b-7af6-45da-97bf-4b25ab105bc4", "value": "5fe47884083bab0c3389c69805e59188", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961210, "uuid": "d4a36faf-ba17-44be-9a91-bee87a818168", "value": "6144:AxozRKHTkthlSAM7RsovsjgrbcXvMRWpambzPuNeRh:Pcz8hkh7Rfvsjg/4vBambzPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657961210, "uuid": "a2eee5a6-d4d9-45ca-9764-6c8380c723e4", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657961210, "uuid": "e8ae9dcd-6a3b-4588-bf4f-30ea4c02f3b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657961210, "uuid": "412e8f0f-8d7b-40eb-9b18-9b44b5b82d87", "value": "350260296bbf6f2cd7510790137f7fd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de06c7b4-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948769, "uuid": "1ff03c9e-e5d4-4edd-ab69-92e6a0da959c", "comment": "Malware payload", "value": "c31533336ad6378ddfe14ae685e3210c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948769, "uuid": "c5de6e7a-48bd-4b6e-b323-0ad28aab7127", "comment": "Malware payload", "value": "fd0574b8ef2ee4478272d7ff32eec1a3490a0357185a9c64b2b888e9053408ee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948769, "uuid": "3eaa1a6f-4872-47b4-8722-af2847081878", "comment": "Malware payload", "value": "e597cd1947302e66219272c5fef01bf677c0aeba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948769, "uuid": "668b0069-8860-4586-a3b0-ce245eaf111f", "comment": "Malware payload", "value": "e10d270c18837fe2155575b20c0ea1b15a5c1dd4a227d9bf14725b69be0ee98ab2bbb7b702ff46cfac616af90f9e9bd5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948769, "uuid": "b54b2706-0cce-41d3-a916-a1763153e241", "value": "T13BA1E750112C1AB17346697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948769, "uuid": "20ab4805-e3d2-4965-947b-e3c701134c58", "value": "96:WRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:WRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948769, "uuid": "45019b8a-ae40-4da4-9904-e2d22a26aa3d", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948769, "uuid": "c0c8ae8f-0ffa-4f42-af22-1a85a1d32cce", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948769, "uuid": "b328d619-a5e1-40c3-9008-55e443feb35a", "value": "fd0574b8ef2ee4478272d7ff32eec1a3490a0357185a9c64b2b888e9053408ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc067c8a-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload (Panchan)", "timestamp": 1657948739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948739, "uuid": "174d52de-e02c-4f47-9051-4fb2e4f785ac", "comment": "Malware payload (Panchan)", "value": "8b6e7bfd4f8359de34c7978fc7a96151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948739, "uuid": "40235f78-f2c1-4c57-8eae-e33f4ef616d9", "comment": "Malware payload (Panchan)", "value": "fd5ea748c19f7ddf26cc9fb081899e64ad687bd7fab571b21c0df926842abb7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948739, "uuid": "cf969a4e-01b5-4606-8fe2-71c6f564e801", "comment": "Malware payload (Panchan)", "value": "a992e8f153951521b2b92916c822954ca1f4c037", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948739, "uuid": "28996669-b904-4e60-bdb1-fb937a515e00", "comment": "Malware payload (Panchan)", "value": "0fb39a24613124047dad6628b831fe8338290f320e07787adbbc674630b849e9fef96e7322b6db08bbac185c96bb44dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Panchan", "colour": "#6E9401", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948739, "uuid": "1033562e-0d07-4996-938a-765c0febb2ea", "value": "T16F27CE73910738E9E5A98CB4D41425426DAC38875738A3C7BAC871F667FA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948739, "uuid": "b23d3d04-fac3-4ea4-9dd3-c2473c6daab0", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVna6:sXyWSpV+Wu7rI3JEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948739, "uuid": "335c083c-c786-4cda-9d2c-f70639f3811c", "value": 20709376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948739, "uuid": "cdaece38-61b5-4952-82dc-c44896a8249a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948739, "uuid": "2d5aba1f-0aa6-42e0-8213-1dd63d3b0972", "value": "fd5ea748c19f7ddf26cc9fb081899e64ad687bd7fab571b21c0df926842abb7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7f7da5-04d4-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657954432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954432, "uuid": "904de72a-5c8e-48b5-bfca-beb701c50b17", "comment": "Malware payload", "value": "3547b8a2958de05790c784f6aa00470c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954432, "uuid": "528067e5-955b-40e3-a004-8932e1808f09", "comment": "Malware payload", "value": "fd822b567721a7fa2467a4b1712b650cc365b1a814cb9e75f86ed68194a17dbf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954432, "uuid": "3b1f6d05-02aa-41b1-a857-468335fe9adb", "comment": "Malware payload", "value": "67143f6bd18cf4306385b9faf4bcafd5bb66389a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657954432, "uuid": "2881d53f-6b06-40fe-b5ae-324ac5f8287a", "comment": "Malware payload", "value": "f8a6431d14182537287b5ca8b3e8c544433f0c95f949ea4e2dd51f1e5bbd98568c4053c2c9ad97b26eeb62fcd571c653", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954432, "uuid": "a19a2d2d-fdd9-4752-ba67-53829c8ce70f", "value": "T1F523F720F7E1CA2AF16686314ED3D6D67639BC5E6E06C30B32547B0FBC30A708A52759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954432, "uuid": "bfd7cd08-0a7d-4382-80aa-1f844307a93a", "value": "384:lk15rwnpS/cTgx+0gLX7/kCjiSwvxjk+tOLQ05fhMJ50jytYX6eG6:lmpWS/ONTJOxw+t7wX6eG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657954432, "uuid": "3a557721-451a-4bad-a625-8e04070975dc", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657954432, "uuid": "418ba3fc-74f4-4294-bd61-77e418198da5", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657954432, "uuid": "67f224d6-f2ac-476d-9fc1-9015381404b0", "value": "3547b8a2958de05790c784f6aa00470c.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00543ca2-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948397, "uuid": "364d1200-73c6-48b6-b06f-d0327af4dd06", "comment": "Malware payload", "value": "bd97ba08c8bef6911dec9abcd9c424dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948397, "uuid": "ac4ec611-8fc3-4b0a-b7e3-06ee23ab9bde", "comment": "Malware payload", "value": "fe358349537491a1ed67d0d7c58804c50b577b5040b1738ae3774c0bf828a86e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948397, "uuid": "eb033aa9-5e9c-4eb1-ae41-63945f3f7cba", "comment": "Malware payload", "value": "4bbd7f71a0401f26caed72a2d65b384d9464962f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948397, "uuid": "acd17353-d9c1-4398-9c29-94432c438faf", "comment": "Malware payload", "value": "f4a95af360a32de6878c90a6917ce1a51885743932ba00abb181c4773ccb92ce7877fd82fa5dbac665df9303a51e0fa4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948397, "uuid": "7b8a5444-d34b-4c7e-8d56-b6c599d22b9d", "value": "T183A1F750112C1AB07346697AD26FFB52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948397, "uuid": "436d2fed-c9d8-4a42-aeb6-1ad8d76385ac", "value": "96:ORYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ORJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948397, "uuid": "a68ec2c0-97c9-43e2-bd19-d15c3113c146", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948397, "uuid": "1241358d-6ad9-4729-b727-4d47ec923c19", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948397, "uuid": "402ef2ea-6b0f-4be8-a2eb-e4853eb4edd1", "value": "fe358349537491a1ed67d0d7c58804c50b577b5040b1738ae3774c0bf828a86e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70adf329-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (EternityStealer)", "timestamp": 1657971349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971349, "uuid": "2bfef76a-3e70-4e45-9a8e-38f41ca7f107", "comment": "Malware payload (EternityStealer)", "value": "c3043c1ecade948770d9de626d3ffc95", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971349, "uuid": "83259f1a-e799-49c5-af0b-b3c22c5585fe", "comment": "Malware payload (EternityStealer)", "value": "fe86af7ccacb57911479270dccb9dbc9a864b21281fe5cb6e9f345f5b895adaa", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971349, "uuid": "9ff7cf17-9e56-47a3-8545-2e6cece1bd4d", "comment": "Malware payload (EternityStealer)", "value": "f9c7f393e5f124598b756697aea5f246e47e70f7", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971349, "uuid": "584c26b2-df37-4a05-842a-2e06652ba573", "comment": "Malware payload (EternityStealer)", "value": "c330f1aae43bfd28d11621be9e05fd6a525fc7bc92992a3a104de164c657ae3959cf1279c7217bfaeb4f849a0c53fa69", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971349, "uuid": "09bbef07-cec8-41e4-a1a7-6b45c97cde9c", "value": "T1BB8397243EF54119F173AA3D8BF17AB68B6EA3532702A32A555133830E129C5DF439F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971349, "uuid": "673b50d2-ff15-4d7d-a1c3-c71e058d9991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971349, "uuid": "57374fca-da93-4a03-a13b-0811c2374e6a", "value": "1536:UQ2Tr//2LajGeBIPckbMp1HY1kqxTXI+vnt//4RSByd2bJqn:UQ2TrWLaaTDb841kqxTXJvd4+nqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971349, "uuid": "7674c161-72d1-4ca3-9be1-f5050e64cbc7", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971349, "uuid": "e5060caf-6f72-4176-9908-9506bc3625d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971349, "uuid": "0fd944db-ec2c-40ca-8ed5-18dfb900dc88", "value": "Clipper.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171696d9-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948006, "uuid": "85450898-b899-4faa-80f8-9f89c59200bc", "comment": "Malware payload", "value": "b696021cd98908abe3fdcdbfe241f691", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948006, "uuid": "5881fa9d-854e-4415-afef-aa23727a6ea1", "comment": "Malware payload", "value": "ff48d942de812e3a319d997db08a2d95c2c21501c9ec7b9c0e524d14fe12d16e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948006, "uuid": "5eb8e4bf-038f-47cf-96f0-ea2e8b34ec4c", "comment": "Malware payload", "value": "922f86fc7d50bec50c460948331816a06ef21347", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948006, "uuid": "92b63597-59ba-408e-8f3f-38eb6de92ee7", "comment": "Malware payload", "value": "df4eb3f7edc3069090405ac5418ccecee7e8a691fc404f126769c36faf171fc94ccc9f39b9856f2b7c4f403733e4a1a1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948006, "uuid": "ff9452db-f13a-42ff-aff2-23d6c6333b9b", "value": "T1D8E012DD40029C6151428F5CE80384805EB6D5CAE9C33599B16A451D8C409007FAD58D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948006, "uuid": "4a5c4ede-bdfc-4b0b-869d-2486b7255081", "value": "6:SXkUuKGsC5fQzTYJfmkUuK9XsC5fQzTYJfmkUuKOobXsC5fQzTYJfmkUuKXWXsCV:+uKFwYfY0uK+wYfY0uKOo4wYfY0uKXWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948006, "uuid": "e1ecb491-7b24-4663-b451-e2c2380af89a", "value": 365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948006, "uuid": "112e9aa9-700b-4028-9844-10b78b07b1e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948006, "uuid": "851e21f6-f6d1-4a6f-844f-8b037dbf7f87", "value": "ff48d942de812e3a319d997db08a2d95c2c21501c9ec7b9c0e524d14fe12d16e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2926dc7-04c6-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948776, "uuid": "a83d0eeb-327a-4649-a841-a214ffe39f14", "comment": "Malware payload", "value": "cc05f89e2f87195d2a0ef932d4c53c47", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948776, "uuid": "1ecaf818-8082-4310-9e23-2b91ee7879e7", "comment": "Malware payload", "value": "ff58078a19c386bb8726204bae05839342174328fb2b424f7509cf130792115d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948776, "uuid": "d19fbed8-758d-4a9c-a986-74026bcfb94f", "comment": "Malware payload", "value": "2c4d1945fed42f141896bb7c5a4d29c23220242a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948776, "uuid": "5f2b9166-1bdd-4451-84bf-b60cdeda7a31", "comment": "Malware payload", "value": "ca4f57257e3597e50c309d3ed6d152c1c0e19530f63c856e3761bd57aef639fe32a9537124d133fb7bdf6bbec10e066c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948776, "uuid": "5c024eb0-8232-4c66-b0f0-1dfe80d21608", "value": "T1B1A1E750112C1AB17246697AD26FFB52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948776, "uuid": "e106f998-e917-48ae-923f-302381fc28f3", "value": "96:QRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:QRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948776, "uuid": "25e49c97-5faa-4c54-9aad-2dd55c2194ed", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948776, "uuid": "f4c274b3-27e2-457b-83c1-858a157b10a1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948776, "uuid": "5397ec39-f9c9-4c8c-8a06-af551d74858e", "value": "ff58078a19c386bb8726204bae05839342174328fb2b424f7509cf130792115d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab22380-04c5-11ed-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1657948226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948226, "uuid": "328e211e-71e6-4802-b2ec-21dd89e30823", "comment": "Malware payload", "value": "a05e1d7898dd023a77a220800b49794e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948226, "uuid": "9448ea6d-6d05-4f2d-b7a0-8c58fa7284d7", "comment": "Malware payload", "value": "ff7dcda4aad9dfc4b6fe43ca2247acd2960a96976599a37d952dcb3d1d8704f1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948226, "uuid": "9c533841-6dcc-4b1f-8c01-e57fa6be69d0", "comment": "Malware payload", "value": "89d34f30e3f123c2204d6b9451c048b644134a6b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657948226, "uuid": "d83e7c8b-29fa-4ffe-b22c-d195ed798241", "comment": "Malware payload", "value": "5998490342df94b612f1a883b6607d1e3f60a5dbddcd4689b5b92b28522a0d8e2e16311b0370c698c277790f1b37840a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948226, "uuid": "973df918-5b78-4c89-b18d-d4bfd5f963c3", "value": "T148815EE466B03A303D6B5983232D2C58727160EE7D52CD8458E8F4E76DCEE8272841EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948226, "uuid": "bebee240-375d-42eb-b7b4-8c90d25c45c6", "value": "48:JLufZqNgUBxVnDm1kzBz4449Q+hQBm2oVY:8Gn1z54449hhQBrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657948226, "uuid": "92e43295-35b5-4a27-8f07-d3da80847ca5", "value": 4179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657948226, "uuid": "227bafb4-e807-4a35-8cc2-ae564d5a8efc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657948226, "uuid": "e7ba1979-ec1b-4264-8081-d97e72ac940f", "value": "ff7dcda4aad9dfc4b6fe43ca2247acd2960a96976599a37d952dcb3d1d8704f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8552786a-04fb-11ed-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1657971383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971383, "uuid": "72e5114d-23a8-4ca3-a9d2-6fc6e5923a48", "comment": "Malware payload (RedLineStealer)", "value": "cd8138dfcbad2932dc7032d4e815f6fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971383, "uuid": "13b8ffa4-0caa-4a0b-9f12-1e312fc16b2e", "comment": "Malware payload (RedLineStealer)", "value": "ffbb61bc22bccc9beca98a3abba5da12188b94035709649c4f7112d07ce4ced2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971383, "uuid": "a505c227-12d8-4e0c-a074-a21b90549b4d", "comment": "Malware payload (RedLineStealer)", "value": "795c00dd474813f63912a665c41088a9a3b4d79e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1657971383, "uuid": "2e080ca1-abe5-4d33-a0ab-462e74944254", "comment": "Malware payload (RedLineStealer)", "value": "8ef51d979b10a87c656043e60b2bc2db443d28fbcdee35f6bf13ed6580ef8e71ee35b6ea41dca4153eae4dc2798138b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971383, "uuid": "414bdb88-880e-4b22-bd3c-59aba722390d", "value": "T12AC51A135A8B0E75DDD23BB4A1CB633AA734ED30CA2A9B7FF608C53559532C46C1A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971383, "uuid": "4eb02361-fc04-4794-9165-1c14a9be192a", "value": "e1888d3e3e34368cefc07e8f747b2817", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971383, "uuid": "9628ba4b-1614-46f5-a43e-fdb0ead780c4", "value": "24576:908/R5sjkmzhfmpY7YjYXUiWfM/tdQgd2lbwKKOOK9UO4bSLsfl3RuQ55313Lv:C8/AjkmdfyEYw2OKiO4bSYfl3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1657971383, "uuid": "86966d3d-7544-45b9-92e1-0700c63a97ed", "value": 2583160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1657971383, "uuid": "30d549fa-9bbf-459f-a56d-12b207af1a9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1657971383, "uuid": "c5edb987-8824-4aec-994a-7d671d2017a2", "value": "fortnite loader .bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }