{ "Event": { "published": true, "date": "2023-02-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-17", "timestamp": 1676678582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "47262b04-f0d0-4697-8d32-dec7c74ca825", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566f4e85-aedf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676650976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650976, "uuid": "bf5b2b2e-3552-4f92-aabc-0146d5a887bc", "comment": "Malware payload", "value": "763581dcd0ba7ccf28e3f13ce2fe593a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650976, "uuid": "a32b2c5d-0343-4763-83b8-a19aef34ed6d", "comment": "Malware payload", "value": "00028c98a3727362f90c00c7d06c59ba87f68dcb85787aa2a436bb900c8053e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650976, "uuid": "e9f170d7-865a-428e-88ee-06e22118a274", "comment": "Malware payload", "value": "ef6e827a95fd37014a38108c80c727df564352de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650976, "uuid": "5f1866d8-0a18-4e86-b05d-edf2008cef2a", "comment": "Malware payload", "value": "9fb76e6b974d700e7626268b2f85faa4b47da7936547e8228e8ad6dd75382c43baf6b2976fc9b50d936438b8f73e365e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650976, "uuid": "3c29d130-3d42-40c3-857a-13b9ee4db8fa", "value": "T168F4124BAAEC5152D5708B704CF602D3093B7E617B2953AB278AAD1D0C736F0BA31767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650976, "uuid": "b11a6fcf-4e35-4639-8d07-ed2ca2df7675", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650976, "uuid": "94fb9a7d-e028-4532-9e75-d1dda63e0d2e", "value": "12288:BMr+y90Xbq0fERY1jxFYyLzrxR8QOI+U0FAZ90e49LimbRRVJQba2:vycbq0fKY1/vLzrv8QOI+RCZFAL5N+a2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676650976, "uuid": "a720fadd-65d0-418c-ab39-14e66614d02e", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676650976, "uuid": "e75434b0-7508-4176-bf8d-ce05c4a96350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650976, "uuid": "19eeaa6f-a851-4593-86e5-d568dc97f96d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43eb5793-aece-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676643644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643644, "uuid": "e5de1f0f-e4e8-4faa-8d0c-5dc1774334ad", "comment": "Malware payload (Quakbot)", "value": "1274c28cd397874482b003818a1289d1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643644, "uuid": "780c828d-836d-4eea-b659-f253b421d6df", "comment": "Malware payload (Quakbot)", "value": "0307ab4d314e349614030c4fde71a9d5f0fba388efcc24dd621ccf8466166c8f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643644, "uuid": "d48f9d7c-64d8-4635-8c4d-a58fb6027239", "comment": "Malware payload (Quakbot)", "value": "be7c58d18a5d10dd7e3571fe8a7019382fa89b5a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643644, "uuid": "4f830030-d69f-4895-b99e-488e5270372c", "comment": "Malware payload (Quakbot)", "value": "5af6d08a6cd21c967ccf65477ce4c076170d6daea64923c8fe8a2caf70b7e41d5a083dde1d5ab4847ae9467b16aa0999", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643644, "uuid": "c897a347-7284-4523-a857-56d2b587631b", "value": "T12BD39F53A55180F2CE76013891FE9F2E9BBE752007A268C7B7D8AD9129605C3D73B2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643644, "uuid": "f4ea8fa9-3d5c-425c-9ed2-b9eef425ea4a", "value": "1bd51003f5494b32d39257bf6bbbb175", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643644, "uuid": "7377f8e6-4e9f-40c0-a020-83eda6932703", "value": "3072:SQNbnQ4MnC3pDGCjZJzkWjGRAuJjen68TBfPOo/q:Sp4MnCZCCViWjGauJyn68TBHOo/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676643644, "uuid": "26da693c-05d6-4814-8c10-68241c2ae6b7", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676643644, "uuid": "3b9575ad-2bd0-4778-978b-37b3155d57c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643644, "uuid": "7df6f70e-af0e-4e0a-ac19-0f7ac60c9110", "value": "03.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668566ca-ae8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1676615355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615355, "uuid": "188fb89e-d16f-48fe-a2cd-4f5b59a89ab3", "comment": "Malware payload (CoinMiner)", "value": "29d0d6661d2adf0f6d09434a247859ee", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615355, "uuid": "8fef3ccb-7861-4004-b99d-d85dfa0f2669", "comment": "Malware payload (CoinMiner)", "value": "04a62995b10b0804ea4bffefe263d14cf0add0865efd204ffbbf4a2cfdc3ee0b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615355, "uuid": "b25e6c70-3660-4ce0-886c-dcc1f9358545", "comment": "Malware payload (CoinMiner)", "value": "8ce85166d3f414d67559195b57cc5e4cb91d4027", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615355, "uuid": "e39f4bee-6a1b-4f23-912e-0eea1ed65629", "comment": "Malware payload (CoinMiner)", "value": "4bc4ac3f6340d13348af4f2e8f6443a2561aef74ec76df70803c964880860c28a9344f39bcfb8f8784a71ba59c1e12c6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615355, "uuid": "89391a0a-c801-4a24-98ce-b5e50d6343fe", "value": "T10165F101B3A7E816F6604674FC62BE6C3522FE18A5164A8F358875CFE630B744D0FE66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615355, "uuid": "5e5fd2de-e69c-4bca-ba83-e1f7a429d85d", "value": "8ba4d298bb465bc8dcb2241291c1ef91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615355, "uuid": "ed7bb369-b6f7-4fbd-be2d-00440f22bb8a", "value": "24576:0beZFjI3AMDvZt4PD3CaQBBEzTvcS0/vecCFpNY918Q15wNhN:ueXE3NvcjCcXvcSLrFpyhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676615355, "uuid": "1b8d50ff-411d-4aaf-a5ef-ac37204de5c5", "value": 1529864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676615355, "uuid": "d62ba3e1-546d-49a0-bcc9-9b7f2da3e0b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615355, "uuid": "66e5cd66-189f-4fb6-9f37-e4025f76de43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc3c086-aecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676642885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642885, "uuid": "af79a718-9765-4199-9943-799afc2e195e", "comment": "Malware payload (AgentTesla)", "value": "0b9ac1626cee8d1eccdec5f594943c8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642885, "uuid": "ff01644a-6fdd-4f92-af21-64af17d8c037", "comment": "Malware payload (AgentTesla)", "value": "04db65b6ea87302207b6533c4262e41ac0fdd6eef2dd63c24c946b226fb9a619", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642885, "uuid": "cb1e2352-078d-4859-aa87-7c49b29a67b9", "comment": "Malware payload (AgentTesla)", "value": "77b281977924dae576f721c15bae2b95495df3df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642885, "uuid": "c7d0b155-add8-4b39-8f97-031f496345c1", "comment": "Malware payload (AgentTesla)", "value": "249d637f75733ab3b875b8c7be23760a954c19c7fc1089dced5316064dd01cc25607bece40e6944d31a69cefe5a7455e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642885, "uuid": "2dc4731b-6ef8-4651-8908-d25c378bfdd2", "value": "T18D642340B390C493E9BB0B319D342A4B7BF6B23520546AEF13506F49BFA76D29E1D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642885, "uuid": "6a345418-a100-40b8-b9a4-5d8cda7b7307", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642885, "uuid": "38d4a2d4-1ee9-4bfd-bbd2-8bc041d8046b", "value": "6144:PYa6VnhkWWi/9BvkXvMqq16Q+MEJE1mab1uLAAUiu9DZWE1zbsgc1cr:PY3nmuKv7M+7o1GAHP1zbP2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642885, "uuid": "7bb0d401-abf8-4945-9889-39a051af848c", "value": 321825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642885, "uuid": "cca5ec76-c220-429a-a980-560f6d63948f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642885, "uuid": "629221ea-f563-4119-9d71-60e291db1e95", "value": "Revised PO-2023217____________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a426fc-aef6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676660958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676660958, "uuid": "a425d4ec-c86e-4ce3-a259-f3248767513b", "comment": "Malware payload", "value": "6174c48e9db603d8f81e06d6d446ddcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676660958, "uuid": "4a9d8eca-4a13-4cf2-9bf7-a36bf7683ca7", "comment": "Malware payload", "value": "0602cc329f3db910d77b447101dadbe9f7ef697cc7d49c8e2fccc0403b6e1d12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676660958, "uuid": "c98e78d0-146a-4815-8700-a22ecb96787f", "comment": "Malware payload", "value": "0906890f82c5772e6c8bc87a817fc03d31f756ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676660958, "uuid": "f2c36394-1170-42ca-bbee-98e47181dd4d", "comment": "Malware payload", "value": "9c94a838c0b8c8d2acf154bf7894bada762055cf0a548c4bac7e7e7b6f3149c84f27b42b03c6ea65162d72327ec0812a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676660958, "uuid": "b38da3bd-a40b-4473-9d66-3733b8f9f7a9", "value": "T18FE5334747E6443FE5A4177058F51AC31A27BEC3FA344A1A3B8D2D9A4E309E477A036E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676660958, "uuid": "44f3427c-656f-43d5-84fc-7e4780e5f706", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676660958, "uuid": "999f05ad-ed78-44d3-8643-2c6e20cd392d", "value": "49152:pW3xuA7dt7MtvfXkyavtj57bKfYXnubuPvgHIN/N5rqs2NbAoHjeDgG0b7Ol87FB:KxuA7Hu3XDavtj57D36uH6I1N+Ltlr7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676660958, "uuid": "ed3070d1-4905-4725-a815-fc75f55f2e5a", "value": 3117056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676660958, "uuid": "e6410a21-51ec-4a9b-ac4f-0fa0b161a379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676660958, "uuid": "8c2beeee-6a9d-4c06-a2ab-53c3fb256355", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6248b6-aecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676642474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642474, "uuid": "a4777fd4-4b91-4627-9c3e-a83749dab05e", "comment": "Malware payload (RedLineStealer)", "value": "b2706fab059c12b8ec5a8ec508d5679e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642474, "uuid": "3019ed5b-0a4f-412a-bede-051922d51ddd", "comment": "Malware payload (RedLineStealer)", "value": "0671c61681710adcab33263282b1bdc2bf18e0ca63ba548617af410b58ebe0f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642474, "uuid": "919fadb1-bd07-44da-b732-86f1ab072da2", "comment": "Malware payload (RedLineStealer)", "value": "747f106174f760c47b6e12cd6b940101d89ec02f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642474, "uuid": "897fd886-e6b3-4cc7-bb49-19bf4a70b440", "comment": "Malware payload (RedLineStealer)", "value": "b41df20fa533877f49eb8a7a42191037b2d51278534ff79b5cb7081f8e99dc56cc6d5b690014ecaa71ea9e83d72b437f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642474, "uuid": "4c3b29ba-d9fa-4a36-9835-38b3b178483e", "value": "T1C015234BB7F88052D4E947B00EF646C32A357E699B348367734DAD0E2873294B27572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642474, "uuid": "6dbac92a-39b2-4d89-95fd-0daad729f00b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642474, "uuid": "9163a65b-2080-428b-a50e-1e1579d84a7e", "value": "12288:/Mr/y90JX/Mr8xJVbsWlAVCaBzN7tZ+PjrYAcqZP4ar1uR3tMY+d1x58OOCKaQsL:IyQX/9JNlAVxthtEYA7qYuR2YqWB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642474, "uuid": "c3408d89-83a0-40bf-9754-99c18739baad", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642474, "uuid": "160ec21e-d69c-450b-9746-4e0de4e17e96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642474, "uuid": "46c2142e-873c-44f4-93a9-81a94f978e8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ad4404-aefc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676663429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676663429, "uuid": "b796007c-aee1-42fb-bbf3-05a47e5a6d54", "comment": "Malware payload (RedLineStealer)", "value": "68c32d15e977f8e8ac72a69fda0a1a17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676663429, "uuid": "91afbd46-414d-4aa7-9557-3696672fd253", "comment": "Malware payload (RedLineStealer)", "value": "068cbb9b6cbc1be53eb4c826b7d450d43197e9ca1444145d98626541dce4e179", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676663429, "uuid": "7ec7a328-b574-4f86-a595-82840fe8bf34", "comment": "Malware payload (RedLineStealer)", "value": "02b624776fa9bf8d6830f693da3874609737d198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676663429, "uuid": "63a524d7-5653-4982-867c-e31b600c1a8a", "comment": "Malware payload (RedLineStealer)", "value": "54cac118db0501b4940c9df26a88f05553fc852c9d3801166a45446a525fb0cb8650583041dd0a38f683362dcede82fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676663429, "uuid": "bc9e6d4a-4a34-4746-80e8-1520b1a5b48b", "value": "T158F4125BBBFC9072F8B1577018F906C32D363DA01BB4475A770BEC6A183267496327A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676663429, "uuid": "cfb8df96-0e39-494c-a7a8-37382eb404bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676663429, "uuid": "73442420-6805-4a11-8654-a36390499e3c", "value": "12288:6Mrzy90immCEN5ccvbuNeay5j11nBrspHGFR45v09Z5wyJ0NDWY5qDw:5ytN15ccSsay5jXBrsZGFN9Z5Z0NYDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676663429, "uuid": "58ed6d3c-a291-4065-90cc-cefe99fea70c", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676663429, "uuid": "7dd3abea-d70b-404d-995c-d302b1feb5b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676663429, "uuid": "6a35633a-c68a-40aa-a0d4-a92ed8bbd67c", "value": "68c32d15e977f8e8ac72a69fda0a1a17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febb7b4f-aeda-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676649111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649111, "uuid": "9e45f28f-5fef-45af-9642-d8f275fd3717", "comment": "Malware payload", "value": "6cca556ca82bb19b8ac18846e40e9efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649111, "uuid": "a5c882a9-e32d-4e30-a859-ed6fecfb3901", "comment": "Malware payload", "value": "08f081b383a3e66e4e1caad317f7fe1880f9f9a260716a4e6c3e827aac38d3b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649111, "uuid": "2e97620d-5e80-434f-bdea-5713520da12f", "comment": "Malware payload", "value": "689279b17712e3a4773d1646ed4c72d37e609e5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649111, "uuid": "72f77937-87fe-4856-8367-ff14dda8bc3f", "comment": "Malware payload", "value": "1aafc6c26d6ba08b21919e560310f071e5bb802f278fe65f0a5426165d7708a0258fbfaf52f0386d70a88e01d00c4bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649111, "uuid": "25e939bb-6f62-428d-9c5f-af05d69f115e", "value": "T12DE53347F1E85322F8B403B0443702D61E35BF623A75AAAA16CF9C6C6C7253479A53B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649111, "uuid": "33eaa376-0a7b-4781-9c29-ccff795d0bb5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649111, "uuid": "21228e79-8c9a-40cf-9ec4-7e2e0ec5239c", "value": "49152:XR6eeR0wDwBcuU4D6nG/aYwuunjXH6r141q5mAC74jNH5OvnNjMJYvS8gXdNfgof:h6eeR05sw6G/j2jXHg418mejbOMJY43/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676649111, "uuid": "4e88b9b4-d950-4e56-b9fb-0a9d6bef9b5c", "value": 3122176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676649111, "uuid": "33e346db-cc5a-48a3-a5f2-23c0a66b1fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649111, "uuid": "17133e5c-de35-470b-93f3-19a19c4eeb99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46650d2e-aec3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676638924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638924, "uuid": "dc68b16e-c07d-446d-991a-5f8eeca854d8", "comment": "Malware payload (Amadey)", "value": "bca8dda08f6d94d1926ff6659b705ba5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638924, "uuid": "3cb18b7c-64c9-41e8-b2b7-68705fe4a762", "comment": "Malware payload (Amadey)", "value": "097bd6ce6d754f614b0cb7c0be5f4adeea5fd65bfb736208619c1b3d4cbbfb7a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638924, "uuid": "0ebfd129-3ffa-4aa9-b6fc-1aac3537352f", "comment": "Malware payload (Amadey)", "value": "e3430be4aa6e16ad8d20959a8a001a95104f4136", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638924, "uuid": "cb5b1cae-8a3e-4305-849c-3ab28027d14b", "comment": "Malware payload (Amadey)", "value": "e42fa795b1d765fbee0e7749ecd246fa34abdf429cfb88c67de320eb042254e39b4bcdc85ffd50f0632707fec199fc5d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638924, "uuid": "db216499-c8c3-4016-9076-677a02334daa", "value": "T16B252207B2E94473E87587B059F613C316367E511B348797234EED2D0872AB6EA3632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638924, "uuid": "533d68c6-2045-40ca-be99-934af3d4cb87", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638924, "uuid": "0190c77f-79d0-499f-a5d3-3e2cb12f5d76", "value": "24576:Xy6wT/znvSAc5SP22YOQD5oFYvRjJ2zo8oh:i6wzbSA8SuQHYvRjMzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676638924, "uuid": "3cc29468-54db-45a4-8ef3-0a611498c834", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676638924, "uuid": "129e24ee-ea3b-4089-b7b9-41ad2b8d1bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638924, "uuid": "47f77281-a8cc-4c99-9fa3-02b52e614c25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a24ed2f-aeaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676628085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628085, "uuid": "22f4fef2-161a-4775-bb62-823d254e0752", "comment": "Malware payload (RedLineStealer)", "value": "5f154d69732fe40ac1bd9cb8bc8a2fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628085, "uuid": "8f2cb343-a590-4eac-a662-509aba34c466", "comment": "Malware payload (RedLineStealer)", "value": "0a025d0ddfac7ecbcadf2b553b2fbcc417cbc4c1ad7196769420ce80f83286ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628085, "uuid": "61cefa90-d11f-4710-bb28-4b8d07145b23", "comment": "Malware payload (RedLineStealer)", "value": "91a57069c3a43bb7158c599f082b793baa99a94b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628085, "uuid": "e19712f8-0b4e-41dd-a247-a44cc163e0de", "comment": "Malware payload (RedLineStealer)", "value": "062609f8a7ca31cff6587eff75fe7e77ea23fd97bf1bf1ee88b2bbaa11b4c55f4275f4f6bf9a02fc464f04f96f70279e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628085, "uuid": "e437b6f2-17b0-48d0-a0b8-958558673100", "value": "T1FB64E01237D194B9E22356345F21C2B5BB2BF8708E3599AF379C163F0E756D2CA26311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628085, "uuid": "daa78b82-790e-4fb7-a0eb-876980f6f0d5", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628085, "uuid": "f95e0fae-2246-4b8d-97ea-acc0d76b69a2", "value": "6144:j7Y0pLDMxPcyNa69Wo00NefROU/AVEinM/95NCmaO:3Y2+Pcyb00NepvkEYM/NCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676628085, "uuid": "469b36e4-6e68-4699-8216-4b2e98d09a15", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676628085, "uuid": "fecc7872-5478-4281-8341-2a28fb7803d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628085, "uuid": "f1c1b847-83f1-42d4-904b-e5f7b660040f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6d40c6-aea7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676627146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627146, "uuid": "e0547271-20e7-42c3-83a6-b1baba945632", "comment": "Malware payload (GCleaner)", "value": "82cf38a6128b84fbf5c38f6c41a31e44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627146, "uuid": "ffc3bd9a-ccba-437d-b97d-9c65a27fc987", "comment": "Malware payload (GCleaner)", "value": "0abee00d1df79822758836db308356e7765b2f42493ec6ac2de1f42af0d09f8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627146, "uuid": "eaca3bc3-d1a7-442c-86ff-d8a4d9c14f8d", "comment": "Malware payload (GCleaner)", "value": "0287d66220a775ea79f182fbd12651f0d04186ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627146, "uuid": "e87953c7-f193-472c-afc7-47833cbda58c", "comment": "Malware payload (GCleaner)", "value": "e8097ed1a5f34c15c31dae6ccbad7e385c9e6331fb2f493c5242ac0e6238ef295b0a4c62594c74a0fe56ca6e9c26f17d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627146, "uuid": "2c25d8ce-4f7f-42fe-8608-52920958affd", "value": "T16ED523D66555C1F2C7FDCFF0F92D08A03933BE1BC8E5105739A87E6A293225E988D609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627146, "uuid": "2f2c2d0e-9174-4067-9ca5-17ade58d093b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627146, "uuid": "36cf1d83-592c-4e27-b783-92f537870bf1", "value": "49152:vNyqtWyEfPueooL0rKNm8Jo36gGLQTErh7LFWoTJ0/7rrH3bgN1g3MlVLCgv2MR:VXtWyqoGyF/36gGCah7LEoTJ2b4v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627146, "uuid": "94bcbff6-2d3c-4e7c-b169-3e94d3c06ef8", "value": 2901920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627146, "uuid": "e31217a1-c9d2-4a4a-b3f1-0586c2675b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627146, "uuid": "2ec95ec5-39ee-42b7-b84a-2ce63763bbd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa707e6-aea4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676625831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625831, "uuid": "9d64dcb3-56d3-4cf4-bcdd-bb99aaa43d65", "comment": "Malware payload (Amadey)", "value": "071986261a5160610c5502c02b0fd262", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625831, "uuid": "b93e2303-ac68-445d-b9ba-bf7330be57c5", "comment": "Malware payload (Amadey)", "value": "0ad0b245a9be3c6476d58742aaaa3452bd01ed2cb4f454d30eb26b1a61151b48", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625831, "uuid": "ec212516-1189-4608-b681-1a09a9dcf785", "comment": "Malware payload (Amadey)", "value": "97353c5978bacef96463c68641704938b7abcee4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625831, "uuid": "92160c93-0432-456d-baae-d6766bf30041", "comment": "Malware payload (Amadey)", "value": "43c4a79c581aad58131d1d6bc2fa10f4616b0fff002f2a8c3282aff0bd0bc4d8446107923ae6c49ba0e3f6dfb9709ae5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625831, "uuid": "85b64967-b37f-4e53-9599-68d6ad5254c1", "value": "T1C825231FF6F86412E9704B3008F903D30A36B9705B758397378B98A919B2AD4B67177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625831, "uuid": "fc186d3e-f4a7-444c-b4a6-d5a7b6cc4b59", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625831, "uuid": "dd3e16fb-4f3e-4c9b-885f-9a31ef33cc4b", "value": "12288:RMrEy90WR/K6NekrC5z9DxY3LbwVtxh987XElFL38kv4iWzgugue9h85f9FgcjNi:Vy3bYhDxY2DkCnvLWsXTUfccNAFKzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676625831, "uuid": "a48529ac-e547-4c68-8f49-ac4587e32cda", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676625831, "uuid": "e5bdefbe-f9b2-4591-9759-a1c31d42d2ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625831, "uuid": "a8373871-92bd-4f8d-b415-8b3d39cf7053", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de01a53-ae8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676616146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616146, "uuid": "b83b6929-a894-4ac9-8523-f4c83e4fbf23", "comment": "Malware payload (RedLineStealer)", "value": "0e9802288e86e24322d6175cea7216de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616146, "uuid": "8ab4a3af-a11f-477d-ae0f-f28bf767eed8", "comment": "Malware payload (RedLineStealer)", "value": "0ad22b2936423000cf2c18624ff86719964ff3be7a6647d4df973dbc1d1fb26f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616146, "uuid": "60cfadfd-0e90-4bdc-95ee-0b509c194c3f", "comment": "Malware payload (RedLineStealer)", "value": "852b0bb2ffced5c5a0a8b43c0fb1932f5aca7325", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616146, "uuid": "b7e94d64-069c-479f-b663-3f2503ffa7ec", "comment": "Malware payload (RedLineStealer)", "value": "41738ae6917f40baa44d3c3d30a153e16f95cf335f9cf829ec6d09a3a94fa13d0c11bd30acb66968f7068af2fbfd07cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616146, "uuid": "b8dea78e-8c9d-4c29-b791-62578b4c9a82", "value": "T1DB25134BBBEC8172E4B1633059FA03D31635BEF05D7487D3268BAD890872270AA75767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616146, "uuid": "46a51c87-33f8-4cc7-a731-79e734c5e315", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616146, "uuid": "d9d596f4-90f1-448a-b9c8-6b42f0d4fb42", "value": "24576:Dy5s6RcEphXk75T2oZtr82H5pe9bV47n8Wy:WpRc0UjZ5pybV47n8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676616146, "uuid": "62a1b563-5812-4b46-8501-5e6d9817372f", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676616146, "uuid": "530f0af7-c35b-47a5-be5e-1167c54265b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616146, "uuid": "706a705b-e388-4da5-8203-f6b8002b10cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83900d8-ae8f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676616888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616888, "uuid": "362455a7-4130-4e79-9b54-f392260b0b96", "comment": "Malware payload", "value": "6f6e71737110c99bce21e64bbbb6b406", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616888, "uuid": "8efb771b-1b6b-44cc-8eb2-37dfcdaaf35a", "comment": "Malware payload", "value": "0add97a1008a7d6e4aef558fb2fa0486c589d9236771f04f3f668ff0ef7f2fe1", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616888, "uuid": "15421900-b4bb-4536-9962-49b354a64f0d", "comment": "Malware payload", "value": "540b76d6297d35d393357752dc4c71696c92652b", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616888, "uuid": "48c2acbf-8dee-4a22-9592-9dcdd9c79ccd", "comment": "Malware payload", "value": "8afd700557d3fe8cb52cd09fc7a4e692f2d0ba7aadd94e165fb8ae10ce8d5afa6434214debdd5770f11f9954ae66e12d", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616888, "uuid": "f5cd53b3-622f-4869-9b0e-d8d4d68f7bd7", "value": "T1817423492C079CAF7E8115E3AF2A9E02EA32855BECF631D4858E4553761306EDF0963B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616888, "uuid": "66dd1144-452c-4015-a977-c1ccd1e6ef76", "value": "6144:U3yc1RKN8uEHfDHqDuCjQJ/QxJ/XuWSIU6Hl3O16kXY2C:8yQK+TfDKDu9KlXuWS6FNkFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676616888, "uuid": "8cdb248b-184a-4287-b2ce-b3fff942152f", "value": 362694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676616888, "uuid": "bdf46e25-ed4e-45b2-96db-154ed88b4848", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616888, "uuid": "c18926e3-cb5f-4ff4-9d99-aeea6948af52", "value": "SKM20230216_$55580.88USD.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c6279c-aec4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676639350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639350, "uuid": "5026fa7d-6821-469f-afef-3268027a43c6", "comment": "Malware payload (Amadey)", "value": "f60cc176dd96ba33422a8b9ad4969d3d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639350, "uuid": "7fc9b9c9-35a9-409e-97e6-5a9717294e66", "comment": "Malware payload (Amadey)", "value": "0bcb65a9d799743fde4f4fe485dfb85098968bc39c168dee098d190ac6493114", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639350, "uuid": "4683c493-1f22-4214-873f-0aae6b4e2ce9", "comment": "Malware payload (Amadey)", "value": "57a607e1adc1f7f57874168fa0ace1d15c86b198", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639350, "uuid": "76c028c0-8f89-441a-b557-22dffabc6358", "comment": "Malware payload (Amadey)", "value": "7885e5a919bdbf9d6d1b662c15e0b43d3ca18684f79d50e9cdfb828c29a85ce08069eec06b6ee39a3ae5dd7989ce402d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639350, "uuid": "b56fb8ce-3a77-40fa-b619-61b50717d063", "value": "T1E625220B37FC8466E9B457B058FB42C30A3A7E610B38C357638BAD5A1C635B4A57439B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639350, "uuid": "ae187b81-d790-4d54-ba8b-033f08e13e4c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639350, "uuid": "f82692ec-76cd-4499-9e57-7c91041399e3", "value": "24576:nyI0nja8ciYiZ59NH4/gBbcCcC8PlJRz:yzj9ci9Z5L4oBV96z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676639350, "uuid": "d40e3777-36e4-48ac-bc7d-e22564e9d72f", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676639350, "uuid": "e840f34d-ba8c-421a-b221-dfa04e53bcad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639350, "uuid": "6d502cff-1d03-4129-835a-7263fcfd5b48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d77d9d-ae68-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676600021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600021, "uuid": "af11b464-a0e6-4cb5-a379-741c3c7d8777", "comment": "Malware payload (RedLineStealer)", "value": "7996e63d41ddccda78afd972fdf56df0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600021, "uuid": "f2109012-b5f2-4872-b8bb-3fdfa4b4021b", "comment": "Malware payload (RedLineStealer)", "value": "0be8d1ed88c970d18e217003d51725ca7104ff70162a922cba885ddf3010ac61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600021, "uuid": "7782b6c0-a92e-4f88-9861-64d56b38dfcb", "comment": "Malware payload (RedLineStealer)", "value": "a6a2404234a636f20aa8927e66a0b63d86be47ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600021, "uuid": "33de2711-2479-479e-971b-fe54938f9eed", "comment": "Malware payload (RedLineStealer)", "value": "080be9c751cce8ce5f78f1c916cfbe4764fa5adeb751c65d25aab7e648fc9cdbea3ae80a8d579966f8a445746df10ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600021, "uuid": "44d06e6e-7c46-405d-8578-81d1bf976aa3", "value": "T10E25220BA6F41132E8712BF118F702D31A36BE511B348393274FEC5919736A4E676B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600021, "uuid": "710fcd71-7075-4888-98ba-167ef8c60551", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600021, "uuid": "ba13fc75-f4a6-4f02-9362-9b05d5a4da94", "value": "12288:hMrYy90bzXsT4d6cKZdacV6x53Rhq3czl8aSoLAO32i4zRb/AEoYZoEiyV1DShf:xyFe6Q26XBhKomo0OczKEpo0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676600021, "uuid": "35fae76b-98a2-43ff-8a06-113f66a8a9b1", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676600021, "uuid": "e66db937-a641-4e17-9afb-b7c8f926ca30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600021, "uuid": "a2d307ee-e5a4-4159-8e2b-e1c86171cbd5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde7299e-aeab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676628816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628816, "uuid": "3a5fe8ed-f2a1-48a2-85b7-44a38f76bfad", "comment": "Malware payload (RedLineStealer)", "value": "a817b19722d52998b7d2d69774af9060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628816, "uuid": "488497ed-8e52-427c-81b1-713fa64d9049", "comment": "Malware payload (RedLineStealer)", "value": "0c5ee3866fb100bdd3baee91ed96e662f26b22182a53b0989112abbfbff0fd25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628816, "uuid": "91f62366-de9b-4104-9c6a-01417137a80d", "comment": "Malware payload (RedLineStealer)", "value": "5dbf6273380d8d5d1db65fa7da9bbb716e51cd79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628816, "uuid": "6fb6a508-1128-436b-ac56-c2577e56758e", "comment": "Malware payload (RedLineStealer)", "value": "23dc6013a7153709ac6e4a7a8315320a6183d3933ccd20ce8c614f176fa0076af96d4127c2bae77a1ece7b64012d975b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628816, "uuid": "69b0c95a-f252-400e-a38f-3d71b6a65032", "value": "T149252357D5ED9433E87957B018F746D30732BFA0AB38C29B264F9D4A1832560B23276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628816, "uuid": "ed023b66-9572-4256-9624-b63f32c0ccb5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628816, "uuid": "da6eff9a-81a3-446b-9490-761a0c87c148", "value": "24576:6y0uTlGp3UX0GiI+06ZZOvsVsQn5ucUbAbsKaVnXtu:BJS32+tiOnAVb9Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676628816, "uuid": "97ae84ef-5424-445d-b31c-19b29e7ade6a", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676628816, "uuid": "9c2b3291-12e5-44e3-bf42-4cb5ed622c49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628816, "uuid": "02cddf18-891e-4015-bd06-42a4373bc66d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6100b178-ae9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676621788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621788, "uuid": "1fa56e3d-0e70-4b75-bb50-104edfc4ec52", "comment": "Malware payload (GCleaner)", "value": "fc55631598c585cf8c6bcfaa4f7557a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621788, "uuid": "decc77de-8f3d-4aae-8c7f-e3915d9da968", "comment": "Malware payload (GCleaner)", "value": "0cf29d9236719da686f4603eb2db315192ac6efd14778c76f56db8cdbc2b49e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621788, "uuid": "e1f6c40e-f623-447b-b5f1-28d568c48ee3", "comment": "Malware payload (GCleaner)", "value": "eadc7c5e4127432c7412c33ee3d8350362784bfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621788, "uuid": "c45f5078-3776-4bef-9882-ed6384f75142", "comment": "Malware payload (GCleaner)", "value": "c3aedd27f4d78a93f444abb93da8bb81d8654879cf558d9ba4c9fa71594d25606b7994a07c35873a31c87fb9391730ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621788, "uuid": "e0b52bb3-c34f-4a3c-b8a4-22feed1297f1", "value": "T1FED523CA6C26D0E2EBFDCFF4B91E81E07AB73D6FE095552A749E7926317219C980C104", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621788, "uuid": "26f37ddb-9dde-4195-8c1b-5ec848f222af", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621788, "uuid": "5d3f775e-6b9a-4bf7-ae8d-a490a858a1d2", "value": "49152:vNf0SeBCdKhs2zP6qp8GiEKtgPr/cm6I9PdWK1Z07Cc7gCnX3nWXGLCgv2MR:Vpewdf2zPnp8bEK2PDNtsKTHqrv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676621788, "uuid": "5352fa51-e456-4d6a-9850-02d386354d50", "value": 2894593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676621788, "uuid": "9364e02a-8394-4c0a-a51d-2a278c2e797b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621788, "uuid": "b3075725-babc-4de0-8d5a-6e089b253cb0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b841b198-ae71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676603896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676603896, "uuid": "a192d95c-01b0-4b30-a73a-3d814aa5981e", "comment": "Malware payload (Smoke Loader)", "value": "80f560ff4a90ea8d7a81bd57424d3c1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676603896, "uuid": "3d35d1ee-cbe5-41e3-990e-c0203f803dac", "comment": "Malware payload (Smoke Loader)", "value": "0e4722653d9d917e35cd403924899bf3d66515b4e7d9d2000ff0ace516b7d95d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676603896, "uuid": "c7b2e8a0-5c89-48b1-b08c-b23767db04f2", "comment": "Malware payload (Smoke Loader)", "value": "fe628bdfc3de7cb0ab475c0ac666586cf34dd936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676603896, "uuid": "617326e1-d7b5-44db-b57f-4de294d08f1c", "comment": "Malware payload (Smoke Loader)", "value": "31da16344e0f2d73d2470ceec3eaaf0ff841d616170ec048f41cd76cca4e3892a96f09f773d123be03a48d1fc9a84823", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676603896, "uuid": "63e2dc07-f473-43ca-8dec-39b2020d1371", "value": "T1A4446D53A3E17C41D9268A729E2EC7E87A0EF5608F49776E521DDA3F04B41B2C3A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676603896, "uuid": "23121df7-7114-4130-9dde-c8b74bdcb87b", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676603896, "uuid": "242d58f7-d381-4ef7-95c0-46455a3e535b", "value": "3072:FbjZT1RLhpERKFboo4gI8k3BG1VubG15foHZ4S8HPVrtPe6v:NNTDLMKNv2GU0RJzHth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676603896, "uuid": "d6698303-ebe3-44cf-8367-b67a717d2044", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676603896, "uuid": "d1abdb3c-457f-4126-bed4-618c96ae05c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676603896, "uuid": "9a86b9ce-a2c4-4f36-a8e0-d9dfd6fc499e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb24d0ac-aeaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676630637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630637, "uuid": "180720de-1f00-4583-969b-8ba8940ecf8e", "comment": "Malware payload (AgentTesla)", "value": "ee832496d4580e3da0886a90e5609b73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630637, "uuid": "8dd74117-19a5-40f5-b836-b603b7c7fcd1", "comment": "Malware payload (AgentTesla)", "value": "0e6c69d5fa33f7002d300ea0f1c0493967c3fa779c9ede1839b8d05af23d2192", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630637, "uuid": "e0f4c460-6aa2-4b92-b417-04493ed5cae1", "comment": "Malware payload (AgentTesla)", "value": "29da15d5f225928fabb1ae46f775ce6624913627", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630637, "uuid": "863b23f0-b2a5-4912-988f-0e02665794b3", "comment": "Malware payload (AgentTesla)", "value": "e9990e1888c76f09f0903c51e8b4b12cf68e09b0e1b7dae9c98c2292bc623a8d5e4b80795e1abb135a6bd586b1f87577", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630637, "uuid": "07fc6fc5-b86f-4007-862b-296ee43a6589", "value": "T1B405F43D39B796D2C238FA3386E7E520B5BD88923317C959D9D62AC04F412827DCE95C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630637, "uuid": "2de9c237-462a-4c61-bc82-002176b826d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630637, "uuid": "563b5ba0-c5d3-480d-b2e2-ff8f3d6a635c", "value": "24576:QTsIBMNjnNNOhAe/S0P14TXkVt1lUxNZsR5s:loVtD+0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630637, "uuid": "c63eac1c-b90f-428a-ba97-6a1337fb4021", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630637, "uuid": "53b5b8e0-63cc-4db0-bfb9-0920c9849e94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630637, "uuid": "232d1e45-87e1-46d0-862f-66fff4b23c8b", "value": "iH4bFWPI9oJtdV5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c1c5ab9-aeaa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676628088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628088, "uuid": "33f97db9-cff9-44cb-88eb-960ba13d569c", "comment": "Malware payload", "value": "30b80fd3e35c9960f1503cceaee766ab", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628088, "uuid": "d160540d-1acb-4cde-be5d-c319abfc40b5", "comment": "Malware payload", "value": "0ea4da009afee2c57d61a37ab9baec69e071650c2ffd21a9dabe6fdd3de8c516", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628088, "uuid": "5c9800a7-6634-4636-b1e7-b2abcfd6a0b4", "comment": "Malware payload", "value": "468365e83c26608b6cf06ad84d5010cb250b1c2b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628088, "uuid": "63558c98-4a2a-4d98-8633-ece4a4233842", "comment": "Malware payload", "value": "345573bca8a378c0b5a8015dfbaf1c529f29fa6a1b9d038a2f939dfe1d5c6d6cc14b1cd65c219483c92165f68a856c31", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628088, "uuid": "b6ad896c-9290-4b48-8d1d-32342bd059fa", "value": "T11CD1E178D675BDD406FA72C09AE13945B078AD13C6724A68FB8C0CF735A8705DF34AA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628088, "uuid": "67f014f8-52d0-49d4-a5a9-9254744645a7", "value": "96:7Qr+aDWRy5/cqDiHFbATW13K4kw+kwMcIHgU8GrSCA+yOEmSnoi+vs/GtS3VmrAE:UiaP7ulyW13EhMcI8wrEmSo3se4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676628088, "uuid": "bd42eb30-0fd9-4c4a-be90-73cc8f680ed2", "value": 6487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676628088, "uuid": "4ac4f83a-836a-4291-96aa-90cb9ade5f94", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628088, "uuid": "6cc70a0a-0495-4526-8587-dc015212bae5", "value": "heyyy.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d94ede9-aedb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676649244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649244, "uuid": "4f29c950-c0af-43e4-86f1-cb3c27caf34c", "comment": "Malware payload (Smoke Loader)", "value": "ee07f7d98dfefef2bcb7167b33b0eb87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649244, "uuid": "c2de5a85-c26d-41d1-8b7b-82973d12f64a", "comment": "Malware payload (Smoke Loader)", "value": "0ef0b37c1e90843380634dc1dddc087a1c556f8ff4dca1c17842dfef8d35fc42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649244, "uuid": "19fc8b29-2e1f-48bd-932c-636769073657", "comment": "Malware payload (Smoke Loader)", "value": "844866b6c920cd9120d061c26af5837eeb0f0ed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649244, "uuid": "2199d286-cad5-475d-a545-3a44b1d93e42", "comment": "Malware payload (Smoke Loader)", "value": "13602c98d5680af9f17b3e9af56fe233350784bf85fc57faa9e10e52208c57145426fdc1438eee97970b6ee74f6ab5b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649244, "uuid": "ef2f3d1e-89dd-4063-9b9a-48b0243f6084", "value": "T1DA04DF613AD5C072F22356344D61C2B29B3BBCB18A768D8B2FC526AE1F706C1DB25357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649244, "uuid": "77f27c72-1a42-4eeb-9cf3-edfcc6e5aea9", "value": "04d4ff0968f0d2d964fcf7ad4ec4e8a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649244, "uuid": "acfbe669-0d39-4352-a6bf-fe2438b1051e", "value": "3072:eOyrsZ/p9YuOVtNWYsdkaOiTpiTHhQf7Ru8nY6z4+HkKpy:4+gbVzW3eYoTBQ9F/zXHkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676649244, "uuid": "53485ddb-02fd-48af-ab0e-a5a63377fc94", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676649244, "uuid": "c2af89ac-a177-44f3-9795-b76a26a886df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649244, "uuid": "bb926e52-2904-4879-8aaf-adc325ad270c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae31878-ae77-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676606558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606558, "uuid": "1fd6f549-43af-4950-afc7-df174444c9f9", "comment": "Malware payload (ManusCrypt)", "value": "02348a17d7359dde9ece8b697d7262e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606558, "uuid": "05523110-ad86-4f74-b911-44d3087901cd", "comment": "Malware payload (ManusCrypt)", "value": "0f8957164a9652a11ebdc564de062475ab11f8b4ff0cf7394a317f8460ca059f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606558, "uuid": "f4ce6c29-d25e-48d8-b465-c2eed77a7fb5", "comment": "Malware payload (ManusCrypt)", "value": "d673af306db28ff02a95dec9efea43a26a0ba85f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606558, "uuid": "f7dd7feb-f5f8-4096-b7c8-d5beb734ff2c", "comment": "Malware payload (ManusCrypt)", "value": "8bf60245e32053bcc77c935970b9a3ae1c537ac26a55982832aebe707d25e8f5f150169f905e011a27bd9b0ec28bb848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606558, "uuid": "c764956b-30e4-45b7-b7e2-38a554a4f881", "value": "T1EA446C13A6E17C45E526CB729E1EC7E87A1EF5608F49776E1219EA3F05B02B2C363710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606558, "uuid": "55318782-d5e1-46ba-93f6-45cd2eeaa668", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606558, "uuid": "fd5f8f64-e35f-4d6c-b8ea-2a4d596f6d91", "value": "3072:Lb0i2QfgLrpEQrTboo4gugBI44GqqUiw6XFOdLwyXUVfSvtffzHPVDjv:Pp2Q4LPrXvu4I4vqJinVmAVfSxzHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676606558, "uuid": "964a6eb6-4ce0-4d89-ac50-de0c228730a9", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676606558, "uuid": "6bef4346-4a2f-4400-949d-da28b6d3f51c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606558, "uuid": "8c1b4512-0312-4b21-95ea-570e790be05e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc7512c-aeab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1676628789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628789, "uuid": "64684b19-a30d-4d8c-89b5-2be61f3d4621", "comment": "Malware payload (RustyStealer)", "value": "f6ed1f34f629ab51dba4c63dc57c1a91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628789, "uuid": "39262d41-01ab-48d2-af38-1fe8fc0649e9", "comment": "Malware payload (RustyStealer)", "value": "104645c74843e385754502a80a935156b585c6969fba1be83efe9b554a746560", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628789, "uuid": "83097cfa-4f2c-404d-8e17-8108be9b2058", "comment": "Malware payload (RustyStealer)", "value": "b62bbeef12de9a18ecf785153b9b429bca733aba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628789, "uuid": "e8a66227-c58e-4570-8ee5-3a05d79fcb6f", "comment": "Malware payload (RustyStealer)", "value": "90b6782d926dccd9a11d1479bc64454113d2bdff79dae69ef8ee045d5f16c629f315e98d3da571ebce7f71db4322b51e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628789, "uuid": "60000550-2595-4bf3-be31-de5c9e18de99", "value": "T1B876231D8C22EDABFFE3D5F18CAB86E45B106F3D6000ABA613A1A8754B2CD1744DD578", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628789, "uuid": "cf99e04b-47c2-40ea-bcb7-4f67c926b00e", "value": "74737a1c73116b0c6a3ee2f6399e6458", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628789, "uuid": "d77f384b-7b64-42c4-bac2-17411faab624", "value": "196608:7DANPFmCV+OoxomMRb4MGK3oI8XY2OqjoRK:70HPE+7GK3oVhOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676628789, "uuid": "e81e1ee8-0d97-4e4c-83ac-1dd45cd2abd4", "value": 7182264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676628789, "uuid": "c05b4cfe-72da-4ecc-9898-bde0fd5b5c0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628789, "uuid": "531fa63a-b38c-472e-801e-a9bca60c8752", "value": "f6ed1f34f629ab51dba4c63dc57c1a91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96e3496-ae97-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676620326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620326, "uuid": "6b3a5b43-6437-44cb-8c76-b1613b842537", "comment": "Malware payload (Mirai)", "value": "ec0d5c7547687e907cbde0f0b98b00f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620326, "uuid": "5a0095b4-3624-4c9a-847a-498144e9ff5e", "comment": "Malware payload (Mirai)", "value": "10865710f92be758e89d282f56b755213406ff78e9c4b936d227db83cb7d2ae9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620326, "uuid": "3404cea7-1024-41fd-9933-cfe0cd61f297", "comment": "Malware payload (Mirai)", "value": "4b12e59ab12371302ce10b1946a449c3f9eb7e5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620326, "uuid": "6eabacce-387b-4575-8709-2e1913770e96", "comment": "Malware payload (Mirai)", "value": "4226b325713a6c9e70256869244fe944880f111a8068da19368a31b10b1daab3472d8b7960cdcb2f535ae77412a20593", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620326, "uuid": "a3859b2b-8409-46d8-826c-deb03b2bd684", "value": "T17FD2E078F4147C82EA9F7EF0598AC788BBE307E89A23C5E76125DA43801111DE354EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620326, "uuid": "f56cd5b5-9add-46c4-b450-d3646de7e7a8", "value": "768:xna3pTDhmaVBLhYjTdFRWUf+cL4X34vxXpe/BqfpgM5s4uVcqgw09R:tST9maVBF07RN+F34vxYis4u+qgw09R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620326, "uuid": "2651e2fc-b2b4-4c7f-976c-e7078c52c4fa", "value": 28536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620326, "uuid": "815083ae-98a5-4fd4-a8f7-9f0e49e3ad54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620326, "uuid": "519f0d3d-59a0-4e7a-aa38-cfb419ddc19f", "value": "ec0d5c7547687e907cbde0f0b98b00f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc96f7b-aec8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676641001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641001, "uuid": "12e0c77c-efc8-4671-9116-54d11f272e94", "comment": "Malware payload (Amadey)", "value": "5fad2d3641adeacf37aa520e9f1021a1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641001, "uuid": "28784e7e-30d6-47be-8c78-8fd3d012830f", "comment": "Malware payload (Amadey)", "value": "10aa4328b46fc3747f21413f80d4cb6fe7c13d2e814b73375fe01f7dcede1e55", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641001, "uuid": "cc2f2fe4-81b3-4452-a586-16a5da227167", "comment": "Malware payload (Amadey)", "value": "0c9db855baaefd242480a1bf587d0551ff328bd3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641001, "uuid": "1a1de103-838c-486d-8ff3-82217ffdac52", "comment": "Malware payload (Amadey)", "value": "4f34f57848b2d80187fd0704265aa36181ef0f433dcd22236824c62020faa2a6f1e83b7fb30c764c9f53631dc0cee806", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641001, "uuid": "2e60f3de-80bc-4555-a457-53aec7490b00", "value": "T10525130BE5E88432ECB5477019F042D31A36F9A1577452CB27CFAC1A5873AE5B6307AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641001, "uuid": "9ca7df26-a78f-47e7-ac2a-7ea0cb075ab6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641001, "uuid": "d6148cf5-c122-42ce-888f-42736ceb3a4c", "value": "24576:Hyt9Yhkdkb/CUAtyjfmse0d/iBIH6J4Oj:SHYhbVSyKr0ox4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676641001, "uuid": "215e97e9-4551-4370-a6a2-4fc53704c49b", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676641001, "uuid": "b68c7499-5f48-4b0b-ae9c-b00dc843a9dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641001, "uuid": "d0f8c992-915d-41f0-9ebd-9da6c89d5542", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e71f916-ae7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676609275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609275, "uuid": "be857bf5-4a1b-49a8-b876-2f7528a89bb6", "comment": "Malware payload (GCleaner)", "value": "f133fd6542d438636b488ae3d24ba96d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609275, "uuid": "f41f5edd-b770-4145-b5ec-e4b625c75ccf", "comment": "Malware payload (GCleaner)", "value": "120ba5542336f7a2a317c389430e116d01873907068e2f0140d1e628cb0403d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609275, "uuid": "ff605d3b-019b-4893-a0d3-9a48a4d1b7c4", "comment": "Malware payload (GCleaner)", "value": "ca1345743bfcc6fb1e3cea7315cc4b7613f499fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609275, "uuid": "20b6add3-82d0-4194-bcb1-648694a68202", "comment": "Malware payload (GCleaner)", "value": "d90adab0d701ad8067c8a5c27f2bce656f711ca8778c4948ac7f62e63a3b0ec494f9fa92cc038c6c2e8bd4fd97c448dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609275, "uuid": "63f111d2-2a73-425d-9963-92b42398fd23", "value": "T1FFE523D67A18C2E3D7FDDFF1B81E89E97A677C1396E4406375683E29A63222CC01D604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609275, "uuid": "d5d4b7fa-1682-4bb2-8dda-06a4a8036e53", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609275, "uuid": "bedf5bcc-58e0-44c8-a5eb-1bb95bd8f207", "value": "49152:XHrHnekJvLiqv2s6yoCkAkb+dFOBGlnBhYUHETpkkuVW4k6H4bGvsBcOMTtRkmpp:3rHnekQlIk8FiGlBhYkgSdWLivKcOM1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676609275, "uuid": "b4ee21ef-182b-4ec8-bf84-1c0be66c5505", "value": 3132673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676609275, "uuid": "54e09296-4d13-4156-aaf9-8cad7a56e222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609275, "uuid": "53018273-0b91-4bf4-92e8-08dc141bd821", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8babdcf4-ae5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676595661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595661, "uuid": "4a16f985-2e91-46b9-b4b3-0cef2da763aa", "comment": "Malware payload (RedLineStealer)", "value": "be4ed69edeb4ae978038700428c2dcec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595661, "uuid": "59dea1ec-7287-4096-b3aa-01e56958bdad", "comment": "Malware payload (RedLineStealer)", "value": "1213031ef7cce9edadc56b7737a4885c77a87a6c2ab8668be7bcd7d1dd978f68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595661, "uuid": "3bf7dc4c-1067-4d22-87ed-6006164e80aa", "comment": "Malware payload (RedLineStealer)", "value": "a3a2e648f9a6dc5262d59b9cb59614775370d8b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595661, "uuid": "f4c2f7a9-92f9-46b8-8af2-95c3f668cbf1", "comment": "Malware payload (RedLineStealer)", "value": "4e50f9dfe9e9c774dd899c7b7c43785a24683ad1df95de3d949c81a13ca7937959c30d423ed88e167a1a786d836f9cf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595661, "uuid": "fbb25f7f-49fe-4da9-8e69-36f02ffc1906", "value": "T15874AE93A6E17D50E5168A729E1EC7E87A1EF6604F49376E1219DA3F04F01B2C3A3713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595661, "uuid": "ea626f5a-4bea-4b47-afa0-0776660bcacd", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595661, "uuid": "9b2d251a-25d2-4d40-8af3-d40b1168d5a8", "value": "6144:tPVYKLr3Uve2T0D2tg5MsmGBig4LNABxb6ASldR5JZ9HNJ:5Vj33XiWRBB34LYSZ5JZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676595661, "uuid": "0544e485-6a1e-45eb-bcbe-5d759bb2512a", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676595661, "uuid": "f40df64f-d2b8-4986-9b08-44660b7c1972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595661, "uuid": "47038a02-5d73-4a05-a5c9-30dbe4019eea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4a3264-aea5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676626267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626267, "uuid": "2f532d24-cf6c-427c-bd0b-79ba1255308c", "comment": "Malware payload", "value": "f621205f4f329992ba8146bf723050ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626267, "uuid": "0ad31c4f-5b18-4da7-9914-1dd522598967", "comment": "Malware payload", "value": "12b54253986d3c0697596c13a0786316bdee6416f4e51446d5df23d9a1a7e08e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626267, "uuid": "a4d0bdf5-9e81-4041-92f4-21be9d19639c", "comment": "Malware payload", "value": "3b197dfb0e469e0deab5900e829106fba472c8c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626267, "uuid": "de28e8e1-0166-46bb-9f13-8d5dfa264e82", "comment": "Malware payload", "value": "d2369ea0bc620a68c627542bd5060305611480df4248967834b957e0705b0811498031c8bd181c20c494b37752663da5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626267, "uuid": "a33ada87-ce67-4d9c-9c30-f2aa77529c0c", "value": "T18CE48C8C91F1EB3ECB498EBA371035081FE056436920D9E6E3E6FAC26F36523199D535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626267, "uuid": "fb570ebb-6c36-4b9a-83f8-c45cd4e75ad7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626267, "uuid": "a8281d8f-8474-494d-99cd-bfe27d2d08eb", "value": "12288:vDyqDSugYafY9ur/pruj5LbH/aWtyzBviOZwcLRx6zMpEZNwDsv9tuDsv9t:vDyqDSugYMYo7pruNbH/aWtoBvjwcGw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676626267, "uuid": "56e84a79-6dcf-4d39-8a70-5cea361beab8", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676626267, "uuid": "9a57d72c-bab0-4823-ac43-1b8b8a1573b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626267, "uuid": "44081207-c223-452b-aa9c-7a59b80732c5", "value": "EQ 6272-NA001-0223 , Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1f49ed-ae7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676609326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609326, "uuid": "96fdafad-a706-4d8a-a5ac-15c765d069bc", "comment": "Malware payload (RedLineStealer)", "value": "9495b170453c8ead761a6f7d0ba7502a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609326, "uuid": "2f3c4901-cfde-496f-af8b-9463361dcd5b", "comment": "Malware payload (RedLineStealer)", "value": "130de0d77826c2ccdc90d405afe86acd14d91aedceab3c815c14e0b9571f5154", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609326, "uuid": "44791e01-722e-4813-b8f2-1457deff8344", "comment": "Malware payload (RedLineStealer)", "value": "ca07cd7f0671bb554448b738416a1c4cec5f4341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609326, "uuid": "d532e23b-4631-443d-b108-35279ad5ce16", "comment": "Malware payload (RedLineStealer)", "value": "66d4d412b4f3ef0dd840b5e562ce57c85c3d429a3bb35a6f765e6fc3dbf0973c3a7edd3526b23e78e904a2c36f586e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609326, "uuid": "98cb994f-e502-4a15-9571-aac01a2a1193", "value": "T12F25234BBBD88132E879477098F502C31B367EA2573493EB754B2C1A44766B0B670B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609326, "uuid": "86563b33-9d77-456b-921d-78b4c13269de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609326, "uuid": "4d13d076-c526-4b52-96f5-0ab7dd2cf12e", "value": "24576:wyFRn3QrCOOHtxLiKNy65miwDf0GoroSmmAMSM3n:3FYONxLi5ZXfnEfmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676609326, "uuid": "1088664b-041c-4947-a59b-b09966368e5c", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676609326, "uuid": "0f6a8f00-6261-4d55-b9a1-109be0e8e764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609326, "uuid": "ac93aabf-93dd-4f86-8cab-606a38508f6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b07dd49-ae84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676611846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611846, "uuid": "67136315-636e-4f0e-9a87-2d2c544cd8c3", "comment": "Malware payload (Amadey)", "value": "0135f8c68dce2aedf3d32ecbd768034b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611846, "uuid": "012439ed-4d7f-4bb0-8733-4438dea0fef8", "comment": "Malware payload (Amadey)", "value": "13683735afe8396e9355c86550828ec430ce58e5304dffe7b217943503d9acd1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611846, "uuid": "c4c2f685-361a-4330-a6bc-44e440b6bb24", "comment": "Malware payload (Amadey)", "value": "72f07a965396dc7ee7f0e31a31c50a76330862d9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611846, "uuid": "e17a021c-6541-4ba5-ad22-6d89e2f6d974", "comment": "Malware payload (Amadey)", "value": "b717a5676b65bf055584ef3df50041eda3d3d7c439f2ca8f30b0dfa4e85094d61271c627593248c4e4008589b6a40c75", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611846, "uuid": "e6f957b4-340f-4200-a679-bda43d477cf3", "value": "T16525135BA7EC4036D476873114FA03D31A3BBD912B3853A6275BAD1A4C732F0A6353A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611846, "uuid": "748d82d2-6b55-4179-bd46-debee4b2dce6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611846, "uuid": "542079fe-cc07-4573-81d6-08a822c26a50", "value": "24576:Iy5+KgDEpuOVURaFa3NTyZs+c9lG+FqtGATaJn:P5FpikOaWsGGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676611846, "uuid": "cc9955b1-500b-4d3e-b5d4-829f66561795", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676611846, "uuid": "98203c2b-9d5b-4bfb-b8dd-81140bd3c385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611846, "uuid": "3beb27e6-8073-44c5-9c29-99b8e591f07a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f41aa9-aec8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676641126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641126, "uuid": "c8624200-eaff-4c7e-9fd4-1f86a4013b9a", "comment": "Malware payload", "value": "333987ddad4cf3c8a6f207afc7ef7612", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641126, "uuid": "422ecee2-6596-4a26-8703-1951ace28ae9", "comment": "Malware payload", "value": "1379d09c55e98dad0f2cd390e894c9633546563f6dbca39e6132f55954c84ba0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641126, "uuid": "a83837d2-00c5-4b0d-a37b-d41280135883", "comment": "Malware payload", "value": "09081b89a7ef873f4adfb0f459b333f7f1571699", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641126, "uuid": "98d4cc30-7988-480b-bf99-eb0441fdbfc0", "comment": "Malware payload", "value": "bdd9902f21420ee7f5a33efb79f4698144f655a37ce6a1306e3e3ffdee3b4dd664f6e06436c9767a4719a188ee41c2d6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641126, "uuid": "001c08c2-81e9-4e92-b718-47c88bd46c97", "value": "T17993125086F0E405D5E252B70393322DE9C72AE070BE2D9E4736355F9182BA8BD592FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641126, "uuid": "88f7f784-85b3-4cef-b483-10edfd3e1d87", "value": "1536:zzI4c3CtFnnXWBszqzQCsP6sk20sb8TA2EVZHshJqrdQqd/2GgbidrXQyenz:z84c3snnq1zDTjFGMhKdQqd/8bPyenz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676641126, "uuid": "d839dbdf-c9f0-4be2-adc3-5f139ff50d8d", "value": 94380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676641126, "uuid": "8314a3ce-3e0b-4f9c-a431-3a899ba96ffb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641126, "uuid": "7739cd1a-5846-4039-a4f8-987a02411b44", "value": "9196420384.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330e5032-ae61-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676596800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676596800, "uuid": "e95102de-31ea-4aec-90a7-075de248944c", "comment": "Malware payload (RedLineStealer)", "value": "b1f565793912fefff7facb57175a6aa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676596800, "uuid": "865d510f-f015-4b76-b188-94aa39ad45b2", "comment": "Malware payload (RedLineStealer)", "value": "138c49c61ea79706300a8b740abd9a3ca7cf6b3b6ca800187e2548b8da2076ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676596800, "uuid": "7c89a9e8-e803-46bc-8680-c61f72d0aad4", "comment": "Malware payload (RedLineStealer)", "value": "f9d4045a441b724f9c25363fdd4ef58311a43272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676596800, "uuid": "3b1e7c6c-9e0f-457a-bce5-36ccff84d1d3", "comment": "Malware payload (RedLineStealer)", "value": "64b5fca9b7c29c6b326d123362655e55d27ce3ca493c7bb83f9d3682a93b25a2ee2ca8a9b0e385d7a69add85e7e69fb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676596800, "uuid": "da24c95e-1ced-48cf-9e25-f732c497e548", "value": "T12B25225BB7E81032D8A15BB025B70AD30A32BC745A78834B138B6D9D58727B4BA35737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676596800, "uuid": "d44401b9-0442-43be-b403-524eeb7f610e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676596800, "uuid": "cc256595-f416-4dac-bbcb-3230a0d90acc", "value": "24576:fyt/z5XqLuqo68Hc1nddhc3m2h6TchFN:q10oTHGImJuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676596800, "uuid": "beb37e23-22b3-4ad1-b50b-66389e480b8f", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676596800, "uuid": "bd60efaa-425d-4e7a-a704-b53c24ded56e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676596800, "uuid": "f7ab5334-0c2c-49e3-b0d6-ca16d24bff2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f60d07-ae66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676599270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676599270, "uuid": "4ebb41fe-84ca-48fc-a62b-882ff47a184f", "comment": "Malware payload (RedLineStealer)", "value": "8c38b143aaf05f50b27bb747a5b5af60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676599270, "uuid": "a8b9de03-20fc-4304-b8a3-ddceb4bce922", "comment": "Malware payload (RedLineStealer)", "value": "13d0c590609f4cd55671c36ef1cfb3fa69b85eefda4717c5faff9daeda8e9e09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676599270, "uuid": "53e42b1e-bb04-4aaf-9341-ac320ca6df91", "comment": "Malware payload (RedLineStealer)", "value": "d923426d3a65c60cd62355c0f8052315bd1ef05f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676599270, "uuid": "18719471-5112-46b0-a088-016cce4ea343", "comment": "Malware payload (RedLineStealer)", "value": "a07890417779aafd8f2a98c54f6159a4b72e0c2a4300e8ebbdb1a1f67d27eac495109e4c08b611e57b3bb81e134caa16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676599270, "uuid": "f601e720-30a4-4ece-8d40-60b114dc7801", "value": "T19525120BEBE84035D4B55FB119F35AD309367E905B7883E6234FA98C19736B0A03676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676599270, "uuid": "9f796c1a-21a8-4293-8f6d-2dd38a7ceb56", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676599270, "uuid": "9b615f9a-949b-4dd4-9325-8b97d8e1638a", "value": "12288:CMrny90TGTgiVTsWDxOT7wRuAfCIg5GgEjkuiz0NGi4QgG8mq6hH2fl/Ij0K2rl7:1yxDVA6oQsAfyEguMQgGnhslQqHJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676599270, "uuid": "ad840c01-0541-42aa-bd99-eb83d1bd65fb", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676599270, "uuid": "6e6416fe-5613-4da9-b6cd-3f310d4f7136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676599270, "uuid": "033e9da7-2075-41d9-885c-d23267b58f04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51a20c5-aec3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676639190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639190, "uuid": "f157d1be-64ea-4a2c-a57a-a92aa2880025", "comment": "Malware payload", "value": "3cf860c04441652062810209fc5d0646", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639190, "uuid": "6d1d3232-d40a-43d3-8c74-54cf2a56a710", "comment": "Malware payload", "value": "1412834388380f678cedd1859951adef8bd6de45dad85373c0ca447ed99ab66c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639190, "uuid": "298a2039-7f5b-4a58-88d0-e0229880cdfb", "comment": "Malware payload", "value": "7e7a428fa5900a23378f124576c9e3eaddcd0712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639190, "uuid": "536390fe-b21d-4610-b37d-87c83845657e", "comment": "Malware payload", "value": "693728184446166aa0db31452d3a86663f0b6732772c0c83517489dabab9628a5c150bfaa9b0f9305f98cc34e3e6359b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639190, "uuid": "995d393e-1171-4efa-be74-233415a3bac8", "value": "T1EE848E25F604D431F4720175AB6E9BB2A87CA9B01342A5C3F3D44DBD6DB02E25A7A31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639190, "uuid": "3b5f74e7-7580-4034-b806-8f676b19f353", "value": "62374eb623a42f583f62e0a54b7bc20c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639190, "uuid": "723d3e60-3d7c-47b2-9a4e-56b387690192", "value": "6144:7KpfzMTkFpYnOOeV4mR+OO83puRqHMFatWMYwzbkL2U5dCkJR:7KpfYTkFNv8H83w0MFatTJYLNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676639190, "uuid": "c2303799-ecd7-4abf-a261-c5f0c4854ea2", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676639190, "uuid": "77c59f3e-9a62-4a1e-b776-9208d9ee9100", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639190, "uuid": "406bb07d-3e2e-4361-a441-92f194d39e01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30970be-aeb6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676633496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633496, "uuid": "8bdaca9c-c114-4098-9d97-059ecabe4ab9", "comment": "Malware payload", "value": "d73ac14149a6ecc82581d15674167e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633496, "uuid": "e413c55b-b7c3-4a6c-ba1b-a2125a7b99df", "comment": "Malware payload", "value": "145bfe76b993e6fa34ce4d6e56d073155239e84ceaf09a219034dc306529c5bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633496, "uuid": "62c9b046-afe7-498d-b500-2cf4dfc6feb5", "comment": "Malware payload", "value": "b8c3f31cb95057d69702b059ada885eac1b21452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633496, "uuid": "2a210b51-ce1f-4bea-9519-7cefc5732cf3", "comment": "Malware payload", "value": "7675ab28dd0780bd6d5114b7d5d004b5509d638fd6cef0c944e9814bc68b8adb8a2566ca8ea92294bcddb414e236d6cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633496, "uuid": "46036f35-c5a1-4147-9618-b61d63bf7253", "value": "T1A1152257BFD88022E43667700DFA07D319317DE16B35E6C6238FAC6E1972261A23572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633496, "uuid": "5d210f03-e13a-48e7-811a-4b968595c143", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633496, "uuid": "8bd65dc0-aede-483d-9932-c9a1358aca25", "value": "12288:eMrgy90VRhlOOVySNDszKKpudF7o43rwdbj+1xETP3+AmHS2FnvW/r/Cbso8MDm:Oymhl9VFNDszTpM6kETP3+A7wvUr/tH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676633496, "uuid": "7894b15e-db6f-45f7-8839-125bf7d4056c", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676633496, "uuid": "c920e12a-c3df-46ce-a960-250bb653650a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633496, "uuid": "ef22864b-c0dc-4c22-91c1-e4d0e4549775", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77456709-ae86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676612806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676612806, "uuid": "3553d33c-5b55-46b0-9c1a-a34df8f3dcd0", "comment": "Malware payload (RedLineStealer)", "value": "00a006ec012956eff5cb6bdb80b4f106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676612806, "uuid": "b4bc6cee-353c-440f-a191-b44af6290ccc", "comment": "Malware payload (RedLineStealer)", "value": "15c7210b8e1124410b66decd175f9cb0a581db6e73c9ba7989fded4d55e44c29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676612806, "uuid": "d6810c6d-197b-4318-93b2-aa950f428aba", "comment": "Malware payload (RedLineStealer)", "value": "a67316a489b45dcaef1dd3742fefd4de30f7f8a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676612806, "uuid": "20d1f15b-ee6c-4a7d-91ff-b43bc8f79d9f", "comment": "Malware payload (RedLineStealer)", "value": "ea5e4429781c0e4432d2fe454a36aea979032e55c833eacb5fbf465424b609b35be49857de4720a12d42dade276c3f5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676612806, "uuid": "b0deed81-c817-41a6-a883-ca708b6c6dbf", "value": "T16A151247A3ED4532E9B507705DFA43C306367E602B7C839A228E6C5609B22B1BB35777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676612806, "uuid": "20ba81c5-6762-42c0-9e9f-712330bd8bd2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676612806, "uuid": "1ad58a56-bd59-4271-9b4c-bf22373fb8d6", "value": "24576:Zyn5Ms4Nbgv2r4F9w1wB7JUGFidOUW+pGNwMfqM:M5wbgbFWgGOUW+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676612806, "uuid": "068fc221-036b-4411-a80e-8b8a24f0701e", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676612806, "uuid": "fd376ca7-4b24-4ea0-ad74-81036902341e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676612806, "uuid": "1c5254d0-8445-4e3a-af3a-cebcc7c32772", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4d8d18-ae5a-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676593967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593967, "uuid": "70290364-04fc-4268-9916-20efd67602c4", "comment": "Malware payload (ManusCrypt)", "value": "a399c38a917156e2c2dcda09679dcfa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593967, "uuid": "2707d326-2208-4081-9610-1354405288dc", "comment": "Malware payload (ManusCrypt)", "value": "1600297e9fc5e9d1fd05e5cfb3d2650ad4d5d2a0767803076355bddc6dae8f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593967, "uuid": "7253e646-d949-4be7-94cc-c141fea5a48a", "comment": "Malware payload (ManusCrypt)", "value": "65da717d9143ef90ec6ed7eb28c4dfbede92b1b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593967, "uuid": "e6914d80-afdf-450e-b800-4fcfd1c90ffd", "comment": "Malware payload (ManusCrypt)", "value": "03a5e9b2be28a70a1c9e773fc72809096b11777bfd21671f806af525370625c342b0bc651edf5e95da9c9b4c594a9628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593967, "uuid": "08f5886b-ff15-4bde-9513-2678266dce79", "value": "T1FD445C1366A17C40D9168A729E1EC7E8761EB5A09F4DFF6E1219DA3F05B01B2C3A3712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593967, "uuid": "4a4d8542-b466-4062-aa37-09d81350a2d0", "value": "99ff8bff99c874b1a1169c1f42931c72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593967, "uuid": "4c0ebd76-d2d1-4f62-9f91-f7108ccbb578", "value": "3072:ZekhLl5Uw/gPfAEXaFJI3DywO/vB+kkuy2y0jwtsphUHPVejYk:AkLV/TTDI3W9ckkuy2yl6UHE0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676593967, "uuid": "2b5ac6a5-2cd4-43de-98b0-bff9e2e76a90", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676593967, "uuid": "7bfcb5ff-0746-4364-8dee-f0de1834aa64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593967, "uuid": "b75ac1a8-c4fd-440b-b476-17071f33d87e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57cbc8e-af1e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676678248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676678248, "uuid": "475f5dbf-1ee8-4992-94fb-641c964287a0", "comment": "Malware payload", "value": "9e0092dde9c3d926f3b045b45ae37c57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676678248, "uuid": "a343718a-b430-4b8b-a44f-f43ad0d38d13", "comment": "Malware payload", "value": "16a971536a914e652b4c4452021bf4319125d8cca1b8e9cd1ce95b329b437ee7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676678248, "uuid": "3d2de864-6912-4a0d-8e34-5ee416d27618", "comment": "Malware payload", "value": "d988546e69704eddc73f47efb7cfe1df6d4c3447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676678248, "uuid": "4e450639-98e7-41eb-8bca-4062c7090a83", "comment": "Malware payload", "value": "4a4d19b9774f88b4525bff9b229fd67c8879a2560e687c2ee3d551e04dfbec303b4e830cdaa726a5bd5b7a8f94e18767", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676678248, "uuid": "72ee359c-4c9b-4c20-8632-14efe4c1d6a1", "value": "T15AE4125BEAED8072E47167B01EF207D31B327E601B78538B278E7D1A1C72961663235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676678248, "uuid": "a4ab1a44-87fd-46f7-8601-79674981d051", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676678248, "uuid": "95480a65-a654-4625-bfe4-b0218db7fa8d", "value": "12288:vMrOy9056SGU7CgLGM6qlDZzahEb4AbTn+9GDHWseL/XxHgeZS+oz/nMyKADp:ty6GU7/LG3MsE/69uWseLPx3doz/nMyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676678248, "uuid": "ea483328-8794-4f11-b4c3-d13cca7e444e", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676678248, "uuid": "e7c99380-7ad4-49e0-803d-2e8af9ebd19a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676678248, "uuid": "79ccc271-6538-4ca6-97f1-0437bff51399", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7acbfd7-ae9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676622793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622793, "uuid": "6c3fc857-c88b-45ec-be72-32f6fa6e43e4", "comment": "Malware payload (RedLineStealer)", "value": "e6bb001de7eff12170553625486a32be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622793, "uuid": "afc8e97f-1e13-439b-990d-21226c81e7c9", "comment": "Malware payload (RedLineStealer)", "value": "16df439f7948f803da0d6d7eab58c547d8f4cc03c1a3a7764a5c431bb1941f10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622793, "uuid": "51087341-c6fa-4cf3-90f6-4a7dd7fe05d3", "comment": "Malware payload (RedLineStealer)", "value": "52536942acc9f15cef578e0faaedf2372d4f4e0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622793, "uuid": "a848aca8-ad19-4ee9-99fa-7b9194de23e4", "comment": "Malware payload (RedLineStealer)", "value": "3a4ee5b4b00715434243a854ce59162c03bcbaaeeab2b084774d51f0110387a1bbdfc54055549a3eba87e7d55451fa1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622793, "uuid": "0f987545-ff9a-4e8c-91f6-2a6dfe74f3e6", "value": "T15E64F12336E18479F11345358E25CAB56B2FFC718E79AA9B37D4062F0E313E2D616362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622793, "uuid": "cd9bc092-7b1f-4ba2-9e01-4a2afdb8133a", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622793, "uuid": "187672f1-045b-43a1-b6eb-3424ce058ed1", "value": "6144:u7ubFNeiPGaKyB+2w4NtzF7cOy8+sUTmKkXCDtko7mO:quCiuaKyYatzZKsUyKXaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676622793, "uuid": "676497a8-92d1-47c2-92f2-f3fea0cfdb11", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676622793, "uuid": "26e44395-d3a9-41d2-ab8d-ab3bdf2b1d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622793, "uuid": "191dae96-9084-4f90-8ffb-e7cabb6e63cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f460a7-aed3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676645981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645981, "uuid": "4f3d3a6a-8493-4bdc-af01-5be2c289a99f", "comment": "Malware payload (Amadey)", "value": "135e9c96024d07a742aa40026b619c3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645981, "uuid": "2c094617-ef5c-4092-84d2-13b1f9fed6c9", "comment": "Malware payload (Amadey)", "value": "1714d4efa0fffd2d33e1257d95ebd6ff8b9417f3fcc2710e7171c7827e8ae0cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645981, "uuid": "1b14b13c-e046-4af1-ab50-c765b53c8f2a", "comment": "Malware payload (Amadey)", "value": "1116216801cf8a77ef0814a53bd56e139733cd0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645981, "uuid": "857e64ec-74c6-41d8-ba7a-91dcabf568d6", "comment": "Malware payload (Amadey)", "value": "e3c8c8240179f9102aa58fa118dfd9284ad28531f5042d1b67cd9c2bd8007394360b974736a20463122c7631c5e7df66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645981, "uuid": "46c70a88-06f0-4e3e-96e3-8ce4630baadf", "value": "T147F41207A7E8D066E8B51B7049F703C31935BDA15B348692670FED6B1CB26A4B132B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645981, "uuid": "3b5060d7-35f6-4a6f-8940-67df27863466", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645981, "uuid": "fe2a216e-61dc-44a1-a318-27aed48c3dff", "value": "12288:WMrLy90NwIJulKpYkd1VGCc43XnaiOEi1S9Amx+yAXQFQPZt+TWm:ByuwIHzhZHnGfS1+yqQFQP+TWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676645981, "uuid": "5cf31f78-2550-475f-a4da-fa28c11e0678", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676645981, "uuid": "dd6d85b5-708c-4c2f-b4fd-02e45d5b4fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645981, "uuid": "291ba509-21f8-495e-a49b-64d25ccda3b8", "value": "135e9c96024d07a742aa40026b619c3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd93f62c-ae8f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676616897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616897, "uuid": "f6991ef1-cceb-488a-a6bc-6c4100cee599", "comment": "Malware payload", "value": "af2bf7ca55f04bd77f1c480b83816383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616897, "uuid": "f83eea99-9347-493a-90d3-754a781daaee", "comment": "Malware payload", "value": "17213ac5771033a13d945bbd3cf248e36ec897c7692fc06eea04e4951e94f31e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616897, "uuid": "ed8317c1-f37d-4528-bd00-e3313964d54c", "comment": "Malware payload", "value": "24a1c0c5146bd8de1a200b772117fca1c8ab91ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616897, "uuid": "96ca2ff0-ccda-46bd-ab60-2a4d97cd81f2", "comment": "Malware payload", "value": "80a308781aab6116ad0c4aca90c0456b8c53c11326d59760bf49d52b4da6c88218846a59e9f53f09e5ea7f28ae11556d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616897, "uuid": "4b0a83cb-960e-4e9a-807f-9c81fa55b1d7", "value": "T1A825124BA7E88572E970577068FA03C31B333D626B7997A7228F6C5219B2670B531733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616897, "uuid": "2d1343c4-7573-4f4c-ab47-365f9d04e152", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616897, "uuid": "e3f791b6-9957-4611-988f-5d0cef0ead6a", "value": "24576:jyPrctZMPlhrXa44W9tnbidnt3QyCCTO8JfCnUd4R8:2Prcylh7ancN/CTO81f4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676616897, "uuid": "a4006021-0d3f-4783-adc4-04daa3182683", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676616897, "uuid": "3c7bcc2f-16e3-4e9e-bfbe-79c76f0f4040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616897, "uuid": "e6819205-93f5-4384-b13b-d6e3b77103e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b31eb94-af05-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676667332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667332, "uuid": "f0f32e0f-3821-4d69-a96f-1afb29a9e809", "comment": "Malware payload (RedLineStealer)", "value": "37133e9c32ddbe2709d2b0478266da38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667332, "uuid": "58a7ec55-5820-4dd8-92fa-b412bf6dbeac", "comment": "Malware payload (RedLineStealer)", "value": "1763a9890a1935dce008b4bd15c1e882e250ef28014498febd5bbc9cd85fb493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667332, "uuid": "d874861a-1fca-4507-a1ca-955b2f632cd6", "comment": "Malware payload (RedLineStealer)", "value": "4ad00416d3bd9e41f87650eeb1ebb8828b273e15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667332, "uuid": "5efecc0a-465e-4d21-bcdd-3e9b7a452615", "comment": "Malware payload (RedLineStealer)", "value": "35ec642c3eb36a6427edc51e23206c80049ec7cc829962b070922a8165e1c01fdda1997e83693a572cfd80e572cabcf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667332, "uuid": "945b216d-ef55-4919-811f-8f48a85a6365", "value": "T1C6F41207B7EC4432E4B56B3429FA03D315367C625B38836B675E9C6918B26B47A3037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667332, "uuid": "ac5788d2-bcdf-4e64-9860-84075b5ea577", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667332, "uuid": "84896dad-2c3a-40ab-a07c-75b39c51c1c6", "value": "12288:3MrUy90PKekdDVn9psCA5F5HkbyeOdHke3AJzN8I+lbX14b/1sSv:3yAxcV9mCA5Fq2tNR32zVI714JsSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676667332, "uuid": "3995b739-b547-4c6c-8478-4024187c3752", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676667332, "uuid": "dc3b5037-4a0e-431d-945f-155646fd2fe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667332, "uuid": "975a868d-d456-4f2c-8371-254659da8029", "value": "37133e9c32ddbe2709d2b0478266da38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e4d723-ae8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676614410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614410, "uuid": "4d7daeec-1ce8-463f-94c6-d7378ef580f8", "comment": "Malware payload (RedLineStealer)", "value": "f0a0eb27b5d28112bdaf97ce32baa925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614410, "uuid": "f18e9483-1308-415a-b017-b4240033f17c", "comment": "Malware payload (RedLineStealer)", "value": "1768ea77450303e9ea6d8804c5b434889339fc72f15edff4ae38e7476fbb5cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614410, "uuid": "27ed339f-55f4-46ab-9e81-b52c40aa71a7", "comment": "Malware payload (RedLineStealer)", "value": "01215caea62615610b76a609089af5ce970170b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614410, "uuid": "d58e86a0-f391-44e7-a745-6f163c857bea", "comment": "Malware payload (RedLineStealer)", "value": "8c686fdc2facf55caa0a63a5d90b004bfe86b12a7fbf2599d9b7ce433601e2c0ba68fdb98f9c14b45e2422cc63f4cce9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614410, "uuid": "1ac3be4c-a765-4af7-93f3-78af78fe4bd9", "value": "T192251257E6ED8172E879837019FA02C307357D615A789797734B6E9E08B20A1FA3073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614410, "uuid": "8fb3cf43-3bdd-43ff-956d-91beb914e596", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614410, "uuid": "49ef9ee1-f3b0-4cf9-af64-db108dfc5950", "value": "12288:0Mrcy90UZ9FmAlCnp3MJMMfVL9r17ROnru6q6KhlthsiMPmFyBNnUTdFS4gvVJej:Yy/hIp3MJMMf9wi6sh1siMPqTW4s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676614410, "uuid": "b46ecb01-1e9c-4b10-b37d-ad422388e3ff", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676614410, "uuid": "b738c9f1-fe74-45ea-b9f5-9fee71b3df67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614410, "uuid": "f906eca6-8e1f-474d-b305-c912b0de4ac9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c155bb94-aeff-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676664900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676664900, "uuid": "f49d1298-c80b-4c97-b6f5-85d6dce22f3b", "comment": "Malware payload", "value": "a453860f9cb1114267ad56775d113a29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676664900, "uuid": "2439e645-fdde-45db-bc88-e9ec33b82239", "comment": "Malware payload", "value": "18a5a4af0467d0f0eeb9420d2654d518a7eeda6faf5198fd04bf10a401970d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676664900, "uuid": "d929717a-9f70-4ac2-90b8-b3b1c635b21a", "comment": "Malware payload", "value": "fbfa72702a805303f28579d56432c2af10f7a605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676664900, "uuid": "5bc2a34c-3ad8-4858-8ba0-d39105b25225", "comment": "Malware payload", "value": "a1cb651d059326f19b93727839b6e5df3e8efde2fca5a4fa3c38a78f8f7f5273208e035bbd5ff5999a670512ec0b6ba0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676664900, "uuid": "6a094a86-d014-478b-b048-2abe12deab70", "value": "T1A0E3D02376D1C073E0639A302CB0D5A06A2B7C619675CACB376C071E1F719D29FBA366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676664900, "uuid": "9ff37bf6-ea4b-4d29-a4b2-8f660b8af6f6", "value": "5d842fb7215bce40485e598d67956fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676664900, "uuid": "95905f26-937f-45a2-bd4b-1d6cab3617d9", "value": "3072:w7NuPtlHHZ5p84XVbhzFMBxn3zQd3yS6/FRyc65:wpuHHZ/84XvA3zQdiS69oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676664900, "uuid": "007914c3-69c5-4edc-b65f-a12038dc3495", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676664900, "uuid": "6733d675-6bdd-420f-a51b-52100c9eeb1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676664900, "uuid": "b3bca450-94d9-4594-9fed-7f633fca0e0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68aa29b3-af0c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676670334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670334, "uuid": "7d66b292-14ea-4547-8583-7c8849cf8b16", "comment": "Malware payload (RedLineStealer)", "value": "cb21fc4ceb48f900f8ffec503c5d6710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670334, "uuid": "e7609344-7ee7-4562-b8a7-6f39c960de77", "comment": "Malware payload (RedLineStealer)", "value": "18accf0223ffd9054d7e7dc27086158769caf1fff6882a0d3114cf38c9add022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670334, "uuid": "cd48c8fc-5efa-4df2-9a89-3aa666c030d3", "comment": "Malware payload (RedLineStealer)", "value": "7abb6dfe911da479351f8ff86d48386464207219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670334, "uuid": "f6c5d544-5d93-447a-a955-7c19f70011ea", "comment": "Malware payload (RedLineStealer)", "value": "8c075418e5d0379403c6c81f3dc6baf2ec2b9714884b21fd4153a6874a33751e6ac5ee96eba8a78a8896145d7d2009f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670334, "uuid": "877b5051-1533-48ab-a1fb-859592c48abe", "value": "T17CF41287E7EC8073D8B457B028B203C30936BD72573493A7575E2C690877AB4A63276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670334, "uuid": "29cb4d75-57ef-4895-81a8-e49154a3962e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670334, "uuid": "3985e91e-4408-40f9-b5f4-773608e19a2d", "value": "12288:bMrTy90ZSBxjyQZgw5r4jlFYJ/OnkyrhV33t9YBO7wbr3dqtOH1TcS:oyKSBxj7Zgw1an6/DKzXYBHv3dtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676670334, "uuid": "f22bd150-b8f5-414f-8c7c-6eb2c58ee2ea", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676670334, "uuid": "3a6b6c7b-6319-452b-9638-9ce71ed0cee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670334, "uuid": "73813d09-d844-43ef-a976-8f9500b71a62", "value": "cb21fc4ceb48f900f8ffec503c5d6710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5741ff8-ae6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676602254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602254, "uuid": "fef81996-95fb-4cdb-80c7-f1921b47b98b", "comment": "Malware payload (Amadey)", "value": "99c91b8306cd8e0a1933cb5878a1c7a3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602254, "uuid": "3ebf995a-d89d-4062-8c6f-7dad5ae9f2fa", "comment": "Malware payload (Amadey)", "value": "18e6d616079aa990a26738f44b270eb4b592d8b571cfc255150579d5e8a0defc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602254, "uuid": "94d1ef48-eaac-4acf-9eb8-fe81c191de43", "comment": "Malware payload (Amadey)", "value": "d501b019cb11fbcbfe810c525ed185e4d56d9e69", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602254, "uuid": "225f7876-9ff6-41d9-b415-53ac37272718", "comment": "Malware payload (Amadey)", "value": "d5eb619cef7bfe15d9fddd8954327441990775a926373b612a2c5a5bfc44ff1f1da7793b83cf2e993fae9aabca81bd10", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602254, "uuid": "97935ef5-dd42-455e-bb6b-c9781ee98478", "value": "T137252353EBF85032E4B86B7105F702C30B767D615678879767AA2D8E04F2BB0A635336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602254, "uuid": "38743e34-7ab2-49ce-a23b-4c230da1322e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602254, "uuid": "35843079-6901-4148-afd9-4f4e24d9d115", "value": "24576:1yDVtcIZjzhgFLatyDTXaLWjO1ROodJZadL7Hm/6Fgk:QD4Gjdx4aZcXHm/6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676602254, "uuid": "fbb362bf-8034-449f-b192-636ce6976953", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676602254, "uuid": "34b06c10-8ab9-44ff-acf5-17bf81c75249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602254, "uuid": "d765c7c8-3417-4170-8209-1d53e232f2c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b08279-ae72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676604219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604219, "uuid": "77d38575-d3b6-4af7-861a-30d9b6246347", "comment": "Malware payload (Smoke Loader)", "value": "21bb1ae30e09331555bcb99306a9d8f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604219, "uuid": "f3c7a722-3c5c-4549-86af-7886e43298d3", "comment": "Malware payload (Smoke Loader)", "value": "199c87644f2e7cc1597eae4ce254b0280f85030315ddcc5709b2056626a3ace3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604219, "uuid": "93595759-41af-44ed-8996-2a17852665ba", "comment": "Malware payload (Smoke Loader)", "value": "80c4353b19d7f3879159daddcc133c833cbfc43c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604219, "uuid": "96222c89-62a7-49f2-8d24-8c16c1246997", "comment": "Malware payload (Smoke Loader)", "value": "6838d5004166fcd395ead58fe98cee5742eb9b176597fb307019eb16cfc71cb41a5d4942d9742bc78badee1039f46c84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604219, "uuid": "574e3b1e-a174-40f7-ac92-3df3dfd2573b", "value": "T1BD446C1392E17C41D9168BB29E1EC7E8761EF6608F49776E1219BE3F04B21B2C3A3751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604219, "uuid": "76035edc-5ba2-449c-9170-215cd9f28a80", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604219, "uuid": "89f2f2a9-762a-42d6-a7d2-ead2d7927b70", "value": "3072:qbRt0cZYLLipE5aeboo4gJv02ZfMwBV1sitJxeeseIcvPkdLXfLHPVpv:cT0cYLxagvJvnV3sAAIMdLXzHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676604219, "uuid": "7701b216-1345-4a97-895c-c814c33644b5", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676604219, "uuid": "798471a5-ab2e-4a5a-b51b-cc60f92c9a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604219, "uuid": "81c6dde8-db72-46f2-baac-b0d403e6b60c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fae70a5-aeda-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676648710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648710, "uuid": "34245073-01fa-45d9-893a-c0c3f7d72375", "comment": "Malware payload", "value": "853aafd2e990e7edcca7882d07208fdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648710, "uuid": "cac25e6f-9b81-423b-a9d2-7e1c70d371b9", "comment": "Malware payload", "value": "19a3afda425e8c5a7b12775c2b90a18eaadd211e78ee3469371195b4bacca4e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648710, "uuid": "8cab272c-6787-4247-a14f-c37c65c280c3", "comment": "Malware payload", "value": "97e102db5c67338c50d92407561208eff416533a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648710, "uuid": "f80b9e1c-0450-404f-8db4-03d4b4cb3a05", "comment": "Malware payload", "value": "d64f193573ae88a9f777c765ffd694fe74dc32a4db30ef55d628d66e9534c1c0f212740de9713142edbfba9eb1d7bc33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648710, "uuid": "ab086adc-5956-46dc-abcc-ff435cd1a8f6", "value": "T1C5E533ABA3EDC053E4A46F745AFB01E3122B3D535D9F852B270A58BA0931B5036B4377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648710, "uuid": "0649fc85-b23d-4401-bbfd-da943cd609db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648710, "uuid": "243f3c59-457a-464f-90bc-30f2e1e5b0c3", "value": "49152:Vox5Qm/88OHkDhnW04ba0OnYyTrCdx65Q+YNoui6Y6nyqXanQ1BxXOVQDjxD/:tm/bOHkDHU5OnYy/Cr66nounTntWQJ+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676648710, "uuid": "4cb5082a-b374-45c0-a2f7-a8ceb67f02e3", "value": 3123712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676648710, "uuid": "6a1d793d-1ae3-485a-b379-aa902229bdf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648710, "uuid": "0355a570-740b-47c2-b048-56bced92eb03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3363481-aeb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676634382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634382, "uuid": "5e066343-d7cb-4c71-8779-00d09ed84b0e", "comment": "Malware payload (Mirai)", "value": "658b638e680a283ebc5fb6a1770ab6a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634382, "uuid": "61222ab9-8853-4ac7-b878-1cbbd2f70916", "comment": "Malware payload (Mirai)", "value": "1a392f7432cd9d979f2888716d1233b6a503a9b695e677805ebee50a435bf2b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634382, "uuid": "4e027aa6-52a7-4fa0-98b3-05a42b876a52", "comment": "Malware payload (Mirai)", "value": "8c660114ba6bd7dc8f1d49ded8e96d6076c49f76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634382, "uuid": "091baef0-f8b7-4194-883a-c519122845b1", "comment": "Malware payload (Mirai)", "value": "f6a5d0fe8aeb975ae1e2c3f5c853aaddc01d4323bd3ce3079e43c0223f6a0afde577c99bf6d4c4539b3292b59aa57e97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634382, "uuid": "9bb3ccea-76cc-4ca4-9d08-3ed5d42aae86", "value": "T1E6431895BC819A13C5E022BBFB2E008D372663A8D2EE7207DD112F25778A91F0E67655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634382, "uuid": "2c77b3bb-8835-4471-b333-6fc68c01c8cb", "value": "768:A6eA02wFGoqXs8ekXYo6VaMHUsIBww/aicc2fuxe/2ikJtAzlJO6oxofWZNOM1Fv:EA8FyYosBUlBwfukuc+iPO4fp0Fzmpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676634382, "uuid": "b91c44a3-7958-42be-9665-86b9f53abbe4", "value": 58672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676634382, "uuid": "7a988fd0-44d8-4570-ae54-497b492a4f8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634382, "uuid": "d25975fc-3f54-459c-bee4-2551f6dc2032", "value": "658b638e680a283ebc5fb6a1770ab6a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c812e916-aea1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676624538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624538, "uuid": "9afe5163-b263-45c2-a6d4-ced8d06234c4", "comment": "Malware payload (GCleaner)", "value": "e9cc3b011511e8ef114d86457e5e993e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624538, "uuid": "5803201b-b4e6-4467-b4f1-f7ced19b1899", "comment": "Malware payload (GCleaner)", "value": "1a636f71f321098d2ceac294beadba63d6f44644967b9c490853690dd1e95646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624538, "uuid": "8bf50d48-0e18-41d0-bdcc-826e022173c2", "comment": "Malware payload (GCleaner)", "value": "37770428994ac16598910aed234c23bdb9c47f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624538, "uuid": "8acc09c8-ac2f-4b80-a338-39fe8eebe674", "comment": "Malware payload (GCleaner)", "value": "63d9d4105d9b4d522a7234a0409017240393b2e884a2cc72595a6ea579b46bd8119780df1691098d0b0f9758bc9db7a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624538, "uuid": "fdde566f-850e-4c1a-8455-117e226bdb73", "value": "T120D523C69922C5F7E3FCDFF2742D88E139A2BD6BD5D44507B194BA1632B225CA42E201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624538, "uuid": "5f13c490-c44c-4afc-8cce-b80b7ac0c4dc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624538, "uuid": "fc0550d0-74e0-4ec5-8a20-ad49110b912d", "value": "49152:vN5WNMGEoW/qOtM9pJj2DDrxSSk4NMRCOCaNbI2ghnKkCLawDLCgv2MR:V5KM1SOtMG3aN827kCLJHv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676624538, "uuid": "257a049e-e9c5-4c64-bd95-570c7cbcfb9f", "value": 2878827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676624538, "uuid": "b0bb4d1c-46cb-44ef-8edc-c8d7e261aab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624538, "uuid": "6d5e5081-fd5e-490f-b897-6797ebf5d83b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb3309c-aec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676639684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639684, "uuid": "6f7526ba-f9b4-4634-9cf1-64a7ace24b71", "comment": "Malware payload (Smoke Loader)", "value": "e456df2642719dc7d29a4d4204c43064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639684, "uuid": "75769ebf-9c92-42c5-bf24-1171473fe3ac", "comment": "Malware payload (Smoke Loader)", "value": "1b1f39a21ca69164e2a39114e310192867b49cdfcf042fc8def9b6842e0fd88a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639684, "uuid": "449171a3-d314-47c1-8610-bd3255c38902", "comment": "Malware payload (Smoke Loader)", "value": "896672daf517166a414211b34eab371b7911dc4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639684, "uuid": "d68280b2-3c48-4900-b217-6a86b6a6d2b0", "comment": "Malware payload (Smoke Loader)", "value": "0ac5e96f7f4bdd6ce55635fdc527db23c0a6db3819ddafc93ca63d10d10c1e5637e3e21a667b9b937e0f40f0aff92017", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639684, "uuid": "3cf7aa1b-df5d-4784-9d1b-c27569e308cc", "value": "T12B14BF327BD2C072E12355348DA1C2A59A7BBCB14A729C9F2BC5067E1F717D1DA28362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639684, "uuid": "8e5bd2dc-8a6d-48d9-81d6-a2abf49efcfe", "value": "31111ee2beeeebc1d1040d6c5884273d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639684, "uuid": "9c6b9260-8ecc-41e7-b392-6ff6bd4bccf2", "value": "3072:hMnlRr0CcPj7FhcdS8TZu53tRVe2OKv3O9DxOy2k9:hilh0jRmMF53tRZOpD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676639684, "uuid": "97141380-8203-4741-8e70-8bda45594564", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676639684, "uuid": "f65b2329-bf15-4d91-ac2d-58fc96469689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639684, "uuid": "70582a79-1ad9-47a9-9585-6bd2391553b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9b08f8-aed3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676645964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645964, "uuid": "2283873f-91af-4601-a2b0-ac90d9a45f2e", "comment": "Malware payload (RedLineStealer)", "value": "f36ec22ce81d69fccd847e1897f3542d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645964, "uuid": "02ae133e-5c92-411b-88ca-eb653425db50", "comment": "Malware payload (RedLineStealer)", "value": "1b3a3d922594d026822719f60de08478ae79c3820ba64e117eca0e5032c69e0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645964, "uuid": "c731ad15-211a-4656-ab65-5010abd5ab60", "comment": "Malware payload (RedLineStealer)", "value": "52cd6f962165a75e6b5b08a5f78deb71dea52374", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645964, "uuid": "0f6efbc0-35fe-4670-a66c-4a7ff3630b7a", "comment": "Malware payload (RedLineStealer)", "value": "b870a4fb128ec49791b7ca3c1b35147bc8ceca5324a7a6040044b14162b510ead971047905fff82a4f10b1399dc53dc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645964, "uuid": "e612d6ca-95f0-47a1-9c8d-0a994931fc5b", "value": "T18FC40207ABE880B6F8F4537019F702C30636BD605F74929B674F694A1C726B4A23677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645964, "uuid": "32e6421a-bd10-4134-9fb2-a71abf6c937d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645964, "uuid": "a43921fd-277f-49b9-ae8a-c90b3c75d162", "value": "12288:lMr4y90c+tGHr1EXscAP0HR1fGN3WKDw:FySG7cLfGld8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676645964, "uuid": "8c4ee9b1-addf-47b3-8df0-ce16f0ff0f20", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676645964, "uuid": "e3497be7-0706-440c-bffe-4e95b9273efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645964, "uuid": "9fba99c3-c9b0-4402-a5c8-8e79012663a4", "value": "f36ec22ce81d69fccd847e1897f3542d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bde702a-aed6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676647013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647013, "uuid": "8382281a-2f8f-4737-8e59-9d37ce9527a5", "comment": "Malware payload", "value": "ea96ab73c4d924ee86098d8cfce73cc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647013, "uuid": "6bf80d5c-792c-433a-8288-294ff9c1aab4", "comment": "Malware payload", "value": "1c65c0a262a9372726369cd3ba23e23086c490c2d816123ff4973a725ff8f5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647013, "uuid": "dd943213-442b-4a06-8917-c3a9344e1e4b", "comment": "Malware payload", "value": "a4e652fdf605c5a6b15e69096a8acd6c99aae0a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647013, "uuid": "cfd420cb-fffd-487f-aae7-b6321357624a", "comment": "Malware payload", "value": "bb3b9156b63824ca5f3782de011e66ec2e8d520c1b8f0b49562e40bbe8ddc82c1668e882402a1dbfa127cd3b8599e599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647013, "uuid": "70fce8b0-a89a-4d86-a291-0e38b644dc6b", "value": "T159E53387F18C0772EC9417700AB617D31E25B9631E6D4E6A270B7C8E1962AB07D74B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647013, "uuid": "3d725bd7-868c-43e3-a8d6-53e96efdaba0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647013, "uuid": "d8ed2805-74e1-480f-9e0a-23e465524875", "value": "49152:gUFAI8Fx1/m0X90LK34u1AwsPvhklZZXyH8MqLsLwxOUVIL5Qx:/85/m0tiW2pPpkDZmJqLsLwxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676647013, "uuid": "462e2d54-a489-415a-9985-141c1dc2ac29", "value": 3121664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676647013, "uuid": "5ddf6b49-4dc0-4b0e-8bf0-0b4f04f88703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647013, "uuid": "ee2a0d4a-757b-4504-93e2-f423a3bed67f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b1a7e3-aece-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676643721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643721, "uuid": "624b9c31-0c42-4ca4-8f07-831db72c719a", "comment": "Malware payload", "value": "b9098fd45f8da2a21340f58f4fcb5069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643721, "uuid": "039ea210-c72f-4e61-a0f5-65652d057bbb", "comment": "Malware payload", "value": "1e3d5a07772fa18a263878d99098fda6d2ca383cf41c4f9f31d98cfc5c55d560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643721, "uuid": "527d2cab-1c17-4850-b2c5-012487359e2e", "comment": "Malware payload", "value": "df912006f973e3dd6b4704081b26e9507f81f1b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643721, "uuid": "7701a151-f09c-4518-a9d8-628616688cd5", "comment": "Malware payload", "value": "0c5d359bee42f7080f6517d0780a4701774b0f65f39c8eb3ea10f5c5d326deb3b84672a8bee705f9093ddde4d040a1ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643721, "uuid": "2acbd2bd-4745-4fb1-80f7-f18eee7dcbdb", "value": "T1636633AC0EE2F64EC1FA4EB161AC0E1E93159FCF8167925C2636226D4B77C953E33944", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643721, "uuid": "c8e2e05c-a9c3-43ca-870f-abf879b62359", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643721, "uuid": "d7716ab8-d721-4de2-8828-a45f4e913d7f", "value": "196608:q5oyacfZum0s/XPK+GPiXtfpQ2eu/a8adnN+0oK:q5tfF0AlsiXhegriPoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676643721, "uuid": "e657cbfa-9e39-48ca-8f7a-1092b438689f", "value": 6963068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676643721, "uuid": "e81f7872-271d-43ee-8018-008c79d7c260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643721, "uuid": "bb2ecbc3-d598-49e4-a47b-157c117344e1", "value": "1ntrovert Cheat 3.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c10d12-ae72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676604190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604190, "uuid": "855f761d-f774-4aac-b55f-7ac35dda4b72", "comment": "Malware payload (Amadey)", "value": "4780ed46aeaa6772286728970ca2802a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604190, "uuid": "38d839e0-27de-41fe-8b5c-23ddc99767a5", "comment": "Malware payload (Amadey)", "value": "1f02de00e07bd1ac7e022e7d7c33a9a10c92c17ffc63fb7c79885fa055519266", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604190, "uuid": "7b544d7b-9fe4-4d73-9f6a-7cc675feff2f", "comment": "Malware payload (Amadey)", "value": "8cd19bac9c568549256e90879ddd481d52795e1a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604190, "uuid": "6ec5a6d2-5b1e-4f30-87b8-cf2d3317ffaf", "comment": "Malware payload (Amadey)", "value": "d78bc05e838468c3eb31b08cd92541dc7ee89eae85a3832b99c59978d5e27379bc9bb1e4a0a0e85cda1be6499e85c842", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604190, "uuid": "12da5bbc-6337-4521-8b1a-ab8d58ba2ed1", "value": "T14025220BE6DC9236D87853B048F607A30A777DA18B7886872B5F7D4E14722A4B534377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604190, "uuid": "4b8c36ba-fbb6-4fb0-bb8c-5c5ff1429360", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604190, "uuid": "540d3561-85bf-4338-abf0-ac000f2de7db", "value": "24576:0yANACVgVAHLQS0uajfB62dm4x3TfY6/iE9Snen:DPCVgAHL92xjg6Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676604190, "uuid": "cc3680b7-e331-4458-9be5-39ae551ce0ce", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676604190, "uuid": "cbf14e3a-7b9c-4400-8445-c67b221c09bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604190, "uuid": "c6aea770-9fcf-4679-8304-79ac7b604472", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc875b3e-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676637887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637887, "uuid": "758df374-5265-4e94-be4c-97f959286cae", "comment": "Malware payload (RedLineStealer)", "value": "df5355a96019f2c1d901141cba341630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637887, "uuid": "d8641ea0-e65a-44fc-abd7-7e5343e7e244", "comment": "Malware payload (RedLineStealer)", "value": "1f03a1a79dd4fb72282a5974ff9e998e16fbd2a3fa0c26b10802ce85dfd1584e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637887, "uuid": "d53df67c-65e2-42e8-ba6f-a489eb78d865", "comment": "Malware payload (RedLineStealer)", "value": "e00893ad030717a57a06f143eb3e0a1bbf54563a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637887, "uuid": "98cbfe7f-cc9c-485d-852a-5195e805ea9c", "comment": "Malware payload (RedLineStealer)", "value": "7b370369beeb4f59ac540658423545a3860d368e7ff5a777990477f064550258911d6b815f0e4d560f67bc596de82662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637887, "uuid": "48046cb1-c2e2-4328-a8e7-eceb87c52d42", "value": "T179F4124BABE98432D976573019F243C70636BD516B3883D7224FAD9908329B4FA3536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637887, "uuid": "6a7b1ee8-9710-464a-b345-71e66ef9daee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637887, "uuid": "639dc335-f302-4ef9-9ced-8247e7742871", "value": "12288:mMrny90ozaVw+NRB1d1xIvVdG29tWfSoON7X2SnTJbNnQm9PcM:FyDoBDUvVQGtGSoq2StBnb91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637887, "uuid": "1f5e4adf-1a5b-4577-ad69-e5d668152fac", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637887, "uuid": "ab425298-db5b-4a5f-aff8-0ea64096876a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637887, "uuid": "279ee49d-4e4e-48b9-a6fc-8269e00e69f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678d2fe0-af01-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676665608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665608, "uuid": "b3a68bb2-5ea9-4932-ae11-e9942d0e1cdb", "comment": "Malware payload", "value": "4004aae269b31a5df2c1769fb0090f1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665608, "uuid": "8ce691f3-3ab5-4d39-b244-6a9fe37716d3", "comment": "Malware payload", "value": "1f2acb47387b977fdc156664571219ac6ad0bf11c47bfc15b243b17215c43912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665608, "uuid": "f4f69da5-bf7a-4b7c-8c7d-f4f9de143457", "comment": "Malware payload", "value": "138f8c15092294991e0520fa0eae4ac65c3e3a3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665608, "uuid": "313008d2-9aeb-40d2-aad8-8e9457bf27a3", "comment": "Malware payload", "value": "4bffc5c5d1f8818c7a6115639143a8eec6a9f2fa1aa4e331c86fe6f69031a1e029c8c8dbb76a4cb146d09878a1e6db06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665608, "uuid": "2d07bbdd-b977-45ff-a50f-728fc71e0a56", "value": "T14CE3D0113AE1C071D41786301C34F391BB6EBC914B79899B3798176F2EA16C29F793AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665608, "uuid": "1e736ea6-95c8-4e5a-8379-b767a50af722", "value": "5d842fb7215bce40485e598d67956fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665608, "uuid": "7a21730e-5ee1-4084-bb5d-7cdf54735d9e", "value": "3072:0FstWrsJ5qWFD7HZN8TSRVsYTW8JiNddHGd:l0rc5qkxRxTWIibxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676665608, "uuid": "f43560b8-b48d-458e-984f-085b59929d9d", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676665608, "uuid": "1c7373c8-95cc-470a-b7e1-38bd08f350e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665608, "uuid": "0b32412e-d6c5-4e03-9351-74dea7673687", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efc5a45-ae93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676618295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676618295, "uuid": "38f8b0fb-53d6-446e-987f-014c0257a73e", "comment": "Malware payload (Amadey)", "value": "664cd1b9f2f03ea7db60315ad10da174", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676618295, "uuid": "5cdc2ef8-932a-4fcf-90cf-48c5b2ea8f77", "comment": "Malware payload (Amadey)", "value": "1f664006a1d4b8c17c284c60404bc6a950e37fee9581e57001350f7cdb68b194", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676618295, "uuid": "ddae3fa3-e6b3-4c74-9579-4123f7228d80", "comment": "Malware payload (Amadey)", "value": "8f4b25dcc077d77056889c44900c9c24ce260fe5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676618295, "uuid": "93ac4652-a5ef-4027-82db-a41c891ea535", "comment": "Malware payload (Amadey)", "value": "cddf7f1f1fabd6fa1e93ab6c00070a442122ecdb2e32deedd5e47ef7bc3c1a6429cd85609eddc2c58ca42ad7b3b0e406", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676618295, "uuid": "1ab5d7ba-d8a2-460b-ac02-68fc97206156", "value": "T12125120BDBFC85B1D865537029FA03C705357E401F79438A568FED6E1CA2AA0E235B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676618295, "uuid": "99633c71-d11a-4eec-a10d-38c41579eefd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676618295, "uuid": "d4dda133-f9dc-47c8-adef-d63d497e7418", "value": "12288:LMr5y90DIURYbLa8X4xcd52Z8kBmCyuWtxekPpXu9j0vL/Jh0OK9pH9F0AihNZ:Sy4IUCrX42wiueeUtTLBE9pHwZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676618295, "uuid": "8dba6703-9529-4f85-8d5b-b168129e659e", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676618295, "uuid": "5678f4b4-d376-4956-9626-c7afd912e75e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676618295, "uuid": "41be02b6-2669-4477-80e6-88c97051907f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc44f611-aee7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676654637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654637, "uuid": "59e0afc0-9773-4308-acb1-14651d72187b", "comment": "Malware payload", "value": "01aebc61b9cb5f9a48d91a7e100c518b", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654637, "uuid": "f6891ff6-83f8-42e4-8d35-145f1aadd76f", "comment": "Malware payload", "value": "201e5b5bf47521430235fae2c3273ffa6bf594ef7153544b18f41a3425a5e92e", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654637, "uuid": "be432d6a-65b1-488e-b9d7-7c852444e813", "comment": "Malware payload", "value": "e77293dfe4ee78e03ef5cef08f7541225ae12a12", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654637, "uuid": "eb28af80-2795-45e8-a688-0e34282e7b00", "comment": "Malware payload", "value": "bffbabfb45d2803dc3e2e3c7989eb79f8c92d2a06cd22ac1821ef94d5ae766c71c136e81f0dc5710c740123b6a54fa56", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654637, "uuid": "306e9d97-d9bb-45b1-a8f0-5484ab9db75f", "value": "T1D16423E22703899AFE450BD6ACE1D7BA0D64481934EA94FF41726935B3376E5076830B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654637, "uuid": "14021426-5267-4757-9bcd-f2f7b28b6cdd", "value": "6144:ZsdqzNCjk99CpRYp46T0IK6n5M2xVPRyZiG53zzgLjqwgskDaTOu:BzNCMxpT0IK6pPRyoGUHgsX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676654637, "uuid": "458ba6d3-65a5-404d-8f34-13f717b3cc3d", "value": 331870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676654637, "uuid": "be12f52e-cb47-475f-9677-0305e9e9c028", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654637, "uuid": "af14c738-5a73-44d2-be76-ea57f1157b9d", "value": "NEW SHIPMENT DOCS TO DENMARK.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5e3d4c-af0d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676670638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670638, "uuid": "a0b75a1b-fbf4-4451-9ad4-bcd0908469d2", "comment": "Malware payload (RedLineStealer)", "value": "0787c11e305fb59655414af8d09ec63e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670638, "uuid": "60361356-a264-45e0-8595-718d13489e7e", "comment": "Malware payload (RedLineStealer)", "value": "20e74bc79bfb0532144cf64baa086221b3a5af9c0da8725c2cc45d440977a5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670638, "uuid": "626c67c5-0630-47f2-a35b-13437a90968f", "comment": "Malware payload (RedLineStealer)", "value": "50cc0591c756bb4481b406ca82599c8f7f54c259", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670638, "uuid": "f0b10718-758c-4b72-aadc-4c7d49ac2a7a", "comment": "Malware payload (RedLineStealer)", "value": "de74034bb101f181caa9f1aa981e05f7be127b8bdfd38ffde7cdeff42f543ae759d3de0df5083c8bd801da2c5ba3a98d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670638, "uuid": "e3e13444-2ca1-436f-9a2d-9e42244bdbc6", "value": "T192C40107BBE88032E5B557B06DF702D30936BD616A34836B231AAC590D725B4B63673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670638, "uuid": "c8552f9b-1fd9-4785-bbaf-5ca728a7e5b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670638, "uuid": "eaeda83f-c963-468d-b4ed-d76c428a07cb", "value": "12288:lMr+y90FcFQdl2V+rOZoKH4dMZIpoGSfS09MbviKtzKw:ryiFkVJp4d5OGoODi2Kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676670638, "uuid": "b1337781-777e-4e23-9712-235fb7e50311", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676670638, "uuid": "689b863b-76d6-4ed0-91c1-e93a1b4cc6d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670638, "uuid": "51e41e96-ac08-433a-b902-44b4ccc6397c", "value": "0787c11e305fb59655414af8d09ec63e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78814423-aeb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676632565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632565, "uuid": "0d5c71f5-e9d7-4c20-bb64-9c2894a59e48", "comment": "Malware payload (GCleaner)", "value": "af593fbc95ac5e95f52d95efe4eea128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632565, "uuid": "c9f8a9a0-5428-483e-9880-1e9ad8cfc1b0", "comment": "Malware payload (GCleaner)", "value": "2101722685beb7050173e5e9c627bc36ba435dab4e47ca7133a01ed8d6ba93db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632565, "uuid": "4594e739-be91-4cba-87d3-732a6da6503e", "comment": "Malware payload (GCleaner)", "value": "988079c1a422a183ea9ab93cd0ccbad287ac83e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632565, "uuid": "426be2c1-fb16-4df2-8866-567615612261", "comment": "Malware payload (GCleaner)", "value": "1888414c9b02cd60a1a66e8feadcc5a1440fa998bde823cf5a0c755f9d6e126ee168ad90a59f64013532bbb259151ac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632565, "uuid": "7f1a754d-f8ce-4349-ad2f-259a215af0e1", "value": "T1CED523C56821D4F2D3FCCFF0FC1C40B43A637E67D5E44886749A7A2AB5B26AD914D608", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632565, "uuid": "fb302540-0b29-4148-8518-aba7f210af2d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632565, "uuid": "63f8c13f-298b-444c-b5a5-5807e057f2e3", "value": "49152:vNp1rpowRy/oKDq4Mkjv1Ji9AYUMyaIly13OsU8/2S6S+jgq5QRG2LCgv2MR:Vp11nPj4XjPYUMGiOsUi6S815s5v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676632565, "uuid": "eb899099-3db0-4116-a436-681b43e01f64", "value": 2892804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676632565, "uuid": "4572d079-ec39-47d8-b6bb-9f881eb86529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632565, "uuid": "40b07ad8-689b-4b1d-a09d-dc22c1e56714", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740fc2a8-ae82-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptoLocker)", "timestamp": 1676611083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611083, "uuid": "e7120690-684e-418d-a245-8dbbeea2ec74", "comment": "Malware payload (CryptoLocker)", "value": "9de48e7cfc2bc56631387e527f859efd", "object_relation": "md5", "Tag": [ { "name": "Cryptolocker", "colour": "#BD8F97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611083, "uuid": "f2daf26f-257a-4651-bb34-4d9aa99a54a0", "comment": "Malware payload (CryptoLocker)", "value": "215c37360388d16653ffc1740c639d486753a9db69a8ad4f3e1b172b1b712df4", "object_relation": "sha256", "Tag": [ { "name": "Cryptolocker", "colour": "#BD8F97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611083, "uuid": "8ea64f46-11c7-4d1c-835f-b778eaf3c8a1", "comment": "Malware payload (CryptoLocker)", "value": "959b863e84103132f89a10a7fd6981771881f763", "object_relation": "sha1", "Tag": [ { "name": "Cryptolocker", "colour": "#BD8F97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611083, "uuid": "bf0af339-281a-4f86-9f91-b8cdf5563647", "comment": "Malware payload (CryptoLocker)", "value": "ac622969b81e4769fed364d9e862ad5d4ba3ce7527410dc6871e468f6c079da927d1a5a4364d1f6f3099cd5e6f2f9437", "object_relation": "sha3-384", "Tag": [ { "name": "Cryptolocker", "colour": "#BD8F97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611083, "uuid": "dcd1354b-2787-4379-8f1c-cfdcdf9804b7", "value": "T11BE27573AFC515D1E673AAB3F8F792C1D627BD295932850E108A3F4446F3680EDA1D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611083, "uuid": "2ea1f5e2-7dff-4cf2-992e-9bda799c414c", "value": "db206e36db5c9492ce02c61a679129e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611083, "uuid": "dc9aacfa-4ba7-4118-b040-b63288aca780", "value": "768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpNEmK/4BM:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676611083, "uuid": "64a84947-3a44-4e51-b8c3-3f74d4def897", "value": 33346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676611083, "uuid": "b7d29aa7-bc20-4aa8-8ccd-df2d0cba8a2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611083, "uuid": "119f0128-a7af-48e9-a4ab-1147f9a11ebb", "value": "2023-02-17_9de48e7cfc2bc56631387e527f859efd_cryptolocker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bc925c-aec4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676639402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639402, "uuid": "f7904c73-178e-4dd8-8b75-730383f671c9", "comment": "Malware payload", "value": "f49e9723010a355be0361679a7ba51b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639402, "uuid": "23418581-331d-48fb-9ddb-fa03fb0c5202", "comment": "Malware payload", "value": "222b40b2cc7f53f81692d7b0d0dcd8717d6735826664e3896f23513a823e11de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639402, "uuid": "e3827383-636c-41e7-bc41-d9927e2e25b8", "comment": "Malware payload", "value": "5cf1c76b2b1f7134fe5b7b5908f77108e7586813", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639402, "uuid": "8d4a3e07-1e0b-405c-b32e-53b02d799808", "comment": "Malware payload", "value": "e177e5f2fe80f6a32772de7b5bd6773b240be7be68013d1ae42900070f79eb165cc135ab0d9df272833035ce8582724a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639402, "uuid": "caf5c371-e460-471f-a237-87bf8db17688", "value": "T11417BE73910338E9E5A98CB4D51425426DAC38875738A3C7BAC871F667FA6E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639402, "uuid": "804c0f2f-656c-47aa-a040-b3a7f508ae43", "value": "49152:cSk1vGE1pFrb/T/vO90dL3BmAFd4A64nsfJvWSIsWWKbeJMJpn14PE9Z7rYPVnaf:sXyWSpV+Wu7rI3JE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676639402, "uuid": "ad46c6ba-b604-4130-9a76-19f3a7541852", "value": 19038208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676639402, "uuid": "9a692f9c-750b-4f5b-8b36-875be67080ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639402, "uuid": "fab1dcb7-5047-44ed-86aa-52dbeef0aa2d", "value": "222b40b2cc7f53f81692d7b0d0dcd8717d6735826664e3896f23513a823e11de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85b3d35-aeb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676633639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633639, "uuid": "0b4f8553-5b11-4941-9310-dcdf743c182a", "comment": "Malware payload (AgentTesla)", "value": "751540d8bb06b1a78856f1ce061c7665", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633639, "uuid": "108ae381-de3e-417a-8f43-89fb5acf303a", "comment": "Malware payload (AgentTesla)", "value": "229687681fc621afc633bbd34f87759df1ac2d952828565b381b84f1cf7d7a8c", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633639, "uuid": "875a12ed-0b7d-4e16-86c7-ebaf0ace3040", "comment": "Malware payload (AgentTesla)", "value": "bd90319610781d2b4cf9c4c53c06bb97e7e1fddf", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633639, "uuid": "e99eeb15-e13a-42f2-acf0-9df63f58cd32", "comment": "Malware payload (AgentTesla)", "value": "fe472522df7e5aa30306d4517bcdf966ea813878bcc728e87f6fa20f6db5b43f1be41662a82a889f429afc1b7fdb09b9", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633639, "uuid": "8c51c629-db8e-42ce-974a-6e63dc149355", "value": "T19B542317BE18209B21DA10D6DE66F69312DA5D1F146E5AA9BBC5CB34D1EBF38CC0C434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633639, "uuid": "a6325aaa-5fda-4db0-9952-0becde470aac", "value": "6144:EStnj/2D+b/7pcDKnxk811TCKSHZN63iUvfIFhipcnqz:Ntnj/37pwwh11295giUvfIKsqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676633639, "uuid": "193940c7-3619-4543-9656-0fa14543b96f", "value": 305119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676633639, "uuid": "660218ac-c88e-4c01-bb62-f2ce0acfa135", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633639, "uuid": "17ec32e4-7629-44c6-a48e-6b01d59d47db", "value": "PAYMENT INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1addca59-ae99-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676620812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620812, "uuid": "de0adf98-63ca-4c02-9c4f-8894fc5fd809", "comment": "Malware payload (RedLineStealer)", "value": "41818b5417c96ddff979560de1711356", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620812, "uuid": "f476a67b-72dc-4dc7-83ca-0512eb669902", "comment": "Malware payload (RedLineStealer)", "value": "23173692f82535ccf2051ac3d1e4936ce26d82ed802aaaaef33be60b1f47e5bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620812, "uuid": "6e54b00d-97d8-4cfe-bfe8-1f93acf4c89a", "comment": "Malware payload (RedLineStealer)", "value": "e264e7ab11e10636228c317c603c02dd375ad52f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620812, "uuid": "b84c5189-b924-4430-966e-2cd09e205acb", "comment": "Malware payload (RedLineStealer)", "value": "4e9c16bdf4d58b4afc06aa41a3078ef6eadf4e84bf682e96fc1571fdb60509605da2495599ae52ce57d29880c9b1532f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620812, "uuid": "374274e7-d70f-4887-8926-476323ae51a2", "value": "T12925128BF6EC1061E8B5577046F603C30A357EB15A288787578FAC9E1CB27A4E63075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620812, "uuid": "615f47de-ddfa-43c1-8b3e-5be53b44fe31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620812, "uuid": "0bedc890-ed47-41d6-b667-dd524d9efb6c", "value": "24576:RyUwTg/OWeMmMz8pU1ergaF2W1UoPkpatacH:EUwRMRzOU16VW8gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620812, "uuid": "51a2a58c-3822-4f0a-858a-821e159aa24b", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620812, "uuid": "33f0d3a2-b18b-4435-a546-5a29f9eff01a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620812, "uuid": "e2af8818-bee7-4c7b-a1c2-189630c68ec8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1422ea88-ae76-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676605768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605768, "uuid": "4fb8e850-e6f0-4599-837b-42cff5dc0585", "comment": "Malware payload (Amadey)", "value": "80d7e8d8c20b90886d8357ce610b7103", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605768, "uuid": "03ddd4c2-ecdb-4ebc-8fd8-373c1535e2bb", "comment": "Malware payload (Amadey)", "value": "240b7403c29dc349a39860b8be4b10b8a2c939c24262dc33a1bac48d37f4ab58", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605768, "uuid": "81e14b85-7871-4cf5-a370-c70b4b76eef6", "comment": "Malware payload (Amadey)", "value": "6946914eea2c26d9942d26504ce4aff5ff1e2f8f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605768, "uuid": "60a48513-c471-4018-9110-31d4945e91b1", "comment": "Malware payload (Amadey)", "value": "26e812557a4eb05b6800167cacc42d4d5d5ce32eff110513b7080d62ccada14d239c4718287e5447acc4be2835cf2acd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605768, "uuid": "38d6deef-f59e-44ae-bffb-7564e9417503", "value": "T17A252243EBFC9026D9B1573009F207D30A76BDA01734468B6B5F796A0CA36A4E239777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605768, "uuid": "3635d9db-a5e6-4f53-a446-fc7a014698be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605768, "uuid": "dd215199-f3a2-40f3-a206-a424272a4ba6", "value": "24576:ey9d105IfEa9LzpCPx60/+HZ4f375/SHSUceSi:t715fEaqpruS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676605768, "uuid": "e5015b47-64d2-43a2-a742-ee93c2c2f8d1", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676605768, "uuid": "1b862b8e-5b47-483b-ba69-33685bcbc37a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605768, "uuid": "e832be44-4020-4232-876b-14f0bee497cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf532190-ae73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676604794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604794, "uuid": "a8343b13-b15d-4053-9dc1-c38db3ddcdc8", "comment": "Malware payload (Amadey)", "value": "bf48a1e035cc840e2a23a8d8e6014a33", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604794, "uuid": "33fd64b9-6e37-4c21-9129-269f6a66c14b", "comment": "Malware payload (Amadey)", "value": "25a1dacad76a259bee016b196c24240881b7f5009acd75a8a7750fccf13f6120", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604794, "uuid": "f605e6fc-aff2-4ff8-bf40-602df12fcd6c", "comment": "Malware payload (Amadey)", "value": "55d48cdd1e0176740b89c123eaeea77e7a727bc2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604794, "uuid": "dca3f84b-a5ed-4f20-a7c4-e836329398ca", "comment": "Malware payload (Amadey)", "value": "eaccf4cecb54ed42ab0f465673435147c12f376ac1cad9865943649d38dad376dfbf5e63286ec2999ae26664144dd510", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604794, "uuid": "d49ba6e5-b55f-4b2c-ba46-3f3901998093", "value": "T143252317EAED8022D9B857710CF147C30B367EA05B38469B6B5E6C9E09B26F47234367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604794, "uuid": "aafee69c-a9b2-44fa-baa3-a8d2d8e04c37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604794, "uuid": "d061e637-52ae-484f-a391-5cc460682f81", "value": "24576:nyFDzG7OGxyCDc64RS2HZCqyx47AHZNykbPq:yFXG7OGxyOc9gxuiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676604794, "uuid": "5b46bdb1-b578-4391-b84c-40417995c4a3", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676604794, "uuid": "422ff26d-1938-405e-bb4f-03aaed9c54b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604794, "uuid": "d842c3df-3b13-4d4b-8dbd-a25d70dc8464", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ea8c8c-aeb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676632608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632608, "uuid": "0b0ff0c2-d207-4443-a81e-1e1e6aa31c31", "comment": "Malware payload (RedLineStealer)", "value": "2ddac01888193988611537b0ed026f80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632608, "uuid": "846d2304-ce99-4904-87a1-d54115db9cfd", "comment": "Malware payload (RedLineStealer)", "value": "266d76b2b972bb0a0878ed11c8f7585964109022d9b0ce5dbce859f0f202a783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632608, "uuid": "4917e164-8a6f-429b-b65d-8e92219f049c", "comment": "Malware payload (RedLineStealer)", "value": "eac4f4c7f950c1c9861918b076304ce8a54da4a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632608, "uuid": "44a37d55-f274-45f9-8107-28e7eb66f136", "comment": "Malware payload (RedLineStealer)", "value": "e435ead7d1d9a8c8b883a6a4275b8f917152acfa82d76e5176ffdbb06301300ec419cc2f042bfc888232c7dae27a30f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632608, "uuid": "a153ef3d-3950-4abc-8bfc-ce782bce40ea", "value": "T1CF152347FBDC8121F9A453706CFA02D30B757EF55974838B6316AA8E1832260B939767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632608, "uuid": "ab2fcde4-3da3-4019-8b7b-e5b8b3bb75ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632608, "uuid": "80a0f9a5-e370-4ecc-9ff5-0101cd2c3a4c", "value": "24576:ByX2B5bO/wzFo/2Nw1MMQGbuUknH8BOVc:0XMykCzQHXnH8Bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676632608, "uuid": "a45b9472-8177-43ee-8b4d-a11be1743a9e", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676632608, "uuid": "e6ba6f6a-ba01-4d06-9ea5-4827d2bc73d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632608, "uuid": "afa8e221-ca06-4766-8885-46475b7254b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c9ccad-af02-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676665981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665981, "uuid": "c9871497-63fd-4909-b043-d3674badceda", "comment": "Malware payload", "value": "01520e6e4848368f3a89608b29506d1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665981, "uuid": "92062abc-6931-4471-8b51-d69164737cea", "comment": "Malware payload", "value": "2688d2fd0c1c32a805b04f52c7f684d024783c6b0c4a7ab38cf055412cce6e99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665981, "uuid": "84c29b39-e4e7-4cab-a208-2f52dddcaa52", "comment": "Malware payload", "value": "eb3cc7516a0307f57ba070a68219aabeb7489642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665981, "uuid": "09e47810-82d5-4713-83bd-33b56c4d84f9", "comment": "Malware payload", "value": "fb6f84787fcf917d54459d55aff85dad55fe1e62c9158ce374b7bdc3a7eddafc090987586514127a4f66b2b2e5fe1d93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665981, "uuid": "3336c261-0e60-400a-9b62-c79ce86c7aad", "value": "T13FE4120BA6D88072EC75A77018F743C716367D60A678C3AB234BA85A1C736B4B53537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665981, "uuid": "1bb480a9-760a-4f19-b8b6-09e3a5950b4f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665981, "uuid": "b2e05709-6c96-4ee5-926b-e1994bfcbb7b", "value": "12288:GMr7y905EvCGKrG0mswP+GQ5my1DbFzq32ME4kXkHsF5LjOSk5RqR92W4eiLq:By4GKr9mJQ4y1tzk2MEtLFQR82WH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676665981, "uuid": "34a03c2d-a922-4a46-943f-c53da352e5f7", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676665981, "uuid": "9ec07058-cd84-434a-bea7-6b64e08977b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665981, "uuid": "8a05950f-831a-43a3-bb31-b83bd8e9d1fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff05eb1-ae78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676606835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606835, "uuid": "552edb30-ecd5-47d0-b068-f8f8bce63b7d", "comment": "Malware payload (Mirai)", "value": "b449fc758000d113fbc92a45038df967", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606835, "uuid": "a7ebfd4c-d99e-4aad-9f97-046a7807e021", "comment": "Malware payload (Mirai)", "value": "27498f6cb5b398aeb9c202bee56af1800ea9a665edb7733a9f9d829037414ddd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606835, "uuid": "91c695aa-1bcd-43d4-8746-0d4f60446069", "comment": "Malware payload (Mirai)", "value": "7d15dd40c3629b786118f8ad785346a772f84152", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606835, "uuid": "2507ad67-c7ad-484b-b57d-55357b1b00c2", "comment": "Malware payload (Mirai)", "value": "e5a21d1e683f5e32a81b9dd60ab44788784adb907a9085127543ca36549ca2385ffb2061e8fc9dc8f1fca23ee2ce75eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606835, "uuid": "3e1d04d8-4c68-438c-b9c5-229e932d7064", "value": "T1C8C3D71E7E248F7DF769823447BB8E26A65833D623E1C681D19CE5101F6028E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606835, "uuid": "9a8265ac-3c44-4202-989f-c7ad5b156585", "value": "1536:XndRLa4alMt+PCPRqkxgvTzUx2et5hHrYYOZxkMIwL3s09eQoelxYVrl3l3+Oo:bLa4xRzxgEvrYYNjw7s0/xwrLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676606835, "uuid": "5e86a8f9-1190-40bf-9572-0b88d0bcbd97", "value": 118968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676606835, "uuid": "eb5744e1-3333-47a4-9da1-0bac5754e46c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606835, "uuid": "cf56cba9-a967-4b9a-8987-fc84a503b0a6", "value": "b449fc758000d113fbc92a45038df967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fae2039-ae5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676595614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595614, "uuid": "eaf75069-b515-4cf0-a649-1f81f74781cc", "comment": "Malware payload (GCleaner)", "value": "7fe1c146c41807d935d8adc6953d6cc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595614, "uuid": "4be4bfba-0df0-41c5-8e7d-9d570ee28724", "comment": "Malware payload (GCleaner)", "value": "27561ad209deaf9367dcf40158066be415ae20ecfbcefd89bc105bed64a70459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595614, "uuid": "6c711793-e3a6-4c3d-a1e7-f0f2b59ef7b7", "comment": "Malware payload (GCleaner)", "value": "e2e9eba274dd8a2bc816a4682d7bd29c09d532b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595614, "uuid": "1ee2d479-f23b-4953-9a95-2c8e67946ca2", "comment": "Malware payload (GCleaner)", "value": "c3dc0bf54b15e35a69223896327ddaaef10210b2e1f1a4cdb337974d0acb3ec39b3654d8e14e0570e6049d520dcf313a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595614, "uuid": "316af681-0d27-4ef6-a935-b4cdbd73b5b1", "value": "T17BE5230B7215E1ADE311CF73EA2E51A92A276C55F4B4D19E34587E0F2AF229D110FF82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595614, "uuid": "16092cd0-dae0-44ba-bf89-9cb98607d667", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595614, "uuid": "b9b71a5f-3835-46a2-9e33-9900a021bb41", "value": "49152:97CGhoQJyCodDImNHaWRLVmRKXVzKF4XEySrz/NQaTHbgAR3sujOzLCgv2MR:xCGFJGtImN6WmOG4XPumaTHsnuK3v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676595614, "uuid": "05aa210b-6ff8-4d78-9610-c4ba8c13517d", "value": 3191799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676595614, "uuid": "736da1d1-da86-4c30-a00a-c7ae69106085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595614, "uuid": "192c536f-f406-4b5e-9b72-3c5139a591ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5e2003-aed4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676646213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646213, "uuid": "3c4a26d2-55dc-443f-9536-4bbc5f24d594", "comment": "Malware payload (Amadey)", "value": "e706a26a2909af50f4d2495a311d6c18", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646213, "uuid": "c89b2b75-03a2-42a7-8877-23ae5b149d46", "comment": "Malware payload (Amadey)", "value": "27ab13e00cb205b752752c0b47ebe53da5ba78e8fdad96a06e5f7543bac296f0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646213, "uuid": "a8820f8b-10f6-4e3c-9b40-acb1f50c84e3", "comment": "Malware payload (Amadey)", "value": "5ebd2cddd686cc34dd83f3549639b17fade18530", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646213, "uuid": "5b813ab5-65d7-4373-89f7-35bc1ce2a5f4", "comment": "Malware payload (Amadey)", "value": "ba17884c583430dcf1a096f60c19919b2dde4f93a9c492dffe32ca8c9513f7eab800f1e71045acbf6009a874d1eeca1e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646213, "uuid": "36016b6d-42fd-4189-b82e-48b0c9d42242", "value": "T184E5334B53E90276D97953B180F30B730771BEB0537456AF8B42ADBB0832668B632776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646213, "uuid": "09c28ea2-af1f-4ec2-8432-133c9fdcff3e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646213, "uuid": "930cf986-5de2-4cd2-ac91-a09ed249c3e0", "value": "49152:4AxVXyvnWv4Di4MZ9xhGoHTovM5nXPv4l0CGXxIfgobSNc9HIA1r86XLTIsMV+yI:Uv84DfMZ9HG0ovEXPQl0BBIfgobR1FP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676646213, "uuid": "b49f57a3-fbbd-4657-ab10-2711e8e690ee", "value": 3124224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676646213, "uuid": "5e2a6335-3da6-4128-a87c-6a570e0c34cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646213, "uuid": "968f31d8-2aff-4b30-b721-41801e0b0992", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd59159-aec7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676640599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640599, "uuid": "34550fdc-3353-4a88-ac68-7b8fb0be970d", "comment": "Malware payload (RedLineStealer)", "value": "07709ca2498bb60fc1e8259c3f430c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640599, "uuid": "f8798f45-29fa-42d3-9f75-ffeaea6bfc75", "comment": "Malware payload (RedLineStealer)", "value": "287ed5f2b792bacfb7f7c54f3fb24ba523dfca2e90ba75d39b83bd51e5efa228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640599, "uuid": "82de69bc-14a2-46b5-a2c7-1e1ce9fe982e", "comment": "Malware payload (RedLineStealer)", "value": "bcdff409928f1159f823cf69a4dc3fd196c2a77a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640599, "uuid": "ae827807-1afe-4129-b8a4-940568a54018", "comment": "Malware payload (RedLineStealer)", "value": "5e92ce0c340537af529d116bf52ed22eea40a58bba02cd6970aad56be9f2e1e9f51dc7ac24b29cc07de8ea61d89408d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640599, "uuid": "47125152-b157-4ff9-84bb-f69a9b46c02d", "value": "T1E3252307E6DD8022E5F16BB049F507C30E357D90AA358786331BBE9D18726A4B731B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640599, "uuid": "83add948-4fb5-4e3a-862a-a118ad33f8ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640599, "uuid": "44e643ef-d8db-4782-a604-789530d76863", "value": "24576:kyPMV895oiSMeZu6H4P7bdijY4uctKefS:zEK2IeIC4jBQ5uSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676640599, "uuid": "7d2bd884-49ea-48dc-b31c-1d569700a8de", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676640599, "uuid": "025ee180-b8ce-48dc-8747-4a387a7f8aaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640599, "uuid": "d1bf7e4b-6ca9-41e1-bb10-94b418199733", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4ab192-aeaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676630641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630641, "uuid": "1e14b448-3356-4687-97c7-bfa47e11e455", "comment": "Malware payload (GuLoader)", "value": "2a2d7264ace02909c23f27392a428f11", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630641, "uuid": "9650b87c-a8f1-43c6-90cd-94bd5592216d", "comment": "Malware payload (GuLoader)", "value": "2994b8e60d3e3dfcc7a7aa275a52734664cb227773895de73f7c14186a6f42b2", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630641, "uuid": "4e9d8bd2-fd11-4c20-a5fb-8feffb85678a", "comment": "Malware payload (GuLoader)", "value": "9db991123d0f26749bbd7caed2718953786b97c9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630641, "uuid": "bd3d9fe8-9e32-4013-ae3a-405158eec869", "comment": "Malware payload (GuLoader)", "value": "db2b0f403741867aa7734acdc40e6a03d5c85ffb2b5ecb42225a874cadedeea70a6e55f5d91ea4547246f3bbc503618c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630641, "uuid": "f7f8008d-151a-4634-a659-38cbafd1c0ea", "value": "T1F6237CE0ED4E320D1ACE364A9D872E94DC15EC6120D219EEEDB5078E360625BC6FB5D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630641, "uuid": "fff08c2f-d3ba-435e-a1a3-ad7babcecf37", "value": "768:hfLWlVUHhH2kh2hu4suni7Vz88LxVaj5swO5Duh9AAMuAfn8UUd5SP:5L6VeFBh2huO+82VajKFi2ADfTSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630641, "uuid": "c348af98-a6b9-40cf-970d-edf4abaa9b34", "value": 47232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630641, "uuid": "9debe849-84a1-449d-b36e-bd5deab17206", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630641, "uuid": "6ad3458c-f370-43ff-bd16-1f23e3107956", "value": "drawing-specification.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6a99ba-ae96-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676619871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619871, "uuid": "eb995764-8f3d-4505-bbe2-2acca296dc82", "comment": "Malware payload (Amadey)", "value": "2dca49f670ce82798dc03207a8048116", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619871, "uuid": "ef3e33ba-8c28-4b41-a174-3598b35dfcbc", "comment": "Malware payload (Amadey)", "value": "2aa7de256c6ac234593cd8285393c052afd2d43d5921926120c7c4902620268c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619871, "uuid": "bbc8e01b-dc39-4824-8e6b-d2182ab6e363", "comment": "Malware payload (Amadey)", "value": "8b832d0fd06ad424bacfe433d323fa28cd4fa94d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619871, "uuid": "04294252-d223-49af-b059-7fd9074d90ef", "comment": "Malware payload (Amadey)", "value": "1f500c9310c302e16e6fca39d0246866b771a4c7be732282bab0f50908246f806db6f4ae765082bd8bde180d6be35249", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619871, "uuid": "889c3acd-35ff-443d-b52b-3d8ee56a4d83", "value": "T11F25234BA2EC4535E27A57B118FA43D31A37BDA09A7C469B134BBC0B48735A4B231377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619871, "uuid": "a6f3ba24-89a9-44a2-b0b2-e043acd5bc76", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619871, "uuid": "7c9c6287-27ae-4c2c-8776-ad0dadde6264", "value": "24576:JyZ1EibO6/VZoKmbewyQ4gm/c8orR3BS+C:8Z1iczjmbph4PU9BR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676619871, "uuid": "5bc9c618-e1b4-4906-93ec-7e9b290879f2", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676619871, "uuid": "3b9856a4-6e5a-4cea-ac81-515c085b92e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619871, "uuid": "52067278-7d3e-4418-a614-b20009059024", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d113d1b-aec7-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676640787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640787, "uuid": "8b0e11f4-da9d-485d-b2a7-1b0248033ee7", "comment": "Malware payload (ManusCrypt)", "value": "2836d22fc9793312d31aa9d96839bd91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640787, "uuid": "b999e874-0584-455d-8fce-7ec69387369e", "comment": "Malware payload (ManusCrypt)", "value": "2aa80995de6dce2c7590be4937c9e53b8f56a515f6699c3818c19000cd0a6bb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640787, "uuid": "c17666b2-fcd9-423d-9faa-ea890a211add", "comment": "Malware payload (ManusCrypt)", "value": "6e5f5a9e2c8d3f8bc714d978542cd12b0b4c8e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640787, "uuid": "e84a7b2b-9beb-401d-b7bb-65eb148a6d40", "comment": "Malware payload (ManusCrypt)", "value": "286e0c5553415d35cc796d85419e9e069956d9bf7aea32ec66489641ffd7286edd043ded1807c6e24d94eb1684ec784f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640787, "uuid": "8fe4d9a5-408f-4242-a79f-c8e3ca8c77f7", "value": "T1E414C0263AC1C472E16311344962C2B2DB7BBCB08A7189DB3FC8357E1F356C6CA69356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640787, "uuid": "2f9a07f2-348c-4a2d-9443-3b05e201650f", "value": "31111ee2beeeebc1d1040d6c5884273d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640787, "uuid": "b2a90c19-3e64-4e7a-8003-371a22aedfe1", "value": "3072:DXyXRryCCqf44XxGv8CTmXi35fm47QyMAeHgdDFv1HUAbljUT:DiXLPfRc04M47Qy3kgfx7blA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676640787, "uuid": "a55f9bb1-7513-4145-8400-c75ab9abff5f", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676640787, "uuid": "faf47e77-1b45-4268-9dd1-13dd0267e799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640787, "uuid": "09ba2363-fb7f-47ca-bbb2-1bc99df307fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987802f1-ae78-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1676606849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606849, "uuid": "5391f56a-80fe-43e2-868e-f5494518f646", "comment": "Malware payload (LummaStealer)", "value": "ddd45726a5e5583927416b931cafa2c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606849, "uuid": "ee75701e-220c-47ec-bce5-84381e36c7f0", "comment": "Malware payload (LummaStealer)", "value": "2aee3815033edf7afcad97979a053982be9c03d4c3fb5f5f746366af347699c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606849, "uuid": "0f3bc603-7871-4d02-bca3-cf71b63d586d", "comment": "Malware payload (LummaStealer)", "value": "e9fe34a62be1576e3c31f92ac561ac62585e80bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606849, "uuid": "a373ab83-2444-4094-ad83-8facba274cf5", "comment": "Malware payload (LummaStealer)", "value": "8b4e580f1aed07da2a0b33fca8865dfe3c99127ef2b1318a1b5338e01f5344ec2837a73e3e050d9e71d6005c336e64f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606849, "uuid": "25917b96-c9bf-444b-a37a-45839fa8f9c7", "value": "T1D3547D13AAE17C45D9164E729E1EC7E8B72EB560CF49776E1219DA3F05B02B2C363710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606849, "uuid": "6bc83923-27a9-4b5a-874a-d8ee3d36ed50", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606849, "uuid": "eea2f948-81ce-4024-b515-8bc6ff1bc9ef", "value": "3072:kbaWraMEL9pECJ4boo4gpiPABEApj7Ucs7gskqkttnjLXe8JmsmiTYwXwaJHPVoR:qPra5L7JOvoPej7Oeqk7X8L6wyH6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676606849, "uuid": "f59e336e-d494-4f7c-b30a-aa0e6ce746cc", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676606849, "uuid": "baf14d68-967f-406f-9b6f-1ef08c2a58f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606849, "uuid": "7d924123-1004-427e-ab4a-2b53288c2c75", "value": "ddd45726a5e5583927416b931cafa2c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c54625-aec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676640476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640476, "uuid": "47b12a9c-217a-4d31-a2e3-2e1d5edfc07a", "comment": "Malware payload (RedLineStealer)", "value": "d948b294d0369a271d5b70dbae8a5779", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640476, "uuid": "1d7b422a-11e2-4cfb-8dc8-266b0e37dbd9", "comment": "Malware payload (RedLineStealer)", "value": "2b120d1e3be9aa367efd28deff34e839f4d31828e243572b75988b63a5a16e4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640476, "uuid": "815f6419-e8f3-417e-8497-daa86ea33744", "comment": "Malware payload (RedLineStealer)", "value": "b03a94b63aeee33de7354670046c30fafdcee7b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640476, "uuid": "df8c3410-90c7-4b94-b896-472c05e5b1c5", "comment": "Malware payload (RedLineStealer)", "value": "a1f61e4f15a10e6c026a72c3f1e4c25199cae78a5d1ea48e080df04ef1de0650c2e8fe8302b5a32d99e1569816803952", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640476, "uuid": "6eec10b4-c48b-453d-a1ea-8f7c1ba7730c", "value": "T14DE41207A7E89062F870177019F607D32A367D51573847DB174E7CAA18B2AB6FA3432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640476, "uuid": "b8fb0788-4b5f-4eab-bb51-99085d045c2d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640476, "uuid": "26bec89d-eea2-429b-9e83-f047adc6bb8e", "value": "12288:SMrcy90X4pVVlkmdK3rxjvlcGBWaEaPzVfponk2xh8RCs7OzPGnE:iyVVVFdAjcGr7PzV88RT/nE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676640476, "uuid": "c7e39bf4-f47e-4d70-a3bc-0c8dc9b9ddf8", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676640476, "uuid": "aaba262c-1431-4b2f-b984-7bb58039f041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640476, "uuid": "26d61610-536c-4dab-9378-41292341b396", "value": "d948b294d0369a271d5b70dbae8a5779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4c3328-aea9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676627931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627931, "uuid": "c0911a5c-f2e0-4fe4-9475-a8fc0c688a7e", "comment": "Malware payload (Amadey)", "value": "da98c91b2a97497300a46498aee9afae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627931, "uuid": "0d16165d-8817-4745-af17-8321471109ca", "comment": "Malware payload (Amadey)", "value": "2b5fa4682af68bf063df50d277e094b3a2cafeb4805318a4ce0a3a53d3bed549", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627931, "uuid": "16d9772f-592e-43be-b24b-7e44b91e6c0a", "comment": "Malware payload (Amadey)", "value": "f3ba9323eb36c98e9d690088b4732988397deba8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627931, "uuid": "8f1c5ea3-a520-4d39-b50a-f663f75d8e20", "comment": "Malware payload (Amadey)", "value": "d2f053e0c5f0a13d68b76b84b98dbc048b9e7149bbf734cb1496eb371cc28f84da236ba76c5da19f262f70164a95551a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627931, "uuid": "9860d072-2cbf-401c-970f-a61bcebb88ff", "value": "T143151247EAEC0073D8A51B7019FB42D30532BEA24A74836B674E6D5E2876574B331B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627931, "uuid": "f9dd2fb0-e6f8-479e-a75a-c8d7e36c4247", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627931, "uuid": "dff41b82-9b57-4653-85df-8d5702a54f6b", "value": "24576:7yaIfXa0Vn05+TpwdHegs5JSvKrzCh3p91wERA:ulxV0pd+/Gr3p9eE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627931, "uuid": "3f4503bd-de2a-490c-802d-cd754906b7d5", "value": 960512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627931, "uuid": "075929c3-72f1-4122-9500-77a308c0820b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627931, "uuid": "82d7a635-ab6e-434e-98d4-c417fe82eabf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8821764e-ae8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676614553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614553, "uuid": "28822d32-27b7-4900-afa7-c259bfd6b390", "comment": "Malware payload (GCleaner)", "value": "769acb6b4ab3aa1aa8edfb9994a6de0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614553, "uuid": "f9410d0c-0de0-4a81-a45b-7733f5d04a51", "comment": "Malware payload (GCleaner)", "value": "2c9ec5e6e1f9c361e64d862903aed5b59411a22b380ceae0178ab32855c45643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614553, "uuid": "38f24078-3f95-445e-bee9-c6a414a80a06", "comment": "Malware payload (GCleaner)", "value": "d9a1f2f1f2d2f8261574ee932742c987c0eaa083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614553, "uuid": "8e31be59-f69a-4063-97da-5c6457b2e22e", "comment": "Malware payload (GCleaner)", "value": "1e1e34e966d828999dbbbb6c16e2c4bbb70576722f0f8a40fbf008e2a793c644e2abd7b3ec9e1b6505b60e030a02b0c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614553, "uuid": "bdf81e62-0f45-45dd-80cc-7edfbebed9b3", "value": "T18FD522C56120C1E2D3FDDFF1BC2D84F5B6A7BE2BD9A4510B34593A3A75722AC908C618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614553, "uuid": "3e3b88eb-5195-444b-8e60-1b77a201a3a7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614553, "uuid": "ec05dafd-dffb-4396-b796-9d1aeb92e382", "value": "49152:vNM4BW9J+1Me/ilX1NlJFdHdZZbVJPk5G1WzRY1GyzN/Dg6ODa/v/G/reLCgv2MR:Vr6+tqlX1brv5FGz2/DimIKv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676614553, "uuid": "6c751373-4198-4373-a7db-593d94ca99bc", "value": 2907630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676614553, "uuid": "0dd52799-ea29-495d-bff0-9be85749aa78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614553, "uuid": "5e4ab892-e971-4d05-90ad-85b2c380c376", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684963ce-ae79-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676607198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607198, "uuid": "0d843337-a222-4371-a86a-56d97c8f2dd9", "comment": "Malware payload (RedLineStealer)", "value": "9c783f64682cde4fbcc5e0984e826dd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607198, "uuid": "fabb1f99-28c2-4704-95b9-154d382e6d02", "comment": "Malware payload (RedLineStealer)", "value": "2d14001f361c49d13a416be69dcce059098df3fffc270d705fca1821ace6b034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607198, "uuid": "4efb2c2a-3a89-40be-afae-2203fbf6eff7", "comment": "Malware payload (RedLineStealer)", "value": "e100a3c2ee9b331aa654c8b5b345682301022b35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607198, "uuid": "d2e36ad5-4943-479c-ace7-db8f8b14117d", "comment": "Malware payload (RedLineStealer)", "value": "0466ed983cec295f3794876f9be8516d23a16328bb156672502b7a65efc58eec408f430c600569399e5c3305b19ef8ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607198, "uuid": "d0011453-d50a-484a-b748-ee8e9ad8b9a0", "value": "T12325235B66DC8032E5B5837029FB02C30B377972563483872A4F9D5E2C726A1A67277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607198, "uuid": "feb035a4-de5e-4393-bcf4-860fe8aebe80", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607198, "uuid": "6e9d1218-4f5d-44d6-8b9b-1caf2266af14", "value": "24576:DylhCKjdXe4EraQJuHs4GoGtMGHlUlPI1:WvCiXeBNN7VtlHlwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676607198, "uuid": "a86b33f1-eb5b-4b55-810c-3dc070436a3c", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676607198, "uuid": "8dc3e3f9-daf9-41ae-a7cc-234614742753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607198, "uuid": "fcad3224-72a5-4a06-9915-2a082b3a5bbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef68958-ae8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676615584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615584, "uuid": "26738246-a476-49d2-8307-575b726cf277", "comment": "Malware payload (RedLineStealer)", "value": "82ab01f48815fba1781b51abb3d2d749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615584, "uuid": "3dcfc8eb-91f8-4f18-b008-9bb038253836", "comment": "Malware payload (RedLineStealer)", "value": "2e8a3490cc55675a57a3cb33819eaff1caf8250782409689f8add1b406c2ee61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615584, "uuid": "98cb5b65-32dd-4d66-a9dd-47a5bafe4555", "comment": "Malware payload (RedLineStealer)", "value": "308c28466fd821d7534848e6163bb1ddca917894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615584, "uuid": "9dbac2a2-a96c-4f1e-99c3-09fd25effdc5", "comment": "Malware payload (RedLineStealer)", "value": "2dc93d894bf84bc1b38a84c9d927d631b40c4f22d797c4ea6398331b479416a0489d13c5cee1260f31e3123916f66ca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615584, "uuid": "6d15bf5a-b3cb-4f0b-b49c-f16aa8c26295", "value": "T127252247EBE98051E975977018F953D31E36BE619E7C8387128E6EDA04B38B0933076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615584, "uuid": "a423eaaa-0fc3-468c-bc17-0a77dd854bfe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615584, "uuid": "9d023fe5-abcb-4368-aec4-c1810b013756", "value": "24576:Jy0VrjobyDt71QWfqqOVkLsG1+X4CbRY/d4t9:80kQt7etVI1+4CbRY14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676615584, "uuid": "d45f7757-047d-4ed2-bb5e-efe6f40c13de", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676615584, "uuid": "20ecf32b-5086-4f1e-936b-86f53f8105bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615584, "uuid": "2d67428a-50dc-4331-99c2-961fd85b0809", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70791a5-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676637824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637824, "uuid": "4820825e-da2d-4f6e-ac35-284e7a09684f", "comment": "Malware payload (Mirai)", "value": "02a35cd4d1d55c23bc27e5bed816a443", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637824, "uuid": "d5265e05-b671-4fbf-9a5c-bfc18c3d3b90", "comment": "Malware payload (Mirai)", "value": "2f0a4f4f23116f3057217a8f909e5551bf1df351f90b73d7377f71d1b9436215", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637824, "uuid": "e3af096d-8b47-4171-8fc6-34cdb77ba642", "comment": "Malware payload (Mirai)", "value": "d9efacc93ec63024d4d7b3afd50752911315e9c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637824, "uuid": "6b46d5eb-4e2c-4fb8-8271-cc2af94f6651", "comment": "Malware payload (Mirai)", "value": "d07badcbcaef95df9a59a02fa7eac248baa78116c6eede663cbc3eab08475a2a3b77aa290c013d248901ea753e394bee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637824, "uuid": "fa490a3b-7127-4a36-b17d-ee769e2dfb57", "value": "T1E7E32B56EA408B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637824, "uuid": "bb34599e-ba26-4121-a875-4d24fe1ea56f", "value": "3072:JJLce3pC5ma7/abHbz4NpaIJ8VIJ1FOU6kkTM/9PSVzY:JJLce2/abHbz4NUIJxHOU6kYM/9apY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637824, "uuid": "086f9f2c-1602-40e0-ad76-a0e78fb2c407", "value": 151104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637824, "uuid": "44138c1d-1681-47f7-b766-0f3914c234a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637824, "uuid": "8d042317-c7f7-4984-89c1-9bad284511f7", "value": "02a35cd4d1d55c23bc27e5bed816a443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874af3f5-af0e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676671245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676671245, "uuid": "e60f917a-fbb4-4972-b378-b8602bcbe60c", "comment": "Malware payload (RedLineStealer)", "value": "24d5d84f7ad85e0a08d39716449a5155", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676671245, "uuid": "2fec9a0c-011b-49f9-a9e4-57103164e980", "comment": "Malware payload (RedLineStealer)", "value": "2f6c8ec09935e4d5efb8822c2549bdba19bf653ddc328da5030044ee3845de4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676671245, "uuid": "54d1c88e-1785-43fa-b01f-75cf97188980", "comment": "Malware payload (RedLineStealer)", "value": "7c1155443e846884b97883cb2cf237785320fa06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676671245, "uuid": "784d2338-69d8-4cbc-912a-96733d64a862", "comment": "Malware payload (RedLineStealer)", "value": "2b615cab9948fd4738c2ce6ef49e11e2c0386c98d372bdcedba48cdb0b4b6bf3e802e4bebd25341f7fad25cf9e7b3c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676671245, "uuid": "938dc804-06ed-4d64-9845-27559e26ad91", "value": "T12FE41217B6E88023E8B55B7068FA03C30635BCA06B34529B335FAC1F09725A5B67577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676671245, "uuid": "cb99f649-1d1b-4b6a-b0fb-07dc9b17ee05", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676671245, "uuid": "e486230b-9282-4414-8857-140aac174e5e", "value": "12288:SMruy909lOdDvAQ/PfXrGqfs9HD+li/oL9RWwbaAAaETXu2J4:YyQl4MQ3TGL9H6lFv9utaES64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676671245, "uuid": "a5229ed2-d31d-47b7-b820-721ddd56614d", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676671245, "uuid": "56bd2f37-49be-4483-87dc-2cc8ac106b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676671245, "uuid": "acda6b30-8c6c-41a7-8e1d-e4e49221f2d0", "value": "24d5d84f7ad85e0a08d39716449a5155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "090bc271-aeb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676630660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630660, "uuid": "1d6445e1-b611-4d95-97af-55afee7e32ee", "comment": "Malware payload (Smoke Loader)", "value": "8bf300c0ed3b9eb25706a4498c094017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630660, "uuid": "c7293239-bea7-4bea-9e47-7f2fbc7a47d3", "comment": "Malware payload (Smoke Loader)", "value": "30afc0e58f7baf65a4e29aa3d556f7f3544542af0beadc5e670f8ce413dc682b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630660, "uuid": "6b2a5678-1ee0-4266-b6e3-1273d0b5cb3d", "comment": "Malware payload (Smoke Loader)", "value": "7f4c314265072e3cb67a40c81b5a772c479c023a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630660, "uuid": "82f8e1b1-fafa-4de7-8e5f-613a6d33982b", "comment": "Malware payload (Smoke Loader)", "value": "461cd8a8801e155b13ec60505c076b46cc0ba13f03f928f7ac74c20051ed716b8eaec108e1c5c3d4f8c1d621a4fe3981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630660, "uuid": "09c1d1be-26e6-404c-b8d1-d2b1ee02eac9", "value": "T14424BF2376D190B9F11746358E61C7ACAB2BFC708E25AA9B3B84467F0E752E1CA16341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630660, "uuid": "753e979d-7b95-4d59-9429-d0be5fe1ed47", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630660, "uuid": "fd1ea8f3-c5ad-48c8-9184-ebfbcae6e56a", "value": "3072:UNwopMNib3xX2bqV7K/cmLyCApguHPpoWtUsANXOEsmbA/P6tDc:UvpD4GV2UMy3g0PhtUsAdsWA36l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630660, "uuid": "28871b10-d28b-41ef-ad79-2ff744ba713e", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630660, "uuid": "a0b6b6c8-d190-4024-9de2-b72f5c2aed71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630660, "uuid": "006e97ff-9d52-4a5d-9f71-72f999d7a3f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd46b94-aed7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676647556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647556, "uuid": "3c0c7fbf-5778-4c29-82b7-8a953a4528c9", "comment": "Malware payload", "value": "5849dc10a9c087d203fb9eaaee62cdca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647556, "uuid": "00260fc7-a52a-4d2a-b083-393af83fe37a", "comment": "Malware payload", "value": "3134116d6073f05648e5b07a1732b04958e6e25c2cfe26581c6f46a71219e330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647556, "uuid": "86683460-721d-4bd0-bcbd-ba0911b50e1a", "comment": "Malware payload", "value": "fcddb177a89bdc4d7b092cd5c729a8c91811e93c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647556, "uuid": "954b3d0b-8703-41f1-addc-b84d75439d58", "comment": "Malware payload", "value": "b55088d2cc8843b069315d972898f534e801fe1b571f355f3f8054cad11c6281b7011b5c31426d6b4275eb6087b11d7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647556, "uuid": "5761f3bd-4319-4e6b-babe-20c13cab8f63", "value": "T15AD4027C3F28D492D2A64274CB91E736E235A5B27DE99F0337A2436C2975BB53E040B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647556, "uuid": "15a358d4-e052-4ede-958d-96c1c3150d54", "value": "5b462f8ebe808b7165e6349acd877897", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647556, "uuid": "8fdee439-5935-4864-add7-65f7ec615604", "value": "12288:hWz4g0UReLsIomFBqmJg/IcUjX1Aekq/dIdEFZzubjXHE:hbvigDBDe/IcUFAWcErCHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676647556, "uuid": "17da9b8c-ae62-4f37-a25e-6fb56eea803e", "value": 630672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676647556, "uuid": "b63053db-2a89-4f18-a3a5-74c3414dcf9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647556, "uuid": "e4455a23-6228-4b73-b27c-51ad81f00463", "value": "GoogleEarthPro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77df6125-aeb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676631705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631705, "uuid": "cc92ca9a-ccff-4693-b126-2008fd426c7c", "comment": "Malware payload (Smoke Loader)", "value": "02e64eb9f618c1c836a52078cf99474c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631705, "uuid": "f1424dce-c6bd-4c6e-a087-d5a884275ec9", "comment": "Malware payload (Smoke Loader)", "value": "314defed93df1f7dd8632a36ae7efaaae30b19c53e56e1dd7ce3d0303c33dfd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631705, "uuid": "89e07bad-ef02-41dd-b6bd-5814551d254c", "comment": "Malware payload (Smoke Loader)", "value": "6079c4b2de48cb1fe64219b498102100f97400b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631705, "uuid": "e0e1692b-c44d-42b8-b069-946322c4099d", "comment": "Malware payload (Smoke Loader)", "value": "09e602d933c29f2da3ee1410ba7a1768effbf4aebf8755122c1301315a775af85ef156c61fe079393687ea409c519e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631705, "uuid": "e2827107-3d6a-4454-b97b-7d7aa0171e31", "value": "T17214CF223AD5C072E22315344DA1C2F19B7BBCA08A718EDB3BC402AE5F757C2DA64357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631705, "uuid": "8d40c5e5-026d-42a8-a7c5-473da19bcff5", "value": "31111ee2beeeebc1d1040d6c5884273d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631705, "uuid": "b4ca341b-f4b1-4002-b8f7-cfd7901aba98", "value": "3072:qK+ZVHGC2y95/r2xqeHTl1Rl46YEmSuHP6paT0K30MdxOsV+KdX:qBZjffT4VTRl4xEgHpT0K3Td881d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676631705, "uuid": "93e8b923-700a-4f6d-9d39-1193fbdbcf2c", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676631705, "uuid": "aa7e0f56-d392-41c4-8434-46e8bea6c485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631705, "uuid": "454688e5-4abc-415f-9635-231e01a29638", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdf2c58-aed5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676646612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646612, "uuid": "ccc55bff-a75c-4ab7-b939-cb8571d036a8", "comment": "Malware payload", "value": "0638b5ee470ce8890907ee5e563f208c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646612, "uuid": "86324280-b5ba-4382-99d7-ff87e467e232", "comment": "Malware payload", "value": "31a2b916d82e1842fadfcaeb9246c792eeb11e234e3eec4805e3b40654b425e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646612, "uuid": "bb5b9c0f-206a-45fb-a2cc-610eea73e22e", "comment": "Malware payload", "value": "204c5b7c98a5a6b277b61279b32b0d3a6483f224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646612, "uuid": "d38d4e57-0faa-4acb-8380-0d93aec07d6e", "comment": "Malware payload", "value": "957d49334ecbd33fe2b398fcfed893c97a5f18b8b88e88246de2457220536b642f927a64f538248c2fc63ba5f1e73b33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646612, "uuid": "c760ac09-a2da-4840-89c9-fece33854415", "value": "T1CBE5330637ED8416EA751B3044F602DB1635BC65DA7182BF960FBE4A2D30A297E703B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646612, "uuid": "d3bcbf4f-bea9-46f0-a1e4-3517a67731e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646612, "uuid": "586ad0f6-f26b-4b73-9794-6a8fde74cc48", "value": "49152:WE1XKVaDqKRTQ6Nv1ayBMTLBaHqU0klQjN8E4BjeTh9sqlvS0ExM8pnH1i/NFGxX:5WKtQMcUMPBIqUkWSh95lvSPN+Ngo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676646612, "uuid": "05126863-4879-444e-a975-90b8e429fb14", "value": 3128832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676646612, "uuid": "16fcc6f0-a718-4cff-b6c1-68bb33a979ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646612, "uuid": "ee29853e-fe01-4b50-b434-64cb954aae7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd73114-aeaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676630350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630350, "uuid": "dd460411-70c9-4953-a0c9-9920290ec0ef", "comment": "Malware payload (AsyncRAT)", "value": "bc1722ec205a1c5ed34b8766971fe608", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630350, "uuid": "919a8577-f5b3-4d03-a433-b4a3fddbe4f8", "comment": "Malware payload (AsyncRAT)", "value": "325076c547bffb21683f5bc023739016ad025c0739a7e122aa7289fa91fc88c2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630350, "uuid": "9e42785c-0dba-4432-9cda-3964f0d0d7f4", "comment": "Malware payload (AsyncRAT)", "value": "43ded76bf48088b7684879214ad4d66b58ef9a90", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630350, "uuid": "ee0767a7-2012-487a-8ed6-8fafa7d2cb1b", "comment": "Malware payload (AsyncRAT)", "value": "5672974ac7100830e819d78c215351b2d10abfa50a4a56e89fe695fb6a58683f6c310df48ef67c5e9919cb8e3f2d6348", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630350, "uuid": "c556a2df-45e6-46c2-a442-9c5addddeb3f", "value": "T1F9C47BCCD1F1EA3ECB488EBE371031081FE45643AA20DAE5E3A5FAC25B39163595D535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630350, "uuid": "b214f24f-e8a0-47b8-b537-30a56f21a5ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630350, "uuid": "927e1c84-5153-43f7-8abb-040dadd6364c", "value": "12288:bIqDSu4Dsv9thG2SEzak3cgH+/nSsYCrDl0wnhkDsv9t:MqDSu8gLY/nWiuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630350, "uuid": "087a58e6-df7e-4d2a-8f5e-bcdf83edf50c", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630350, "uuid": "4013ef3e-dd2a-49de-8e1e-0851353ba291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630350, "uuid": "65d95fac-9be1-4ffc-b5c9-18750cc8ed64", "value": "document_viewer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7164713-aeec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676656829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676656829, "uuid": "5e785c33-a017-4913-a1b3-f4f0fafcd695", "comment": "Malware payload (RedLineStealer)", "value": "6b979aa830ef170830662223b32214ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676656829, "uuid": "dce0a65f-9d1b-41a1-99e5-05f81399291a", "comment": "Malware payload (RedLineStealer)", "value": "32b2bb476a686ef7de318dc1304ef5c20c062b801453bcc046be64b68bf2f477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676656829, "uuid": "e11d1aad-602f-4497-ba83-3682f8b9b94d", "comment": "Malware payload (RedLineStealer)", "value": "5b2ab54bde8851d74cf1cc067d02ea65e244a779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676656829, "uuid": "13a7a490-cbc0-49fe-827d-9cb6709d5cd9", "comment": "Malware payload (RedLineStealer)", "value": "d96fa4b92c277a37683088137b2ac93ebe9b808415024732e6e9665537ebeadef498e060b592b3033731322636a31b3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676656829, "uuid": "53c557f7-7d37-4b8a-8fe7-262b5ccc5d06", "value": "T1E8F41257BBE98052E871273028F703C70636BD715B38978B265E9D2918B27B4B632773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676656829, "uuid": "079a3cfc-2a43-420e-b455-aede4c474492", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676656829, "uuid": "8ac12f7e-06f4-4f33-9712-f6d116b37825", "value": "12288:yMrGy903fcG7dQuC2wPluuF5Pjr/2cbv9Jx0KSal9875:4y5G1PRuHPjrtr9JR9l9u5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676656829, "uuid": "8ff3793d-43d9-44ea-b586-6bbc390c5ff5", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676656829, "uuid": "e3b900f8-4a8a-4311-aa8b-1b49aa6d58cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676656829, "uuid": "3dd375aa-e984-4afa-b6ae-645507fce4b0", "value": "6b979aa830ef170830662223b32214ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a1a3ae-aee5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676653706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653706, "uuid": "2632d002-04d2-4348-a9d4-59dbf157a626", "comment": "Malware payload", "value": "968e94a797ad78441b2cc3d31bb8bd08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653706, "uuid": "4a97e30e-4327-47ac-b0bb-2e5f17ffc8fc", "comment": "Malware payload", "value": "32d3cdae010be4cb4bbff8ee5f714de9bd61f22d587490c1dec81d09c13dd137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653706, "uuid": "f3d9d0ea-40ce-455e-8de0-0db6b95a75ea", "comment": "Malware payload", "value": "e70fece4312a003da9d98816bd2507111468df9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653706, "uuid": "a9d8a358-5e2a-4be2-862e-83537b2b1aa0", "comment": "Malware payload", "value": "5b1829cacd072a32e7a3cbfa10ab12284831289b43edde220a04b447cc1be2dc01ee3e5306d75de6136b17c91db6b11b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653706, "uuid": "0a1d085a-18c7-4e21-8168-ea657431de98", "value": "T176E53363F6D90927DDB0037444FA47D31F38FFD69E6D02AA1B863C2F18922669670366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653706, "uuid": "e7b64d9e-52c5-43b9-a479-a064a0022aff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653706, "uuid": "0b19e5eb-b7c7-4ec3-b072-21b3e410f46c", "value": "49152:sGpyV3n2kP5EaX2YnxWQTHNXSBhY5JfKkWqLOxXqonECJEhB3GY7QS7:ed265FX2wICtivYXfmqL4q3C+hNxQS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676653706, "uuid": "7ab059e1-34d7-44de-be9a-1b7cbbb141e9", "value": 3109376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676653706, "uuid": "ac6e5a7e-0f1d-44aa-9117-b55e64a33caf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653706, "uuid": "23adb3e9-c182-4764-a53d-3c1b70b6bcca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cd7f28-ae8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676615409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615409, "uuid": "0aa931b0-944b-45e2-bb19-22e6b4ad7f6b", "comment": "Malware payload (Amadey)", "value": "5a6533d64cd8dcccf21549b797647b8c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615409, "uuid": "40d37a7c-26d1-47c1-9254-cb8ef83a39e2", "comment": "Malware payload (Amadey)", "value": "332af0412b27b7bba48f1cfc2382f82a968e604490ba066f072c46e2699221fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615409, "uuid": "2a375658-cee8-4184-bf1c-58c7a06b08ef", "comment": "Malware payload (Amadey)", "value": "b41c03d6dedba80a918773258ed13e4c5b6a12de", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615409, "uuid": "d3f94ea0-f085-4cbb-84e3-2e3c08da46fc", "comment": "Malware payload (Amadey)", "value": "95248329193b9f3a8992afbde4ba033aa8dc68853a214df7d93ae909720aade0afa9f84f7261e76fcd4b36bc1223c467", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615409, "uuid": "94fe7c23-acf3-473c-8fa5-f461fa97098d", "value": "T1EDF4120BA7EC8132E5BA43341CF702D315367E616B7886D7224F6D5A28B25A0F931B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615409, "uuid": "2993e313-f05b-48ae-9ef1-153d04e35ef4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615409, "uuid": "d7c26b79-b831-4d61-8df9-9fec761e2db3", "value": "12288:VMroy90cuQZKvD6cq1546OwKOdE/83VuelazFYljKY:ty1lAZA545zOda7eMxYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676615409, "uuid": "c813a18c-60a5-4e69-83d7-ec1c2fa24dd5", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676615409, "uuid": "bb284849-a6b3-40a2-b4c7-e666aecec3ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615409, "uuid": "180f92b2-15e9-49bd-8e16-8e795ebd898e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea9a810-ae81-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676610725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610725, "uuid": "bd41f93d-2bf0-48b8-9c80-4181a03cd5a7", "comment": "Malware payload (RedLineStealer)", "value": "208cd2dca5921b8060d6c73d93dc1fa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610725, "uuid": "c4e1ee08-d5eb-43cd-87a0-e1c58cf34e4d", "comment": "Malware payload (RedLineStealer)", "value": "34769d9f3bd4e9033fa6f3d908430d8fa88ee2a585c8697fd8b7c8a636c62f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610725, "uuid": "05d1ef08-ef90-46a2-8677-1e5c34b73a43", "comment": "Malware payload (RedLineStealer)", "value": "f582b4dd4639ba11b894430e3641c8ffb94fb2f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610725, "uuid": "7ff825fd-5726-49d9-b7b5-903260c54bc3", "comment": "Malware payload (RedLineStealer)", "value": "6b1bc4cc55c033cde3b9197416dd8b887ebdb92b1903ba3371a5c7c58c5ed18226446c71a1cc37fc5cf9e6fa9465d734", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610725, "uuid": "24c3180d-247f-4b51-be7f-375f94d1dcac", "value": "T1E9252397D3ED8023E879577029F603C30A3ABD126A34875B378B6C6E4C71691B27176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610725, "uuid": "21b806f8-8ad0-4d75-80e6-0e9e8156df62", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610725, "uuid": "12685d41-c577-4c01-967d-193257976ae1", "value": "24576:By00Pl/biY4YHt6MNgUIYG1Z5oMDShnc:000PlhHt6MKbpoT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676610725, "uuid": "e9809365-0e0b-49b8-a00c-8af86c756991", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676610725, "uuid": "f8848882-b503-4f87-a25c-8e153c5416dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610725, "uuid": "621ba66b-bdec-4fa9-9ad7-7c761e4b8672", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08747432-aee1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676651705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651705, "uuid": "7a52f1b6-7c4d-472b-9f9a-64dc8a0214ee", "comment": "Malware payload", "value": "95728bfcf2bcf9719fd86749e50d3a65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651705, "uuid": "c9e370cd-9a56-4384-8421-9e8b9e54adfa", "comment": "Malware payload", "value": "34c8ef175620828cc1a521991937f11ab39d4e21e373b5d9d68c5a5f9a6e6816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651705, "uuid": "33142a68-d38d-4f28-bf18-46f052340fbb", "comment": "Malware payload", "value": "9be1178c4cb0a45992449d471b23f8795b491430", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651705, "uuid": "50ea2f3b-f1ac-4591-b3f3-0f72367bd6a0", "comment": "Malware payload", "value": "22e79d749c23807ef9c2d5c055a7dc43a2f55ca574d277b7850bf6381f198bcf4b6b33f5a3a860b431aab1e5e926ae5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651705, "uuid": "54c56c3e-9964-4b27-a0e2-28429d261446", "value": "T1A0E5338BE6AC0117D4B5AB711AF21AE7097B7454AFB183223307E87D1873598927837F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651705, "uuid": "bcd24826-4b9f-4126-8c15-d0e269aa8181", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651705, "uuid": "fd0c5322-99b0-4323-a04f-f5806403185f", "value": "49152:vcjGCGwpLLxl1P9taQK3jlkDPz1SZsNxTssB08PZE0fz3Bcw3WAU0LPjQrZPbpjW:I9FLV9taQoOrzcCP4sC8Py0fzBcOWAVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676651705, "uuid": "126e1d5a-d7a0-4be8-b513-cd604c7835ca", "value": 3111424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676651705, "uuid": "0584017f-2a51-4aaf-9b3b-bc3d561a1331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651705, "uuid": "c3624df4-18a5-4733-be13-e8ad2967d7ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b038a17-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676637670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637670, "uuid": "bfa65390-236c-4971-9ea5-324f6f806200", "comment": "Malware payload (Amadey)", "value": "57613b9f521ec4d75c154436e46ed6ff", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637670, "uuid": "3e0c522d-c069-4406-a3cb-151d0f432478", "comment": "Malware payload (Amadey)", "value": "34db61f23c2701386292bb8c50ee4a0a425051a255335b07c17a880aa185666a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637670, "uuid": "c6ad1e3c-000a-4e66-a500-859ee006f365", "comment": "Malware payload (Amadey)", "value": "d7066ee5f67b9c26c4466411e1326e37a64c14cd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637670, "uuid": "368aa961-28d7-4c03-9649-91bab5ba50ad", "comment": "Malware payload (Amadey)", "value": "b86f5c9c0318a6705266240cd6d2581535960b2bfab16bb89ea3f143384fd730b5f18c40eb1fdeaea159bb65459a2a6f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637670, "uuid": "43931aac-5db7-4c6f-acec-44f8e0296fa8", "value": "T12525234BEBED8422E9B853744CF207C306377C126B78529B224F5A195831AB4A63577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637670, "uuid": "3975efa0-8512-4c3e-8258-72e9ef2a1c8a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637670, "uuid": "fd183b51-f6a0-4a1c-96b4-91c84b0e5fae", "value": "24576:SyP4Px1YRahd/kwuo/IldDTGJ5BeWG9CUZdt:5Pgt/Ju0IGvG9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637670, "uuid": "40d2c542-f86c-4d63-88d8-6979b6cbf47f", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637670, "uuid": "f838286d-3607-48f9-acdc-c5d34e629da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637670, "uuid": "486df182-094f-45db-ada0-0c7fd07a1d16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1986806-af06-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676667933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667933, "uuid": "d5cf08ee-8782-4251-b30f-fef126ebde46", "comment": "Malware payload (RedLineStealer)", "value": "c9c03ec2426c8416841fd7e93bb9dc3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667933, "uuid": "cbda6a9f-bc37-43d1-80b5-f35cf6b4672a", "comment": "Malware payload (RedLineStealer)", "value": "35bf034217a7e519626a2e1f7d1627322ebb31f9fa8e839eafdf7ae2cde977be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667933, "uuid": "fe9fd17b-ce0e-4e02-af73-ab0e0cb15ce0", "comment": "Malware payload (RedLineStealer)", "value": "fd9430cc92842d29f76a7b3169eee466f67273db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667933, "uuid": "550c1c03-cce5-4e0a-8957-6b485c698db7", "comment": "Malware payload (RedLineStealer)", "value": "e5e455f4ad6494d7c4a5da6996b52dc83e8068030ae3b20154d5dce68a6c17934fc14aed6bcf12431b63025fce0e917f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667933, "uuid": "9b9398d9-7c43-43d9-b7df-90b53d4e157e", "value": "T1FB04D51437FCCD11D1BA5A3FA961A05086BF9802A852F75B76C367CD0E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667933, "uuid": "d7ccb59d-3e31-45a1-a04f-f6eb1a2c3efa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667933, "uuid": "741a0e5e-0c0a-4be0-85e2-15f216a5d90a", "value": "3072:cxqZWJBaKULo3HieYaez5F0h4/xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwk:yqZIHi5t0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676667933, "uuid": "5a3d568d-2c2b-4123-a7dc-7316eea77497", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676667933, "uuid": "accf8cf7-237f-4a2e-81b0-507c640cbb2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667933, "uuid": "d7516872-81d4-4731-8f5d-5b67bac25b21", "value": "c9c03ec2426c8416841fd7e93bb9dc3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846d3d02-ae8e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676616264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616264, "uuid": "2e961458-bea2-4fda-903f-7339ffac85b4", "comment": "Malware payload", "value": "a56f782af2f9cf140dc1684d7081fd6c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616264, "uuid": "5a60cee6-abe3-4645-8397-c69f2ab0d6ac", "comment": "Malware payload", "value": "35c2607c6670f5303f3eca40de2e3441c2f48101861d2135d85029a8827cae25", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616264, "uuid": "bc89fa16-e8c3-4bea-84f7-ee7381cdba74", "comment": "Malware payload", "value": "8a3fc26d8bbe27881c7d758a3b9ce80e5bd23c6d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616264, "uuid": "08b98d3b-201f-4c11-9ee6-417a110feeb0", "comment": "Malware payload", "value": "01663770ad433c557db6cf6d4fac7c107e9e2044dc78fe661ae5868c84afcaf85ad0362839763a3e2cbe310726befc4b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616264, "uuid": "e3381666-8956-484d-865b-551b701f4d82", "value": "T14286330B30CE9B7BE9960372463FA32767655C60512202337275FE165EF22A867E73E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616264, "uuid": "fb4b7494-1d4c-41e8-8026-2b18eb4b1f25", "value": "196608:Hpda9dE//65tj1PUXlFOIKthKDGRbDR7xuXp6cqZix5e:JdHy5/UVYthKD6DRduXpRUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676616264, "uuid": "2d1268fd-1f1d-49fe-a98b-4d4b1561b1f4", "value": 8485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676616264, "uuid": "ffa40978-8244-4f5a-a299-abac9d36a7e6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616264, "uuid": "11bc853c-a940-4d4f-bbac-2173ea7d2a34", "value": "Processo 17-02-2023 WVE\u88c6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21dcc5c-ae7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676608234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608234, "uuid": "5ad30e13-344f-45e8-95b1-463391d971ee", "comment": "Malware payload (Amadey)", "value": "3c5c5e468c358078db7c043aab833e13", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608234, "uuid": "0aae42d1-f8c9-4e23-a070-986b969a48d3", "comment": "Malware payload (Amadey)", "value": "35ec9cea18f0587049fa1f85859ae29f026b2747fafd8086ae5b936b7911eadc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608234, "uuid": "89457879-37a6-4740-bb24-986952264190", "comment": "Malware payload (Amadey)", "value": "2fbfd045a480aa1b08f6fdc3423a91b404e1922a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608234, "uuid": "ec4cdb90-fcda-45b5-916c-b003b696e333", "comment": "Malware payload (Amadey)", "value": "a8badc29802a5b4bcc333a2ff079b045f6f8db16c840b29550e1a656a01b7d2ab982d6b15b2b3dabe0289628f5f27594", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608234, "uuid": "694c6247-3692-4e93-9434-9134f6f2769f", "value": "T133252207F7EC5063D5B1477005F613D32936BD90A73942AF27CB7C5A1A72AA0A5B03AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608234, "uuid": "3f3c85c5-8c3f-4976-9026-00b17ce1c98c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608234, "uuid": "6b1709a8-9b55-42ed-8343-bf4192afb0bc", "value": "24576:syLV2La91+JgM50HgdqqiGTtKV158H9z:bLQL69A7ZOL8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676608234, "uuid": "8086d052-25ca-46f0-985e-24d47e1a9f32", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676608234, "uuid": "04b37415-175e-4363-8818-d8c4b74d6675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608234, "uuid": "a57e5bf1-81e3-4d9f-91fd-c799c9c2aa05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434ee8e8-aebc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676635912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635912, "uuid": "1f101fe5-1a6f-409c-b483-c1ec4e7e56f9", "comment": "Malware payload", "value": "2b2a6ce21a9bea9e24077bd43689e464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635912, "uuid": "83a4d3c4-baab-4923-8638-b8b800c8df88", "comment": "Malware payload", "value": "3666691ef3ece55e87225b254ba9507b532741a5a9515e6cddd3ca26289b6037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635912, "uuid": "19879db6-a825-48a9-ad3e-7139c536b4fd", "comment": "Malware payload", "value": "1911951fe23398e451722ec66e47681731be0e64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635912, "uuid": "4721e27d-3611-4192-a819-cc6c9ce87462", "comment": "Malware payload", "value": "27e87a9383a49dd3caae5af5f536b74db990203ae98b5cd5a6602a463e6dfcf632743ffa4cddb61ded9d43ef65ac51c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635912, "uuid": "97685d31-e75d-47ab-98b9-169ead15fb57", "value": "T12615230BEAEC8162D9B5673055F647C306367E605BB09393335EAC2B18726B0E93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635912, "uuid": "41dbca39-49ce-48a3-9965-49a60c7cfda0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635912, "uuid": "3d93f0e3-a035-42db-ae72-b1af9e9479ae", "value": "24576:NyGUMSHau8hauiM3aWBVJEhna1j+7EPbZT4DXYWb2IoK:oGUNihNiMKwJEE9T40WyIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676635912, "uuid": "021b15db-3ca7-4376-b6bf-9d9239d160b9", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676635912, "uuid": "a1b4b4a3-f0b3-4261-89ed-4407ccec7971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635912, "uuid": "4c38890a-13d2-4682-9f50-500c11074c0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579fce5e-ae83-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676611465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611465, "uuid": "fa8a09d7-f8dd-47cc-8f72-6aaa2c6bd3c2", "comment": "Malware payload (Amadey)", "value": "541a264a543b65ff6571b1c7e9b21e89", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611465, "uuid": "bfaa43fe-6429-47ff-b6a7-83296774c61b", "comment": "Malware payload (Amadey)", "value": "3854f7f1fcb2dd48a235e69be3a7618bec6faf676c8af4fc3ad1d253dc653591", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611465, "uuid": "54ce7a67-9651-4bca-8bb8-b02ab74deb22", "comment": "Malware payload (Amadey)", "value": "e19d384d70052046ce7caefacb45525ccbd23620", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611465, "uuid": "2296fa46-fbbf-4e06-b896-70030c8f98e1", "comment": "Malware payload (Amadey)", "value": "947c4c71efb52754ec3405c206c399d139543d58438f8d1c3c7de81dff56ddea7dbf1c3ea74b2ea735728c9304e1add6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611465, "uuid": "89ec637a-5761-411c-9680-a0ce51b03176", "value": "T16B251287F7E88022D875577009FB03C3157A7EA25B3E83AB228D4C1F58726A4B675327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611465, "uuid": "bf6da2e4-c427-4eff-99ba-b008ba5453a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611465, "uuid": "2ca7828d-29bd-4bba-be5d-1f9e377c3738", "value": "12288:nMrJy906wG95fV8xbkMeuJ8hCsfw30IR57V6rQgr/fZs+fHGhI33jrfJuNzOz0vQ:Sy91lVLuJIfQRa397fHGmjZMDz/J5Ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676611465, "uuid": "2c99bfb2-494c-40b3-80fd-f317331f75fc", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676611465, "uuid": "0aa720af-4677-4a3f-8f0d-8509ef32a547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611465, "uuid": "98e518dd-34b7-4136-a398-e65a4a4f966d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b270ed6-ae59-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676593432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593432, "uuid": "4645ef20-6060-402a-9b15-966e4022a953", "comment": "Malware payload (Loki)", "value": "d7976a1b0ba9ef31b265e27f03cfc3b8", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593432, "uuid": "b30ac39f-a34e-4cc8-a9e1-3b7fe9ea8cca", "comment": "Malware payload (Loki)", "value": "39999753f89f21851b943b83359b3738e180129a239cc4e424ebb077ec738d2f", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593432, "uuid": "6033fdec-fc67-46f7-831e-bdd41da7c67d", "comment": "Malware payload (Loki)", "value": "1d0671fd17080358afc60b501d0d13b222628ac7", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593432, "uuid": "0ed74759-131f-4c4f-87f8-72dac33eaf6f", "comment": "Malware payload (Loki)", "value": "48275ef79fe9ca598ac89517779fb71031d2fd25e9a21e80ed328680e8e6c1f51a866155c373daa331e522916d8607f8", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593432, "uuid": "4cf1a7ed-8896-4b75-8ad2-6a953a9c0461", "value": "T1BC227C2DC515FE3AC32205BDE06842F4F72C106AFA95BA5D1841F29E4FA16C353DE2E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593432, "uuid": "5df8a8cf-47a3-4667-a4c7-a5bb91936aa7", "value": "192:ScIMmtP5hG/b7XN+eOneQjO+5+5F7Jar/YEChI3Lt:SPXRE7XtOP7wtar/YECO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676593432, "uuid": "8dbffee3-b9c4-4ee3-b352-2fa0f84d742d", "value": 10361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676593432, "uuid": "834387aa-beb2-4e34-a7fa-9809914351ee", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593432, "uuid": "368ad439-3b3f-4424-8265-ccc848b59c9f", "value": "Scan_Copy264293.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8942a4-ae98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676620766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620766, "uuid": "6d454d80-9e51-4264-ac12-79bea083da63", "comment": "Malware payload (Mirai)", "value": "cd97d1d90ef161062e052ba8c1a7baa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620766, "uuid": "28bd4495-4a3b-4ad1-a58d-337ac599089c", "comment": "Malware payload (Mirai)", "value": "39ac55e4c4e0c3a4b8f38a716da2c2fd2c8fca252cf766d3ad66064b03d04132", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620766, "uuid": "0cfa9ee1-d403-4b37-a9cf-ba3ce38ad233", "comment": "Malware payload (Mirai)", "value": "c92b128039386e28f338a9c4c63fb3de21521781", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620766, "uuid": "4fac3999-c9c7-42be-87fe-633e4a37fdbd", "comment": "Malware payload (Mirai)", "value": "5f4aa50de205baa10b544425c4eb9d0b835a88c79b7201ce6d462518494b55861927cd3dbb29fca59f7ffbf87e4d82e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620766, "uuid": "227a1a5d-cdb0-4734-a1f8-351aaff9ef57", "value": "T101137C7BE4AE5E54D0460230B4699E341F13F6C493436EFB1DAA82A15487AECF905FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620766, "uuid": "35f00c71-b904-4e60-8898-52abaaf76490", "value": "768:eaRH4ge4hYyFDinQT3yMILrvC+deb/C3o9ufR8C/ww:eaRYghh/FmnQyMie+dO/f968C/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620766, "uuid": "b7d39eb5-ee4d-4208-a4b8-e3fa73049ec8", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620766, "uuid": "841d5603-cc4c-4e64-a551-8f02a0d223e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620766, "uuid": "199da305-9b50-4b71-a56f-4b122f27016e", "value": "cd97d1d90ef161062e052ba8c1a7baa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb22026f-aee1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676652112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652112, "uuid": "6729e832-e643-416b-aa79-0fffad477d6c", "comment": "Malware payload", "value": "2f59a4f131c3345ae47440173ca27129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652112, "uuid": "3826ecf1-bb6d-49aa-b68b-539d560df3b9", "comment": "Malware payload", "value": "3cba07617efd2d904eaa0ae1366b89725a24f9dd98aa5b8d5ba8eadfcf06fec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652112, "uuid": "c7bd7a2c-58d3-4652-a855-23a9000b8c66", "comment": "Malware payload", "value": "d0d8c9c95df68e0c445c50651c25d091293f2708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652112, "uuid": "1cd96560-c27f-4659-afe6-e3f49c1d6e25", "comment": "Malware payload", "value": "bc3fcbdcd9d35f9f00d56763127fac450e9ce1bae91dca6b91a8568a874cd9ec40f2962fca1eddc745e40c7a214461b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652112, "uuid": "3d6d68d9-a031-4b45-91de-54358ad986bc", "value": "T1E5E53343A3E85432E85567B004FF87F31F32BD471B2A859B1A0D298E5DA1256F530BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652112, "uuid": "5f8acca0-b30b-4ffa-a3f2-038f4b709c4b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652112, "uuid": "624eadfe-2867-4dea-8b19-b2c0bfd63f45", "value": "49152:pefTYSbQysXsQ0CB/NsH32XCK56TammSY8hgYZJSp8lOlps7h4iNYYNqeRJq2Lk:YfTYlXsVCB/WX2XC46TaZSYwwSlq0Ci3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676652112, "uuid": "950eaa00-99d2-4504-b63a-7a7effc63d83", "value": 3111936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676652112, "uuid": "eb6c012e-d6ec-4e35-be62-df810e13f812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652112, "uuid": "88b91d46-df6a-4bfa-a466-5595aae151ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c50febd8-aee4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676653310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653310, "uuid": "61fd9940-6759-48e7-a07a-436ce26a9ee7", "comment": "Malware payload", "value": "37070ea5bdb61b076f14870db68af287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653310, "uuid": "2921a44a-3ec6-4089-a74d-fc95da292a6a", "comment": "Malware payload", "value": "3d5d9d09b31291e45a7a9f800ff333e4dcb71ede5a0e5d885b24fabbbd23cd97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653310, "uuid": "fab762e4-37e9-4376-b624-9f594dd9f31b", "comment": "Malware payload", "value": "cfbf123a17acebee7aa1ce363a2f4e10c880865e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653310, "uuid": "5299d1b2-4987-4477-8114-3cca50fdedc6", "comment": "Malware payload", "value": "e28930e7b20d09003d3bb4bf95c2ddd059e731de3c10a059d5faf375c42403444da171a631f74329adb67c7dbf54390e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653310, "uuid": "5afc3834-0d77-4cca-816c-ebba046519fd", "value": "T164E533477AAA4067E8B993304CFB47F31B25BD021E9942E50B4B5E9E0C622F47571F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653310, "uuid": "943b9622-a9b1-491f-ba0e-351747e69e33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653310, "uuid": "f4f29d29-7205-465d-9b86-96fc9e4481b2", "value": "49152:mg7RZvXfv5GDjlOotLaY4btX1CZ5Z5+sJI1ruDVKP06eTrpD80KdSBaOS4t+DFn0:HLvf4ROozAtXMnZ7JItuDoP06eTFHGSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676653310, "uuid": "626c27de-9b87-4211-a88e-23e96603b7ca", "value": 3104256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676653310, "uuid": "8d13a50e-d3ba-4435-b92b-fca9b9ba3c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653310, "uuid": "3d2b9cc3-89f6-4fbb-8533-cd537888abf1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d0cfb2-aebc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676635839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635839, "uuid": "3afcbe27-3143-4422-abe9-379e7f43a898", "comment": "Malware payload", "value": "d3d3fd92bf59b7d9493e6d5124def0a0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635839, "uuid": "9efc9e41-0bf4-44e4-be8d-9fe62491f67c", "comment": "Malware payload", "value": "3d84c3142ceb5672663c31c626240b3bf38f522407564c23afc88b60b6b4f095", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635839, "uuid": "ef8fe216-5bdf-423d-911f-f907f482a258", "comment": "Malware payload", "value": "e6dc366b9b89233aba66561108dc84fbaf8b72e1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635839, "uuid": "d97ff6f9-f634-4c58-a345-771f44c2d4a7", "comment": "Malware payload", "value": "e6b106bef58d355e557c6c56281db6fc8735a15147f5d442fa91d0e6d34697a875f419dee40ee808c88817fc9049cf16", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635839, "uuid": "76c41ff9-88b1-4842-b688-818ee968278d", "value": "T11655011BE172EE2FCE17C67CCC9E648186169C789E69860C3087B31D56393E5127FA39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635839, "uuid": "14d9799e-5785-4711-9006-5abb60a23a28", "value": "24576:tFeQeMdbeAXZSO3GFe73HuwlEAXZSRPTBb8dLnGbKeA31R0m9:foKEmmS3OwREL8pQA3X9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676635839, "uuid": "81d47d7a-42b8-4e7c-81da-4a7b0f97ad1d", "value": 1312768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676635839, "uuid": "3815b222-c011-4aa1-affc-7288bafcf1f7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635839, "uuid": "999aaf35-b3e8-44f6-85eb-539f4165ecce", "value": "Product_List.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47ff093-af0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676671831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676671831, "uuid": "d803ba55-0ef6-4f02-9311-eaf2a061713b", "comment": "Malware payload (RedLineStealer)", "value": "1f9b2d750c6f7e9d1424c6b4f5ea419c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676671831, "uuid": "85d80ce4-f018-4564-9a1c-adeadca13c1d", "comment": "Malware payload (RedLineStealer)", "value": "3ffa015992650bbf7816552c1a97cc737f10b931c13d9cda673d75d3d0bc4af2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676671831, "uuid": "81a3061b-5624-4aa6-b3e3-266c5b934405", "comment": "Malware payload (RedLineStealer)", "value": "9306b574069f36c328bf5b1cdbf4eb426479acfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676671831, "uuid": "b296beb6-5694-415a-ac0f-8d0939f9be51", "comment": "Malware payload (RedLineStealer)", "value": "acd45be0be0eb4281ff9e3dcd7297cacdfcd19895e8acaf30cbf94bf855426261fa51de403b33f5c9bd8c5e8189e393e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676671831, "uuid": "9dbea6f2-9ac6-4b5f-ac5a-8b2f3bd4fa26", "value": "T198C4020BFBF88036E8B1577058F603D316357DA06F34929B234B6D6F18B25A4A63176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676671831, "uuid": "a0747ace-83e9-4fe5-82af-fdc6de10affd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676671831, "uuid": "725ed7ed-7c23-4812-ad60-c89209579697", "value": "12288:gMriy90p1qBaKhyNKzzkRVR1CtMmmUbCMoS:yycHKcKXkRxamU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676671831, "uuid": "daa1d898-3a39-4696-9941-6250cb855c96", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676671831, "uuid": "ed600ad6-dc53-4efb-8271-436fc180be7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676671831, "uuid": "ef580190-48ba-4baf-9e31-5629c2af573d", "value": "1f9b2d750c6f7e9d1424c6b4f5ea419c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa6278a-aedb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676649346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649346, "uuid": "9ad3dba7-a91d-43ba-9396-a307c8480df2", "comment": "Malware payload", "value": "dd385c370a7142810c3751dfbdb84bc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649346, "uuid": "ca6d5b69-bda8-471d-85ef-eecb0c4c8570", "comment": "Malware payload", "value": "40e2835f04a1d88ace167748cccb6f776650e438f54674c9019c0500490d899b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649346, "uuid": "c6c14990-aff4-4da4-a131-9c873ffc6f41", "comment": "Malware payload", "value": "6021cd450bcb0be7764ebe419aad94a59960cdf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649346, "uuid": "be7ceda5-649c-4a24-a0db-0d6d6822d28d", "comment": "Malware payload", "value": "dd4be235418c6ff2c371fd873fe3dd5f4bc71a827b409bd9ef25389978d22ddf3b176be7ea93c55315041d065127d0bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649346, "uuid": "214cea87-c0dc-44e4-bb6a-8d47f08fe280", "value": "T1B6F41247BAFC9472E8B45BB418F703D3063B7D605938939A164E6C1A08726F87631B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649346, "uuid": "bceebf9a-99df-4933-9b3b-c8b175761886", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649346, "uuid": "7f9f92a4-8d77-45cb-9c98-15b8dc151df8", "value": "12288:iMrdy90xXx9qlyN/96hJ6PTbOix1RfU9Sr/mzdpEcMpvbb2:byUx9qlyNshkP3vVuNUNpvbb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676649346, "uuid": "47df28bc-5982-4591-aec2-7a061e2ce783", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676649346, "uuid": "3a60d988-5cb0-4f45-83e2-828b90d895ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649346, "uuid": "beb41384-5c32-49cd-93b9-eb72de1b9e40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c570b794-af01-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676665766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665766, "uuid": "421a1d48-3261-4f42-9125-3378e327c40b", "comment": "Malware payload", "value": "f6b381749cc2729c855992e2e9ba2cd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665766, "uuid": "cf8a9aff-b91f-4f3d-852e-f2e19372b182", "comment": "Malware payload", "value": "41846bc9b8c1e3e4484b296825199134bf5824ac4383ff15652092a5f88448ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665766, "uuid": "b18c0d19-87ae-4d0d-b217-30683b4a1c97", "comment": "Malware payload", "value": "68c3ff392fae3eeee94f89adacc84a515dda9b91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665766, "uuid": "5b45c3af-3330-4c52-b712-f7420d629293", "comment": "Malware payload", "value": "879d0be3a290777f5b0ac17183d03b8dd5908df7c73885b7926f8251c2e18ad50aef18bcede68aedfb83ecef5aba43ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665766, "uuid": "09bff69d-4aa7-45ac-852e-bad17fbe53d7", "value": "T16DA35C5279D0C4B1D5761A321870EEB59B2EFA304E619E6B3758067E0F302C29A36D7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665766, "uuid": "450f7e7d-5063-4fbd-aa15-b232392bb11f", "value": "5ef760ca0d8eda2826336c4b35a0011d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665766, "uuid": "ecc20509-569d-425a-8a06-4c09401646ab", "value": "3072:luH4psWAPFrLh4Vb6//+raKVKW4cFJ3yIYqg9H:lQ4psPF3kWaDbtg9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676665766, "uuid": "855481a6-8b51-4693-bc73-1c92ae2f7498", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676665766, "uuid": "1edbf3be-4a22-4f36-87dc-87f5d7380bd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665766, "uuid": "58dc4026-803d-49ee-b58f-33d174a95796", "value": "SecuriteInfo.com.Win32.InjectorX-gen.18944.24223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d7df0b-af12-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676672742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676672742, "uuid": "2c167230-2c9f-4e5b-8ab0-388b5ef97290", "comment": "Malware payload (RedLineStealer)", "value": "0eae001edceff3bc23cadaae071dfc32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676672742, "uuid": "a6deccc9-1327-46bb-a0c0-6dca0596e1e0", "comment": "Malware payload (RedLineStealer)", "value": "41b4cc711899e88e5a7ddc2977d9f817f230e4186841a0d26bd66f26281562b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676672742, "uuid": "572f1298-138f-45a1-8b46-d42e5181df63", "comment": "Malware payload (RedLineStealer)", "value": "5d387a67ba534fd143eaea2730ad0a15e020e7e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676672742, "uuid": "8d83cf56-1c9c-4b47-85be-ba6aca112b10", "comment": "Malware payload (RedLineStealer)", "value": "5ffbf367cdbd098ea47f813fbd53705f84bf74e04d61ba0ebc36f01f232c9f87d53a84752bfb44218b9fa0cc26fccecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676672742, "uuid": "02f0d510-a757-4f3a-a2ca-733d7cddb350", "value": "T16224BF1377D1D47AE12355358E66C2B06B3AFC708E75AAAB3788263F1E342D2CB16315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676672742, "uuid": "5352791d-ac45-43f4-b96b-db3aa70ef9e4", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676672742, "uuid": "2c6c27bd-e10c-4081-86f7-3083a7c27f49", "value": "6144:i7ziNNyACm+SVpiHIu8v/1Z94630C8Ot1:+zD1m+SPiH58vdZ9J3Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676672742, "uuid": "c6a7f51a-84e4-4ded-8cea-8f8553c991f0", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676672742, "uuid": "0408cc7c-f2d9-4aee-be77-ffca4b94cca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676672742, "uuid": "0ce641b3-fe59-472a-b0a1-f4a4f315ebe6", "value": "0eae001edceff3bc23cadaae071dfc32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c6b495-aeb8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676634274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634274, "uuid": "4526bac8-ea5b-4894-8723-5deb19379d72", "comment": "Malware payload", "value": "6ecadc60d78b50e2edaedb374ddf3344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634274, "uuid": "a37ccc21-e719-446d-832e-d56ef459c6c6", "comment": "Malware payload", "value": "41f00829797285c1206ee4d6a12c6e528e605018bf176f5968f023aa00cc9e9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634274, "uuid": "e40f97b6-e72c-4619-8405-4e35ca2049d1", "comment": "Malware payload", "value": "5e1cbb9039a9a45367c3c696b6c7afd185b86297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634274, "uuid": "01e0f4eb-c405-4ced-aadb-a96af4632140", "comment": "Malware payload", "value": "405d1f94e56028ccd6dd79a530847f2efd31faaccc903ccf4a5a6f8518312dae10ac19772b3e088f3053e8ceb5af7c91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634274, "uuid": "33b07cdf-4677-4df8-9fec-7207b374363e", "value": "T1FE252247F2E95462E8A293701CB603C30A3B3EE05B788297239FB9665CB36706535777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634274, "uuid": "b88fd493-382a-4989-b23e-94bd663e11fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634274, "uuid": "f4eca548-4448-4fe9-96b4-074c41833c8c", "value": "24576:ZyXNZKcVTZ+gDS44coTCLM4EHtlBkBZOTdMn:MdZKc/fDS44+Y4EH/MQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676634274, "uuid": "63495816-8403-471e-b416-17f0766dfe92", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676634274, "uuid": "c70b6388-6b8e-4771-9047-064a581afa94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634274, "uuid": "ec5cdc82-4a82-4fd1-b5ca-3c835e3353fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c10e11c-aecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676642718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642718, "uuid": "474572c2-c40b-4fea-8de4-3691315317a0", "comment": "Malware payload (AgentTesla)", "value": "a776756d01e90d1839e88f6650457883", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642718, "uuid": "22dab530-3691-41c6-971e-645f78b76e7d", "comment": "Malware payload (AgentTesla)", "value": "42254d3829283c99a687de7f73c7c6483e194f3a4330d12e0d6da63f44cf9ab5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642718, "uuid": "58ebf866-05c7-43a4-a28a-89af7c0fddfd", "comment": "Malware payload (AgentTesla)", "value": "165730db2e4c348e03a3deaad9f2dc3a30d4d4b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642718, "uuid": "6eba202d-6609-474b-8824-87a0a35c9cbe", "comment": "Malware payload (AgentTesla)", "value": "00b6744fe89186856c74b8093863d81f9ea53f3f11d6012f0a1d9ce7ce39b7ada9c6a833d5b2f8dc667bab842fa0ea26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642718, "uuid": "e04f4878-9c3f-4df5-b5ef-2603df434b92", "value": "T19B257BB110477E5D9BB71CA9E540B6338C7CBE636BE5C044BE880EEA5975218DE188FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642718, "uuid": "efef735c-efc4-4f0a-94c8-7482b176c214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642718, "uuid": "a02b0221-d21d-4117-aebf-2bf64790c364", "value": "24576:QHOZM4l18sWZk9CAHBE88SIuEiagT8NPzEb/VdsOh38BSlYl0+eklMYT3b:VMS4lT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642718, "uuid": "ce04aba2-4be1-4302-abc9-82d09ed6e628", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642718, "uuid": "c16b919d-9559-445a-a41f-6185daf841a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642718, "uuid": "d1be3e7c-cf4d-49a6-a995-69d8e3bb3ad7", "value": "MT-55001-5061-322png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10e1f5d-ae7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676609118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609118, "uuid": "4e0ef62d-10b8-4be2-b334-a30dcb4382f3", "comment": "Malware payload (Mirai)", "value": "ddeef2dd4fdb37c5319f66cae3c2c370", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609118, "uuid": "f0d214d9-7fcc-425a-86ae-d91041aebb12", "comment": "Malware payload (Mirai)", "value": "42f883d2b9bcf179ea564266da08f2ee865523a2a4743817d3487138065830b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609118, "uuid": "5b8d85fc-4ebf-4ddd-b86d-9fcdb6711cdf", "comment": "Malware payload (Mirai)", "value": "7d0d98928bdecda5092e1cbcb5a98df916aea1c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609118, "uuid": "b55585ac-799a-4f1b-a799-016b1823ebcd", "comment": "Malware payload (Mirai)", "value": "b485d53c0a8a0391a3e08e8d9113972f13a5fbe846dd0b10a2251623b42f1eb2696916ec8f6e809eec188eb1c4418641", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609118, "uuid": "467b5ee6-053b-4711-af58-32a47fd13d9f", "value": "T1FFF34B46FA418B13C0D6277AF6AF4249332297A4D3D773064D24AFF43F8669E0E67A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609118, "uuid": "fd02d69c-f096-4618-affc-a7283e15ce60", "value": "3072:ULsgBea5FdT7VvbiXSPKai1Kba5YTdCCEWgJ5IgHqptW0vMM/9tlkUep:Qsgwa5Fd/Vv2ieoba5YTdCCLgJLwtW04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676609118, "uuid": "0662219e-6952-4d77-b9b5-465ed9c3166e", "value": 163250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676609118, "uuid": "19df30ba-c0bb-4e5c-889b-b95dd70487eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609118, "uuid": "fe3ed0ba-4259-40f6-b285-a39ce7d74b31", "value": "ddeef2dd4fdb37c5319f66cae3c2c370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b70f7c-aeda-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676648774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648774, "uuid": "c6ff54cd-86bc-4e77-9779-a0303c2a47c1", "comment": "Malware payload (Amadey)", "value": "42f1be31623ca966d6ab28cc5b056976", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648774, "uuid": "754a45dd-5241-4163-ae28-1ef2aad11c91", "comment": "Malware payload (Amadey)", "value": "43080e4b71ef48c8071a84d16fdb820e4b2aa63cee73e9314549cc4132ffcbc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648774, "uuid": "01bb0ef1-be86-414d-9203-663639a54477", "comment": "Malware payload (Amadey)", "value": "4e71dfbd815a169a6b7a46fe7e1b133f05dbdb47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648774, "uuid": "e50b84fc-4bdb-4595-b1a6-90aa28a57716", "comment": "Malware payload (Amadey)", "value": "2bb98fca5d87e30573b108a7b57dacb274460aa549dcad98a520d18ca33b727179f95c00cb32f6b691ad4fb3c21780fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648774, "uuid": "8cb25cb6-f06b-489e-b0c7-7b4c4bad6ddc", "value": "T13CF41307EFFC8575E8754BB029F217D30D76BE716934539B234EA81E18326A4A23472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648774, "uuid": "a1f5b312-123e-4268-8489-949e0871a38a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648774, "uuid": "abd403d6-c523-4576-aea0-23c387d36c55", "value": "12288:HMr0y90oj9nxHYHCnNlRnCuMsZRWdUxXFxnrsrSr/UzK2/q6rrGEX+5z:Py5neHCnNlLGgnrY3Hq2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676648774, "uuid": "55bc38bb-53d9-4590-9dfe-b6f7bb585530", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676648774, "uuid": "5a98e461-61af-44ca-a2e7-fe0ce79e5c48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648774, "uuid": "fc561855-e3ff-4b2d-b2db-7a4e353892b4", "value": "42f1be31623ca966d6ab28cc5b056976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eed16d7-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676627395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627395, "uuid": "a2e1b76b-c02a-43f5-9ca0-b4c338be360b", "comment": "Malware payload (RedLineStealer)", "value": "842f0365b39335c85afd65e0ff6306e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627395, "uuid": "79a0ed9f-29c1-485c-86e5-2acb5bc5cb97", "comment": "Malware payload (RedLineStealer)", "value": "43139728c5ab9467068c75e1a1327c3b8199cf242cf1e139b02296a72d63db5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627395, "uuid": "4b137b36-a00a-4498-b206-609883a53016", "comment": "Malware payload (RedLineStealer)", "value": "0226d7b01debfefc0ec6b27c373257e61d50cd28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627395, "uuid": "5a7bf33b-6162-45ae-9e82-8153a0e43723", "comment": "Malware payload (RedLineStealer)", "value": "2ef32655b45f94f118cb45e92ee5c33ec2011e3a06d2bf2be04c7e3d62b79c59efdaa11989e5d2732b74ab1ff7ff80e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627395, "uuid": "bfbba11a-fed7-4062-9699-bdf705fceece", "value": "T131F4120BF3EC4032E9746B3059FA02D3167ABD309B3C5A5A238B9D1E48727B46671767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627395, "uuid": "de244fd3-4b2c-46f5-97ca-c09483797830", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627395, "uuid": "d85cb727-cd13-433b-8cb8-0a62d8fe03ca", "value": "12288:gMr0y90aYEksN9A71jFFAT4QcDee9+XYSm00T4iE3ThHUpkZQdZN886fFIeNV80L:ky//9zkPa4Q8ee9u5dM4ZUpIS+f2er84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627395, "uuid": "958b38fe-4c7a-43c6-9c94-b272b7d1037b", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627395, "uuid": "d8eecba5-b7e5-4db7-8090-62f00ad446a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627395, "uuid": "fd3527ac-8fa0-42b7-8620-c43d73801388", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ef9ae8-ae99-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676620887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620887, "uuid": "94008608-8fd7-4612-94ec-9b18d857ba61", "comment": "Malware payload", "value": "26db2992fad7d1e868bd5ad1d52aa5b5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620887, "uuid": "cf49bee6-1a5c-4ca7-b939-09e6358c2dde", "comment": "Malware payload", "value": "44494db1d807f363af9bfaa3514ccc3128b4133f1fdad4ce5e8d9a529d2b9225", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620887, "uuid": "84f7ca92-dbb9-4abb-bee0-4a5aae9729c9", "comment": "Malware payload", "value": "5dc1e718a065f8df70323d1a88500c742d732552", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620887, "uuid": "1413c4d0-3e2e-414e-b18a-f18a9d5589fe", "comment": "Malware payload", "value": "cb0a6d82aa86cf92b444ff475eff881bdbcec8a3d5e5a078e68f5bedf61a14c68f92c3280a6214c05352084726df5fb3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620887, "uuid": "18c15485-40a5-4657-8b34-ac163e7c195a", "value": "T16E138512B3D6AF26F22326B499F3C295B339BD049BB2872F2158370F7C725701952722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620887, "uuid": "fd39c413-4480-43ac-80ab-99ea61a38cd5", "value": "768:gfnaaZGOLhJaOj9dwsY3kSHBeOxw+tsaV:aGcK4OxrtsaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620887, "uuid": "f4cb7b13-1711-4ea6-b315-7edf5dfec23d", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620887, "uuid": "9ab11c91-bbf0-4ab1-8718-d5b342b72bfd", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620887, "uuid": "db6d8bd7-6d90-405e-864f-a5fb2d0649d9", "value": "GOTHAM CRANE CORP NY .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e4cf8f-ae8c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676615279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615279, "uuid": "79b9e66a-0018-4f2e-b266-29c09963050f", "comment": "Malware payload", "value": "1fba3c67dccebb28f750d32a38c77d9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615279, "uuid": "514f6a38-6f68-4967-a609-482b70fccd0a", "comment": "Malware payload", "value": "4467f9f9c4e76bdc543401582bcd4d17ff1b80d5e6a287c84fff657b9635fa9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615279, "uuid": "6ca37d0b-6401-44bf-a6e3-41cb86b6145e", "comment": "Malware payload", "value": "d5c8f51c6937a4a5f56a454b2408a5a8265b057a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615279, "uuid": "7667193f-b98f-4fbc-8dcf-345d22b9f374", "comment": "Malware payload", "value": "77c8fb6dcbc7b886281722f0903b0c97e75a8ac8a7aa9274d8a47bab0000c1a958d2976e7424faebee33c6a696c291b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615279, "uuid": "69e2b46f-a7c3-484a-bb4c-efcd45064a59", "value": "T102B1DF4A9AD1C91AD8D2223961D74FAC3374D9C1B605872B921DE8702E137EA1E7360D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615279, "uuid": "e059cfc2-044a-47d4-8b71-0a2ba2d5a2bf", "value": "96:Y13oYim+RjOPiR1RHa/vw+5QDXOsR7KYeSrwuTlRGon:g3rim+ksvHmnYeSrzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676615279, "uuid": "a18c102a-00f1-48d9-a7fb-75ee1ba58e51", "value": 5165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676615279, "uuid": "a7b08001-a356-42fa-97b5-d8e41132e74a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615279, "uuid": "8ef29635-82d8-42cb-a49e-f6c59cdf6b25", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.7798.23791.22148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bb1551-ae70-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676603568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676603568, "uuid": "ddf42596-055a-4b5a-a427-124fbf5fe62f", "comment": "Malware payload (RedLineStealer)", "value": "438ea9485d8cba48aff6a2b29e863f9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676603568, "uuid": "2c9e7fc7-ab16-4318-9f3b-a52c31f9a11d", "comment": "Malware payload (RedLineStealer)", "value": "44e270c72f476c42ebc63e927a12e42a35b8fa3c03eaafd61754352b28c47185", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676603568, "uuid": "fc9ef6d6-3099-4ba3-9297-c04f5c53df2c", "comment": "Malware payload (RedLineStealer)", "value": "b6919137182d8ae0080c58f8ef285edd24f97f96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676603568, "uuid": "92821057-ba5c-4c9c-82ec-fa3f021852e5", "comment": "Malware payload (RedLineStealer)", "value": "e528769e3771f8f112c1424e21585fd83516b04714bc29cb07039bf1016f6f19bd8d3ccf87a7e6fc0a35b25dde2a0687", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676603568, "uuid": "c9fcdcc7-8385-4395-ab82-d42c72bffbfe", "value": "T1AE25224BEBFCD022D9B58B7069F313C306373E611B385357679A6D5918326B4A2307AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676603568, "uuid": "50bbda1c-5cd9-4ce2-8a78-ffa8763edf72", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676603568, "uuid": "36e6c223-e0d4-496b-a259-6d360b0f8e35", "value": "24576:hyG99RZQ0GwRDCWLvU1cmGMMJnJ8lvun3:UG99s0GwRemU1i+vun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676603568, "uuid": "ae311949-4d21-43e7-89c7-3235db6c7339", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676603568, "uuid": "85edfc47-20cc-4bd9-b00b-a40d32a5a3ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676603568, "uuid": "7d051824-f616-4f14-a5c2-d70b87e94d86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0ae7f6-ae95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676619097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619097, "uuid": "5dbf94a8-12d8-4e63-a83b-06003d320b42", "comment": "Malware payload (RedLineStealer)", "value": "c0be8d195688d370a2f62473867c63ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619097, "uuid": "8effa736-57df-49bc-b80a-ffe997588868", "comment": "Malware payload (RedLineStealer)", "value": "44eba42cde77f07678c03194802fd1de161ec5ceedcf92beef9051769435333a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619097, "uuid": "ea36e9b6-5f2b-41b2-8a6f-ffdf0a39d418", "comment": "Malware payload (RedLineStealer)", "value": "6b1ca8b418080e83eec1175fbed36ef648a37077", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619097, "uuid": "0f391eaa-4f1f-49e2-bad3-f052e047b009", "comment": "Malware payload (RedLineStealer)", "value": "28c89469a184981f30065314f31284dea5aa0c6b93798d44918543e0906f79013e6095b6bc572e22d03b425d26462a8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619097, "uuid": "21ab5a94-6f5a-4836-8b72-0079dd2aa510", "value": "T14664F14333909477E22345358F25C6B5A72BF8B28BB6AEAB3744562F0F752D1C722352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619097, "uuid": "d4208c5e-00bb-4714-b6b9-37f274e54cff", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619097, "uuid": "b08f3ef1-811f-4257-8e2b-7954ab500eea", "value": "6144:g7zDS+i4GvEBUWpjaN8ktmxZUyNC4m0FNU/O6LiS+C:Ez89vEBrkuZUyNC4VFSmrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676619097, "uuid": "7e6a8127-8d07-40f2-a636-da88c80771d1", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676619097, "uuid": "ca3af8b7-ec27-4e01-8736-9cf58bd7fb9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619097, "uuid": "2dd032f8-ef9b-4063-b016-1f20d75fdaf7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f7d838-aecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676643357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643357, "uuid": "598709d4-d2c7-4ee8-9ffe-d6959179c4c2", "comment": "Malware payload (Amadey)", "value": "c3f851315fb11d07271afed3e8faaf01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643357, "uuid": "105e2c93-b057-4758-8160-1e500e43f5fd", "comment": "Malware payload (Amadey)", "value": "44ee44d45a1d890def3f6b35210637f1f32441e9fab717e71ad27e2afce9cd95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643357, "uuid": "709a627d-8d2b-4809-9b2f-e20501c8a6ed", "comment": "Malware payload (Amadey)", "value": "5a232aeb9dab35e09cc6fefa87207f9225817ca1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643357, "uuid": "195b3682-83ba-4127-85be-28cabdecefaa", "comment": "Malware payload (Amadey)", "value": "6af7a47c88714f139abba8082858c689e67ea57db37de7634ba093bf43d18a7512d36c1f40de4d22136808a3b346efdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643357, "uuid": "b431b2e7-1187-48a1-8f84-6110b2d3cae4", "value": "T1DCF41207F6EC4036E9B557701CF602C3093A7EA5AB3D8297128E7CAF1873665923176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643357, "uuid": "bcf663b8-b5e9-461c-b46c-aa5ac6e29d22", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643357, "uuid": "544afc47-4658-4492-ac05-78baf1182854", "value": "12288:wMrAy90x7TM6jBgnhxy4CdQrG4qeeouPX+8SxqndBXBnq1K1Ifx+xld3zsmNraUU:gysTM69gnh0byGNCUoqnXwwIJ+vd3zs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676643357, "uuid": "8e4d50c9-deb5-4f2d-b481-0b4eb664c532", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676643357, "uuid": "b844bba9-7271-41c1-9c99-22b30b912bfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643357, "uuid": "1d078542-71ca-45c7-ad12-e394a01405cc", "value": "c3f851315fb11d07271afed3e8faaf01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4499d0c1-aeaa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676628183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628183, "uuid": "78c0e229-e2c0-452e-ad08-8d1d1204d2ab", "comment": "Malware payload", "value": "8a23cf5d92fe0fc5de6818d49e8ee133", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628183, "uuid": "a4295f74-0b70-441a-be9c-c1ef4f56b6eb", "comment": "Malware payload", "value": "455bbe5f912e6f1134442eda842334c3c747d4452ac6d205809ccbf9128750a4", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628183, "uuid": "6befcacf-a565-47a8-aad8-edd3dd82c902", "comment": "Malware payload", "value": "0ef4e3c967cab9dcf0fe6b9bba292d4244ff29b9", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628183, "uuid": "1e8fce69-9e2d-4d28-b396-e4232c2b3360", "comment": "Malware payload", "value": "f2ad26b33b3549d65ca17e67fb8b12dfe5bb6e1e2c5ca1d8f727ce6f7c93359c262325ad6ea1053045d5fc3945150961", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628183, "uuid": "f5a7ba38-b46e-4cd8-863e-39eeb41a8551", "value": "T1F211121A18E69824EC7D9C45BEEBF3A02CE150153A42E380904DC09F941CEC1DD2EBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628183, "uuid": "2ef40a2e-78ec-4c19-afb3-fbade1d33636", "value": "24:FHkbnsqRRjBK1vAdRRcpbWZRRZOS9IgNV4Nlaz5/T/sOoVKhIPpu0jvive:FHkbnsqPBKCdQpbCMS9/6NlCtAghIPcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676628183, "uuid": "72c36950-d952-4f11-81df-dfc0c035999c", "value": 1058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676628183, "uuid": "9b51dd0b-d1d0-41bc-a85b-2ef88f257daf", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628183, "uuid": "acee5893-8b55-4c4d-9b0a-0bbacdab7892", "value": "NFcmoOSI.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36f825d-ae9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676622007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622007, "uuid": "635a78a4-1fff-4a82-a3b8-239941733e23", "comment": "Malware payload (Amadey)", "value": "925d045105ace4a5b258185d0b8a0086", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622007, "uuid": "c889b1f5-a31e-4c94-aef3-f5af8bf79d26", "comment": "Malware payload (Amadey)", "value": "45ba643052de54e95d1a675970d5ca460f57c86fe9301fb00a597b1a106a438f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622007, "uuid": "1a6f279f-915d-49b8-8ce1-8118e4863ca8", "comment": "Malware payload (Amadey)", "value": "413588795116949083a7348773b22e78ba6f14ba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622007, "uuid": "fce96547-d61f-4175-982c-c4b2dcfa40cc", "comment": "Malware payload (Amadey)", "value": "9da7c8de535c5bdaf6d76e1e6c313afe5cc8f568dde41e9537cbab3641ebe99fbcc4c40c5d220496fc68f48477de5782", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622007, "uuid": "740e6535-f325-4e76-8edb-2aef7cfa5c72", "value": "T1AF252327B6ED4135E5B667700AFB03C30A367D919A3C8387374B9D0A4DB2664EA31367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622007, "uuid": "0d5a6a27-9736-49e8-bc24-8cafc5d09a48", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622007, "uuid": "3533aaec-24fe-4056-982e-e5aa04746d41", "value": "24576:JyESDUM3UnYlGmw/0Ds+bFq0mb6Z5QBEydeuX:8EjMkn1mw/Mwboo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676622007, "uuid": "ec93f59c-724e-49dc-90c3-5482f4c35c27", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676622007, "uuid": "6827fcfe-3938-4381-a7e1-c6050a038b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622007, "uuid": "8af37f9a-f40c-4d80-9b4d-c4428b478931", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015a7f40-aeab-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676628500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628500, "uuid": "8ffbb1ac-0279-4549-8bb1-e53c430ea641", "comment": "Malware payload (AgentTesla)", "value": "6e2e0c79e5a40859fdb2153a9a32a04f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628500, "uuid": "6a3d8bb4-9632-4b6b-a1c7-720ed704534e", "comment": "Malware payload (AgentTesla)", "value": "45e3147f1b2fdcd97492b8bf95ca8f6b18493f395f1f8725a2cfad936391d4e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628500, "uuid": "6769b9b5-d45f-4ead-a1bf-c3076d4b1da8", "comment": "Malware payload (AgentTesla)", "value": "311576003d0931119b4c8f26b2f28bbd8ab9b2f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628500, "uuid": "a3d0a70d-22bf-40a4-94ba-355cbd63d366", "comment": "Malware payload (AgentTesla)", "value": "9a5a68870d604de740b7e13c153ccebac16c0f981d612f130f1b82f7651bab8927b25dec0119df764cde1ea29e7de28a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628500, "uuid": "70c2d66e-aa08-4fc5-8c3f-0761f1e06a9c", "value": "T1D76412157B28C46BE8D205F1AE3AE2631BD6AD0B14BD565F27C09F6DB9A3B50CC0D231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628500, "uuid": "815c1019-ce4e-41ed-9981-5b2e4fec1fbf", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628500, "uuid": "df464411-3e16-4282-89eb-fefbefb40845", "value": "6144:/Ya6H8DUAL/TBcrWnxk8R1TUKS5ZN63i+vfaFrKpcqqE:/Yd8tTBGEhR1Q97gi+vf6iPqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676628500, "uuid": "e8c0def4-5a06-4d4c-8ae3-f106f85cf1aa", "value": 319892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676628500, "uuid": "9218ec1f-dbca-4769-a4cd-44532f08d15f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628500, "uuid": "4159f3b7-0640-42ee-8f72-c2be23a41511", "value": "S O A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474d0f9f-aee3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676652669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652669, "uuid": "fdd496d1-a08b-4d65-8c32-e88bad0fa595", "comment": "Malware payload", "value": "81cf7c70a044ccafdc8c8d16c6a705c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652669, "uuid": "80137e8b-e6a9-4823-a30e-9fa0661b9b6e", "comment": "Malware payload", "value": "460e1e4d125b25fd5e9449c2abf40cdf0752d51e6b5590224f64db57a35b4209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652669, "uuid": "41be1df0-df65-48a9-adea-b1b15e028ada", "comment": "Malware payload", "value": "2261b9d0b959f482b6a2998b6e4493f7cc25a2bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652669, "uuid": "2a6af177-6665-4b8c-84bc-925eb017f77d", "comment": "Malware payload", "value": "76e58331c36b29406366aa96f96b4acdd6a23bde95e56be47a74976303e1fbd92055e4c9957e4ccb19a7126a10321c04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652669, "uuid": "bbd21c74-d465-49e6-a340-420c2ae8d500", "value": "T1C1E5332AB7D50027E0A0237414F351D30E72BDD33E7DCA9A2996588D29227F57B713AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652669, "uuid": "2c4eed42-928c-4b57-bc10-b7d0b47c3231", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652669, "uuid": "3cedf2f8-b0b1-4858-a4a2-6b2196915c02", "value": "49152:JqEqHRhpeutYn6n/4av4sS2yYn8hf1HG7h5XCSxDQn7ZqpQz6H06JT0QqWrBQ/1:ExhpVM6nHG2yYn8h5c/X9xU7ZqpQ2HLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676652669, "uuid": "3af46a27-9f93-4a8c-bbbd-2205ae812ad7", "value": 3105280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676652669, "uuid": "21e59f18-dcdd-49fd-a808-7123831e7355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652669, "uuid": "6cfa1402-3bf3-48be-9241-ce3c67d3be34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec41e64-af15-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676674237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676674237, "uuid": "ef00ff90-fd92-4d26-8bf7-9ed1bc1cdafa", "comment": "Malware payload (RedLineStealer)", "value": "546213b5be34dd84d13044c84c5c3ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676674237, "uuid": "880dec72-936e-4225-bda8-dd2dd255242f", "comment": "Malware payload (RedLineStealer)", "value": "461d1703fd2a8263e65ae5a5cbeecf901190822b993d08b43731d96d5b7da4f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676674237, "uuid": "9b51095f-eb3f-449b-94c8-ee6b4e81580d", "comment": "Malware payload (RedLineStealer)", "value": "0352749e39f8c69dc7e3163d72dd0dbf3d935596", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676674237, "uuid": "5d82d139-547c-4c3f-b3cc-3876291ec6a9", "comment": "Malware payload (RedLineStealer)", "value": "b6906ac4520e25c58f97a3cfb6a601c19c0eb84b88225a4c53d7da665fb533e524df8f4f9d8c5e81e6ee16a06a97d4ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676674237, "uuid": "c7811fbd-9e1a-4fc1-b5a0-8d66283d8ad5", "value": "T19A95230BE6D9C462C4BBDB7016F9178309B9BCA05F7892CE374D6D4A18732AD7934722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676674237, "uuid": "1f18f88a-e0f7-46ea-b8ed-34c10619d726", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676674237, "uuid": "b6dc2b51-42f7-48b6-b539-06e3dea2c327", "value": "49152:nfGH3XLz3bvGIAZcWPMt8vOmOVDnuyjB3:g/3bWZcWPM8vOmOVD15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676674237, "uuid": "ab7dc180-7a0f-4203-bc94-c3741edbc18c", "value": 2043392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676674237, "uuid": "4559bf5e-1de7-4068-8d5c-f19f3944f3a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676674237, "uuid": "bfe3a3e5-7531-4019-b5ad-581392fb2723", "value": "546213b5be34dd84d13044c84c5c3ee3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becdfde8-aede-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676650722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650722, "uuid": "7f7f8248-21f8-42f0-a793-eca24e160a1f", "comment": "Malware payload", "value": "bf6f5f40795bfef7466d77d1a6f92ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650722, "uuid": "cee18fd2-7f74-4355-a9ed-d979d51786a3", "comment": "Malware payload", "value": "464cb61d0b4d1cd242594533f64d81c6e0363ee6b55fc9611ff0fe0c53e01a15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650722, "uuid": "adcc0248-6d35-49f2-9501-1d04bc6ae0dd", "comment": "Malware payload", "value": "3553ab0cf1379eae8d0d177125ac55e85c8843fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650722, "uuid": "4e2b2189-5563-4481-bad2-1ed01e47b323", "comment": "Malware payload", "value": "c50332b8a2c0996213ab79d96f3593d8fdba97df7eee8d3694f581e0322f305395a00547e5b57cec8ed029c96a936adf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650722, "uuid": "b88fae6e-78fb-4e72-a026-b40463fe9247", "value": "T10FE5330ABBEC5412E1F423B84DB586C70833BF635768865B4B2ABCDE2C7265075707AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650722, "uuid": "ae37fbbc-7842-480e-8589-e91c3b1f0f2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650722, "uuid": "a90179aa-ba13-4512-aab4-a49963a59395", "value": "49152:Gz9OXcxZsOkfEJCPrHpZXglxT65t7Bdl/9QkW96dsrNml18xRX9FfQ7h5y7du:OrsOOXXm65tHnFW9CaNmlKx5Q7m7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676650722, "uuid": "5b48131d-111a-4e67-a906-98be54c3f1c0", "value": 3127296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676650722, "uuid": "fad9fd81-a575-4cb7-89ca-39ff3ef4caf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650722, "uuid": "57d40359-6ebe-4ab9-8854-a81a124e106a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f261d2e0-aea7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627186, "uuid": "5496ce12-9445-475e-969e-b526dec40496", "comment": "Malware payload", "value": "ab623bd047d48b7c06a1ff96b96e62c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627186, "uuid": "329240a2-4e38-4ba6-bc18-4ab3300a0013", "comment": "Malware payload", "value": "46a9734dd1ed4526f968c10575c1feb5580e02de8d50a74e68bbb8a09ba172eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627186, "uuid": "43bc0207-5a02-4e44-8d54-3c86a0041003", "comment": "Malware payload", "value": "b5680e20f2453d3e52b9473e35b689cdee705bd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627186, "uuid": "9d89b642-4534-498b-b545-ff9150e38755", "comment": "Malware payload", "value": "7c18272095a09b9287f6c4d5d6f622bf66fe880cbbc2287af052bdcfb8cfa34617630886a6555198cff49d7163192a70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627186, "uuid": "39279286-35f7-4b4d-830b-86bedfe8a0fc", "value": "T1D1252307E7F85062E8B24B70097603D316327DA16B349357B69AAC5A19B37B4E232377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627186, "uuid": "7912194a-c883-4a60-8e1d-9e12982c2de8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627186, "uuid": "814dc3bb-35c9-44bf-b415-4324550de8a7", "value": "24576:oyLv47JBa74ccOpyyjNA+PM8qEsCVCxbB:vLisMOIOA+9q/CVCxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627186, "uuid": "baa009b5-c4c5-4c60-903a-1abbec725dd9", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627186, "uuid": "c4e96d72-f261-414d-8b00-f6f6e90153e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627186, "uuid": "400f9fc6-084b-4557-a14e-6f1d915170cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da49c598-aeea-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676655922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676655922, "uuid": "9ecee897-f8c3-45e8-bce1-755322957ced", "comment": "Malware payload (RedLineStealer)", "value": "96530f931586f1e237db8eef706f7cdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676655922, "uuid": "a02ef568-ee7d-4094-806f-b58662a17a58", "comment": "Malware payload (RedLineStealer)", "value": "46aaab86e703a417e047127b4cea47ce052df52f2de4f91329db50b004333514", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676655922, "uuid": "77b703e2-1afd-4973-ad13-13cd62c49e58", "comment": "Malware payload (RedLineStealer)", "value": "a3a3260bf5b74d7d83fe0e467406a63406909a04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676655922, "uuid": "f0e3d67b-7957-4672-939d-31cf86b1c1fc", "comment": "Malware payload (RedLineStealer)", "value": "cda7c6285c24b09f00ee2ad3e8f25abaff4a064c5c80f828a45b8b92da9dfcc4b4c8936f81d56deac563a7c5f49e2b97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676655922, "uuid": "c3c35fd5-0307-470f-927e-04c806431afb", "value": "T17554F1213BE0C4F1F11786788D70D6A59EABB9708976989B3FC4016E5F352C2AE2C357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676655922, "uuid": "cec3ffd8-175f-4118-9851-dc3c0c5ee009", "value": "04d4ff0968f0d2d964fcf7ad4ec4e8a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676655922, "uuid": "3a2a0e4c-9d5f-4a0e-b1e9-511dfeec5f91", "value": "6144:EVe3XTedgNeSvVR3J9Uz3XMJA6pR6D1YrZG8:EViDcgESv/8z3rfD1IZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676655922, "uuid": "9338469c-7ba0-4a81-823d-b749efd8349c", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676655922, "uuid": "f3573228-36ff-4c4d-9145-67b0f79e6a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676655922, "uuid": "a7bc5c9c-8da4-405e-86d9-7d91c4b7a0bb", "value": "96530f931586f1e237db8eef706f7cdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0718a4-aeb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676631476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631476, "uuid": "7e3b311d-ed69-4388-bdf6-64d998c301f0", "comment": "Malware payload (RedLineStealer)", "value": "cb0bf243fa23ddaba0aa5c2434bc03f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631476, "uuid": "849ea9db-7a47-4d38-8d26-4d3a7ee6e434", "comment": "Malware payload (RedLineStealer)", "value": "4705cd053d069d919229c4bae91b6b527e217230030611def357f89dc19e7c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631476, "uuid": "88b3ce1a-f309-41f9-ac9f-91967a781c1d", "comment": "Malware payload (RedLineStealer)", "value": "5da36574df75629dc4ff9af07b9ec9585645f007", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631476, "uuid": "3800478d-6489-4a81-a07d-8ca1ee4b93ef", "comment": "Malware payload (RedLineStealer)", "value": "9becfba7ba2f79e03a38cb81c10c853548fc3201e9188237ff7b08dc66ee2d5bb80e52ea7e74fc7c8ee79e2f120cabc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631476, "uuid": "3913ec52-177a-4f31-af12-30494cc920c7", "value": "T1D8A52303E5C595F3D53609364A38AB62347C7E301F2456BF638D6E3D9A781D0B229BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631476, "uuid": "ce19b709-968f-4b71-a3e5-4f0d1fae5655", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631476, "uuid": "3b8dc577-91bd-4907-88a1-356d273781c2", "value": "49152:V5O6TlFQPz6xoic4DXXdA9QcceklxDEhR:V5TTlF8zzCXMQxemDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676631476, "uuid": "98184cfd-c0d9-4e3e-8842-5f33a068b83c", "value": 2150312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676631476, "uuid": "7fd849dc-3f4f-4508-ad98-55bf4d07c356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631476, "uuid": "29e658d1-a8b7-470e-85dd-5be87ce05b09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904f4e2f-aeb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676633464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633464, "uuid": "a0f87840-f545-422d-86cf-c3682924dc86", "comment": "Malware payload (SnakeKeylogger)", "value": "a95c92a95076b7a297db5fd7ec0922ef", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633464, "uuid": "ca09d616-de81-4778-8f97-33980439c19a", "comment": "Malware payload (SnakeKeylogger)", "value": "480d3a576e709c1c40c7511f079a402fd0d90bdc5bc1cedd44edb2a69786c953", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633464, "uuid": "e8059e86-050a-475b-87bb-b888217ff47a", "comment": "Malware payload (SnakeKeylogger)", "value": "9f425eab1acffb6e414524013c979c754a117c4e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633464, "uuid": "38629419-604d-478b-899d-286f3d89a344", "comment": "Malware payload (SnakeKeylogger)", "value": "20b9631dbf6d9e5ed442685c2166fd0963117a331d772d2a7ae992fed02b2300e94693b87e053f82df007af95c04b7a9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633464, "uuid": "ff9d061b-f071-4265-bffd-c8761c36a2ab", "value": "T17B64231519AD242FEDC9DEC42AB4BB1B020D32D3651CB2F80C48DBDE63E5574AA84F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633464, "uuid": "abd85069-6e73-4af7-a62f-ec3c7a3b5561", "value": "6144:ewkc/V45gt6EDiPaEXve3gCtMkqB5tBTdRWPw2G+kxjORv1+wAg:LkcG5q6xyqCakqdBBadkx6zZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676633464, "uuid": "f7012615-cf2c-4965-9e40-b9114867e05f", "value": 316032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676633464, "uuid": "aa78e599-119c-41e2-94dc-c0115da1ae22", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633464, "uuid": "f489114f-0621-40f5-8f1d-65e732edacc3", "value": "OTP.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb75ab2-ae66-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1676599097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676599097, "uuid": "f519109b-9a2d-4b6a-a561-f71da6a78e13", "comment": "Malware payload (CoinMiner)", "value": "72e553220482cd512fda86d7c58de179", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676599097, "uuid": "82f704ee-6821-490a-bbfc-03ab1097f760", "comment": "Malware payload (CoinMiner)", "value": "4865b0707c02fae3792b73b057b7d96bd0539866ed8e0ed5e8f5dacc8f1e2beb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676599097, "uuid": "5f3c4d33-830e-4b6f-9162-3e75f9b9c093", "comment": "Malware payload (CoinMiner)", "value": "2bc3303c48d08bd21e03f5c8b66733b01f40865d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676599097, "uuid": "f9f6836a-57f2-475e-8482-e92a4158ba2a", "comment": "Malware payload (CoinMiner)", "value": "323b7cf03c7e5a8e91f30bfe00d376702286360ededa4eaa55b505f1300115cb8b93c0b721466bd90439eb5d5afe0a1d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676599097, "uuid": "7c26522e-ca4b-4dfe-be69-1cc24b5e8b07", "value": "T129447C53A2E13C44E9168B729E1EE7E8761EF5608F49772E1618DA3F05B42B2C373718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676599097, "uuid": "61948802-5d10-49a0-843b-dcc5e18942d1", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676599097, "uuid": "3d19da75-a374-434c-8cf5-cf5f5024fcf6", "value": "3072:jb2Rb8OLVpEIJaboo4gAEaN/KSMJIwox2F4vBcfJ84jnsHPVcv:n8bTLlJMvCypmvBcfJTnsHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676599097, "uuid": "3625a7ec-441d-4483-b45a-70dc0aa4f076", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676599097, "uuid": "0b425a09-60f6-486b-ba34-ac89c2cf0ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676599097, "uuid": "1caaee92-e180-463d-a70c-511a05e959b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8227e77e-ae87-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676613254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613254, "uuid": "41f2aa01-620c-40b8-834a-3813733b1e80", "comment": "Malware payload (RedLineStealer)", "value": "7ec8dadd1b64b2d296fe576f655a4bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613254, "uuid": "46a4126b-38aa-49d1-996b-8ed6c72042fa", "comment": "Malware payload (RedLineStealer)", "value": "48a740dc78da8ef78e04769e38d039adb0a6b83960ba32ad384ad03e50f613f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613254, "uuid": "ec679697-f5ad-4e4b-b653-be2912059e18", "comment": "Malware payload (RedLineStealer)", "value": "eb82cba6e2d8168341adaf1461f4e0bddac0f471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613254, "uuid": "b5d96884-9a94-49ca-95da-cf22d51eb85a", "comment": "Malware payload (RedLineStealer)", "value": "aded104e014efe11f9b4c44d908a4b03f62dc70139a1683ad528034f98e6eafb45166724054bae362f53e13caf042915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613254, "uuid": "c3f7c293-3f4c-4567-8da9-ced7651a645d", "value": "T13015230FB7FC5132D5B84B305DF282D306353E219A789293129FAC9B18B29B156747BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613254, "uuid": "d1f933f3-037f-4d1d-b867-1e0b68726eaa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613254, "uuid": "102946bf-ffc4-44d9-b262-a8a6fea3a1ff", "value": "24576:qyy43tl923Ye2II4nOiDG3SV8lBMGR4q60oC0yu:xZtrabM4Oik68nCm0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676613254, "uuid": "526e8717-37fc-4ad1-a21e-08705fe98325", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676613254, "uuid": "33c284ca-ef2a-49fe-bbc2-6e093207e91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613254, "uuid": "f4664772-6ba4-43d4-80c4-0dfbcac3208c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2587e2d-aed2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676645628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645628, "uuid": "fe92ec2f-5627-44e4-9c59-64f3ec6064aa", "comment": "Malware payload (Smoke Loader)", "value": "5387176a60bd69ca8a8e43bd3e75b19a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645628, "uuid": "5203eb59-e7f1-4419-ba20-fb1aca58af82", "comment": "Malware payload (Smoke Loader)", "value": "492f88a291a714550f7d48c4cbb16e0589f5ffcb75f0ee3735b289c0e3023213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645628, "uuid": "4d76a65e-ab68-4e22-bdcd-b9427b2ec385", "comment": "Malware payload (Smoke Loader)", "value": "a0722dabff784163055f7d75689782d306c9260e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645628, "uuid": "bc725b9b-73f8-4463-aa82-87cd5cfc66b0", "comment": "Malware payload (Smoke Loader)", "value": "222ee472cc665bedb8714d093c10732a565eb4c6b458725eeed47b16b05c7f82acb7c7e41eb94aeab425ca8de7daafd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645628, "uuid": "137e45e8-efca-4530-9142-c7e6981d2138", "value": "T12704D0223AD1D032E22351399DB0C2A69F777CA05A75999F3BC4067E1F756C2DB68323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645628, "uuid": "cf2f7506-dc85-47c9-ba60-a2b066bda889", "value": "04d4ff0968f0d2d964fcf7ad4ec4e8a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645628, "uuid": "e24fe180-7f08-46bd-8181-f9cf010d4827", "value": "3072:6OyqZdCzlFYUauVCGj+sm5OifgmNFL8YOYaZjY/D3QzxqQ4mN:Eq6wluYGiz9YZc/DgzxqQ4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676645628, "uuid": "1dfc29ec-c605-41d2-a4bb-00f9e8c40bf0", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676645628, "uuid": "1c4eb752-005c-4e39-be01-abe35965f58e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645628, "uuid": "048a474a-2d03-41bd-885a-def35dfd16f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d26d23-aeb0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676630707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630707, "uuid": "6684a13d-7c77-4399-a4aa-e7eb3a833838", "comment": "Malware payload", "value": "690dfc13ca40d478a52eba53815b971c", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630707, "uuid": "8d9df6ce-be1c-4432-9771-7d6663239bdb", "comment": "Malware payload", "value": "499a07ed388a9e9d51e839fd63e7cd5a26f0774600ad26dd0d31d50641ba8aaa", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630707, "uuid": "a296d3a3-91e5-4f36-9741-ef9573f3aaf3", "comment": "Malware payload", "value": "cc37ce261780a614d758b8db846c5458f9773a12", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630707, "uuid": "06c8d63e-1c88-4630-8808-f1bd8d726f40", "comment": "Malware payload", "value": "db61e7caed250a79d9e8cb42533c20d20a10df46b8fbcadbf57ecbe35a9de1bf7ce723c4eda20cc285a5317f32a66e4b", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630707, "uuid": "a2f1b817-d4af-435e-837a-bd5b3189e163", "value": "T12FE6332E37040873F6F8D47AD5E94F95FA0517E9E8908A5A6A25C128F7033C54BC1EEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630707, "uuid": "10b32716-632e-4fdd-bb0f-dd919cddce83", "value": "393216:+ZkJOohOY3UG8Sxrb2qB2m7gDQ02mgBCNKiBoi9M+:94Y3cIykBsDQ0/gBCNCi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630707, "uuid": "d993e8d5-f6d4-4e29-bec7-f3f3f38fee9a", "value": 14215129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630707, "uuid": "54ddecd8-ee4e-41e9-983f-8040b9d6c91d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630707, "uuid": "8bc79ac3-a41d-4389-a0a2-e34120b85ab1", "value": "TVRurvCP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bf5a27-ae96-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676619756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619756, "uuid": "85decc13-39c9-486c-a7ce-7bac8f565fcc", "comment": "Malware payload (Formbook)", "value": "5362fe7836b074ef80dc63cd3e39b7d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619756, "uuid": "b938c582-07de-4212-9cd3-d4841fb1aaed", "comment": "Malware payload (Formbook)", "value": "4adcc8ef0f0f441cf8e44f0c3c446f620409dbf79353811fa4d6526c6752f6ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619756, "uuid": "b13c9d79-f608-4c0e-83d0-73193b82cdbe", "comment": "Malware payload (Formbook)", "value": "76bf341ee3479f46af168f488c175002befaa0f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619756, "uuid": "ca58b94b-d4ff-4e7e-b3a7-347ce9416b74", "comment": "Malware payload (Formbook)", "value": "33113a1b9febde89436c05d8fb30e544cbae38c9e494f5bd77bcd20ff73b6d79c876108fdc56356e81ea3b57aafc706d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619756, "uuid": "631be4f3-973c-42bc-8a3e-f8fc00b0492c", "value": "T10E5412A479F8C563DC56AA734CFE15879AA53213984AD30F17B06F6E3A32241C92D323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619756, "uuid": "f8c875b5-00b0-4940-8d6f-a813bdfa39c4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619756, "uuid": "6c878d50-fe4d-43d1-9f60-f7b2e8d290fd", "value": "6144:/Ya6U85X0OjihFnvBUJ+aaUvWQSndOv5bpzyD215UlK01cGeZO:/Yy85kOWhFvIDtOQSgZyDe8eZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676619756, "uuid": "1a5fad73-fb77-40a8-a34e-d249d85f1ab1", "value": 301968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676619756, "uuid": "b9f9d1d7-2e94-415e-9dff-33c044698cbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619756, "uuid": "0134593f-e09c-40db-b66b-d737085c5aad", "value": "Akbank_Ekstre_20191102_073809_405251-PDF.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e1a038-aec9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676641654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641654, "uuid": "cf0c1dba-3ffb-40ab-ab4a-2b2615112fbf", "comment": "Malware payload (GCleaner)", "value": "567463d7b785bf9433fff7a54d710841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641654, "uuid": "ae638bd8-ade0-4cae-9e6e-57b80773d49f", "comment": "Malware payload (GCleaner)", "value": "4b35fa7048eda8e4165d6f18f70fc3f3df90d2b0cf1a345fe36750e1cf6f10e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641654, "uuid": "c2edb88f-67d4-40a1-8d28-ef36148a1baf", "comment": "Malware payload (GCleaner)", "value": "029f9daaa722e22b49dfe65e29757fdaf827dc47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641654, "uuid": "b2e57805-924b-4fe9-87e5-271672c2c6ed", "comment": "Malware payload (GCleaner)", "value": "17bf7dcbb5e27906365885f97fdd54e9df65806855a06973f009c51094f9cf6447e5ddb176a84cf2c32b20afc5dc4ea9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641654, "uuid": "512361d1-24d9-4ca1-af8e-50024a9db690", "value": "T1C1E523E36924D0E3D7FCDFF0BC1E85E87963BD9BC5D1156738697A1AA132299C40E208", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641654, "uuid": "de2c3122-2a1f-451b-a017-4a5aba79ab53", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641654, "uuid": "1a36882e-81cd-432f-bd3a-214f34fd4811", "value": "49152:1s4l61mukng15Cbu4CvBdFh9mA2Ig+Ri/O7mtA0DPi/LAup2MsVZ78K3dLCgv2MR:S8emZguNCv7FhHg+VCuKahp2PVuEv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676641654, "uuid": "241f676a-576c-4781-973e-4baae4e7057e", "value": 3050188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676641654, "uuid": "ad0f4408-c098-451d-849a-4b0286e1a5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641654, "uuid": "a85b0aa9-c075-4f08-909a-25a868fda833", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43ad290-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627511, "uuid": "1c8bf744-a3fa-4505-9c14-95fe180670c3", "comment": "Malware payload", "value": "1ba533fdc0d6af3220b37b533e0cfcf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627511, "uuid": "e1516bad-020e-4a63-96fe-3a439fd952e6", "comment": "Malware payload", "value": "4b723454bef671a84ece9a02554ca6d3c256dcd06c60a9b605df5fa8875492a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627511, "uuid": "43b94ce9-8914-4df1-a6e8-2d5069b5d59c", "comment": "Malware payload", "value": "e40453bd1f94d9aab2bcd44d1d3b8469c7d4e279", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627511, "uuid": "38277239-d480-4fb6-b7f9-fc3733c69358", "comment": "Malware payload", "value": "7edcbf7ebedac7b71454d499d3e8a7465ee26b911645e3dab4e8fbf955d4c5e56d684ab34a337e5121e8fd42c27c734d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627511, "uuid": "756faeda-b5b5-4fb7-b8d6-06e052b5f1b7", "value": "T11F149DC1BAC8ACD7D515167895EAC32A273CF3C65B834B130C34B6351E837D1AE8B56A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627511, "uuid": "9f24b60a-883e-4c91-85d0-14c17dedd101", "value": "dae253036ba9d710a708001505bd2540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627511, "uuid": "87f0e316-4cc0-4100-81fb-9698697d4b2e", "value": "3072:MUp6uNXNOTJZKK0+2AuzucBNi6dZbLLtInQIuBMFP:2aOtZb0rbu4NfrbVInnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627511, "uuid": "af50ae16-1265-4a26-95dd-12e4e354e813", "value": 206891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627511, "uuid": "9c33a34d-4c20-49d1-a0dd-8d66ee3099ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627511, "uuid": "62a27a4c-c2a2-48b4-ab00-bef51e69e095", "value": "Googlee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eebf4ef-ae65-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676598458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598458, "uuid": "408871de-f975-4828-9185-b92a1fad31e8", "comment": "Malware payload (GCleaner)", "value": "d42942a93d196a1ddcdbc2b77a680250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598458, "uuid": "529b224b-8b43-407b-bc0d-45cce0631498", "comment": "Malware payload (GCleaner)", "value": "4b76863b3798cd16a2515ac06510774b5c753b2d55e75ae548682009c1231505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598458, "uuid": "ba933cdf-7da5-4bc2-b4e7-67a6866d9d56", "comment": "Malware payload (GCleaner)", "value": "707796b66d3f4d9f5ef5c08c365acc4213cae100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598458, "uuid": "a954a432-ee36-4bd5-b3d1-8cf9669804da", "comment": "Malware payload (GCleaner)", "value": "41eb06a594b6989c7aa9415def693afb1f59794e56c85eb331f562bb3c2bf721ccafc355f77d113f7dd7a08f112b2960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598458, "uuid": "995c4a17-46af-41e8-8b8a-8661803b434d", "value": "T167E523077218C2ADE229CF33A81F81A456679C25E8F1C60F35563E5F66F22DC252EF49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598458, "uuid": "232ec081-b63b-4aa8-bfb8-b96d903a1cf5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598458, "uuid": "95e3b347-d1bd-4232-841d-d9ef2aff2955", "value": "98304:x2MVq82NU3oUULY5meHkTZSOvdF9tlRv2MR:x2MM8ToRLY5vkNJRvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676598458, "uuid": "dd949993-0844-4099-939b-681c889c370d", "value": 3180783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676598458, "uuid": "6baeaa07-4d16-467a-86aa-e98fd10e5dc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598458, "uuid": "dbde0094-06af-495d-b438-abcef9258b8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62eb0e38-aeb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676631670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631670, "uuid": "5c596946-eebc-456f-80e6-995405b020f8", "comment": "Malware payload (RedLineStealer)", "value": "813dbf22dfe6a62b9b300c7a58ad6ebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631670, "uuid": "ce7179dc-012c-42f8-a120-70958d92f825", "comment": "Malware payload (RedLineStealer)", "value": "4b979e200e6cc0a13c7abfcd7ab795f6a74dbfda0f8e6ba5a46f336fb71645c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631670, "uuid": "fd0004d6-6de9-424b-8674-d4063990019e", "comment": "Malware payload (RedLineStealer)", "value": "48c285b90fc8be64a2decdb7e0d9d1880a30f791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631670, "uuid": "c4841cc3-5ac3-4344-ba09-c4cb4be0b56e", "comment": "Malware payload (RedLineStealer)", "value": "bb317d251fd1cea0f765076c7cc1bc03704967b331d9d0f68131a16f6178c07fa2bb5acf62aa4c23be6375760a14b525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631670, "uuid": "5bcf2f64-dae7-4473-be21-4306320276a9", "value": "T12C54F12237D6C072E02355385921C6A98B37BCB05A35CDDB3BD501BE5EB53D2EE68316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631670, "uuid": "0ff28524-17cd-41f2-902b-f3d1fc582761", "value": "31111ee2beeeebc1d1040d6c5884273d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631670, "uuid": "e5cf163d-e65e-472b-9520-0d34a816526a", "value": "6144:r5IclahOnFTgPVJjBf4J75xHu3D17CwUGd9NXBX:r5uhmFT4h4JLS7CtG7NXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676631670, "uuid": "660eb4d2-d740-4c64-a360-f15d49c58a19", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676631670, "uuid": "745a76c0-7dfd-46ca-a003-a20f2d06dc42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631670, "uuid": "3d6659ed-2a50-4264-ada7-a9d5427fdfe1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cce739f-ae98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676620385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620385, "uuid": "fa9669ae-a0e6-4aaa-89f5-9cd4ea9f7a4e", "comment": "Malware payload (Amadey)", "value": "facb9cf9a409159937e882b6ec9fc686", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620385, "uuid": "0de1750d-c27c-4e20-a7d8-e85c398d2376", "comment": "Malware payload (Amadey)", "value": "4bbdef2d85469534494b167a6c96bedbe8094be02e7d22625b02bc0aec036b79", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620385, "uuid": "d86667b1-87a7-411e-aac2-a5ac1b6f7ecf", "comment": "Malware payload (Amadey)", "value": "3df46b1a4a45f7245dbceb46b886b393bebe9c89", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620385, "uuid": "ab63b34f-48a1-47ab-95ce-10fb415ea434", "comment": "Malware payload (Amadey)", "value": "1b85084f0d4d16f63129696375d74748c2e687087e104d5fad42c2e3b656cf87dc765540af8a8333ec2ef20f116891d3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620385, "uuid": "252d3c3f-5578-4b22-9ac7-9cd77dd43ff3", "value": "T19925124BF6FD8422ECB4877049F603E3173ABE514E38975B164A5C4E1C736B8A63136A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620385, "uuid": "6361fa76-baba-4fdd-a21e-662038ef9019", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620385, "uuid": "6a9fd634-22dc-4c74-8329-0955d411ea27", "value": "24576:gyUbc6VP3IL0LVHc0+EFbvo2ZFHWbS1t4/DsW6dONHUE:nYc6VvI45+IzoA1t4/AM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620385, "uuid": "08bb0f2d-61ab-4622-a1fc-37e0c2bbfd7a", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620385, "uuid": "3981b3cc-9edb-4d5b-91f9-a0b851bcd02e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620385, "uuid": "baeb64c5-989c-4992-a342-90c9d9aed637", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0c092d-aeb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676634402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634402, "uuid": "f4bc7369-b7b5-4629-b384-ee0f16b8ac17", "comment": "Malware payload (GCleaner)", "value": "330f739d03f5383e7957b08aba0b9f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634402, "uuid": "486ae621-4cd4-4481-b28d-0f095c1ac507", "comment": "Malware payload (GCleaner)", "value": "4be5485798a0a878be681a6bf006fe093cf5ab4f7020a273495919d889a11182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634402, "uuid": "508150ba-e6ee-43e7-804f-81c50b70427a", "comment": "Malware payload (GCleaner)", "value": "60063ed6628531bbad531e6ee68377bfe53bab64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634402, "uuid": "2b417381-4ba1-4075-9bb2-b6996d4da019", "comment": "Malware payload (GCleaner)", "value": "36c285468de3dd14affd4b9534b6a88a7db1f8ad35ce2574ac07415d60468a889a4f7610c7d12a14f7b4ca2db88acab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634402, "uuid": "45c19d43-dd1a-4f2b-b10e-6fdaa69a85d2", "value": "T1E3E522D25825C0F2D7FCDFF1BC0E98F43563BCDBD8E8051A34AABA267672189954D608", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634402, "uuid": "a123307a-110d-4ba4-adca-1268e87bc6b5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634402, "uuid": "d989feb7-2376-49d6-b885-de000183636d", "value": "49152:1syykkdreh2mITA5ZYNwoFKp7fw+xspqt3h8iC6Ls2utL0RHb0ExqtLCgv2MR:SEkdc2TT0pc+xoM+36Ls2lhbyxv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676634402, "uuid": "fe0f6906-2c2a-441d-9d9c-59a662321324", "value": 3019501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676634402, "uuid": "abbd0f75-197b-4505-8209-5e04d37d042f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634402, "uuid": "e653ed52-6e68-4dd4-ad32-3606d410943b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc771b7-ae98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676620739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620739, "uuid": "9e20690b-fed1-4ca2-8f92-e23fe1b681dc", "comment": "Malware payload (Mirai)", "value": "44c94c997d069d3df6437f3e1f82fdd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620739, "uuid": "92e476c5-ada2-47c6-aaa0-f0db1f3a663b", "comment": "Malware payload (Mirai)", "value": "4cd3a895aa7747129e9808fa6bdfedd17b6263936b792aca30edc1b9e1981b34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620739, "uuid": "b12a2f21-8738-46cc-b82f-e4618ed951b0", "comment": "Malware payload (Mirai)", "value": "b37b3ebf6e29e8ace1ab43c034be0c5f88e5e1d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620739, "uuid": "cc08f3b3-c322-4a1f-be03-70bb143a23d2", "comment": "Malware payload (Mirai)", "value": "969c93b1c257c2cd362e00f7d5e883a74cc8aed0e894801512bf6b5487b018c22b491ca000f3050075766c3033e43a4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620739, "uuid": "bccfc210-48a3-4478-8dc7-1b11f9b9ab16", "value": "T139C33B46E6818B13C4D61775B6EF42453323A79593DB73069928AFF43F827AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620739, "uuid": "d282e5e6-88df-4340-b0e2-995d56879c1c", "value": "3072:AQO3WqApOKMoMuPGYlqqiaoK+EuNM/9cE:AQO3SXMoMuPzQqYK+E4M/9cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620739, "uuid": "f32e1aca-6a1e-4b01-bf60-c31759bb2b57", "value": 120446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620739, "uuid": "f9aaca3e-384a-46b3-9a7f-3d9860848fc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620739, "uuid": "6c333d54-1a78-485e-ae87-e44945f328a1", "value": "44c94c997d069d3df6437f3e1f82fdd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f571a2ff-ae71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676603999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676603999, "uuid": "127fd12e-a4b2-4f7b-9725-027f7f0ee843", "comment": "Malware payload (Amadey)", "value": "7f556e2df74ec64859e4f902a624786c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676603999, "uuid": "43735fad-ac5f-4fbf-9833-add19db39c9e", "comment": "Malware payload (Amadey)", "value": "4dcf7bd0d7b5d7ea8f54beb965fe417a9c371b63ca5dfe1a47bdeaf599cda32c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676603999, "uuid": "04e91075-8843-4d94-92f8-a55366d63af3", "comment": "Malware payload (Amadey)", "value": "045406621b9d91902c942bbf6c2970b4a5ed545d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676603999, "uuid": "0f580475-f0c3-4820-8cb1-211d65f8f531", "comment": "Malware payload (Amadey)", "value": "e7ce9867242b0d35c2c574eae05e0c9e7bc5da0215eb1fd713337847cc59582576566164dea5dc0a9170ac6d7944afbb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676603999, "uuid": "46828861-bea8-4c36-a27a-9d251e5a19f3", "value": "T189F4121BA3EDC032E8B8977019F203C31A377E615B7856AF264A6D5A04726B0A274777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676603999, "uuid": "5e3187f6-10cd-401f-bfb8-981362045d5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676603999, "uuid": "9ca9faf5-bcc8-4fb8-be7f-767661f35496", "value": "12288:nMrzy90J+VX7NaAbTimPrCyZOc8neRGpPn0LWGx3VrpCPT5bgg14AY8T1qQ:AyVVrNaQ18eRZWmriT5bgg1LL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676603999, "uuid": "a33ffd12-c72e-4c48-b123-82df48c31594", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676603999, "uuid": "141927fc-3683-49ec-ae9e-d23d05ffa9a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676603999, "uuid": "17307741-062d-450d-990d-1dc7fde70992", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb3c92f-ae62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676597541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676597541, "uuid": "ce1e195f-c6d3-4eae-85d0-d0150080a11b", "comment": "Malware payload (Amadey)", "value": "6c4a26f84b43a131b8553a3788be9add", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676597541, "uuid": "848529fb-ac1d-4d88-b421-1ff4aad56b5e", "comment": "Malware payload (Amadey)", "value": "4ea4e6d11bbf318eb542a2710e8bc4e194bf0fef268414b5f19f4c6a3c95dfa1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676597541, "uuid": "d9bc1f24-479e-4467-bd8a-f3974f04a844", "comment": "Malware payload (Amadey)", "value": "d9e553b386b0785cb91af8cff4e1471194b72670", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676597541, "uuid": "f3a93e8a-43ab-4f91-ac12-7bf2bd159390", "comment": "Malware payload (Amadey)", "value": "8956e5fb7804bdf82a12e47ab03d0b1819ec628e158a47e049ab45cc5e87f7f483ac94c4ceeccf7bd668280829228c3a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676597541, "uuid": "25b498df-0233-4e38-9bf1-7888bcfcb6de", "value": "T14425234BFBDC4162E4B443B008F613D30A35BDA15F38879A23DDB94E09B3AA46635767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676597541, "uuid": "e1936450-b93b-4f6a-bd2c-513792d1c006", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676597541, "uuid": "16f59ad7-84ce-42c7-b24a-24ac63e02af6", "value": "24576:syjMIvI2ZkLTf3O0baAw4Zwnv80KsYd5f0:bjlaDzjw4Djf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676597541, "uuid": "e5c0d10d-ed6d-436f-b50e-f6da93f41f9d", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676597541, "uuid": "06386bcc-3c88-40a8-8cb1-5960eebccf0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676597541, "uuid": "5680fa08-6cd3-4cb2-ae32-d4a5b802ac05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21bab08-aeca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676642084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642084, "uuid": "fc992bea-0b48-4cb0-b311-febfdeb10357", "comment": "Malware payload", "value": "628e0d88c6be1d0f3e7fae9eb8958e8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642084, "uuid": "f521ae72-4307-4fe0-b59d-f1ec32faf826", "comment": "Malware payload", "value": "4ffaa573958081960f040a21fe041f15e9272c9cc8eec7c5b8e0fbc4e23ff81b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642084, "uuid": "43511f63-e170-41b2-a81d-62f95fb10357", "comment": "Malware payload", "value": "18a37eca80a6582c8912244ecbeeb8434a131678", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642084, "uuid": "7dca610b-a226-4427-8776-5a61a8356486", "comment": "Malware payload", "value": "10b30c16afa3018f7e7aed003bc4ea81b08d41798ebfe2d4834c72173439079101abb216b46629e7f8cf6222807820a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642084, "uuid": "d5cf7a93-7725-4289-b172-f44771e4baa1", "value": "T1B9056BDCB1F0F67ECA46CD36AB102D14ABE0654367268593E263B6D59F3D4638E1C0B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642084, "uuid": "474c7b2a-d914-43ee-898e-7a03d3509663", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642084, "uuid": "36371aa1-94bd-4b39-9638-4ed6c77d0e28", "value": "12288:3w6qDSuQDsv9t17D8FobyCe+BHrXdmSzM9dd2exqbSlFBvlmFIDsv9t3Yn6Ay+JT:3TqDSu+EBA5vdFq2lFBdmFmPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642084, "uuid": "fcf3e3be-f4d5-4ff9-8a2b-795f08ce5d32", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642084, "uuid": "f757ef8e-10ee-4fa1-a817-4940ab509c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642084, "uuid": "1fdf8791-3aef-4745-a0e0-2257b0409bbd", "value": "4ffaa573958081960f040a21fe041f15e9272c9cc8eec7c5b8e0fbc4e23ff81b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfa8bdc-ae9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676621649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621649, "uuid": "e1623288-c07e-4f2e-b56f-4af5107f5280", "comment": "Malware payload (RedLineStealer)", "value": "5ca5a94d99de4f5df957df33da57968d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621649, "uuid": "572bd1de-0c4d-4ec2-bb4d-cd89bc8a3e8a", "comment": "Malware payload (RedLineStealer)", "value": "500e5a082d8f4634774c1006b3c1c8ce82048db809a6d38422f6b3532aac310b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621649, "uuid": "81904af5-6f6f-4bee-803e-da6dee8f40da", "comment": "Malware payload (RedLineStealer)", "value": "1fd66c71ef4a9cfc72832bace38e738c6043ed22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621649, "uuid": "a2f6e6a9-82f2-4f74-a58a-7c3bea8df30b", "comment": "Malware payload (RedLineStealer)", "value": "e6135c613079d8c4d9f2e6e1769d1a962b6bb950c04dc6427e268d790ec7a458dfefa14e7e4f3a2db8a7b0ba9010d365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621649, "uuid": "8b58b9e0-d92f-4f47-b99d-7a100706ad29", "value": "T1C3251303EBE88462EDB5977108F602E32D36FD605634D6AA378FBD1A1D72160963136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621649, "uuid": "d89a836a-3d05-4636-9ef3-9b86c04b0bd7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621649, "uuid": "ff54d2d8-68fa-4c00-beb9-a2d659ec2a49", "value": "12288:mMrgy90mBWgO6VCuFUvLwyJQ6rlDf0bVKIxaGQKQKnwOEFHtSvbZNE9m7bFZ0pj8:eyY+VsLwEJYK8lvwv/g7jmkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676621649, "uuid": "977da80a-b792-4397-8d18-912695d7b8ea", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676621649, "uuid": "7dbb358f-6a16-4130-99c4-8bfb738e78cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621649, "uuid": "bea5b912-ea7a-4870-b7f4-96dd09ab7660", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb68480c-aead-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676629698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676629698, "uuid": "5b8b7599-f1d2-4e4f-bbeb-dd23a63f0c54", "comment": "Malware payload (Amadey)", "value": "5a3c872d87383864520cef423fa640a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676629698, "uuid": "29c51705-f7ea-4766-970e-cc552ef60f2c", "comment": "Malware payload (Amadey)", "value": "50e1c42a514c38b0b7589861f3231adfc6cb997becc5d64c7b32a2bf0e07b53c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676629698, "uuid": "630be405-972d-478a-aa85-89f601368e2f", "comment": "Malware payload (Amadey)", "value": "12a75f236da988ce6e0436ad090d6179af963e4d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676629698, "uuid": "0df89fc6-c15b-419b-8bdf-fbd6f7bb7665", "comment": "Malware payload (Amadey)", "value": "8ef64dc07a3eb84a49fc1f652131142fb218b453f386f79b7ac9c8634e39f602cfaefb293841c5e3bb585aee5089d8c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676629698, "uuid": "55722695-1f16-47d9-8874-adb90a33e044", "value": "T1FF252387AAECA425E974273059F603C315357E522F38879B6A8BBD1B1833664793133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676629698, "uuid": "213dcd63-775f-48e5-a1a2-1932038966cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676629698, "uuid": "97c548fc-4a5a-4c94-8b50-e5e7662487ca", "value": "24576:3yZJXMvPp7hxoM2BXnC8vB8b1QFM3YQpX/:CZJmp7hxXun9WP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676629698, "uuid": "27182ee0-c777-4ea2-9449-08886fc6cb28", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676629698, "uuid": "1cb4b85e-966b-436a-ab01-8a9d162de2c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676629698, "uuid": "d889f96f-e3b3-4e39-95b8-9a36db8df9ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9115066-ae6b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676601401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601401, "uuid": "5d8ef4d2-f0b9-46c2-a25e-34d14eba5714", "comment": "Malware payload", "value": "e1aa39f17c772777023386ffa32ac6e1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601401, "uuid": "26ff1750-d5c8-4393-95db-6f5fc24eef83", "comment": "Malware payload", "value": "5143ceae18304f507257886966ca5fee7e7118e08d1ab765b8d3f112488dd096", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601401, "uuid": "96ff57b8-a40d-4d4c-9d9c-6e8128eeae8f", "comment": "Malware payload", "value": "c93ef4b725de29045abc71c4ea82f9bfeb74dce7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601401, "uuid": "5ac7b365-0ef5-4600-9d0b-bf69a469f650", "comment": "Malware payload", "value": "9b87392249b0027bed7d455cd737884fdd8952ac8942ead733c34363d28c313f885a46707095c63390a0c1823aa14115", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601401, "uuid": "46606eec-aa6e-4b14-9367-b15b59b7f8a3", "value": "T1442733931C26A8DAC1326436057E1345A8B5CE1A3EB37B6210489FBBC5F3575CAD9ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601401, "uuid": "1942a085-3fde-480a-87cc-07505e698ceb", "value": "393216:38NEJF8sJA35z7A79L+0s71mbgafiubcFZHbVT9i/zVN2I+TXQ5KKpPbNiRSKcsN:LjJA35z7c5GRmbBffcjHHi/zVN2IkgYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676601401, "uuid": "000c9070-a20f-440c-980e-0e7066558e63", "value": 21502980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676601401, "uuid": "a1a5eb15-8a36-4e30-aa95-da19498f9af9", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601401, "uuid": "42443f25-3828-42ce-85d6-c8601d297c33", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4ff5fc-ae97-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676620336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620336, "uuid": "89390c2c-6a87-4b14-9a74-4c266bcd74b8", "comment": "Malware payload (Mirai)", "value": "def72b4e6612163dbfcedda6d941695e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620336, "uuid": "d7a7a72b-ebff-45d7-b801-af6b61bf4db8", "comment": "Malware payload (Mirai)", "value": "514a83a750efa0d4ac168111c510d2e0d0adb3de184913e0478207b350a90e23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620336, "uuid": "13b0a4a0-e9cd-498d-b831-659e6b991812", "comment": "Malware payload (Mirai)", "value": "3136ee61c058fb0c9ea9d30aa0187ccec13d1d02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620336, "uuid": "27878c3e-184b-437d-a45d-a10ba14bf64c", "comment": "Malware payload (Mirai)", "value": "3872256819d1ba84388a1f95a8ce51640ee4a0808af5e65013a969f46a01a4cd4dc7f767cfaf24038370ed0cdcd59917", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620336, "uuid": "ca0cb223-a794-44d6-b167-a852eeabae5a", "value": "T18FD2E175400F4C10CAACEAB3D6F981C2052BA7E2B951BD381A6551F4FE780149FB9FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620336, "uuid": "980747eb-2172-4410-ab11-bcd75945e47d", "value": "768:qGNAY1bHfRb4EVATHN5me+l7QwKh3Vs3Uozr:qMAY1lEDmLW3Yzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620336, "uuid": "301876cf-9bf6-46c0-82a9-f35658bdfc17", "value": 30216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620336, "uuid": "a0e27933-238c-426b-8a25-b40f3a54ee51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620336, "uuid": "cbe89cb3-9095-4a8b-92dc-12bbc38a180b", "value": "def72b4e6612163dbfcedda6d941695e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcc1eaa-af05-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676667363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667363, "uuid": "4f3c046f-1fdf-4ec6-b0aa-88424625262f", "comment": "Malware payload", "value": "b56c91de8cff86f80cae6d363eb0b91e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667363, "uuid": "708dc129-12cb-4924-9b0d-7a12fa73a651", "comment": "Malware payload", "value": "516908fc95c6c31806a19b5a9108c0a99fff52371426fb77a10e1d75d1ae8a79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667363, "uuid": "5faaf6ef-099e-4d1d-8b70-a06bf7bb1fd6", "comment": "Malware payload", "value": "7f158ffe127b3dedf6c0e0c2b434433aa8069eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667363, "uuid": "d6781fe9-7393-4d9a-953c-b4ea64640f3e", "comment": "Malware payload", "value": "1f7c3b79a8e36f78234fc96c035c3f91007347d9b0c1bf91090dfed6ffa56b1cbf74b036b144bc622bab07d6b1e0fb90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667363, "uuid": "bf8520c2-ad17-47ee-aa12-2cbc5c47eb63", "value": "T10EE41207EBE88422D5B11B7029F503C716377E909B7C87AB264F6C5A1CB21F0A67477A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667363, "uuid": "db246367-a3a2-4279-8634-a794ce713d9f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667363, "uuid": "2f8a1c67-c552-435f-aaf5-0bf6c59510ce", "value": "12288:8Mruy90YkAElGG0HKcaPqgopAC9E1kLWHEW5L4yglmyDoL:6ytkNGG02PaAUE3LwwyDoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676667363, "uuid": "b3282530-f521-4c5b-a68c-efd7714af06c", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676667363, "uuid": "d0bdb2c4-db35-44d5-894d-c81758c6baf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667363, "uuid": "545aebc6-991e-4063-8f09-edbc56d2831c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69c342a-aef1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676658976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676658976, "uuid": "fe691999-6df2-411e-889b-7cbf2477341a", "comment": "Malware payload", "value": "02a5510d2e228be52d461b2aa9ccb6ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676658976, "uuid": "18a1b188-1ce6-4190-af67-c2986e61ecc4", "comment": "Malware payload", "value": "518dfa39c624ea9eab8e46c206bdda5a303541ab10f0378e6348bf496d41f2d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676658976, "uuid": "13b5af67-8fc7-4745-a53e-601b6b3a7443", "comment": "Malware payload", "value": "64552d25cec43ad88b9b6306e220ffef6605293f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676658976, "uuid": "e8343725-5031-41bc-801a-b0144b8dd007", "comment": "Malware payload", "value": "0feb25531e23a570d967789da5fd93137969a30343796424739f64c96937db5d53b88180eb9c32b8b4687ca47748d896", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676658976, "uuid": "f22545d0-26be-4941-95c8-1d5c497331b5", "value": "T17944F1117DC1C471D4674E704CA0D6A0676BBE6086B0CA577B58273E1FB6AC36B3A327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676658976, "uuid": "424e5b44-821a-4c22-963d-3ba112267060", "value": "8cdad4eae189848d90763fd3d82d253c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676658976, "uuid": "76775d82-5b35-4cd9-9956-a777e0d55841", "value": "3072:oXLFzzIE6OzRGuNSRzxaB+UbNHm2mrOHapjilAKcjmQqXlPVf4Dp1xVwLaMfjewD:o7FfJz08mrOHaEABjmpXlh4FXVweYz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676658976, "uuid": "f2e0b653-584c-45de-b229-da411e0c90a4", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676658976, "uuid": "ab51fb53-f3ff-4cd1-a94a-d83864333cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676658976, "uuid": "4b5ea021-5064-486d-8e39-5d03fb2243f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e59e5b9-aeee-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676657432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676657432, "uuid": "2ecdee6f-cf98-4e29-9c07-7d3db04b24e4", "comment": "Malware payload (RedLineStealer)", "value": "bd9c7e3ee3702c019bcf14db19439a58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676657432, "uuid": "dc51db79-c377-4a70-b9dd-c54f7769f689", "comment": "Malware payload (RedLineStealer)", "value": "51ccb6a2257545298badc3114136520da6b91d5932c54b0cc5bb837558440e8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676657432, "uuid": "81f7b9ae-963d-42ed-87c9-6940f69951a6", "comment": "Malware payload (RedLineStealer)", "value": "dad78edc5ee0fb7a0e83fffbb20df294787258c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676657432, "uuid": "794035af-b94c-4af1-9870-06f38de7fd49", "comment": "Malware payload (RedLineStealer)", "value": "8d65e1c79c055b4b463deed305862c838ecbbc4576c66154c411d5c1db6b3d8c02d36cb939a8c8c92d10e307e5c3f74b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676657432, "uuid": "fcf5f29e-2457-4bac-a967-cc8968bc6de3", "value": "T11FC4024BA7E89072D9B5677005F703D30636FD615A78834B178A5CAE0CB27B0BA3176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676657432, "uuid": "575a62d8-d62c-4ad0-ad92-b3e46cc1bc2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676657432, "uuid": "a3674d59-1823-4000-a438-f4800e4705af", "value": "12288:lMrvy90v7YMb6v70CBNzeTjbNSSS0yBye:SyjMG7lBkXZyBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676657432, "uuid": "e01c76db-83b0-4d06-9446-d7e04bb52e24", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676657432, "uuid": "8926386a-e2ab-4535-8ef7-e1f1b79a3b6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676657432, "uuid": "84994563-d511-40a1-8e74-4006c75e39f6", "value": "bd9c7e3ee3702c019bcf14db19439a58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b9220c-ae9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676623333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676623333, "uuid": "9a4c8bab-ef4c-46b7-a961-686de69f0369", "comment": "Malware payload (Amadey)", "value": "54f5117004913d413ea0d0cebaa68483", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676623333, "uuid": "df47d690-ca10-4815-849c-2949a7057963", "comment": "Malware payload (Amadey)", "value": "51e448d8dc9521d900fe6cdeba8ce629413593998feeab45807a58dcae174c9e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676623333, "uuid": "33e8b7c1-29e9-492e-8881-6f2537198bb3", "comment": "Malware payload (Amadey)", "value": "a7eee45f44bb3dc592dd4615f453df943f0ff211", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676623333, "uuid": "699ebd57-845b-433b-aa50-b9799d801328", "comment": "Malware payload (Amadey)", "value": "f56444317be6303e9a786f855c72d3d2ba850da553921d5f5ea797df1fb561b66688a0c3a90fdd98d60f9140fb33bb9a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676623333, "uuid": "6486fe47-d057-43f6-ab07-3c1cb40db085", "value": "T10B25234BB2F94032FDB1A73448FA02D3163A7E6057384396135FAF9E5D325A8963136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676623333, "uuid": "25b23a2e-b79b-4230-8373-6a0bd5cd2fa2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676623333, "uuid": "e4332bce-c56c-4c39-ad78-abb4f5455088", "value": "24576:YyuRQJbqaBsQTyWLEadVHfmV2I/ITF10:fQWhzNEO/mV2IATF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676623333, "uuid": "b73ad1cf-a0b4-4830-b392-2700d5333258", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676623333, "uuid": "e5493ef7-2b9b-4b89-87a9-84643117af38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676623333, "uuid": "72b371e2-bd32-4121-8e1a-85adf9be41ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110afed4-aebe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676636687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636687, "uuid": "a72991eb-353f-425a-813a-228c1e62f0ea", "comment": "Malware payload", "value": "17fa1d1c3c892ea818f05d4e0cf0eacb", "object_relation": "md5", "Tag": [ { "name": "CargoBay", "colour": "#2C84F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636687, "uuid": "8c460633-9731-4bb1-baec-bfe4ad9c09eb", "comment": "Malware payload", "value": "5218ea3cfcc44010b18418240a2f2dd81cff0a52d5ba4a300b42563e346bf844", "object_relation": "sha256", "Tag": [ { "name": "CargoBay", "colour": "#2C84F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636687, "uuid": "08972935-a6c5-4009-b0aa-e230c5e6d8f7", "comment": "Malware payload", "value": "eac50f847c914f6275bc1f8ef4a6199f9d9e4d25", "object_relation": "sha1", "Tag": [ { "name": "CargoBay", "colour": "#2C84F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636687, "uuid": "943bed19-f974-417a-8507-fe4711ee8de5", "comment": "Malware payload", "value": "71404c45ba8f50f786a8e3c931df8f056f28f28c43b2f5e3a85e9bbf794d6e6932b3e4243efe2d511f4491f29baf9521", "object_relation": "sha3-384", "Tag": [ { "name": "CargoBay", "colour": "#2C84F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636687, "uuid": "1c72f1da-912f-438b-bd0e-b657097e7965", "value": "T1F1758D03F68045B9C4A9C27883479B36B671BC890725F7EF1BD4A6213E22BD06F2D759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636687, "uuid": "c595c5e6-eeda-467a-adcc-2ca01821cadc", "value": "a70feebfa2edf58fb78aabdca62a836f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636687, "uuid": "a75ae536-0e08-46d1-8e68-a624b8939364", "value": "24576:H/RmiAY3GzTad+8QUfqXHQn652jOi+9TmccljVIH06iyMy:H/RmNY3GzTadNQUfqKF61cXIU6iXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676636687, "uuid": "0955f0e2-3506-41e2-9b54-a384f6c9975a", "value": 1693696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676636687, "uuid": "2026711b-ab21-46cc-a99f-0e169c67a49f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636687, "uuid": "1dc53416-7f93-4cdc-b21a-6ae599b60dd9", "value": "5218ea3cfcc44010b18418240a2f2dd81cff0a52d5ba4a300b42563e346bf844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0cbf7e-af1a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676676462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676676462, "uuid": "457ece5d-5c9e-48e0-b4a7-241077574ad9", "comment": "Malware payload", "value": "ffce0de2d7e5f23fac4df8c4ed0aa1ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676676462, "uuid": "dff646bb-c8e0-4303-99c1-3f6c7b1d749c", "comment": "Malware payload", "value": "5234897a4624f1282dfec3d0d43c8c37533b2122924cee0debc8a68aa8d31b3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676676462, "uuid": "43a3c340-dc76-47d9-b1b3-84f6a11b57be", "comment": "Malware payload", "value": "b0865010224b5cadbeae049cd8228d395197c72b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676676462, "uuid": "57cc1784-eb69-4c96-bb83-8e0184b7175f", "comment": "Malware payload", "value": "e07d4290487a92cc8d5205da2c3fb0679f5342f01f50c6a299ab4ff678a0690314d3e27d996e7c8cf080f3c36442276f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676676462, "uuid": "04f88ba2-117e-4284-a7a3-901720555027", "value": "T1AEE4120BE2F88131E975533059F603C31936BE215B74C297368F6D6A1DB29F5A2313AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676676462, "uuid": "30758a2f-8d1c-4d64-afe5-85386cddfb9a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676676462, "uuid": "71853235-f848-4ba5-ab8a-28c7b578148f", "value": "12288:RMrJy90CmbmiQpxwrZA22F8dDilUSoI2mOmVtH3BNUy0qLtfuvpMJS:0yxiIxJ/wI2aVuyr1ux1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676676462, "uuid": "3e400d29-df9f-49b1-b192-f3fa857634c0", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676676462, "uuid": "217d43cf-e30e-4347-9d6a-032907c5aabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676676462, "uuid": "d668119a-da44-47ca-af8a-77cfd7d6e1e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d618f2ac-ae98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676620696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620696, "uuid": "23bd5f85-f9d0-47b9-80d5-2f309ae06a71", "comment": "Malware payload (Mirai)", "value": "a3d5aaac189021023694ea4f12237718", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620696, "uuid": "c1f310d3-5613-4a49-8e7f-aba7e5fc90ef", "comment": "Malware payload (Mirai)", "value": "529a238fb78427760ccf735ddd58d8ce380ae57f5e70861b0b754dd9b0393a1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620696, "uuid": "7651baff-572f-4608-b9ca-da912b474b80", "comment": "Malware payload (Mirai)", "value": "79595a1ada117ee97c51b3ee14861b81f37af033", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620696, "uuid": "a2d4c3e2-4665-42b3-a687-9460e9bebe05", "comment": "Malware payload (Mirai)", "value": "bcc0eb7202146bd13a8379140cea4618625aaaa1dbe0804e791507eaa5f4cf14704f6e9f1858e0f2fdb36f2b8ee0adce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620696, "uuid": "ec8825ea-9beb-43d1-b8a9-d3c8b88d2106", "value": "T14B23399AF8018D7DF94BE77E54164A0AB93063D152831B2B13B7FEA3BC731592D12E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620696, "uuid": "f2df7896-4c20-4e60-8954-97c54342b094", "value": "768:G4SeUp1dxT8dM2NXMgZjHSxuqVsxLfkMYazQwq8DbqSdGt:ZS1T8d31jHSgquLfkMVzQr8DbYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620696, "uuid": "7152d469-c958-4c52-aba2-3314049ea25e", "value": 46672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620696, "uuid": "586e223f-ed07-4e98-a16f-94afe49c0e97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620696, "uuid": "ec9adfe9-a868-4833-96e2-77e0fa3a1ff7", "value": "a3d5aaac189021023694ea4f12237718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2e0123-ae8b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676614806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614806, "uuid": "5c7d75c0-3b05-488d-ba47-1de8537cdf5e", "comment": "Malware payload", "value": "afa4b8baf8c658642bba484be61f7391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614806, "uuid": "7dca5202-66bb-44e6-b217-e6493f9b709c", "comment": "Malware payload", "value": "53ef84417c303db39bf8e919545d67e8df3c33d933e2735dda84ddc8b8a26c9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614806, "uuid": "b434816a-4b2c-4ee5-b756-297ef98cc90e", "comment": "Malware payload", "value": "be79af8bfde7e2f2cb9fdb4f7b18bad13ff77a9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614806, "uuid": "8f05f0d6-c2a9-4823-b84c-597dc05da4dd", "comment": "Malware payload", "value": "d5c537b348ff59b6d86230c35abfa955fa7adafe504c840217067361848e92a69e8a04ee1fedbb68df1d2d34d781955f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614806, "uuid": "f1b5fe03-fd1d-44c6-982a-cbe80f22b7d7", "value": "T16E937D1275C7C073E51612B948A6C7B5893BB8741B269ECB2BC4126D4F363E2DE3538B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614806, "uuid": "9d181368-446e-44e0-b7a5-8ff54e5755bd", "value": "2c399d381d03e44b02e91ad01ca3c756", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614806, "uuid": "8b70ea88-7520-462f-9098-631016531654", "value": "1536:wr6uVv+U3Whr/V8Fir8owZAsGgI5Jk5R:wr6uV+U34/MGgI5y5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676614806, "uuid": "95750bfa-4272-4407-a0cd-84390766e8ea", "value": 93860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676614806, "uuid": "517ce100-4093-4dc0-97d6-3004fc09e400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614806, "uuid": "200c4bcc-f54d-4f49-be41-2c3f8462d8e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6512100-aee6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676654224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654224, "uuid": "538dcac8-41a5-4ca1-80b4-0abd3efbae3b", "comment": "Malware payload", "value": "570a5a2750f1a7ec898c6a2cda5cb33a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654224, "uuid": "d84af853-c300-405c-bb61-485f21f08efe", "comment": "Malware payload", "value": "54a1bb25a6299871c9cf60e87bd341be4ccb3716c12825bfbbc592072860fdaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654224, "uuid": "e43c3401-df60-451f-9747-cd46ec7a71fe", "comment": "Malware payload", "value": "0915f46ed70f65475a25a517165c1d5398772d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654224, "uuid": "3bc9611d-a0fd-42ad-8598-a9a61ac2da14", "comment": "Malware payload", "value": "1b1050835eb1d1ffafb31b4470c1b1340662d7d1fe84fc0875096dce0bfcac8b5f8dda2bfd234633900a67be8ca1389c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654224, "uuid": "74423ba7-6660-4ac6-980d-e7020340f989", "value": "T13DD523D66825C4D6D3FCDFF1BC1E80F83AA37EABC6D016173456BA2E743225A841E509", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654224, "uuid": "50d30a40-3573-4b28-8fed-34fb3b764ea4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654224, "uuid": "81a1f95c-cc9d-48d6-a07b-5f7f76c237b3", "value": "49152:1s5Cz8WX7ZMCDxdK8LXUY2H6XGSkJ3gw7jeT2IVXCBpuTN2LCgv2MR:S5O8uhDXpEYt2gWaVXogmv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676654224, "uuid": "a06fcd29-c4d7-4de4-bb87-c57b7375b820", "value": 3016988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676654224, "uuid": "f8dc26c9-1b60-4f39-988f-1962286f0879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654224, "uuid": "1d40bfe4-71fb-4aab-92be-f04e94f6b74c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d148b21-aeca-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676641995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641995, "uuid": "f529c595-a869-485f-93e1-d9eef1d3c306", "comment": "Malware payload (AgentTesla)", "value": "fcf0a06de4ec16a4b1d150810421ba07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641995, "uuid": "1e94236f-47d6-4447-9a99-3613c03c27bb", "comment": "Malware payload (AgentTesla)", "value": "55b9fc2f272aff790156b263923896f16e6578a21c703d26b87847e198b0ef58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641995, "uuid": "ce67db15-eff8-4616-8c4b-113149dc91fa", "comment": "Malware payload (AgentTesla)", "value": "8bb68cfe2d3e192def0502690e19dc53501ad034", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641995, "uuid": "89adaa50-d02e-4440-88c0-0223077fa997", "comment": "Malware payload (AgentTesla)", "value": "e98336f2bb94b896da785f3df11d40f2409ac0ff75037547c5f0f48491a72b903dbe3ccabdc598428852a23b6f7c2d78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641995, "uuid": "5b25e91d-2055-4535-a2a8-0c67255b3324", "value": "T1475423C28C1B228A6674801F2A0C59582CF6AB06516877DCFEDED87119DD775CE82CFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641995, "uuid": "23d3a6c0-2029-4035-90ea-9352edb5f983", "value": "6144:FStlRjQQitkmSFbT2rKuvX6hkLW/xkcipwSZO9mUJHGX:gtPjQRpGsKuX6qi/+fpwWIJHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676641995, "uuid": "7e2cd058-8fe6-4064-bf4d-0e79b67ae010", "value": 304818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676641995, "uuid": "68bfef2c-1373-4d89-a0f2-26ccf113219b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641995, "uuid": "a5a11645-b29b-4d52-bffd-3cbca7c9dc95", "value": "TT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdeec803-af0d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676670934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670934, "uuid": "0218877c-caad-49be-be13-4f7f3a343487", "comment": "Malware payload (RedLineStealer)", "value": "a0ffca8d830c3368cb1bed36528876c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670934, "uuid": "71bbcb55-0640-41aa-b222-7cf5bd6b10cf", "comment": "Malware payload (RedLineStealer)", "value": "55cf267e68631e9e533a15fd0057017a64ad9261718bec04c4b0ffacac02b93b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670934, "uuid": "6600e839-d151-4590-94f9-f8ef47cd6d66", "comment": "Malware payload (RedLineStealer)", "value": "503773c11b4f851ce4d657b8adabb178aa1a673c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670934, "uuid": "7eb1bdd9-2993-4dc2-bbd1-49a27d831f2d", "comment": "Malware payload (RedLineStealer)", "value": "8e38661d9170c4883f19c59742dce9abe7c51fa8960578e9f8a2044a429e1a02b858c1cdfbfd8fa2fe6a855d68fa71c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670934, "uuid": "47251b43-7ed4-4825-b3cd-5d224e22554e", "value": "T128C40213F6ED9032E4B917701DF603C30B367E652A34879A674EBD0A1872674B5327AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670934, "uuid": "2b8d3f82-2f6d-4368-9e00-ab86acdbdcb6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670934, "uuid": "ad47f8ac-18ec-4b75-97dc-c848481fb895", "value": "6144:Kny+bnr+lp0yN90QEJCVglvoDVxgZfLJ3G+qzp7D/sXFO8N39tyLVSzuqjkiYUTV:xMrJy90+ClI7IRIpng2rNUTu70cjvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676670934, "uuid": "25f8fe16-b6d0-432e-9623-77bb95463431", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676670934, "uuid": "fa37ee97-ff5a-4f8f-a8a2-4e3f2710e3fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670934, "uuid": "457b7bb7-df87-43f3-87e7-5a0735b6fc92", "value": "a0ffca8d830c3368cb1bed36528876c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404c090d-ae58-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676592957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592957, "uuid": "354542db-1381-47b9-a234-35a1ec87368a", "comment": "Malware payload (RedLineStealer)", "value": "16b45a466b59f8109851441898a49716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592957, "uuid": "543c92f3-3535-4340-a7d3-0c1bc2963fd4", "comment": "Malware payload (RedLineStealer)", "value": "568b282c68a46447e963a3570af1c8632519824c01b75521e8be7b52e1089398", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592957, "uuid": "7db2fcb4-8d38-477e-b13d-3cc36861105c", "comment": "Malware payload (RedLineStealer)", "value": "e174e0cbd105be6921488c0597e5fbec83ac60d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592957, "uuid": "48050ec2-22d2-4f17-ba76-59ffb4e469fd", "comment": "Malware payload (RedLineStealer)", "value": "d64965d9ddef47ae0e3858bc9f9664850bed8c6f39ddc9c59cc335b62f796dd779d6e745eafd1d4a9ae402111538d7ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592957, "uuid": "76efc0d6-3aa1-44cb-a1ea-511cf84eb7b2", "value": "T1E8252307B2F89062D5F45B7015F703C32A767D900B2C86C7278E6C6A1C726A9BB71B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592957, "uuid": "b517b1fc-b619-476f-bf2b-49e7add56158", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592957, "uuid": "c94ea839-8cb3-4fa6-a51e-e3452e5bb10c", "value": "12288:pMrOy90PHmA5ScALKSlq8P72zpc+WcLDD5G2jX5IJod91bb5ZZ9Fm2KnYNzOswV:rysmmSSSH7SpclYk4iC5/ZS2RKsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676592957, "uuid": "d8d703ec-3f1c-4a95-bbde-41d52b00d6cf", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676592957, "uuid": "8c0792a4-39a5-4cec-af21-7bef95f2d8e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592957, "uuid": "b12de136-3906-4c22-838b-b1a6ee20cd4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25196655-ae58-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676592912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592912, "uuid": "9543fd33-eb41-4c94-9af7-052acdf1b22e", "comment": "Malware payload (GCleaner)", "value": "b515014750b6cb35006556e2cdba21be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592912, "uuid": "4a65e7dd-b68e-4815-b094-a78b222ae527", "comment": "Malware payload (GCleaner)", "value": "56d8a6f28289f63553117cbad117b4c8236cf38d7ae9dafefbc50bcbb22e5b14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592912, "uuid": "733ea959-d17e-40b8-9f6a-74d4e0bede59", "comment": "Malware payload (GCleaner)", "value": "2eed51fc0204525e9057f0d68768563387114e36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592912, "uuid": "b52cca29-ac44-4bd7-827e-761569df3cc3", "comment": "Malware payload (GCleaner)", "value": "c325f7a4ad745cfc646d00da48677fc80734f8d1f97c43e2d65523150a67bc188d0ba0bd8688711bae780fac8ec4ec71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592912, "uuid": "9d59b04d-72ce-4487-b037-bb7568818789", "value": "T104D5236B7695C4ACE241CF77885F85B52AA72DA8E4B0D10A74843E0F36F23AD501FF46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592912, "uuid": "e3a40094-0123-4bf0-9f49-aecbac4e622b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592912, "uuid": "a5f802f9-eb30-4d05-b806-d472d6b4fae0", "value": "49152:97qBO5iBZgeVYA7TlhiOMKv4swpxQ4onCju4KOEd6oOzd+legXfaLCgv2MR:xqA5iXgeVJnlhAKv4FpoCjufAo56v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676592912, "uuid": "5dbe5637-4d0b-4658-8660-3282068455b9", "value": 2996623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676592912, "uuid": "8885a62d-b701-45fc-b392-a2288fc4d39c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592912, "uuid": "d1a4deae-014d-4501-9040-e9df8d2011ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3156ad9b-aec8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676641036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641036, "uuid": "7dad1a49-ed16-4d6e-925f-cfb094f839c9", "comment": "Malware payload (Smoke Loader)", "value": "852dc3ce0ad1290aab2b5449af6cce50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641036, "uuid": "18bcf8b9-3d4f-4275-be2c-67640b496f8a", "comment": "Malware payload (Smoke Loader)", "value": "57faee26a7adc215fe009520e2096e005a55a605047d5fa30f0e24faf2c9fd8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641036, "uuid": "266d559b-6dd7-4324-9b33-f34a9891ce2c", "comment": "Malware payload (Smoke Loader)", "value": "db4ffaf3894b10d6a3dfa33f28c0482355d70ce2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641036, "uuid": "a7452a27-6918-4463-a2db-5f6f8bb888f9", "comment": "Malware payload (Smoke Loader)", "value": "39ee1d522e3522d1832ae00d759dd0cd907673f57c7831bae02b7801ffe1600aea96d34dac7888988649307a1afe55ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641036, "uuid": "75ce129d-090c-48a6-b421-ea06cf651f71", "value": "T18204DF223AD1C072E62346345D21C2B59B7FBCB14A628D9B3FC416EE1F716D2DA24357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641036, "uuid": "2aa7e85a-ec75-4a32-a5f7-0726e221595e", "value": "9d64e6a2a7bb4f74b24f7b7e42936433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641036, "uuid": "999d42ae-6fcb-4991-b423-a8a52bf2cfb3", "value": "3072:O4VDtqr48xK1yDLOQWeOy2+H+74Rs9JC1H0+g+Db78U5:OA/WKgDK3bhv4S9JC1H0+g+Db78U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676641036, "uuid": "d123a80c-286f-4b6f-82fb-ae54b532187a", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676641036, "uuid": "fa771982-2fed-4902-8b06-ed4242fab3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641036, "uuid": "64f72621-b097-40d5-ae95-aee2353b32aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1e8ad3-aef5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676660437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676660437, "uuid": "5eab8795-6e3f-4301-85e8-ea25045f37f3", "comment": "Malware payload (RedLineStealer)", "value": "435104a3d236fca008443184b57a8f6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676660437, "uuid": "81bff6cb-f0f7-417d-b31e-f930523f9a5e", "comment": "Malware payload (RedLineStealer)", "value": "59229c7b70c40875d2d4dc19076b4d19fc32e2d3645530c5f80929543cd2cecc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676660437, "uuid": "0967de92-b391-47d0-8f08-e1efe8d2beef", "comment": "Malware payload (RedLineStealer)", "value": "923bf6d4f582026f352cfd39de1da60b9cad8749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676660437, "uuid": "3f0e13ea-7397-44b6-aa3d-24858fa78127", "comment": "Malware payload (RedLineStealer)", "value": "ea9c101f1331acdcf909b533f71af765c5d230c69e3c4752eed91eae6a39e1b8b43e88fb9cff3147c26cceb73f9821e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676660437, "uuid": "d03a9839-034b-4948-a3a8-ea1dff5a2359", "value": "T159C4024BABE85032E9F5273019F702E31536BD515A34925B224FAC6918B3BF4B53137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676660437, "uuid": "200ec00e-9ba3-4455-bd13-be644b4d3bca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676660437, "uuid": "8581781d-1565-4d1d-a86c-7024161713c4", "value": "12288:qMrYy90KuPij2J2d9aOoBNzeyqbNqSSRuxqJxnjO:WyhuqjswIBk7ZFxqJxnjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676660437, "uuid": "f47bcb6d-8dbd-4a2b-b71f-6d92dfae724b", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676660437, "uuid": "500f0ad9-bda3-4888-b5d1-7d705ce9e69f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676660437, "uuid": "3261cd6c-040e-4b41-acef-0bfe6cd018d5", "value": "435104a3d236fca008443184b57a8f6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae847cb-aec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676640247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640247, "uuid": "6d0ab842-5f21-4637-addf-e3c383c2adc7", "comment": "Malware payload (RedLineStealer)", "value": "5e1f6160d11f254472abe7450b68cb14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640247, "uuid": "1f5982a9-3216-4504-8f9d-e07302556cb7", "comment": "Malware payload (RedLineStealer)", "value": "59c34b1f9ce3b7e7a4bdbe35fe320802e37e8678b03985dc3f1a18cb8ac69d25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640247, "uuid": "0ed60637-4a67-4d19-9f40-a83291d34724", "comment": "Malware payload (RedLineStealer)", "value": "f6cb8e25505e2f616fa5def1a0bd64c3a1a55724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640247, "uuid": "11118cc7-a903-4395-8077-bf3e6ba3e9dd", "comment": "Malware payload (RedLineStealer)", "value": "407b4b4d2daff4a44f6aeffbb6d5b5a82a4e5a2a5e2a25c01b9f05cd77a7d0bf6d171bc1c918cb93426b45ca5db5d12b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640247, "uuid": "c120a39c-ee86-4f40-bcb0-ba53d1c8b2ca", "value": "T1A115220BE6EDC526E4F51B7119F603D30E30BD91067A57AB035DBD6A18B32A0A631B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640247, "uuid": "74ecd04b-faa4-4dc8-8487-25b767898d50", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640247, "uuid": "4c100257-a07c-401a-b5cc-370427d5d011", "value": "24576:ByV7+gzSj/TNpgPvPXkv8zbUyiFebmt8i:08YMTNpgPkmUpeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676640247, "uuid": "36992ade-24bd-4474-a796-329967930ecf", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676640247, "uuid": "fbdc5dab-aa95-4982-954d-122890683aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640247, "uuid": "13477b10-d6fa-4204-b779-17147db807da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df542a0e-aec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676640469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640469, "uuid": "dc3cd0a0-77a3-4f48-90fa-10c7515cc1fd", "comment": "Malware payload (RedLineStealer)", "value": "61e7e79215b791b32d98e669d2375787", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640469, "uuid": "252881b9-65ab-489a-8df7-13ecf62c128a", "comment": "Malware payload (RedLineStealer)", "value": "5b6679b660f325eca852d70b0d99e5bfdd6826c9a777167d94798f7c90663291", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640469, "uuid": "a06aba5d-614a-4ccc-8f75-9e84a8f75db2", "comment": "Malware payload (RedLineStealer)", "value": "726ea4637f0fbab0a809df942dac4c412bd02b16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640469, "uuid": "8972f1f3-cc57-441e-918f-c64354a538e7", "comment": "Malware payload (RedLineStealer)", "value": "596e33f5b1fa4fbae805724b36d6ee3390df208cc963c96c9cb443aba8e697c0e7b0af6937ed4d0ce8b267aed97dd794", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640469, "uuid": "3beb918f-4e57-4de5-8654-cfdccef5ba95", "value": "T169C40217A7FC8123E5B453B018FA06D316367E911734835B274FB95E2C722A8AA3177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640469, "uuid": "d0b67844-5815-457d-bd7b-a38932c61b12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640469, "uuid": "298f6a9d-1460-41fc-a453-53fd063a7c7e", "value": "12288:JMrby90wW4nbi3EtpeRFKw15OmGTwgO/lIAzRLy+KlJa:+yzP9peRptbP/iAFsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676640469, "uuid": "3e7fdf4b-24b7-4e24-9925-ad7068ff6bc3", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676640469, "uuid": "3cb2cfb6-cea9-4045-b40e-e3869631dbf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640469, "uuid": "b79423d4-05cf-4fbf-907b-1c8e109473fe", "value": "61e7e79215b791b32d98e669d2375787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d8c147-af1b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676676953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676676953, "uuid": "d8a17eb7-f245-4b7e-9425-28fc081990b3", "comment": "Malware payload (AsyncRAT)", "value": "647e521c6c7ced0a1fbba87d15fcc7e2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676676953, "uuid": "d29b2422-4407-4ad7-8447-6c28938c1c73", "comment": "Malware payload (AsyncRAT)", "value": "5b92c0a0aa9d10ab77c04faf26284bd52acfd32c7fc25920e3f97356355a7aa7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676676953, "uuid": "5ccd69d4-1b27-498a-9b39-e463faa241b9", "comment": "Malware payload (AsyncRAT)", "value": "585038f54fb92157135fa5a986e5de852fca3964", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676676953, "uuid": "b605fd4c-3cb7-4c13-b325-fd28e6630eaf", "comment": "Malware payload (AsyncRAT)", "value": "309732341a01da55222f0feb9c7b5479c56aa99e11c7a256199271b33e3b09bca491db4e1e32077b9c1c2f7d6abb0b51", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676676953, "uuid": "3bf27c69-d79d-4744-b6f9-53fa04b97ae4", "value": "T1385302B0229C5857CB10C7335ABB5E9E13B9FB36F0D4BA9E1B894ED24C22B544E81176", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676676953, "uuid": "5ddec1cd-50b1-4303-9605-b26c05e578f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676676953, "uuid": "d3b41b3a-8611-44f5-8656-f311c5614a41", "value": "1536:TpGaakZ7L64LYba7cDI8Gb5ABOez/4b97B/GjjIJToq:FjemYW7IAeEezM1fGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676676953, "uuid": "e2e81605-448f-4bf2-8ece-a8cd2b6b0c7e", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676676953, "uuid": "873e2639-04f9-45f3-af2a-0d7876bad65d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676676953, "uuid": "428fa5ae-9385-43a5-acb3-ffa30c62ff3d", "value": "647e521c6c7ced0a1fbba87d15fcc7e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9af34d4-ae9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676622877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622877, "uuid": "57f5b6f1-df3d-4da1-b051-87398a9f9af8", "comment": "Malware payload (SnakeKeylogger)", "value": "ab01ebd8311a73bcd57058dd1318bfd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622877, "uuid": "5cb6e25e-79be-4b21-8041-988513800555", "comment": "Malware payload (SnakeKeylogger)", "value": "5cbbcc389957ee4853a152a39ecb929c5e83923e53dd208e9b28211a2a3eb779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622877, "uuid": "c85497ed-b0d3-4aa3-a243-0131f3759716", "comment": "Malware payload (SnakeKeylogger)", "value": "e90f8260943bcdbd8c501cf560c140716685c92f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622877, "uuid": "781e9639-2e02-4d59-b5ce-92987bb322e1", "comment": "Malware payload (SnakeKeylogger)", "value": "e1b3281aa87353b992b8145d15e443c35ef6c4164d5ebe9af821339b788e72bfa171a0d17e717bf8dc9b7aec23cf518c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622877, "uuid": "c808323e-702a-41f2-879b-a04d51203bc7", "value": "T14684D0291359E475E1883572BC709B14A7984E34ADA3C28AFF317E9FF4343D729269C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622877, "uuid": "fe5425d8-c4c8-4083-b588-3df2eca74140", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622877, "uuid": "02cf02f6-48cd-4f96-a768-54b10dd7ad83", "value": "6144:qYa6PSRZ0/45FWJ9PtpeNYufWZ3EER31HlVRV6hgmAK6fJ9JqzM:qY96ZQ45FiHpe+L1R31hwgmf6fwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676622877, "uuid": "b852b895-41ee-4695-bdc8-1ef96ef4053f", "value": 398329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676622877, "uuid": "2ebc272e-f4dd-491a-890a-47aa36ef5547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622877, "uuid": "d39db0a9-6b81-4126-bfe2-5a1d87f5c49e", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e803706-aea9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627797, "uuid": "a229838e-eac3-46aa-9efc-9249b3581064", "comment": "Malware payload", "value": "46c567f4965f6381f5bc19a18bae0bbc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627797, "uuid": "233da8ec-97f4-4320-8741-f04ac5ebab2d", "comment": "Malware payload", "value": "5cddcbbfc70ad65ea677e5ce00ff0f69d5b16ff0e3ef656a5c8a58818a7878e5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627797, "uuid": "fc093c28-0caf-4ea4-a9cc-d1e27558351f", "comment": "Malware payload", "value": "6fb5d02ec97623306f321b2360367898ca3f562f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627797, "uuid": "3d214873-3699-4f29-b4be-b5abd441ae94", "comment": "Malware payload", "value": "623ba0cc46f649f4884960128ff1950fb17d5acf7a39c66f16a329d6f27092f9e4927eca10e38738727ebb231cf52c7d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627797, "uuid": "5fefa2d8-ef0e-4de6-bf4a-6b8b7bedc614", "value": "T15ED02B4684D0D19ECA0FCE4DE525AF83C26B04E48EE2B7E0FE98695D8CD10D9E9580C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627797, "uuid": "92b8dbc2-fe6b-43e6-b1ee-a90bb4603fe2", "value": "6:hRnyLptjabS1qnrXq9cWOmQsq/JA3VLPOSE1/J7ZPV4zKAl9P:7nWjR8brW+1JA3hWSu/J7ZPV4zKAl9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627797, "uuid": "41623c65-404d-41ed-ba29-61cdc654eaf6", "value": 290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627797, "uuid": "0cf2e872-d7fa-4555-be92-a4c55195e399", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627797, "uuid": "3e20e44c-0673-4222-9f0f-bbb39826f4e9", "value": "launcher.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d062b8dc-af14-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676673944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676673944, "uuid": "3595f996-7da5-49bb-94d4-4fedadbebbfb", "comment": "Malware payload (NanoCore)", "value": "51ffd0bd81e101f14bb9705e5036c39c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676673944, "uuid": "e4133eb0-7726-4010-8637-e6dd4a774eb4", "comment": "Malware payload (NanoCore)", "value": "5df43de0e1f0c204ca4ccb472fbf22458e342cee2dc44f9efb1f93864ace85bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676673944, "uuid": "07ca7a44-e9f9-4b9a-bda6-ea464d5a1220", "comment": "Malware payload (NanoCore)", "value": "6e9d21800398f86782fdcb729a94c1d2858ddbb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676673944, "uuid": "bda045d8-7389-4c6f-ae92-cd9dd82b24d4", "comment": "Malware payload (NanoCore)", "value": "e0b3fa3aca86bfe16481d0b79bb0840b8de43fe30f5a69d264dc356d381a5a3f9715b87e601f52320168014f0e44c59a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676673944, "uuid": "4dd91630-90e8-473d-9008-72c5a274f3ce", "value": "T14CD423162399A3AADEE99FB52CB021462732375AB901F78F1C8A74C94E52F044710EF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676673944, "uuid": "6bb2caf4-0699-4b8b-9d6d-60eabc497ff7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676673944, "uuid": "4abe532a-e799-4402-a6dd-671f22e50d65", "value": "12288:fFFZ6DIuCTnlbAyNU2DmoJWqm/q6P0l9W0c9HGh:J6zcnlJNU2DmCWqmr8lZyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676673944, "uuid": "470058a3-9f7a-4071-a310-7e63e37ff46b", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676673944, "uuid": "fc292a87-ae84-4794-8ad8-8ea20ef3a60c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676673944, "uuid": "53ea3b74-e6f3-475c-b5bb-77c3ed11bf47", "value": "51ffd0bd81e101f14bb9705e5036c39c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6593052b-aeb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676632104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632104, "uuid": "91cfb966-3c24-47ab-ad89-8c89cb4d077c", "comment": "Malware payload (Amadey)", "value": "473c0d690ed8bede54f22322448606f2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632104, "uuid": "7485f73b-3de3-4d3b-ad9b-d85a349662b1", "comment": "Malware payload (Amadey)", "value": "5e50096cfbc9068960adc876fb5e1483a104d61634519644dc24d2bd334d0844", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632104, "uuid": "c50260a5-696a-4dd2-a3f2-e6e28d4b871e", "comment": "Malware payload (Amadey)", "value": "748d9e46c3a19a51af7723e87d789bd34e80e2af", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632104, "uuid": "811795e5-27fa-4041-8904-37f85271440e", "comment": "Malware payload (Amadey)", "value": "13e35ce1b69432656c87c2153ad18e63a3369e754bade9b31f3d48bb7f9d0a1c8128c0e3ef60fa0e5519cbb9f856c088", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632104, "uuid": "b0f005e1-f085-4dad-9a89-a49f51e782d0", "value": "T16C152253EBEC8132E465173058FA07C3267ABD616724C74B670BBD5A1C62270E9327BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632104, "uuid": "d950bd08-4811-45d7-b655-4362c687ab84", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632104, "uuid": "c2c787e4-7540-4ed4-8026-20b1600375a9", "value": "12288:rMr3y90eJvCK1WOCu6qd3FYYeJ4M4/cKkDpeDd5PHiGf/TVl+JlU8MW9clKtQ9b0:4yTCK1XdVRynTKk4XVlUU8igO9nza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676632104, "uuid": "da00cec8-148a-47bd-a9c8-a58a35fb3e26", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676632104, "uuid": "fe4b4643-78e0-4eda-b772-9429fde7efdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632104, "uuid": "fdef0f5d-ac0d-4a17-b847-a2edb41b0560", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b734a36-aed7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676647415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647415, "uuid": "61cfc72d-8ad2-4d4b-81d2-74ff294534a3", "comment": "Malware payload", "value": "14fefeb431d92170439733587681c610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647415, "uuid": "d8fa81b1-7d37-4974-a51c-82ac7325bd2f", "comment": "Malware payload", "value": "5ec607dbbafe92b640c01d19e6a5aaafcf0080e2652665a49f49a127de595348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647415, "uuid": "f2d383f2-6e35-4c98-965f-4174c70a508b", "comment": "Malware payload", "value": "5cd7f69b534ce7eb990237e5eac82b4fb2b879c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647415, "uuid": "7e7587df-7a88-49e6-93d5-d5f2075559aa", "comment": "Malware payload", "value": "9e2b67dbcc5de9ca2441003811b8ff72260ae42c5e3fecd7a2434d4c00a9fdf4c6ba180dcd1f4f7b052a4d39a0b79913", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647415, "uuid": "e34ec67a-c900-4a8a-8f7a-e9091c57eeff", "value": "T1EFE53303BBCC1032E425637041FB56D32F37FE577A1805BB254EAEAC1C266E5B5B06A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647415, "uuid": "520304be-55bf-4c66-bac7-0a80cbae1ea7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647415, "uuid": "692a346b-b97a-4f64-8258-e829f5a5c6f8", "value": "49152:o5hokAVUHXpIPwgBtvIKRdOawXLLtWbLTYrIYpOiMPrW6EYTXqacXI4We2:FkjWwgBtQKRdKXIPErs7wOXTcXpWe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676647415, "uuid": "5a5b3b06-7fde-4142-930d-647ce8a5399d", "value": 3123200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676647415, "uuid": "4b5f9ba0-8983-41b7-9ed3-64e2cfac526d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647415, "uuid": "58c79f91-3d0a-49a4-b119-e2ecd774ca2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce8fc27-aebd-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676636277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636277, "uuid": "896fed81-e6b2-403d-9546-e745eea98603", "comment": "Malware payload (GCleaner)", "value": "929d0c7355b034ddc5802f415a1ed4d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636277, "uuid": "6679fcf9-43a8-4773-ba28-aa9f3f6da11c", "comment": "Malware payload (GCleaner)", "value": "5f1e4918ebef770e67def959ebb871af35b2b22a9876eaed5be048abe1fc87b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636277, "uuid": "4e66f9ce-20c5-4fa0-8cd2-c584785363d6", "comment": "Malware payload (GCleaner)", "value": "ab9c4be1f1e638c360e5a5f56cc05210bbda0de9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636277, "uuid": "245dbc57-a0a5-42f6-9ffa-7f099f63c6b3", "comment": "Malware payload (GCleaner)", "value": "d1477bff5ff4fee5ce5eebe14cc39b397c112ecbe5ef78d8a2de44144725f8a7a009f9fdf3f1d215e4bf5c8391f8b0a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636277, "uuid": "1043ee1e-b72b-4ac1-85a8-a7f996368327", "value": "T1D3E523E67814E4E7D7FCEFF0FC0E45F139A3BC27D8E0066A38657A2AA572259841D508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636277, "uuid": "eb1faca9-c9c3-4820-9f62-1e7fb015dc3d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636277, "uuid": "41192b8a-a222-412f-9c0f-e34e5d3ec858", "value": "98304:S25SS/DwgewS8zwp5DfI3MbQEZ9nM8+CSv2MR:SfSMhwHwp52C6CSvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676636277, "uuid": "1fd4cd67-c556-497a-8071-b94b49df6842", "value": 3226461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676636277, "uuid": "8652060e-6b8c-4a83-97b9-63d2c4376c45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636277, "uuid": "784721f4-bbef-4ed4-b804-f425c8701405", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a35315-aeb0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676630737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630737, "uuid": "124740b0-bcd1-424e-b718-c0b97f97432d", "comment": "Malware payload", "value": "4a50b16a7a5a07616dbb2073b696a731", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630737, "uuid": "2f81a594-efcf-4146-b08b-2f19d29a64f6", "comment": "Malware payload", "value": "5f40824a256b11d46101bee5957d3c3fa9d79d663602e5d064187e83d1dbb5dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630737, "uuid": "35da7239-31fe-4c8d-b3b8-f49646560eb5", "comment": "Malware payload", "value": "d2e1c801c0b28875f77216fcae8d20fd07155932", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630737, "uuid": "b1ea1398-e8a8-4804-aa61-f1b7056bd6b2", "comment": "Malware payload", "value": "eb68a41459b5ebdf1b96626843e3f5dd5786d470597b5b46e16bae6f5fb1fa6ae5cb7008eee61adc5ecca0b12bc1d690", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630737, "uuid": "62302381-38ef-4b26-9d2f-cb9998d9e534", "value": "T141E6339C75B4B876F1D8833BC6D91CB5EB1D7510FA8C6E9B8F2080267A432494F4AD78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630737, "uuid": "680b6d53-ccff-4168-8ced-48edd98c92f9", "value": "393216:qZb5o3+OneimeJRhyMnaedeZMGy6AFSPkk8jQCL9bq6:YbyuOngm0+joZMGFAFSPaQCZbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630737, "uuid": "7c27cc1c-7fd5-4882-b2ed-da8d60675e45", "value": 13908695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630737, "uuid": "56f22900-766a-4472-b5f7-543b9c635917", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630737, "uuid": "4651ad77-7bbb-4135-957a-7f78e5ec8929", "value": "libpython3.8.dll.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa36f86-aee6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676654097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654097, "uuid": "8ceca0b7-10a4-4f64-9319-f316141b51a5", "comment": "Malware payload", "value": "81da750d3688f514a2350bfb39282102", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654097, "uuid": "2a0ff3f6-f2b4-4992-8d35-9f5e3abe0c05", "comment": "Malware payload", "value": "5fdbef29420f2fe00fe4efcd30f9f4e6ae5dc2af7b595cbedc681038c8d1a1fd", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654097, "uuid": "aa2bda54-041a-4b44-b02d-670b4b360339", "comment": "Malware payload", "value": "16da4d21af12c2f6c9ac682a2fdb9f6c5eba07fb", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654097, "uuid": "29c411d1-182b-4348-afe0-123c35c3a449", "comment": "Malware payload", "value": "15929603426848ae5c2c7fce761e68c14f090b4f44b733cadf11353d15350321c5495854664170f1f6dccb6ae9c597ef", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654097, "uuid": "e1302307-ac2f-42f3-ac1f-e1f2e2916c01", "value": "T129B423553D8F26F60B5CA200F427B0A4791FDC247DC8BC69601EBB912FEACA1D65F885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654097, "uuid": "b489e6eb-c846-4a6c-bae4-ff3ff31503dc", "value": "12288:7CD+4ycCNYloVlvTLVCKH6VUPWe1dySUKqdB/v:7CnpoVlvTLVxPT3ySUpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676654097, "uuid": "584b4603-2e1d-4e36-8736-5683d6b463e6", "value": 510570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676654097, "uuid": "e7c43a48-4fca-40df-90c8-bac119fc8901", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654097, "uuid": "24f586fd-6a98-4792-af53-ed4bab4e18c6", "value": "2023 SIEMENS Energy -PO- 216238068 DOCS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301f1d6c-ae80-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676610110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610110, "uuid": "bf7ffedf-c0f2-44ff-a027-cd7cdf93b468", "comment": "Malware payload (RedLineStealer)", "value": "32bbf2c6d6570064d526a7ce5fc2821c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610110, "uuid": "9b8cb5bf-ba62-4dad-aa50-c264557c7e40", "comment": "Malware payload (RedLineStealer)", "value": "60e886c4fa48fce6c4074534db640c377c48e204074c7b12f0ee4fc81b1b5d34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610110, "uuid": "5cfe8f01-8141-4875-a45b-09f2ac35b15a", "comment": "Malware payload (RedLineStealer)", "value": "7b673760279be34d3a1eb06dca5f5c4d6f37f607", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610110, "uuid": "7c457df7-de35-4c6a-8a72-4fa059e44e59", "comment": "Malware payload (RedLineStealer)", "value": "71429a29840f843032b6048823fc73ced485b8ead8951498de26b508f5712f9629cca0ace3f01ebfc77b579d19053441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610110, "uuid": "5000de0e-d644-40ef-83ed-765075d7031a", "value": "T1EE74AE13A2E17C45E9268B729E2EC7E8B60FF6604F59776E121D8A3F05B11B2C363711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610110, "uuid": "3ef5d58a-72ac-4720-bb79-defc2d92f616", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610110, "uuid": "a1226235-c365-4d13-995d-24a1b3e34c3b", "value": "6144:ZX8SILq5pvkMem/TPvdYRIm8ww39wISvVmZDXj6Jj3clTuLHPugO:F8SIW5te1RqwwNUN2DX21cZuLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676610110, "uuid": "2e1b665e-a1e8-449b-b7d4-12510d122e40", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676610110, "uuid": "9bf6c9e8-3eb1-4944-a42d-c3cb7479b256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610110, "uuid": "37d3cc5e-7bca-43ff-ad09-ea55135ef630", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69140b4d-ae7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676607629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607629, "uuid": "54e24560-b689-4cb7-aa2b-6ddc49b1b0de", "comment": "Malware payload (Amadey)", "value": "27e017c51492e1f0ab97d82a37a06e6f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607629, "uuid": "38c2d0c8-6bcc-423f-81d4-b7a86421ba81", "comment": "Malware payload (Amadey)", "value": "615e7281680ad03f3e6b0833193a5d6d35d131887fe76cc7ccfa04d5a6c12a74", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607629, "uuid": "a71c2079-cbde-4e24-9cb5-ec134383a45f", "comment": "Malware payload (Amadey)", "value": "d7195da261c38da22bcfe7ba0c6da912fa4c7ac8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607629, "uuid": "583d901a-3758-4095-9559-aca62124e24f", "comment": "Malware payload (Amadey)", "value": "fee95f4eca61ad93c4a7e366caa3d7ecd560470ee62fe8a7183bfa9f8e0030579087b65279acc5ee12247dd3452aa000", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607629, "uuid": "d29b3165-3921-4c2e-be4b-fa98f6869970", "value": "T17E252253A7E89073D8B5937408F703D30636BEA12A3587AB238BFC464871674A77476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607629, "uuid": "92efd759-8be6-46d4-88c8-0878cefc4e7a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607629, "uuid": "a1482e57-e772-4aab-b2cc-87e1fcd4c827", "value": "24576:iy8c1PVm4j0YIJ8ysZ5HpDGCvJ4Xi4r7ar:JBPc4hINQJCuJ4XiWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676607629, "uuid": "88e64992-2699-4b83-9aa7-98fe9f53bce9", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676607629, "uuid": "4af28c7e-ef7a-46d0-8744-d48ece7af19b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607629, "uuid": "581a0521-441a-4255-be8a-18b3e292f80f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9310cd19-ae5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676595673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595673, "uuid": "0ef5aff0-3a6c-4fb7-91c0-8c4acd9a1389", "comment": "Malware payload (Amadey)", "value": "c1652c1bc1e442cb16a005ad91884c5f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595673, "uuid": "376d4908-9bd6-4e79-9d4f-506bcfbe0e34", "comment": "Malware payload (Amadey)", "value": "61649f65117944d751a9d5fab13e145af1e74f8b549948630c2de3ee77145e58", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595673, "uuid": "0b765e92-920f-4916-a291-27ce6769ee6a", "comment": "Malware payload (Amadey)", "value": "5f00d954a7b6d9ff1b4662dfef717dbd34d207c2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595673, "uuid": "4c0f9801-46f4-40b1-9c88-9c6059fc9eab", "comment": "Malware payload (Amadey)", "value": "2f009dc8dae3c19d7a617ac249edd86b97baf5aa19615b52e2c25ff3daedc2a3a970944c625ebaf0f4e2a26fcb0ee3c5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595673, "uuid": "1401a14c-ed39-4e45-a3fb-ca8a74ea141b", "value": "T1E9252207F7F4A020ECF157B118F203D31536BE626D39C29B578BAC4649B16E4A6317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595673, "uuid": "708c1104-4d11-481b-8fa3-8fe5b35b2629", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595673, "uuid": "344bb62a-9e41-4ea0-97f3-1eda6b0bbb82", "value": "12288:TMrxy90DGiL5qAE0Ms2lrPVjZKEdXrvZS1KASx+tM56i4BMj/AEo8ZeAZLIiSkY+:6y+532Jf1rvuSx8CYB1EJe0LSPwAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676595673, "uuid": "8ef82d02-0cf5-4218-b3da-23a5525d725b", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676595673, "uuid": "5ea7faf5-3469-4142-964f-257445a6d1c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595673, "uuid": "a3128cde-073e-4c2f-b0aa-e8115484ed06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72aae33-ae72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676604431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604431, "uuid": "451927c9-a6b8-4fa3-b286-5cc33648903a", "comment": "Malware payload (Amadey)", "value": "e771be983c56273e5cc837c52be37002", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604431, "uuid": "b856b83a-740b-439f-a079-6b4abd126231", "comment": "Malware payload (Amadey)", "value": "618ede6671334ae8149f59cf1e1ac2bc54c7c4ce572539e0f07026f824761d8e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604431, "uuid": "90c0be0f-6a6f-4fb8-bf1d-32c475a3682e", "comment": "Malware payload (Amadey)", "value": "cbfd4bf2a55ca3c4275acce9669c5b685172b2f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676604431, "uuid": "d3041f1d-b34d-4e2b-a5bc-b9eb927fa0e2", "comment": "Malware payload (Amadey)", "value": "0c306b4bd4d3f2704161c76a7c906d77d7fd001127fedc3ffb4ae6af4c3a48f21998ade4a1a0e06679ce0b665effdc5f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604431, "uuid": "e0798919-08d3-42f3-886f-7edaacc1a35d", "value": "T1EC25230BFAD89021D4B48BB159F303D30A367DE25B39538B374DAC8658B29B465327B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604431, "uuid": "881a26e1-5ed3-4d9b-b4f9-75151d25090a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604431, "uuid": "7d1d36e9-de19-436b-8d03-35b96065ad03", "value": "24576:Ay/Kpj9Sb2Jg6shV3ftD0coqyoOzIF75VJcj:H/KppSb2Jgzv3ftD7oqUEF71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676604431, "uuid": "83ec813c-22cf-4970-8f58-1e2ef607941d", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676604431, "uuid": "ccb1c77c-1394-4983-a342-67500da7d2a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676604431, "uuid": "cfa73b25-502a-461c-8b60-52ab34c68ea6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d494aa03-aeff-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676664932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676664932, "uuid": "10e68167-5fa7-4b7e-9e29-511bd69344c4", "comment": "Malware payload", "value": "287e09b20d6c4ac1a6936579067ea911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676664932, "uuid": "d7478107-ec96-4dc9-8589-ee6f636e9a33", "comment": "Malware payload", "value": "61bdb456c11a0d8e15ffc3c2cebb9da83ee195c208892dbe12fb8b29771f7975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676664932, "uuid": "fb8c6fa4-aebf-408a-8904-4c685b948f35", "comment": "Malware payload", "value": "9dad558211906541b3cf5f1d4514edf2ee4867c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676664932, "uuid": "76fc35ee-b6c0-49e8-9c9a-5bb4807b827f", "comment": "Malware payload", "value": "6dc4c5b8ff9305288fab9b4e99cfc852e5b0e5a21d5adb531a2a60e0351b3aa2a7798b2a1bd3dcf08ff53da25254170a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676664932, "uuid": "6bab1036-249c-4109-9f09-ff751199460c", "value": "T1A1D5F1B7F7000D27DD5A067169A58B619B12D1AD92A0D30B38ACB01C3F7B35A5CAF9D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676664932, "uuid": "abb34fe3-5879-4b8d-8650-2832a771de9b", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676664932, "uuid": "31ca649a-95c5-4daf-ad7a-fc6d12d15ca7", "value": "49152:44E8mwokYxSoWo68c5xI5hH0sIacQX+JM0l6h4+XfhTpaVFSv94V68rtx7wZuufw:VmwinWuhCJMRBTpajSv+V9rzwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676664932, "uuid": "1f376456-860b-4491-a034-928e0cfe11d7", "value": 2782728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676664932, "uuid": "a72001ae-39c9-46a7-b318-211a51f2b8a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676664932, "uuid": "dbdee2c8-41ae-448d-bf41-8bf4d3ffcd42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04869a12-ae6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676601876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601876, "uuid": "65086b7f-38fd-4210-90f8-b8962755c433", "comment": "Malware payload (RedLineStealer)", "value": "9bdd93025f47b2b5b4e4da58b67329bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601876, "uuid": "5205e32d-3af4-426c-89c5-fcd3dbbd595a", "comment": "Malware payload (RedLineStealer)", "value": "61c1c6be26d8f206d400d3a7608b9514f4114483e06eb7109bf3c98e51d47377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601876, "uuid": "8e2e423a-2a9b-430f-b6d1-c628860ecf57", "comment": "Malware payload (RedLineStealer)", "value": "99a9f1ba47d22cd94a0893b5509fc484af8238f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601876, "uuid": "31dd3591-89f0-4903-89c0-4dc7e47d571d", "comment": "Malware payload (RedLineStealer)", "value": "7d154e820ac0751c320e0a3da062467757ea101da615b979f09de786a075d1c17d9a48320b4b75bf545759c497481f6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601876, "uuid": "85522f7b-9818-4fac-a195-f7c6be2a2c6c", "value": "T188252257A7FD8032D8B9533419F602C30777BE614E24835B3B8EAD5A58B36B1A57032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601876, "uuid": "cce6e7cd-28d2-4f88-96e7-66215a6981e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601876, "uuid": "f3f89539-7963-4c51-9d88-74d362f26318", "value": "24576:8yxIYspOwVmV7da46ebnfHFpxbsFNg3T:r+swV67eebZwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676601876, "uuid": "7a5c4794-c3c2-4812-93aa-3c37e1eaf998", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676601876, "uuid": "5266082d-7b63-4219-bcfa-de5c6cf8f719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601876, "uuid": "867ddd6f-4f2c-43c8-8705-473010ba77c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077ef11e-ae86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676612619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676612619, "uuid": "75bd40a4-7419-449e-afa4-05cc80f34ffc", "comment": "Malware payload (Smoke Loader)", "value": "e946405ceba43682f648143c4fa2e75f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676612619, "uuid": "48705383-639e-482b-a415-cbd0644c0fd1", "comment": "Malware payload (Smoke Loader)", "value": "62789153e6a8d8b66b9e5130cfe6963228e0f5d3131de2375ee86284b234d887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676612619, "uuid": "0bb5d30e-b491-4d75-9641-a60ccf44ee0a", "comment": "Malware payload (Smoke Loader)", "value": "8119c71159a6ec5540191a07ae9476f91259ac99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676612619, "uuid": "7b4b02e2-bd34-403a-a656-e256fb409afa", "comment": "Malware payload (Smoke Loader)", "value": "cfe9b0eae2692e4f021185031bd5557fd1db43a097112f9a1868ba6286adce070fad80b708e74c5042c41e9689714f1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676612619, "uuid": "b8ec5120-a1ca-4bd0-b67e-c50e62d877ed", "value": "T1DE24C02336D19479F51707308E62C1F9AB3BF8718E65AAAF3784462F0E752D2CB56312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676612619, "uuid": "f2c76b46-3a10-4630-87e4-17e133a1920b", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676612619, "uuid": "53e7e0ce-1672-443e-b6e7-e95738deacda", "value": "3072:r7c7Jz9fA3xG9SgnzVkNjewqAUF695Gh6A9Coef41QXdDBO8j6pi38eFDU:r7+JQYSgzVUjBQeGovoeqYZOJet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676612619, "uuid": "8c334024-e88c-4d37-a822-9dae3a526ac2", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676612619, "uuid": "cd39e11c-50fe-447c-bf42-08e1f23baf30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676612619, "uuid": "9af61f27-ba16-49cf-8c72-245539a801ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb432ab-aed3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676645971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645971, "uuid": "c3d77bbc-523f-49f3-a80f-ef984e3e068b", "comment": "Malware payload (RedLineStealer)", "value": "4f344a208db215692305ade889d61c4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645971, "uuid": "b2911ff9-8373-4a6c-8ca0-c11df33f73a7", "comment": "Malware payload (RedLineStealer)", "value": "629c2719bb65a0f5f7d22331b4e158a2f4e22c3345c13a23e9208f8dc2b94c13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645971, "uuid": "96048720-53d6-4074-8f50-a31a1053a9a7", "comment": "Malware payload (RedLineStealer)", "value": "c8c5cfd5d440525bc2910e3746eeefbc662a0ec8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645971, "uuid": "631b371f-9746-4ea7-a9aa-3ec3ede63667", "comment": "Malware payload (RedLineStealer)", "value": "2d230fd8dbc1a09ea5bffa74b7eb991505c95966ada71ef8b990a3cbe5c643cf0e7e8323a71ba6ad38770c1f5b519531", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645971, "uuid": "085b7993-05fa-4955-a7e6-dba4ae434507", "value": "T123E41207B7E88026EDB557704DF702D3163A7EA55F38C36B334E6C1A48726A462363A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645971, "uuid": "3acbfca6-f8c7-4ba9-87d5-22c9a7327195", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645971, "uuid": "b326c23e-dd3d-49a9-9ec1-103344c6ca33", "value": "12288:TMrly90xwW/TuKNXi6Ic1pci+WohXRb/leBykhYBXYfd8dd4SGNsqWij1F85cIJH:uymF/iKVEc1pqrh9UBy7XYV8dySGNkmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676645971, "uuid": "8b20aca8-3bf6-4120-9b61-1358d85be415", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676645971, "uuid": "301934f3-dc3c-4d5d-bb13-f815d102cab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645971, "uuid": "82b8ce96-49f3-46aa-a755-091f53699ff3", "value": "4f344a208db215692305ade889d61c4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15194169-ae5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676594173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676594173, "uuid": "e765110d-da21-46ac-b9e4-745fb7c55b9c", "comment": "Malware payload (RedLineStealer)", "value": "f5ee7cb3133c3cddbd3c2f1d1eb2a383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676594173, "uuid": "c63e6e2a-81ef-4ee0-b5b4-8c86c36f1761", "comment": "Malware payload (RedLineStealer)", "value": "62a7849b2e1c452fac942cea6ec9ce1563acd6a075253fadbd9cca00d652e4dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676594173, "uuid": "a5604937-05d1-4717-9123-b5166d0b08dd", "comment": "Malware payload (RedLineStealer)", "value": "269f4fa595ff56dc9d4d9beebb815106fe72e52b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676594173, "uuid": "af28d0c8-c5ec-42aa-be26-7e66207e1d34", "comment": "Malware payload (RedLineStealer)", "value": "50cc8cbd754f8052c248cc4acb8e979ec79ba7acb0a7fe38dd0766fa041fe38f3d73396fd86cdc1e5e7909f534022e84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676594173, "uuid": "5144078c-578a-497c-99e9-0e76f566935d", "value": "T13225224BBAE95832F8B50B7018F207C315357DA25B798357334DAD8E1DB2160AE3636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676594173, "uuid": "0f1e67cb-09c1-44a9-baba-9ad8e7587f10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676594173, "uuid": "93addaba-6ad2-44a3-a1b1-1afc3e238dd0", "value": "24576:xyhd+zWJMzhHzNELDEMGMWfTmMaJisOlfrIX5O0D:khdwqmh0DEd1KP4dFrqs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676594173, "uuid": "9a5bc30a-a4a0-4475-82ce-3108419542ce", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676594173, "uuid": "785dab96-2ae2-420e-a12c-2b149d4d89d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676594173, "uuid": "c5ad08a2-8ca5-4d5e-a609-416c14e7bb56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882d1eda-af08-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676668669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676668669, "uuid": "bb92d03e-c112-4282-869d-69b6e6aaa7e8", "comment": "Malware payload", "value": "4b270d26d1167127ed755ffc43ef87a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676668669, "uuid": "0bc9a725-7cb2-458e-af76-a4832e374251", "comment": "Malware payload", "value": "62c3fe7c67e0477eb29035b237df2709ac180edda56f3335a105b6f219f6bc0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676668669, "uuid": "9aa00b6c-7bab-4819-889e-4093a5a2a278", "comment": "Malware payload", "value": "84f1357e92f845f628f03825ca33c67f6168363f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676668669, "uuid": "06251d24-c02e-41ec-add8-9741de019d4d", "comment": "Malware payload", "value": "90d28cc6e94f912f96ba52336d847cbf04e6e6034da4268d517f923c8b3ec236efd0e28fa4b642c44859f2afb10538fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676668669, "uuid": "681b2db4-6cf7-4492-9f7a-cf5efa56d4e9", "value": "T154E4128BE6E8D031DCB197711CF202D30A36BEA11B7C4357278EAD5E18B25A059353B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676668669, "uuid": "336408b8-ab32-4a0a-9fd6-fd770bd4a648", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676668669, "uuid": "e02b09b6-54be-4155-8878-555afb090b1c", "value": "12288:XMr1y90Y2TZYsVIgSWdRVQXP3KihhbBTt0pEakU8H/l5LFR2uzQWIaNMw6AlHm:6yDNgZmX/KihN/0pEJL/jNpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676668669, "uuid": "bd6048ff-fe0d-4d84-ac27-53028bc3c364", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676668669, "uuid": "79eecf6e-8328-41c5-a568-03bff6b22e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676668669, "uuid": "e1c57a7c-bb1c-4142-890c-8c212ba12a71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637e1e30-aee7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676654434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654434, "uuid": "8c3892fd-070d-44b6-bb23-04a3775c522e", "comment": "Malware payload", "value": "db3fd41ee2c887d662242dad2c37a2a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654434, "uuid": "c43da2a1-bda4-4356-b656-f277399e6402", "comment": "Malware payload", "value": "633dfc0b22644c468cfb0c0b7f1fefc791501626be96b7db31ecd171dca395f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654434, "uuid": "b963b4a5-2484-4496-b900-14bf18692b29", "comment": "Malware payload", "value": "4e814d2566f8c80da83a63a9ab89ae71bb6d49dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654434, "uuid": "ef766f07-4779-40fa-8724-21b4c5a14a85", "comment": "Malware payload", "value": "e855f589bba0fe52678b0ab660bc7ef7aa3725db781d92e34022d6a11c37f7a78d1b9ab5b0071716451a244872a51878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654434, "uuid": "4fa0fef5-e93c-4196-9ae6-d0b5f4d1091b", "value": "T1EA94D0111DA75CD3F09488FA6BFF61848DBFB2D29619484729AC218476FCA837D293CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654434, "uuid": "b0e97fe1-f75b-49af-9047-9f8a992bc38a", "value": "966d4625a512accda940a17b527725c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654434, "uuid": "f9b2ea3d-bc42-4d83-9945-ad8239efbdb7", "value": "12288:pPQKZKtOQL2O7Pp7GfEhMb0lM7xjWLuy3:pPQftc6Pp6fbWL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676654434, "uuid": "92bb0750-5707-42a4-b7a1-a6be2fbea9d0", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676654434, "uuid": "47bc7430-4151-4d99-ad61-f0099d9038dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654434, "uuid": "3bcb01d9-b5a0-4621-8bd7-74263b1323e3", "value": "Lightroom_debloated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6a0ad0-ae5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676595667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595667, "uuid": "e0d65216-4979-45f0-bd8a-7428abc3f7e1", "comment": "Malware payload (Smoke Loader)", "value": "c6f990f0219abf0655c3555c004105fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595667, "uuid": "4eb9f557-0e33-41e1-99b5-e6beab6906b2", "comment": "Malware payload (Smoke Loader)", "value": "64b4217093f4b47242522c60c4e427e38a0e8975f4c7bcca721daee302e64a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595667, "uuid": "2be2dcfd-4650-4133-823e-b0ff115ec5c0", "comment": "Malware payload (Smoke Loader)", "value": "2d536404a81198a753778cb8be945c50006179b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595667, "uuid": "26dac295-77cc-4b08-9cce-4417b412fe9a", "comment": "Malware payload (Smoke Loader)", "value": "fdcf03e1504fdd9cfc1bbfa400166e166e8dcac9e3a01fb410cf20a40ef1c4f5c4d91e6b345a96dc0f03822342381c0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595667, "uuid": "d415c580-4989-4d7f-86b4-dc36448bef29", "value": "T1D3445B13A2A27C54D926CA729E1EC7F47A1EF6608F49776E12199B3F05B12B3C363710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595667, "uuid": "1bc44918-8b13-459d-8c8c-8bc95fd85f0e", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595667, "uuid": "c46bda60-2d83-45f2-bcc7-f4b615c39573", "value": "3072:RbtuC7HLbpE374Hboo4grLDZyQCVhed3WD5C8tYjHPVIGv:5QCDLw47v/FY9tYjHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676595667, "uuid": "68cc033b-82bd-4e47-8ad2-dfe8b93ec651", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676595667, "uuid": "0fb99ba1-c1f6-4e9b-a8d8-62aa2f875e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595667, "uuid": "d8e53e77-2b08-457f-bae6-dfe707583b27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe97617-ae76-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676605976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605976, "uuid": "3de46759-1e33-4f68-804a-9aee2038d7e3", "comment": "Malware payload (Amadey)", "value": "59b322fb0c34d973879140981c610a59", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605976, "uuid": "3a569012-ea7b-4227-95ea-0e977d710bcd", "comment": "Malware payload (Amadey)", "value": "6639844cb33e78efc5093408048255bd1f673488be72e9c70d965847425b5d10", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605976, "uuid": "ec6f1830-086e-42b1-bc8a-dcaa84033b0d", "comment": "Malware payload (Amadey)", "value": "32df0c183fcde846153f3759fe9bbf6064c56b6c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605976, "uuid": "8331563d-73e6-4d90-bac6-2849139eba49", "comment": "Malware payload (Amadey)", "value": "037a766db392e0046e7d92de506a98f6d02acdb443155d44a1f07e35ea23bb4d00b9543cd9b8f6d47d913b13ba28582d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605976, "uuid": "a859679f-b55d-42d7-ad3d-afd3d1dceab5", "value": "T16F25231B86FD8076ECB957741AF302D307397C916B7846663B4FA90A08B23706A3577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605976, "uuid": "d506e210-dee7-4f06-9c56-e9b2f744e6c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605976, "uuid": "5e69b5f3-1bca-4950-814e-538e1f99b543", "value": "12288:qMrJy900ISLvRweiAs4sje4LYGU12bRoH57MVvz3TitEnvxdHGWIgBp18tFhyJUj:ry3oAQa6o8oudHGup1Te/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676605976, "uuid": "0548cdfa-aa3f-44a2-ae99-382b90536b7b", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676605976, "uuid": "2e6b0a67-565d-44c3-b094-2e454e00e6d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605976, "uuid": "d0c08f6c-3dc8-429a-8f25-f28d0ed071a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f4f89d-ae6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676601129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601129, "uuid": "af64792c-a9dd-4f43-b5e8-db2cb29108df", "comment": "Malware payload (TeamBot)", "value": "4848a3b18c0ba3d28e5925e4cb8fa8bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601129, "uuid": "7400d123-8364-44eb-bc71-fc6f6b6509a9", "comment": "Malware payload (TeamBot)", "value": "674d6af0707268f39ad59969e22667acd9f98464017c24a13721c6301f286737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601129, "uuid": "aede949e-83c3-4f7b-ad53-9bac78068ee1", "comment": "Malware payload (TeamBot)", "value": "30e6bdd62ae774f99062de7c7288da07537c2c02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601129, "uuid": "ec4c30bd-991c-4f23-8642-222249ad0edf", "comment": "Malware payload (TeamBot)", "value": "cdb9362ab5d056f588b04061ade538a6965a846f7723fc45869acda40d4c5c187685e725f98541781af187b82fd7f3d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601129, "uuid": "d8d06f64-1f9c-4027-ad83-bfb81d896f10", "value": "T1F3445C13AAE17C50E916CB729E2EC7E87A1EF5608F59776E1218CA3F05B11B2C363711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601129, "uuid": "6df437d5-0748-408f-bbdd-01223591c794", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601129, "uuid": "31542883-fc26-4514-9e18-a8367cdaf313", "value": "6144:zepDLMKVv+XmuQ7yX3FwBX55XgazviHK:qpDIKgFQ7yHGXfwa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676601129, "uuid": "3416c371-6f99-4f9c-b0db-33b4620d794e", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676601129, "uuid": "1d4bf3db-562d-4be9-8197-b73209fb5b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601129, "uuid": "c651fc8f-25a7-418f-b13e-a50ef6a7fc9d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921fd8b6-aecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676643346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643346, "uuid": "dc75307d-3e92-48e0-b9b9-f1e2900e364d", "comment": "Malware payload (RedLineStealer)", "value": "5e147162d8165039f04bec4fa32b2ad3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643346, "uuid": "dd8c600f-c9bd-4a14-8c56-5f3c21e003c6", "comment": "Malware payload (RedLineStealer)", "value": "681289485b7b71708d904c5acee3c31ba1ccd2812068be35ff483ee041c7bf6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643346, "uuid": "ab84291e-50a3-4aca-beee-b398f2e6fdb5", "comment": "Malware payload (RedLineStealer)", "value": "2eaa0e89eeb302d822312d1303e31e0c2fe5ae5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643346, "uuid": "9a97dd1c-31fb-4300-a2af-bdb02a7a086f", "comment": "Malware payload (RedLineStealer)", "value": "8ce72806ab986fb2ecdc0b915eb8f098dd4ecfff083587ddfaac35dc878e9863f69e240eb4a670a1562fa878af8cd244", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643346, "uuid": "5d74afa0-af17-4dfd-bbda-e024159c2dbc", "value": "T199C40107B7EC9062E9B6577018F702D31636BC50AB78C387234F6C5A1972668B9317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643346, "uuid": "80a052c7-4628-40ca-a6f9-fea343fb3086", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643346, "uuid": "c7fc65c8-2046-4346-98b7-d15d0456ec79", "value": "12288:aMr1y90Hpkd0i082BPrAA5rQuhLeMR1K0O48:ry2mdm82BP950u9K37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676643346, "uuid": "3ea9dc99-b7cb-44d7-85fe-14d1c3d1120f", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676643346, "uuid": "75107ff2-7638-4685-a8e1-7e9ba45bd7c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643346, "uuid": "17417e3e-2d1f-4c84-86f1-c7851204ec26", "value": "5e147162d8165039f04bec4fa32b2ad3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e8d6f0-ae94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676618735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676618735, "uuid": "ddfc830e-edc1-494c-a5a0-323988fe6dc8", "comment": "Malware payload (Amadey)", "value": "ef17e0b8ee3ed3264524d07373a7ac39", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676618735, "uuid": "56020eda-3e75-43a1-9eb4-a211230d4e66", "comment": "Malware payload (Amadey)", "value": "69d9cd0774b5e0808499e8fc6deeab4e5f033c35019615bb930aed1e3d19c8c5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676618735, "uuid": "4b8eee1e-fcbe-4f45-8f58-5590a9c00059", "comment": "Malware payload (Amadey)", "value": "faebe58a139b35d379df99fe2790fe024ccbe390", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676618735, "uuid": "a0d9b892-063f-4b2f-821a-73f1c575b192", "comment": "Malware payload (Amadey)", "value": "0cd2e1a719816180545f581d7b8978ea8647e2fce8cbc9ce8f8feb41ae4c76c69440def7eec9d374a4be7d1aed4fe200", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676618735, "uuid": "66bc1bdd-10b1-4ef3-9141-df316fde0dec", "value": "T1AE25120BE6EC9032E5B143306DFB13D31A397D514A74C697239E6D9E08B2990A63737B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676618735, "uuid": "965659ed-8a27-4140-b724-0761f5859cae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676618735, "uuid": "340c229d-3794-4383-8e1c-8b0fde894543", "value": "12288:1MrVy90mFFTqRRk5tseVjBEbaZN9rDy8W7GLh4Nx2hi3JPzgpaWVa56H9lbCtulh:0ydrqrksyjBEbEr5/m2o3NzFWso+tkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676618735, "uuid": "3a7da46c-5723-411c-9447-f5d990a9faca", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676618735, "uuid": "a045d70a-d328-47f5-823b-1a9f58d6f5b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676618735, "uuid": "392c80d4-1691-41f1-b97f-d697a5d324e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431f4014-aec3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676638918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638918, "uuid": "113cf768-4e45-474c-8731-a1227a1adcd2", "comment": "Malware payload (Smoke Loader)", "value": "c50c3c1ddbc6630a65ed07d5dab24047", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638918, "uuid": "354a7adc-4fc6-4dbf-8bdd-ba69e0dac5fe", "comment": "Malware payload (Smoke Loader)", "value": "6a068bbd97d4db44109198b8797f7cf54186da1a0012a02baa27875dc9d45769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638918, "uuid": "292706e4-a0ab-4741-9b63-706097de18da", "comment": "Malware payload (Smoke Loader)", "value": "c6309e78ab81ae15ed6200c29ff5307e0e858f25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638918, "uuid": "dc9843f7-2204-4c75-bee1-574f4c14a26f", "comment": "Malware payload (Smoke Loader)", "value": "83ba24899e99b620a11f3675ffc379c4c1527349f7bc3fcebba2cbad7be079b6d88433451942a8c4570aae57bbf29c33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638918, "uuid": "98cc7f7e-f87a-4fbf-b048-cf64afa88117", "value": "T1E914CF3277C2C0B2E2136E344DA0C3B29B37BC608A718D9B7FC517AD5E75282DA64356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638918, "uuid": "eb6eef61-38b0-4516-b041-99ae702bd37b", "value": "31111ee2beeeebc1d1040d6c5884273d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638918, "uuid": "82688a41-75c4-4630-bc97-14fa22200255", "value": "3072:zj5v0YemC5nmJ/257HeGTzK2Df3mMu9mtn8P4uopqZALa52rMMBMinW5PGGSf:z9vn8NY+d+gKu/OmhnpqZALw2rM85W5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676638918, "uuid": "78228650-58df-4c6c-99ef-c1cfb4de152c", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676638918, "uuid": "778db22b-6dcb-4f15-b0bf-c788ed8357e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638918, "uuid": "53007f6a-f066-4079-8b30-abfd605544e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeccf547-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627502, "uuid": "3e8eb6f4-deaa-4a3f-a02e-3f3537d8afdd", "comment": "Malware payload", "value": "8ce637950af71b44469ceda82bd2760d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627502, "uuid": "cc2352b7-dbb8-421c-ac25-e3ac0eb794e0", "comment": "Malware payload", "value": "6a082fa02ffa586c80847f74ac6fa034d41b6d23640d188a95d3c704d44ffd80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627502, "uuid": "c1236624-59f5-483f-9a50-6aeedb50b6ca", "comment": "Malware payload", "value": "9894b67910d3dfe8c0154ff804c472ff37426ed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627502, "uuid": "a2a48c15-93cb-4681-b412-306d089bef3f", "comment": "Malware payload", "value": "d15941411cb0e34dc94ccd8f4f7f4d78016a67c483e85d035f7da10a8e87a43e7febe758aff71f919495023206a1f60a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627502, "uuid": "10d8a011-3d81-45eb-bc67-b8a7c1fb4d1f", "value": "T170149EC2BAC8ACD7D515167895EAC32A2738F7C55B834B034C34B6341E53BD1AF8B52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627502, "uuid": "1cec92d0-9fb1-41a3-b290-089b12ea6e26", "value": "dae253036ba9d710a708001505bd2540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627502, "uuid": "cb068d77-9414-49d6-81ed-456ad1ca0e42", "value": "3072:IUvtgIfB8N3E1aZAH7QPvVwbPLtInQIuBMwP:dtzfIK2vVEIneP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627502, "uuid": "bf47a65d-8bc7-4540-8715-8467acadf051", "value": 206891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627502, "uuid": "f08c1e3c-6006-4f23-8ec4-098f63c1a7f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627502, "uuid": "bf5b0a1a-e2e4-4c01-aad9-c03dfb1a1b95", "value": "Google3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe70c13-aea3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676625484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625484, "uuid": "b9e667f4-fa9f-40a4-90c1-3cf493988de9", "comment": "Malware payload (Amadey)", "value": "c1a88456b85a57e70822bb1ae7a3f429", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625484, "uuid": "f6558f81-149b-4c05-91fb-471d8c9d3a57", "comment": "Malware payload (Amadey)", "value": "6a39275fea5664b586d36f886d12c64e4e2454c76674386463791053fbdaef49", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625484, "uuid": "e0536fbe-7279-45c0-baba-86c0605a4fb9", "comment": "Malware payload (Amadey)", "value": "283b4fb2bfd3ac8d804dc898e80c971cfda9f3e6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625484, "uuid": "09d67e1e-9933-43c1-bdd4-be9909771a94", "comment": "Malware payload (Amadey)", "value": "9f26b6db98147cf88ad7cbc046d2f154dd46e01d36f717cd731cdbbbe779460d8b3f9a61fb3d1d8186d85e9bcddb04fd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625484, "uuid": "1623b2c6-ee54-4fcb-9867-abdae1645863", "value": "T1F625230BF6F45166E8A5273008FA03C31A3A7A521A38C39B375FFD5E1972264793477A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625484, "uuid": "591d5cf6-3781-4758-b3ba-093f9775930c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625484, "uuid": "89a1dcd2-21a2-4943-bafc-de99bfff6805", "value": "24576:EysnJcDtgEOHGhTVm0CZ8e1cJApvmZ8hzrLAFZCOCLT9Cg:TIJchgFG9pu8o+ef0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676625484, "uuid": "4899205e-db22-414a-b116-080f1aa1301c", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676625484, "uuid": "a959b0a6-0cb6-4945-8e20-46eaeb456e04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625484, "uuid": "dfc5f19a-8ff1-4c25-bf9b-d2a0bfe0df88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4f8c11-aebf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676637299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637299, "uuid": "9ebbadb2-fe52-416f-9fc3-1658d7279931", "comment": "Malware payload (Amadey)", "value": "570ef5099feb7105ca15dc8c5d23b1ca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637299, "uuid": "cf350a14-5c59-4b1d-8080-362fdf2c1725", "comment": "Malware payload (Amadey)", "value": "6a8d72db04758222272865d6de34ae351ba376ed1c879efaa72ad1a49ee780b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637299, "uuid": "479cc385-e004-48c2-9b97-8c5bb9c85a9d", "comment": "Malware payload (Amadey)", "value": "8d70d88a6f1973f3a93455f13c89e626fa35cf41", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637299, "uuid": "04d036d7-c51c-41f4-986b-58bf7dfa8fb9", "comment": "Malware payload (Amadey)", "value": "98f2f7492b8bdac8540ae2b37989e59c99ef160d0b7f92843752431e61d918dfcbc1f980529052024ae8b46c680b5e96", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637299, "uuid": "7c1d9cb6-83df-4520-9756-d2a9585a2421", "value": "T1F725231FB2D8C033E471037059FB87D3013A7E905978439BAB4E6AE954B26A5B63137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637299, "uuid": "c95e9706-bf66-401b-82eb-ee888fbdd384", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637299, "uuid": "2d1d111f-196b-4509-9f34-934ae398e5f1", "value": "24576:hye7U2PUoH3RZWbzp+vVdzOGxSNepKiwn5JkQn:UaUQZWPp+vVdfuIkn5Jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637299, "uuid": "af4afad6-0d94-4d76-aaa1-435795dfb37b", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637299, "uuid": "53a6d8de-cb17-4bfc-9475-a17a0e71e188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637299, "uuid": "8cef1475-849c-445b-9d55-53eae5c9f26b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66327c3d-ae90-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676617073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617073, "uuid": "c5afd40c-0b34-4b7f-bcab-194f7e30d083", "comment": "Malware payload (RedLineStealer)", "value": "aa1be85f0ef463b54aa4df22df685380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617073, "uuid": "508b6190-ee76-4298-aef4-4b72ddfa5e22", "comment": "Malware payload (RedLineStealer)", "value": "6ab6b208973ad2f29e27dadd2220cfa595ae35e4779edfb6301e8fcc1cde41f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617073, "uuid": "a8433ee9-687b-4c5f-afd5-32e9ee83c39a", "comment": "Malware payload (RedLineStealer)", "value": "8778c4bac793f213a67d0aae0531803eba13cb3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617073, "uuid": "10c0fb53-7a21-4274-808d-23998c685a03", "comment": "Malware payload (RedLineStealer)", "value": "7011f6df3dfaa67cdd061ddf5f55c10f9695909ab4fda341fbafc58a8047520ff07ecba7aaa5e1bfbfda1a41d806a3f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617073, "uuid": "1fe582bd-2bbb-478c-b098-a4280bbbfec8", "value": "T1BC25224BE3E88566D9705B7098F703C31A333DA12A7857E6238FAC521972370A536B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617073, "uuid": "8d1395b7-7456-4a37-9185-5d5f75362f2d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617073, "uuid": "95dbe263-567f-4ae6-a829-0dd968bd5f31", "value": "24576:Uy2t3BrVJnzMQo4W9tnbidnt3QyCCTO8JfCnUd4R:juBjnz/3cN/CTO81f4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676617073, "uuid": "856b02be-ef44-4fe1-8ad2-4b7c6d4f5a63", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676617073, "uuid": "c354ac9b-3dd2-49f2-896a-c1ccc9d5480d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617073, "uuid": "1b3a029b-298c-4816-9a8f-0d1e2a57316d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb08c4d1-aea3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676625456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625456, "uuid": "1b9ca639-1f2f-47bf-82fc-50196ce9abf0", "comment": "Malware payload (AgentTesla)", "value": "e1987cf89ff22b3e89d60976cd5241ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625456, "uuid": "d5c42a38-8fb3-44ee-995c-3e895a21b497", "comment": "Malware payload (AgentTesla)", "value": "6b3266f6f3c9022adc65b15b1a19496fca47c7bb9b2adcd5fcc60ed29d40d068", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625456, "uuid": "a0058cc0-d45b-4717-b11d-a53c4a73977e", "comment": "Malware payload (AgentTesla)", "value": "ad379c17d002b78422e397edf18c3c10eb0fcc51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625456, "uuid": "8b4a27ab-854c-42bb-a7a0-cda16dd05192", "comment": "Malware payload (AgentTesla)", "value": "235243fe0e10df9ab7ab9bc693d2574624f5576ad60c069bc1d10566c68f2bd126926542fc490544ace2ec036fef1865", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625456, "uuid": "2a3be9a9-dfce-4746-89e7-d662ed9479ab", "value": "T1D35423422E0620DD93EDEA8EB3F453B75D2E08ADDE879702CAC83155175EA287744B3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625456, "uuid": "bc05c0f6-6b80-42c4-8701-4d03778fbb18", "value": "6144:DStT2Jh10nxJHczyOxycZuuybjBqJvOeEwMu55s9b1tNMUGWHnglKehoBjDtc:OtT+kHcb9u5ovOVu556ptN5Hngldii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676625456, "uuid": "1c46ff13-c90d-4189-b394-30c0b28460ca", "value": 304474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676625456, "uuid": "06b3cc2b-b53f-476e-b589-75daeb1e62a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625456, "uuid": "1cda54ab-4667-47b3-867a-adffb33e7b76", "value": "ASIA SHIPPING.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8428b69c-aecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676642463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642463, "uuid": "5aa179fd-d338-40b1-bcb3-a4a6b3f2e29a", "comment": "Malware payload (RedLineStealer)", "value": "3dc7a9c16bb73e836aa60454c0eafa17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642463, "uuid": "43910ac1-c256-4311-88cc-80ef58346845", "comment": "Malware payload (RedLineStealer)", "value": "6d46ad01e2ade1d2007221b4f41876e8569c560d6b745712e3607ba1299928a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642463, "uuid": "84915510-b4dd-48b8-a43f-eb7f345dae97", "comment": "Malware payload (RedLineStealer)", "value": "fd45fa91219ac82bde74da3965e11bf3f69a985c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642463, "uuid": "38d44cab-e436-45a2-9a1f-26f9f3edba75", "comment": "Malware payload (RedLineStealer)", "value": "086488fabc3afa6bc5e04de179708fe33cc6f02ad67bcb7dba844cc8317d54bfa56f9ea88c0259b245d9f0d7a0109d96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642463, "uuid": "4ca74887-b0d4-421b-a6fc-240d6fa56f74", "value": "T1E854F13237D5C0B2E1235534AD61EAB28E77B8605632889F3FD9056E5F392D2DE24363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642463, "uuid": "e0fc183e-9b3a-4792-877b-60d999c0982b", "value": "9d64e6a2a7bb4f74b24f7b7e42936433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642463, "uuid": "21aa7a4f-938e-4acc-874e-49af4ee4bbf4", "value": "6144:/hg5HV/6ok2mFcwDK4qm3fx+PXKzzRudmzgfgC:/hkl6oW93f8PXKzludmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642463, "uuid": "7925edf6-e600-441b-9e28-633e28469146", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642463, "uuid": "9bce4547-60a2-4a9b-b6af-cccf3e7d8d3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642463, "uuid": "0d1c3f00-4c0e-4157-baff-483427789280", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51dbf00e-aeb6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676633359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633359, "uuid": "0091f7ea-676a-4c72-b1e7-c292c9a4e89b", "comment": "Malware payload", "value": "a7e47ca8c954e9b5272c491272f78d17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633359, "uuid": "58d8a383-8a93-4a59-9cf8-7dfa153825b1", "comment": "Malware payload", "value": "6d5d2824309b54c8c79a7691945f483394451a9362d9f470676f357f5416d26b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633359, "uuid": "4da22673-3f80-4361-996c-08ddb5add6dc", "comment": "Malware payload", "value": "c2093486472bb7ac501083b0470a05f8b35302a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633359, "uuid": "6725fc06-3e97-40b0-b1a8-fabb401acd66", "comment": "Malware payload", "value": "6561edb525e2f71622643562bdec5fd319f4b213d24c44b6c26c74576185e19742d7b220d5424242bbb58d293288ef20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633359, "uuid": "389b391d-8b0d-4abe-81a9-8d9e6913393d", "value": "T117F41257FBF94032F8A5133029F602C30A36BEA05678D786378EAD2A1C71664E53577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633359, "uuid": "a1992c22-1625-4f07-a5bd-bb131469741c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633359, "uuid": "446911ed-0a40-471d-b213-b5e4d0928014", "value": "12288:xMrAy90KJRg1gAU8IIQnuxUeaRuo3Y7bZQxfIpu+i4tHiIL:9yDXADQnw7WutLuMtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676633359, "uuid": "812e346d-dcd9-4097-81b1-e47fb2b64962", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676633359, "uuid": "f8ec50d3-2f49-4ac2-b63b-6fffb4664b1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633359, "uuid": "49814769-a4a5-4cb7-a662-b92706b6cb58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d020965-aeca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676641995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641995, "uuid": "6b055cdd-e1c9-4c61-a8cf-91336d0ade62", "comment": "Malware payload (Amadey)", "value": "619f44eac5b8e3effb683b3969d2224b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641995, "uuid": "e4a57791-0a64-4614-883b-00b9007d740d", "comment": "Malware payload (Amadey)", "value": "6ea4fcfb94fe7275fadbd98793dd53187c0edb53858994be4537c0b3a49a0003", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641995, "uuid": "47fd9044-28d5-4e23-9c49-07bb399d465d", "comment": "Malware payload (Amadey)", "value": "b0d80ce5f8ba98f70d4e4f9fbf9613c073e581e6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641995, "uuid": "3a63c458-502a-4f30-9baa-80831deb722a", "comment": "Malware payload (Amadey)", "value": "254f37f0590398d87bf3de66d3082d2b01a6abb582fda7d860b5ea92f60f3f94fcda8b5e992645ae5c48a1ee7056f220", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641995, "uuid": "38f1ea08-e397-4060-99d3-8082ade4ab80", "value": "T1DD152307B7ED8051DD7167304CFB02831A38BD219A75C69B234BBD9A1C23278B675B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641995, "uuid": "93da3067-c144-4c05-9d76-8ad4ce5a5ac7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641995, "uuid": "e74df228-abd5-4556-ae00-f8408227bf1b", "value": "24576:zyz8GroHxyHpmdHACeoVArTT3hz9as4R:GIGERqpGQoiXB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676641995, "uuid": "0c6675ce-a654-469b-82ae-274f91a4b9fb", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676641995, "uuid": "8edebb0f-f4f0-46cd-b5ff-bb2210f6575c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641995, "uuid": "108bb6ba-5ba1-4a60-987c-275c6475dce6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5dff4a3-ae98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676620723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620723, "uuid": "6d6c201a-c333-426a-8148-ff6b98335610", "comment": "Malware payload (Mirai)", "value": "c4fcc2207cd77f049de1dc8ff2c7e9f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620723, "uuid": "fb2ea5f4-69b5-4dc2-ad93-a7c22050881e", "comment": "Malware payload (Mirai)", "value": "6efc200c7c2c48735bc3262eaa3e946888064c7dcca1f64b5abf8e544393fa57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620723, "uuid": "32a3673e-c822-42a7-b7eb-67317317d8a8", "comment": "Malware payload (Mirai)", "value": "f16eec47877ba313cb7a2f5d426d7f4c74daa56f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620723, "uuid": "9edde8ed-8e7f-4a2b-a44f-964fb3a7de8a", "comment": "Malware payload (Mirai)", "value": "6215266c7faedcea6740d5f1d09e75eb28937b10a1a20ffca01f57fbfd4023188f6540a677b19c1206aacd0ecfa97be6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620723, "uuid": "e193ea52-9b32-44a3-a35a-de89b5714de2", "value": "T1DF133C42721C0F17C4A35A70253F5BD087BEAAD032E4F285665F9BA68A75E371482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620723, "uuid": "159bac73-a83d-40bf-b99a-ec06b20a3898", "value": "768:g40J4bzio9RfQRW0qRGQ8Jt8hTVsBWltn2susUzFuMtdW4dLFrwA:70JOC+QqhTxxjTMtdFLKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620723, "uuid": "c46736ae-a06e-428d-bb9c-37ad84e55b9d", "value": 43780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620723, "uuid": "faabbd98-2992-43de-a4bd-732abc4a1312", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620723, "uuid": "2d177f7e-7d35-4b6f-8448-5483142e37e1", "value": "c4fcc2207cd77f049de1dc8ff2c7e9f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a217cc3-aeb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676630662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630662, "uuid": "0b94ab1b-ea12-426f-ba4e-14c14d2ba350", "comment": "Malware payload (Quakbot)", "value": "2be2cd393a9d7578131fe5eabb99783f", "object_relation": "md5", "Tag": [ { "name": "1676480611", "colour": "#574C48", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630662, "uuid": "71e754a8-1f0c-40f1-b765-16263b1bde24", "comment": "Malware payload (Quakbot)", "value": "6f99171c95a8ed5d056eeb9234dbbee123a6f95f481ad0e0a966abd2844f0e1a", "object_relation": "sha256", "Tag": [ { "name": "1676480611", "colour": "#574C48", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630662, "uuid": "5e2969f6-d492-402e-91f5-0decc1652a06", "comment": "Malware payload (Quakbot)", "value": "07a99718631d3244f984cf2c124e762f05f4f867", "object_relation": "sha1", "Tag": [ { "name": "1676480611", "colour": "#574C48", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630662, "uuid": "c26b7902-0657-45f7-9b62-7ad887c0176a", "comment": "Malware payload (Quakbot)", "value": "f91c1c29da14574efa4ecb45a910baca42e1694c6288d505d6f6ab44f424cc64e35254432eb18e4868f6c5942cca10f9", "object_relation": "sha3-384", "Tag": [ { "name": "1676480611", "colour": "#574C48", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630662, "uuid": "980d9805-0233-4a5e-bc51-e31f25d2e804", "value": "T1A9647D17E10391B6C8573BB31A1B94EF3254E70180306F6EEEAC4D24F33A5219A7967B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630662, "uuid": "d1de1ac4-26c0-481a-8a17-8cb1574ab06c", "value": "7be7a3567658ecc96c7ff1ad89521da5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630662, "uuid": "d2eebbc8-eef8-46fd-ac43-a21c2e17dd73", "value": "6144:kpM9pxmZSH9Zr2gHttAu1ly45YlZ4VHlE4dplW4BKlN4k1GGeH0IALPdpABjx62r:kp8xmZSH9Zr2gHttAu1ly45YlZ4VHlEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630662, "uuid": "3a8add74-6452-45ee-ac99-21bb31a1c870", "value": 313224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630662, "uuid": "5e63a422-df0a-4973-8190-2b151613b0b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630662, "uuid": "353c4159-8e02-4964-a391-e4341c42c2af", "value": "fd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fd705f-aef1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676658982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676658982, "uuid": "12e6a5e4-acff-476e-9380-e78744da2d83", "comment": "Malware payload", "value": "e1772639532649955fe4475431d14d98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676658982, "uuid": "518343d3-71f9-4fbd-afc1-99861b3b734b", "comment": "Malware payload", "value": "70831d26ad851895720e6422c3d6213b4a847257d105e4eae96adeb93603eeee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676658982, "uuid": "50e0e6f3-0c04-4069-9b24-afdda19b9a89", "comment": "Malware payload", "value": "058f1c16da70c9d68198a88d9489ba6939d6a011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676658982, "uuid": "265fe2be-ca20-4132-b9e3-6a3e0abe3bbe", "comment": "Malware payload", "value": "58e45c8901fe2f0781e9012dcf02b7e84f1985f99aa9ce03cbf108e15105c822f22fea3af16662e03a565d311dd1dfd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676658982, "uuid": "11954e16-eb67-46cc-a7ef-21efa149fb41", "value": "T127E3D02335E18073D03B59306C74D1B06B6EBD5DC6B4898B3B98162E2F725C29B7936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676658982, "uuid": "3b87f562-0626-46e4-90a4-989ebaeebfb3", "value": "8cdad4eae189848d90763fd3d82d253c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676658982, "uuid": "d431f866-b564-414c-8ff1-d25029e746db", "value": "3072:HTqFUylxVzL0/bRTPGSsH+04MFKS+RWTqd8004QB:H2F/lxVHMbR7U+0pKS+RW2H04Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676658982, "uuid": "6b137504-8123-4037-a2cb-6ed0497bbf87", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676658982, "uuid": "dbfab694-ae08-4b83-965e-2a3e05dd657a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676658982, "uuid": "f91b31a9-a775-4864-8d67-0aa3b90a1526", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09df71f9-af0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676669746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676669746, "uuid": "b4527451-e868-4caf-996f-62797d0c9ef6", "comment": "Malware payload (RedLineStealer)", "value": "50a1c40be39a40ea4878e1d93528e0a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676669746, "uuid": "9ac45932-601b-4aa7-bef5-96a4ec45504b", "comment": "Malware payload (RedLineStealer)", "value": "70a4e7f71a5cbc724f49237c5751c2cefce8c07ad8845b993002036c46dbbe51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676669746, "uuid": "035639c1-e2ac-4939-8f3e-5601215ed523", "comment": "Malware payload (RedLineStealer)", "value": "926a1490928a383c0dc20d2649f5ab1f9a334043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676669746, "uuid": "8cf2e846-4463-40e4-a784-4879df94921f", "comment": "Malware payload (RedLineStealer)", "value": "d19518c9229acc70046bdc08bf126a18a1d3a684513a896a9ba4d47389da6ce8f97e1048477d538d594866a6e561178c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676669746, "uuid": "8fd666bc-9893-4b87-96b1-7d1f4081b0b7", "value": "T13814944CF39AECE8FA6A0339207104162FA09C5F6495AA5D25CDF6663D36342409BDFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676669746, "uuid": "420bd0bd-2e8e-4948-b813-3aeac6fb1736", "value": "3072:xkhzz9K3UdJST3jUDLIDtV/vbDhSLS9pKJP7w2pN+:xkhzz9UzpyN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676669746, "uuid": "15a97e4a-a3ef-4f70-805c-7d3675fa9e67", "value": 202154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676669746, "uuid": "82616733-4764-43b6-928b-ce552e8987c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676669746, "uuid": "e1e0e9ed-b4f6-4c9a-bd40-7d7da3a5fa3b", "value": "50a1c40be39a40ea4878e1d93528e0a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef84fe86-aecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676642643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642643, "uuid": "5a6e7dbb-7842-4621-8cf5-8ed5bedc38f4", "comment": "Malware payload (RedLineStealer)", "value": "d1af3a759554270530d318a9ab85be49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642643, "uuid": "4e32ea25-a521-4c7c-bed8-fb3bad5bc5b4", "comment": "Malware payload (RedLineStealer)", "value": "711e3aaa29ad4bb5581bff65bf3e8d67c4afe4a855dbbe19526cbb1e7f6e0992", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642643, "uuid": "126ae104-6ec8-44a3-850a-f073f89b2ebd", "comment": "Malware payload (RedLineStealer)", "value": "bf7e9eea6cf83addf53aacb87ce6885733f76296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642643, "uuid": "d169e4d9-4a71-42d8-81a1-a85609043a0d", "comment": "Malware payload (RedLineStealer)", "value": "79ee1837cf0b6501766ddc85140aa717109256b68b2223cc1183be223b5ca3fc15ce29299b936e16b83a4945979706ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642643, "uuid": "f8727e2c-65c1-4e5c-8978-77f48362c74b", "value": "T1B815234BE2ECE022E47543301AF703D306397CA05A758797378FA96B2872664E53776B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642643, "uuid": "4f4a9ca2-8789-42c0-b57f-c8c8368ed80b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642643, "uuid": "d652e911-ff59-4d32-8829-60a31b20f1dc", "value": "24576:yyNpSozOkpNawYqxwQxjD92fnVfNMXY/QzVVzUXh:ZNpSoOkfa3+lD92fn8hzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642643, "uuid": "7b47faed-c40f-4035-925b-aa646a8e34c2", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642643, "uuid": "bdb056ee-8993-49c4-9da2-401ce92972fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642643, "uuid": "76bf82d6-05c2-4e99-a66e-f9dd1cc0d8bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c728a92-aee0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676651497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651497, "uuid": "3f147a41-c0e6-46f1-a105-834b66542166", "comment": "Malware payload", "value": "ef233adc05bb42781d22010115122126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651497, "uuid": "d57d9bb7-f096-46e4-be36-34b74b5d74a4", "comment": "Malware payload", "value": "712bcc3d0a8a8629637e0d2697dcd72bb7dac1563db6314f587ae8f93d141efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651497, "uuid": "d7038d8c-172a-4d16-94df-adccc559ed38", "comment": "Malware payload", "value": "4a979620a7c69aac98f98da6135c95a851f47b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651497, "uuid": "9d9ebb63-c2e8-4c37-9108-a8c6717a695d", "comment": "Malware payload", "value": "80c6f46731d1908fff18303a074971d0b0fe7fcb0e448810444a2a03d9a20ceda3f82833c78d40a873a3ed7dd34aa2be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651497, "uuid": "8d791ed0-84f5-45a2-9bbc-d0d3df487eb0", "value": "T1614401223BE0C035E85717305874D891A77AB8226575DD9337182B6F2FF05C27B7A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651497, "uuid": "348a86d2-c0a8-4f79-9660-6d22971643ee", "value": "8cdad4eae189848d90763fd3d82d253c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651497, "uuid": "4e725aa8-783c-4f31-9ba8-e3640b9a2e5e", "value": "6144:AA4LjOHQA87t3Teu8KjeT7POhKhiNDKPSMmvDJsOuCNnpcg:AAPHQTLwrGK4Y6s8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676651497, "uuid": "f81017e6-838f-4ea5-8d77-29befa21de5b", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676651497, "uuid": "c3208d35-0de0-4dcd-b287-2389b6649ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651497, "uuid": "e7c0df41-edb2-4871-8975-ccaa636789d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec731e64-aed1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676645215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645215, "uuid": "0b15bbd1-7ae8-4118-9ea1-2246710741e8", "comment": "Malware payload (RedLineStealer)", "value": "bdc1adad721b74f6ade4b35e822b8f64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645215, "uuid": "4d97bf04-6b43-483a-84a5-d9b87989006a", "comment": "Malware payload (RedLineStealer)", "value": "716b0374e1cc500e077f59d1ef2ac24b956495dd2554f2953ba539e71daae747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645215, "uuid": "ba0da6e6-09a3-4d0e-a083-aceecc48d937", "comment": "Malware payload (RedLineStealer)", "value": "8d0f4553986bcb9399c3f487b6a24293d297891b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645215, "uuid": "02f1b371-6466-46d4-b7b7-2e495a921851", "comment": "Malware payload (RedLineStealer)", "value": "7a2c0615bf9a2de4bebc1d809fdb465b5ce46aba40e80bb9d8143ef49fcef69bd61bf1675c52fa29f293adcdaf35325b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645215, "uuid": "16d38aca-8ecd-4891-93d6-ee4d7b95af40", "value": "T100E53317FBC84031EBB1233109FB42D31B36BD5326289E2517156CEE2CF15E5A5B2BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645215, "uuid": "651f3764-bcdf-4084-b018-5cddd00bef36", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645215, "uuid": "8661146d-3072-49d9-bd4f-0152b131410a", "value": "49152:bMcIqMOE1oxSZUf/WB4uogXrsmFuURyejm3lDhcFDTZcoe9Qk2ef5bhWG02Tsm7:QO0oxuUf/WB1FHRVm1DhiBe9Qk55boG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676645215, "uuid": "de6f935d-8df5-4e35-b593-a79f0e2f5c9e", "value": 3124736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676645215, "uuid": "794c5094-50b9-42c0-ba08-027cdd0a5601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645215, "uuid": "125ddc09-126f-407f-be2d-f7d014e5e57b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7272717a-ae94-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676618811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676618811, "uuid": "82ccb8bc-394f-4429-8ce6-d34624413dec", "comment": "Malware payload (RemcosRAT)", "value": "ae9a910e4fbecb7e8cd61ae5f7a04190", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676618811, "uuid": "e5753306-9b84-4ce8-9432-148b2000f7be", "comment": "Malware payload (RemcosRAT)", "value": "7256a2d587016004497f06c9e4911789b13e4ad91a87e9b4216418077df0ebed", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676618811, "uuid": "8b0bd04a-94bc-4294-abad-3518d40140c4", "comment": "Malware payload (RemcosRAT)", "value": "49393a691e9b0682eaab5aaa53d5a55879902cdc", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676618811, "uuid": "6067173a-5118-4bef-9fc9-c787cdfe66c6", "comment": "Malware payload (RemcosRAT)", "value": "021d8102e5bb2d699c6dfd181b9ea16efdc6d71f1337efdea6b4336592852e76b3a20f7bbd38d8c831109cfb6a38176b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676618811, "uuid": "440767d2-e8b1-4d15-b59a-bcfbd1c3ec57", "value": "T11AB42307A7D8FB086111354F0DEBF3F31A569D264B76C1D1318AC9997E25902F28ED8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676618811, "uuid": "f7df4844-e113-4f3e-acd9-6f046185ba98", "value": "12288:WpH4IAmy1uL1vvjaqp7TFFXl0D2EoejMRlM/AE:CH4I1ygtLa6X1Hpyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676618811, "uuid": "a02d4b2b-b1d5-417f-8c44-cb6a4973ac4b", "value": 521552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676618811, "uuid": "22f000b0-c938-41b3-b098-ce463565255c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676618811, "uuid": "6a327804-047d-4c74-ba26-03e29960ba59", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96217f70-ae91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676617583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617583, "uuid": "9ad3d29d-332f-4a9f-a70c-f7087d30bd91", "comment": "Malware payload (Smoke Loader)", "value": "3c93393552cbbfdbeaad9c41bad26cae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617583, "uuid": "16e1b0b3-cee5-4fc0-8a93-f9cefc3f6ef1", "comment": "Malware payload (Smoke Loader)", "value": "73aebbe852a944dd455825a735207848a74df9da0faaf611c5e5a34d4cc1e4a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617583, "uuid": "333838d4-f612-4405-8d1a-42334212f5c7", "comment": "Malware payload (Smoke Loader)", "value": "f7fa40daad595b8c1c3da80ce9267e10eaaf1fed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617583, "uuid": "405746bb-2dbd-414b-bb0b-32e69b253f8a", "comment": "Malware payload (Smoke Loader)", "value": "cd555d0ea8f5102d3d63cf9459d708507720cd9cfbfafe2211f724c2e74d078fa5c24856d8f7ee385baca3db807f9acf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617583, "uuid": "c52a5c7f-7c47-4325-ac37-6ca0eff6bf8c", "value": "T13D24C02333D194B9F12346354E22D5A46B2BFC718E75BEAB3F88562F0E752D2C616312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617583, "uuid": "be475759-fc30-4e64-9d34-2cb57acb3a5c", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617583, "uuid": "97c17739-1c41-455f-83e7-42dee7af7ec7", "value": "3072:s7/wNc9xQ3XpyzDdAJAuzW6LqA/5wpBf/qCV5/xymCiE97KFDB:s7YNBIzBCAMWKTwpBqCV5stKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676617583, "uuid": "5791dc16-233c-4246-82ff-2bf406aef51c", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676617583, "uuid": "54fde466-9856-4f71-b00f-37b47a2bd134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617583, "uuid": "4244f6af-68b4-491d-8a29-2fffdabee41a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4766813d-aec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676639784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639784, "uuid": "4dab66c0-0fc7-4306-bb42-859c03c4e84b", "comment": "Malware payload (RedLineStealer)", "value": "757bfb569ec91f84dd3aff09d9488339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639784, "uuid": "87c5e31f-e154-440c-a007-392a94487053", "comment": "Malware payload (RedLineStealer)", "value": "73d67453a6c2ca61e3e4cf061ca4e80da3a580012231397ba28ed694a31ff6a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639784, "uuid": "76619a89-acaa-4dc7-9243-b4dd6408b4a6", "comment": "Malware payload (RedLineStealer)", "value": "879cffdf4243a2735ab0a40274dbc5a929c11989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639784, "uuid": "93e5e7d5-e686-49df-867a-32ad81608302", "comment": "Malware payload (RedLineStealer)", "value": "360b64457a208b2bf484c90b7f6e34228afed0a0f581389cdd405307d891dcb0947a84999ccc19d23c468780ee79e601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639784, "uuid": "2c248578-410a-4cc1-8ca3-2b05f3502fe4", "value": "T1F3F41207A6EC8463E8B0573018FA03D71736BD925B388797278B6C1E0876694F9357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639784, "uuid": "aa157f33-c139-4b32-9535-0fc6484c1a97", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639784, "uuid": "80b5a413-043c-4bd2-8f17-bea862a84713", "value": "12288:lMrvy90Z8d1y3hKC5DF1LJY3b1nkIm1THkXc/W1V3ponpXRuzwrbUSk:SyRLyRK8F1NYRk7X+1VBzwrbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676639784, "uuid": "f3f77527-df20-477c-a9a6-027b00e51f55", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676639784, "uuid": "df91c5f8-b010-49ff-b63b-48ce2887c4ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639784, "uuid": "9a9d5dbb-9470-450b-aba1-8b7434b910d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59ebbe8-aee7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676654599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654599, "uuid": "2e8879d4-3547-4929-9792-b743d4fa407e", "comment": "Malware payload", "value": "c3bbb6777a96937c65949299846890d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654599, "uuid": "6e244a01-c72a-445d-b7c3-65ba1f26528d", "comment": "Malware payload", "value": "73df61e5b857a42a63edb57a71aba2892a731048fe91c8b9d3e40d989a8fdcc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654599, "uuid": "160ac38b-de0a-44ea-ab96-23653217b829", "comment": "Malware payload", "value": "e1ff5b06bb99eecc2904237d642de7a45a6d8d06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654599, "uuid": "ae16a88e-8cf8-4e1b-b6d4-8f9d41a50784", "comment": "Malware payload", "value": "e20713730051fe954a4b24e6f0f7d4d7c7848b2fbda49947cc1b1b412121d57a477a36c2ae853d7d0972ef22cab76e8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654599, "uuid": "2450e742-df13-479c-8b94-55c681208fa7", "value": "T1EF76231D8C22EDABFFE3D5F19CAB86E45B106F3D6000ABA713A1A8754B2CD17449C578", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654599, "uuid": "699af526-9cd8-462a-a4d9-f16f393c1504", "value": "74737a1c73116b0c6a3ee2f6399e6458", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654599, "uuid": "5e8f1e4b-0982-4a28-b0a0-260ae6271c96", "value": "196608:MDANPFmCV+OoxomMRb4MGK3oI8XY2OqjoRE:M0HPE+7GK3oVhOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676654599, "uuid": "508dc059-d9bc-4cd9-9979-45a3ce00744d", "value": 7182408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676654599, "uuid": "ee86cbc8-200b-4cc1-9150-b901649f7e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654599, "uuid": "55f66d58-ce45-4560-b842-1243b7c888cd", "value": "c3bbb6777a96937c65949299846890d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0369c826-aeb0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676630651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630651, "uuid": "db752c3a-e525-408b-90f1-5267d4562cb5", "comment": "Malware payload", "value": "37fc4a4b5a83ac6e9985307bffd3e938", "object_relation": "md5", "Tag": [ { "name": "1676480611", "colour": "#574C48", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630651, "uuid": "6e18647e-b8d8-4c04-a7b1-5ec1cba03138", "comment": "Malware payload", "value": "7427d5bcdd548f6bc47b6f776f1f157e23619be3814d3da7c0f0e234306fb39a", "object_relation": "sha256", "Tag": [ { "name": "1676480611", "colour": "#574C48", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630651, "uuid": "36309d35-e924-4885-aaa0-d61e1480f9ab", "comment": "Malware payload", "value": "23b600c3d73225540d8e2fc23491060fe7fcd8f7", "object_relation": "sha1", "Tag": [ { "name": "1676480611", "colour": "#574C48", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630651, "uuid": "1dd419b2-a304-4d39-9c98-66dfcab5e08e", "comment": "Malware payload", "value": "7c43bdf443199a01729a096a722e945fbe97e9ade2aed3fb993ce039132763a835a22d54a02de96cd1a37d7cd7f07ecb", "object_relation": "sha3-384", "Tag": [ { "name": "1676480611", "colour": "#574C48", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630651, "uuid": "0ecab555-1d35-45d3-9e2a-88d229d2c761", "value": "T1FCE09254BCE9D119B0120B5FE1B088CAC455D04052DE981473CD5A3E7A246E447DF038", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630651, "uuid": "a3db8f14-e734-4ec5-9e9c-96bee1b924a3", "value": "6:+LeDFsa/CsQZlZYapgYZUAZBMa7oy/i7Mq0N9DgqlFHfBbf3FD9BaFvlGjMeq:xWa6TZlZY6gYZZZSkA10XDgqvpb3FPaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630651, "uuid": "40026858-b040-415a-be7e-2345175c0295", "value": 380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630651, "uuid": "628f02de-0083-454c-ba28-8fb216a9fdd3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630651, "uuid": "e1d449c7-70ed-4cd0-94cb-c6cab3dde300", "value": "Open.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c050c80f-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627532, "uuid": "5f38f563-68bb-490f-b3e0-fbc3b2e6f505", "comment": "Malware payload", "value": "0f216e0a1230d3191a7dcf850ad97a07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627532, "uuid": "83c34514-dbbb-4c95-b206-f4b1947f3c7e", "comment": "Malware payload", "value": "742c9cd92357f84181104075fe6db25a277d8464c13521fd62def965097f5841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627532, "uuid": "f94d3e3c-b6a9-4e22-9f85-4a460387fcaf", "comment": "Malware payload", "value": "79e4843b7afb3428e662d2e3fe1768a692b494cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627532, "uuid": "ce1b1cf0-006f-4fc9-a434-26ba74e4069a", "comment": "Malware payload", "value": "004e8e56b54c156380ff6e96cf3f44cd5e425ec6ddc0aec1e8efec4cf29fd93ff8443f2c69c21fd8bb2b2db3aa2087ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627532, "uuid": "4cf2f01e-d4fa-4b76-b5e5-197eead49b17", "value": "T114148DC1AAC8ACD7E516173895AAC32A273CF7C54B838B135C34B6350E437D1AF8B55A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627532, "uuid": "168c3e58-9c1a-4cad-9c42-e6cc0049c7a0", "value": "dae253036ba9d710a708001505bd2540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627532, "uuid": "8680e9a0-df61-47a8-80b2-2befa200b6b9", "value": "1536:3XXXkiFJaW5PABja7y37zhQ0XSxCCs2ELGgYS5tLsQUsWetCjhjwfFY+h+LuhNgQ:X0iFcja479Sxps2EMYLpWlUIuUnIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627532, "uuid": "f0542951-be85-41e3-b8dd-20a4fce68c03", "value": 204331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627532, "uuid": "c230127c-905c-4a7f-aada-155cd2981ff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627532, "uuid": "7d4377e8-3459-43ac-9a59-530a1e700af5", "value": "haeds.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a514a6c1-aee7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676654544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654544, "uuid": "f8abf5c3-b1d8-46fe-bba3-42ca2516309a", "comment": "Malware payload (RemcosRAT)", "value": "c04b61b8d6b044141def409be3b41799", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654544, "uuid": "16085e97-6dc3-41d2-b0c8-9e6f17cd6b01", "comment": "Malware payload (RemcosRAT)", "value": "747964e61e42b5bd725ce362faf6400d946fbafec8f6129635f3536af4eea0bb", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654544, "uuid": "4475b8cb-f9e5-4f54-b7bc-28b97e8398b1", "comment": "Malware payload (RemcosRAT)", "value": "cadfedc0f6358978505e84bd5fc84db69a797153", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654544, "uuid": "7df792d7-c99f-4df0-92b1-0c2777be8c46", "comment": "Malware payload (RemcosRAT)", "value": "ccd79fe0a78edd896143ef58fc6e617cafd216f5fe19b71b1635bede3b8be6c6ada800c312d0ab52dd24ac0cdb703df6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654544, "uuid": "12545f4b-f6e4-44e3-9856-531d625f1b13", "value": "T1ECB423C920FADCEEA2C993FA7743669291B04AC776B80632E5113403C948E35E756D37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654544, "uuid": "0b081d9e-cf87-40cb-b5ee-4e2c1367f2e8", "value": "12288:pcL/nBopwvsm6u+JYylqWgRZHzopVh2mK72HHpndYS+78O:KLPRdw/pgjHzoZdpndI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676654544, "uuid": "31e3bbfd-1095-499b-aebb-ca068d2f7b2d", "value": 527814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676654544, "uuid": "d42c1636-f9be-4690-95e4-00df4e1e781b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654544, "uuid": "2572478a-dd73-435b-bdab-8cddb061c113", "value": "doc2023021700999000001.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c32ddf-ae63-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676597911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676597911, "uuid": "0431777a-4184-4a9f-8107-db588fbe8e09", "comment": "Malware payload (Amadey)", "value": "3f5815589194da5f86178a63c03b0037", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676597911, "uuid": "f25bfdf3-a39c-4392-8cc3-f9309aeffc25", "comment": "Malware payload (Amadey)", "value": "747c1eb3e393b781cee20aeecdcdfd153e0444fc79ab33628a6a852a23c90a2f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676597911, "uuid": "25b3b112-a225-4ebf-85cf-9190b7e90481", "comment": "Malware payload (Amadey)", "value": "34d10c7f1b2c36d91a05cc0f758e4a3187e6d03b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676597911, "uuid": "8554169e-09d6-4249-8a85-c1d1796cd200", "comment": "Malware payload (Amadey)", "value": "ecee082b0726ac02c2818c629c7caa169e0af8ac543f620bb45ae78d4a92ce4a202e0e769c405939def89f7ab82aaf46", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676597911, "uuid": "8028cf39-32a2-4fdb-b25a-637e754a6163", "value": "T15A25235BA7E49532D8B043F148B313D30A36FD926B79838A27DEAC6504721B4A73176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676597911, "uuid": "6aef1b22-1678-4026-a06f-7ebed49d40ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676597911, "uuid": "20a1f1cb-d89b-4336-925f-7c91acd89f47", "value": "24576:pyziHVGEaZxitKvnz2VjK3C8JEq3IJ0F9:cziHBumKvnkK3LJE5J0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676597911, "uuid": "3e7406f9-0b70-49d6-a84d-1010271adec1", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676597911, "uuid": "cb321574-bfb5-4ee7-9604-c27adf74f0d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676597911, "uuid": "1ea07f3d-3ee8-4fec-a780-2e827ffcded9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d86bb1-aef2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676659317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676659317, "uuid": "b8360f29-85d9-4675-8288-608bd1f376a9", "comment": "Malware payload (RemcosRAT)", "value": "af7c8e86658941ff3f84682ef98dd082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676659317, "uuid": "e27a4a40-fa67-4f5f-811b-a460db3f583e", "comment": "Malware payload (RemcosRAT)", "value": "76005c1982c2d4df1995d8ba0e2163ac84b5009823466b9e043a5a017e15c9cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676659317, "uuid": "734f95e8-5417-43b7-8925-e0e81c91f59f", "comment": "Malware payload (RemcosRAT)", "value": "3438ba93ba8ccd8ff84c1e38f3569e47a5a381ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676659317, "uuid": "eacead0a-db5c-4d57-bffa-648844db7269", "comment": "Malware payload (RemcosRAT)", "value": "0ef5b58b9efe4707080a7685b3a7fb649684ec6b0110c9df27bb68b8b82b02528510df69021ba630737ed88a0662995f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676659317, "uuid": "016196f7-8fd9-4478-8f2c-3dd87ac2ea4b", "value": "T100E3D01236E1C071D22B95305C74E1A0BA2F7D719375CA8B3B58136E2FB16C22EB53E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676659317, "uuid": "5df92985-7933-48f9-b9de-5693af9854c6", "value": "8cdad4eae189848d90763fd3d82d253c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676659317, "uuid": "9932860a-8c58-49fe-9eb6-7681f4951ccf", "value": "3072:6z8H/UTKpWVEWLzRkyFjg13zPkbmp0qIckIMXxME:6IHMTKpyEUCMwgqp0qvRMXxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676659317, "uuid": "352fa1fc-6d85-4f72-a272-c372fe958f1c", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676659317, "uuid": "7d38f23f-83ff-413f-9b22-4742338f2215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676659317, "uuid": "076e20fc-6c8b-4969-959f-878f896f3ed4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381d6d9b-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676627303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627303, "uuid": "6aa0c71a-1e1b-45a7-b8fa-8b335a1b1366", "comment": "Malware payload (Smoke Loader)", "value": "9580c6111a654ee87da0d1e5a41d64d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627303, "uuid": "2fd4fc0b-c9de-4c1d-aef9-17e18a60809d", "comment": "Malware payload (Smoke Loader)", "value": "77b57f2918cad8432979891872b6ee6951aa17fccf7596d5897e629b47fefed9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627303, "uuid": "da18dd0d-1b6d-479e-b8d0-028c3c632f9a", "comment": "Malware payload (Smoke Loader)", "value": "465226b77426613ac08069ca6263640c36b746ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627303, "uuid": "5cb04915-3c20-4dea-b636-10ccd2898a27", "comment": "Malware payload (Smoke Loader)", "value": "03b6fa88af9acbc7ed9305ff5e7af8c0fa18eccfac36b24ca65d91db30fcfb578a5e9125f69c6713331c8de5fdfb8a79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627303, "uuid": "a1dc81a9-8951-429a-b64c-4de71774ec55", "value": "T12C24C01337D494BBE21745354E72C2B4AB2BF8B18E75AE9B37C8561F0E702D2CA16312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627303, "uuid": "6480dfdc-be0f-4f81-ac6a-c96dc5ded99b", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627303, "uuid": "5d8de997-a0c5-449b-94ac-917611f3c1fc", "value": "6144:PHTIEYbAmFo8gM2rVMWlWyMF9IKgwgSkIsWVkaaB:PEAugM2hMWlrMAKDJqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627303, "uuid": "5d39a385-85b0-4700-9fb7-6444b4a35fc2", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627303, "uuid": "793d73ec-4358-48b5-89f1-e9a7da0da744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627303, "uuid": "63601a8f-a3f2-4426-8bcc-9a362d359037", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09dc4cf1-ae66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676598879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598879, "uuid": "15770249-28e1-4c17-af2d-bd16d7ef20df", "comment": "Malware payload (Amadey)", "value": "0cbbd15e208339520869608a5d301234", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598879, "uuid": "5742fcb0-d339-494e-af8c-81df6c4ec324", "comment": "Malware payload (Amadey)", "value": "77bb76e48e47ea082692ee90389ad52b7c5daac31822429d475757775cb2a505", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598879, "uuid": "69a859f6-7e6f-438e-ba7b-cf96e4458337", "comment": "Malware payload (Amadey)", "value": "4db7957b3d06c9b4939283302e26de9efd3325e7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598879, "uuid": "61f50346-eee6-4fcc-919c-b5dd0fbfc8cc", "comment": "Malware payload (Amadey)", "value": "224cf94860b86a9c0a3e992d6c017a79405bd4ebf9489a7e9c18bc3d0c1464d8abc09841a59b55caf06708f2e9004fe3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598879, "uuid": "f455052e-d8b5-4348-951c-dc422db6f1f5", "value": "T1E125124BE7F88032E571637018FB02C309367C616AB9C796278F6D5A0972231E675BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598879, "uuid": "21c9e3f1-9299-4435-897b-ee638ffa716c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598879, "uuid": "885be7c9-17a3-45e3-ab49-76b0edef5b7c", "value": "12288:SMrDy90TjQiU07PoAQ0ZvMbimExToI133zBT1k6i4Wv1gdZq+tEUh1IjjnVws9Po:JykjW0blC2zJkYW4q+tEo1IjjVJRMWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676598879, "uuid": "9a25c8fc-5547-4590-863c-cffa7ebd24fa", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676598879, "uuid": "6850a8df-bcb7-4105-8c1a-615c8c215ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598879, "uuid": "a9e66529-43f7-4603-b982-a61dce226f63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a63a79-ae89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676613981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613981, "uuid": "4b133de4-65ce-4411-b306-739da113a6e1", "comment": "Malware payload (Smoke Loader)", "value": "f6f9c6d5f499e90a855979af82926f7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613981, "uuid": "afce2eb3-2216-4b7f-a43c-c102dedf0b17", "comment": "Malware payload (Smoke Loader)", "value": "78248761477b304110999b2001fd5af367c907c699d39a27380d1690ca476115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613981, "uuid": "b1c56b43-585c-4682-986d-41cd7f402e56", "comment": "Malware payload (Smoke Loader)", "value": "26aa78160166d1fde32db37746f907402d3840c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613981, "uuid": "337e9bf7-bbfe-49d3-8002-44d1a8f02b46", "comment": "Malware payload (Smoke Loader)", "value": "f491f3c1e74af5ae5668aac21ee8ac162399de4bf6b30f1942b0d84f15c90c8a2691fd71db8d135367774627e074018e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613981, "uuid": "9ca827d2-8554-41df-a89d-dd010e4a6406", "value": "T17724BF2377E08475E21705318E66D7B56F2BF8B18D759EEB37841A2F0E702E2CA16316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613981, "uuid": "527a6022-0e4e-4b74-97f1-6190dc70006e", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613981, "uuid": "edd37432-6de2-41de-b0eb-ea7caa0cbd5c", "value": "3072:zNGulY0N44wu3yXxZepZAeuP03AXxBbCZoAOQsYarVknXIKlDt:z/lYPcAZe/BM0uxco/k4KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676613981, "uuid": "49154240-d5d9-4f8f-bc7e-58f3dba77864", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676613981, "uuid": "a3001bde-c27a-4ac4-a1e7-053082f8f92d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613981, "uuid": "cf168693-cbc9-4b3f-8988-e3b8715fd388", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9232f398-aedd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676650218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650218, "uuid": "5af9df57-f092-4c4a-95fd-9a43ae5e975f", "comment": "Malware payload (RedLineStealer)", "value": "f7124abcbe6a39e91a21f56819d0ac50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650218, "uuid": "61f75aba-5861-4914-8759-1269e79d38f9", "comment": "Malware payload (RedLineStealer)", "value": "7914864c66eb2c76abccad01531512d73d4819842ebe8b96e7dbc06c85b9a293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650218, "uuid": "a15da4bc-d3cb-4f01-a2e1-afb9bf8a1462", "comment": "Malware payload (RedLineStealer)", "value": "c2404aa468733aa305921293f7a73bc3dc755be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650218, "uuid": "96c9f348-33d7-4b08-a724-215ca86c3aeb", "comment": "Malware payload (RedLineStealer)", "value": "e3436a28b873fb9bcea2941b6822ddede0a19faed34d619a1ab25d037b28e8958bdb4af5e34c9d1e3e2232617330c0cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650218, "uuid": "13cb067d-b402-43da-8c31-45f10fdf0379", "value": "T14915120BA6E8C062D876477059F707D3077A7E505735868B234ABCAB1DB21B437327AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650218, "uuid": "a8eaca12-26fd-458e-8e3c-c08c1cde8a5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650218, "uuid": "3b04df40-16ce-4962-b693-c7989e6dddaa", "value": "24576:Gy6V3nOBNbif0Da0iMx9oizSc4zypiWd3LVDnkm:V6V3OCfGMNFzypiIbZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676650218, "uuid": "0bba3baa-6806-4623-91a8-cdb9a427c3ad", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676650218, "uuid": "47a1ea7f-719f-4bd6-8dbd-099baaa920df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650218, "uuid": "92c4233e-1682-4be6-8f2d-138f26a36f66", "value": "f7124abcbe6a39e91a21f56819d0ac50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519fb293-aec4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676639372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639372, "uuid": "19cacace-aa6b-48a0-8980-1fefb5b88861", "comment": "Malware payload (Smoke Loader)", "value": "f10d693114736bd7bfa93fed898f82a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639372, "uuid": "10b11891-a58c-43ab-b4b4-bda052ec2b17", "comment": "Malware payload (Smoke Loader)", "value": "7980dde5b377d5a383157f1323ccfe328f8efa744c5f6a709f3a0ae0d3bd42d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639372, "uuid": "c92fdefe-024a-47b6-971d-248c1b71a0dd", "comment": "Malware payload (Smoke Loader)", "value": "8d4e10e8cdf8cde2d1c9ed27e9eeefdc3746ceb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639372, "uuid": "d97e7b9c-50e0-4050-8fb7-3d1e69d1ef97", "comment": "Malware payload (Smoke Loader)", "value": "e03e3ec04ec35b08346719a34c07e7f91ef9fee73b1607b09eaf39cd517567deef4c4b88187fd473beb4c8f8ca5e5459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639372, "uuid": "2ee47ad4-31da-4ddc-90a8-a9ec4652bf9a", "value": "T18C14CF223AD1C076E25316348A62F6B59F37BCB14972898F3FC4167E1E712C2DB69346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639372, "uuid": "f2e140a7-7d8c-4172-a48f-5e47fe42b204", "value": "31111ee2beeeebc1d1040d6c5884273d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639372, "uuid": "dbbaa671-0cd1-443d-8ac1-4ee0e0e22727", "value": "3072:gbnjohrCCSKfI3Cv5SV/8yTtuEA8GNwHqsAsuniyokk5InxB/K/:gbjoLffOkUkov3LTkTn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676639372, "uuid": "7dac64ce-1640-49ea-a0af-18b9fd3c7180", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676639372, "uuid": "f85d0791-bf52-4e72-a11e-7aedd7eaf667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639372, "uuid": "16d45597-cb5f-4e53-8ba1-b0a842c66625", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178e78e4-ae96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676619518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619518, "uuid": "71c6fe0b-4d03-4e72-b524-d8920c8e145a", "comment": "Malware payload (RedLineStealer)", "value": "5d54a2cc9b164a8b6b14ccc9c2554854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619518, "uuid": "8532346e-33e9-4d09-808a-72cb5bbba55f", "comment": "Malware payload (RedLineStealer)", "value": "79ad2f9e46394c93345bf97a0f0382dd3042ba3d864d721850d33d3233912d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619518, "uuid": "236cfe13-404c-4ffe-865e-ed9f4c45c4a8", "comment": "Malware payload (RedLineStealer)", "value": "2880c2337d4968419ac33ce2bea0acca7cd737d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619518, "uuid": "116e4d08-0965-43b7-9c31-fa3611c36cd0", "comment": "Malware payload (RedLineStealer)", "value": "468666c07e8b64effd4cfb38c4bf35b11d29f60f85cd3743439b010f1a237e3f2f1a55243e884aed2e48226686bf3ba0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619518, "uuid": "645358cd-0c84-4e41-b0c7-49b45e172f06", "value": "T12025230BA6FC0132D97597B00AFA03D70A337DB15ABC574A539B6C6A0C62172677233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619518, "uuid": "9382b0ac-611d-4b2a-a909-9fbb6c1ca83f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619518, "uuid": "bc314bb9-1e3e-4dba-be7a-50d6c7af89fb", "value": "24576:OyDBDc0C/z82aWH40hDFK58E65iOGoOG+cqUd:d1Dcv/z82aWH34OfmoOjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676619518, "uuid": "27b0e1be-8eb6-4bc5-828b-5404c7f2946b", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676619518, "uuid": "7152e4a3-9a22-4bca-998e-ddd859330926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619518, "uuid": "95d109e3-9417-4d0f-aebb-0ba9958b687e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06647c0-ae7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676608607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608607, "uuid": "dbfb3cb2-b0c2-4b4b-bc36-0b7065e88c68", "comment": "Malware payload (Formbook)", "value": "de4b7e1403e683bb1f73e248c2c65ad2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608607, "uuid": "74061ac9-ee8e-453f-b844-671f993a5d8b", "comment": "Malware payload (Formbook)", "value": "79ae6681fe6fdf1d7810a3bf37811b7c49f706ca0f4c04ab719633f924f727ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608607, "uuid": "b09de81c-5f82-49cd-961b-4df4f6b650c0", "comment": "Malware payload (Formbook)", "value": "d0dbba2fdafa673e47e51808a7ef0d7ae66f38d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608607, "uuid": "5973496d-7783-4ec1-aeea-ca6b66a0ef43", "comment": "Malware payload (Formbook)", "value": "eed3963b571e201c34e48855863c4859247f2e84d224c9f1a9e768ff044a9d34b5de146d15ff1c5a4e11f3828f9383ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608607, "uuid": "1057c944-26d7-41e2-8720-f27f4fed86ea", "value": "T15F84234599F0F7BBE49502B45D7F4A17DEB0BA32A6B1020703B09B8DB56D152E34F722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608607, "uuid": "000efc1d-8dbc-4efe-b04b-5476d4b2962f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608607, "uuid": "0e6c5f5d-a54d-496a-81b3-b547100a2e35", "value": "6144:FYa6ivdcKL2XHUvHciNxr14E5ltY1+v3Hr0xaKyLI9XrXV0pbezngKAz:FYUiUVPXr1vTS+v3Qa/LwrecNAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676608607, "uuid": "9195ba4c-713b-4ff0-a22d-5e9d92a30300", "value": 394699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676608607, "uuid": "401b13fc-d1d5-4c8f-8bec-1e51929303c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608607, "uuid": "84db85ef-234c-4ec9-8045-37c26c0b078e", "value": "de4b7e1403e683bb1f73e248c2c65ad2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cc0d86-ae62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676597178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676597178, "uuid": "420d85a6-c2b8-409c-ad9c-e1a1620e2ef1", "comment": "Malware payload (Amadey)", "value": "5bdca03af21edc35c3e32818f443d0a5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676597178, "uuid": "d6613921-2bb1-4cf9-8fcc-8d23a0571b83", "comment": "Malware payload (Amadey)", "value": "79b158f4bbbee18bab4e1b3a9a7b528a8f112e618452d27c35afe56902e3281b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676597178, "uuid": "505cfaa9-b571-4cbd-9162-5027943f7776", "comment": "Malware payload (Amadey)", "value": "baa4b97dea14ac72e87819c0ee5a1da7bb017be2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676597178, "uuid": "5ef62d71-c3ff-4a95-bd8c-7b0c06dd3ba5", "comment": "Malware payload (Amadey)", "value": "421675a43a1a57be3b8bad3c4cabbc6bb9af39c31938110545fcf38d36cceaf4080d5feb2ffbc621be8d56bde750d6d0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676597178, "uuid": "735fa12f-6c9d-41b4-8ebd-7e023b8c86c9", "value": "T1FD252303BBE81471EDF55B7058FA03D31D367C601B3D8A9B238FA9991872674A63136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676597178, "uuid": "c84be356-74e2-4aee-a62f-d134aab44c63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676597178, "uuid": "d5de54f8-43c1-4639-a7a9-4f2c7817a16d", "value": "12288:jMrGy90gTM2U48ZmWK9P7D1yjMtgv3tilEdnHR/Uwl4lXsb+oi4Zfo36YS0HU9C0:hyfN2mf7BdW1Kwl4lcb9ZA3O000fqhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676597178, "uuid": "e8260ca9-944e-4087-bca2-6776505f1ef8", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676597178, "uuid": "8a188169-f162-481c-95c5-35c7c900b914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676597178, "uuid": "0c087d6d-2a22-44a4-bbe5-ab5cc34a729f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3451ccd-ae6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676601311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601311, "uuid": "c3d1dc1b-640d-490e-8181-d29e8c03d7f2", "comment": "Malware payload (RedLineStealer)", "value": "3dc3c84c91e713829053e6cca915e593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601311, "uuid": "420b9bb3-2929-4009-9fbc-a9947d072093", "comment": "Malware payload (RedLineStealer)", "value": "79b82b06f99f0272cc1dc5422d25a99a975a4ec6141dd53c577610bd57d197f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601311, "uuid": "2e129d1b-53f8-4fca-9f3c-3fce34c84c38", "comment": "Malware payload (RedLineStealer)", "value": "3acc397515609b12e952611580d39c4a22083139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601311, "uuid": "fece95de-bb75-4a62-bcec-234eef7d84ea", "comment": "Malware payload (RedLineStealer)", "value": "507e8cb7c0bddb7061cf5289e22b1285861f567d80ac371d4d81752f6432a1aa1ce635d7116b711e4159b5bab9d48f29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601311, "uuid": "55e6a47c-715d-4fe0-adc3-f8f765dc27f8", "value": "T1DD25220BD6ECD432E478537029F202C309337D916B389B8F774BAA5E44B26A4B635767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601311, "uuid": "82071b29-d739-4272-8357-52ed6483bf60", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601311, "uuid": "9a2a4978-553c-4c79-87f3-3f9afe56ffe9", "value": "12288:iMr6y90HCu+OEqKV0Wp97vZY9NG1zRlgDchBfDMcCLxswmQ3Da/R4ZDLoMoKhOD3:4ydNGU0arLNw/nC/RK+KhOBKn6zTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676601311, "uuid": "f34f4b87-4469-489d-b59d-8e14ab7a6804", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676601311, "uuid": "c0569ce3-df5d-4189-85a7-43454d4bc252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601311, "uuid": "f9dddf75-5178-4046-864e-d443e9838b83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953a5f59-aeb7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676633902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633902, "uuid": "3e80450f-02bb-4fee-8a6f-11eb239ade01", "comment": "Malware payload", "value": "f61ef01222f3307ca5511661858a0b2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633902, "uuid": "3df9d91a-7a48-4766-a9d6-56fa82cb4d31", "comment": "Malware payload", "value": "79d80194a2259494b91f7fe3a3ef3edee532a5b23fd37a7aa0f44447c93dac47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633902, "uuid": "f7174a29-c5f3-47eb-81cf-9a039c92cac7", "comment": "Malware payload", "value": "438bbc52d6aea4549ec0e10b1eaf1525588f0a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633902, "uuid": "121fe9f7-d350-44e8-abbb-cb88090bba38", "comment": "Malware payload", "value": "8e6ae71937da439c218e3f054813580df952a626514aede3a6d4f06fe00ec30c2c24a4f715b2a21bcad23b1d019fbe58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633902, "uuid": "8e695add-86cc-4c5f-b3d1-92fa238016b2", "value": "T10A152347ABFCA471E4742B305CF702C31E363EA19A75974B178A6CAA0832675F631367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633902, "uuid": "d3cbbcb6-8d83-4901-9abf-88de62c6f40c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633902, "uuid": "b97da1f2-4c3a-44ef-985b-cd22b0c636e8", "value": "12288:vMrcy90b07wW5nQYPLa6kbm4AroOv2diJ6Dza+8xhqGXeDaNKI2AJmAjJ:rydZFjGIroDFDzalxhjXeuPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676633902, "uuid": "6a160171-adc3-4527-badd-9d16649164d3", "value": 955392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676633902, "uuid": "4137a0e6-53e1-4f08-90bd-0ea799c1731b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633902, "uuid": "90358a5a-7d97-4f84-b32f-44ed8f5133c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2acc238-aea2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676625012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625012, "uuid": "21c73fab-d313-432d-a7da-e310b633a05d", "comment": "Malware payload", "value": "f2d6d06ba8e50cd24c266ad239eaa0f5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625012, "uuid": "ae239e6d-6677-440b-8d17-5a0f15477e20", "comment": "Malware payload", "value": "7ad8a6af4740fee00840c4aa8eff6ba064053570dcbdc0c29a1b4f16fafa8b60", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625012, "uuid": "4f33f4a8-1a8e-48d1-9540-2386ce312b0a", "comment": "Malware payload", "value": "736498384fb59e2a2ee8ad1bec4fa70d2737905e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676625012, "uuid": "76230e28-5638-48f5-8950-cbc12d38ed60", "comment": "Malware payload", "value": "8a9949c6dcbd374b9108a7dc392dabe8337743b23e57c4b9d4c26ba00197379d378815f9997fac07a99159600ab53a4d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625012, "uuid": "1bfda75f-3358-45a1-add8-3bfb4fd1b9ee", "value": "T1AE64235170EB7A47C978CC7B32E7758321DA8C1808C365EBE27A57B2E62017C639B356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625012, "uuid": "ab169215-60b1-4ed1-baa7-fe0fc1fd386e", "value": "6144:tGJaFAhw3db+LLlmn5SuO4U/WSE9k+pK2vU5m+PBJWE7cvjgBjlJI5:tGaN+snU74UuSEC+pK2cwm2K25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676625012, "uuid": "62ca4c5b-6cbc-4e5f-a94c-b6716719bba2", "value": 309721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676625012, "uuid": "cd1c01db-2a2a-428a-a2d3-7f8f92cddafa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676625012, "uuid": "1719ec92-964a-4b7a-a118-f90781eed499", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d157eff-aed9-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1676648303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648303, "uuid": "fdfd1fef-37df-445b-af60-350fda410f00", "comment": "Malware payload (ModiLoader)", "value": "16d1981f245b65f43e2b64cf32aa3c15", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648303, "uuid": "b4c4c65d-c848-4795-8d6c-4368111a40a9", "comment": "Malware payload (ModiLoader)", "value": "7ade248258607cabe21381f7bc1d26141e18c6cc5998da2f57eee775ba78d955", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648303, "uuid": "46740103-62da-49dd-a72b-ab20afdc66e0", "comment": "Malware payload (ModiLoader)", "value": "441aa0df327dcca0ca4ed879fc1b33f030213eed", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648303, "uuid": "7a952a06-7ba0-4f16-a1b7-7adfd5f05c3f", "comment": "Malware payload (ModiLoader)", "value": "fbba0c5282243c18476bca1e27d6abe01f1748604e8982c1079870dbbce9ba6bdc00da5e2a3851716a6c96a5ce2b1d09", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648303, "uuid": "cc8d7220-f3e8-42a9-8776-a34b3a8da46c", "value": "T1DA84236B76C9DAC2DC5F0F8879F1116097616E98143F2A320A094AF7D277D4038F7AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648303, "uuid": "7d72a108-d499-4c7f-80cd-72da5e0718af", "value": "6144:cL57uQpMAbWDPiLDK0EJAWKizfDe+K5mjspBLzK27eSmhuWhAnrQ8YGQuKX8eaMi:cL57vbwdJAWK8xMTPWAc82JLeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676648303, "uuid": "6e99b804-3269-414a-8bca-9857045229e1", "value": 372600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676648303, "uuid": "e0b32673-6e51-4a87-b4dd-4c0a055cd00c", "value": "application/x-xz", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648303, "uuid": "38599c09-547b-47bc-a6ed-b7681047f02e", "value": "nPedido_adicional_6567787_PDF_exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb4acaa-ae98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676620711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620711, "uuid": "06ccc4cd-39da-4b9f-8681-d027cface9f7", "comment": "Malware payload (Mirai)", "value": "bfc90f5971fcf8ae350a33ae862cfbe7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620711, "uuid": "48529818-b1d4-4ea3-9470-405494d655ef", "comment": "Malware payload (Mirai)", "value": "7adf4681d8a21a6c42c5685edabb40916b89c0cb54f151a766b4d7c9ed511a56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620711, "uuid": "923707db-b4a7-4d50-a87c-387b361270fc", "comment": "Malware payload (Mirai)", "value": "fc96a3288781d96017762f765bb691d3579b947d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620711, "uuid": "256ab17c-b1be-4f62-8f90-d0f45ce927dd", "comment": "Malware payload (Mirai)", "value": "97772821886b33de33e61bfa3f8e83e35b0468198488fbcd241651d1364ad4d16629071d1988ab8e13fd340967ad84d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620711, "uuid": "e58973d6-2605-49b0-9409-fb93adf2d1c7", "value": "T1A61318C4F553D8F0EC5A06703076EB365E35F1FA222CE553D3A5DA72BC82602A60699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620711, "uuid": "f768b334-0fe6-4d6c-a0ad-dd867ce5eb4d", "value": "768:xMlB2zs8ssGfrRI6aQ2nEenz3q8uDOycM3U95VlVs:YYzs8ssGfrRI6aVnEeDWOrMErVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620711, "uuid": "8b46814a-c63a-428f-a4b8-d927aeb2c016", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620711, "uuid": "ed1ec75c-02af-4753-ae98-22725b6eb14e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620711, "uuid": "905b6055-686d-4e61-baa4-1a3e25cbc8ed", "value": "bfc90f5971fcf8ae350a33ae862cfbe7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab8a071-ae9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676622798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622798, "uuid": "b7f3b73a-f1d3-4cf3-baf0-a5fc568b11b5", "comment": "Malware payload (Smoke Loader)", "value": "4cd82652cfa5e41116e174ea43afc656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622798, "uuid": "07fe4f10-6d19-4278-af44-e9bd39ff4047", "comment": "Malware payload (Smoke Loader)", "value": "7b0dadd767602dc7b1c52e1c7d7dda882198e7c45e88d86df3b49fcb67385115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622798, "uuid": "bac4a6f8-7a4f-4f70-95bb-d972ee72e655", "comment": "Malware payload (Smoke Loader)", "value": "ac32e38bf60f4ec0843a079161727b2c61bc489a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622798, "uuid": "93ca6dd8-4f18-485e-a142-b88ee761486b", "comment": "Malware payload (Smoke Loader)", "value": "0b571a07132caa59af31a63b29c4b80e0e8f4dcff1917f7e2a8c0145adc1389b3596458f9e8c351f26b71fc9b0b983a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622798, "uuid": "5b512de7-88e8-443f-a21d-61071ffd0e28", "value": "T1B324C02332D0D4B5F12345358F26D6B5AB2FFC718E65B9AB3788062F0E751D2CA26712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622798, "uuid": "a3c81654-deda-4cef-8726-955076dd8556", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622798, "uuid": "883b8671-395c-4974-ac2b-865b6eba0267", "value": "3072:B7a74f9Go3MmPIfVREmrS8FqAVeI4x23K1be2qpCpoEi5Dfy+:B7M4N3IfTEMSqzeI4x2Kbe2qpCtiBfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676622798, "uuid": "14f11c3c-dbe8-4641-b9dd-1b0695a0f37f", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676622798, "uuid": "8ff5b6f1-8b15-458c-8a70-77aafe513b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622798, "uuid": "e7b3316e-4f4f-4de1-b695-49aed9a792e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80d86bd-ae89-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676614230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614230, "uuid": "c18eb85d-8605-42ad-8125-5c4568ab7379", "comment": "Malware payload (RedLineStealer)", "value": "940a19da42fb7485f9ed849a036cb9cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614230, "uuid": "57ad39bf-565a-49a8-a06a-0de3700eafcf", "comment": "Malware payload (RedLineStealer)", "value": "7b906e4179129da2cf39f1b987286096d88d37285b40445d4a3a2f5ceb12a1cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614230, "uuid": "4b614f41-7d63-4a9c-882d-d3cce509e3e2", "comment": "Malware payload (RedLineStealer)", "value": "34c2cec34a29905098d5ed2d49f574bbed665098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614230, "uuid": "92061633-23e7-42bd-86d7-e4a294ce532c", "comment": "Malware payload (RedLineStealer)", "value": "ab8aefc7aaeebd3c81425ed544b16202197f65b3be2ff0ec4f747d370efb56f8547a7175169418a16911cb0b883727df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614230, "uuid": "db145a3c-d0c1-4adb-8f8f-f9f002eaf689", "value": "T1BC252243A7F890A2E974533058FE43D72B36BDE05F358297138F595908B35A4AA3273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614230, "uuid": "279f1905-0149-40a4-8a94-33d1c4a76b98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614230, "uuid": "e3997054-6f65-4398-8677-b5fd5d11781b", "value": "24576:8yYIw3eDMw6a3KYfxz6MjT52wSGEc2E7yi:rYHIP3KUxeo52vGeEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676614230, "uuid": "347bac25-2dd0-421f-8782-73679fef4db7", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676614230, "uuid": "9345aed0-d145-40d7-8068-abe9bffd3af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614230, "uuid": "9012752b-4632-41bc-871f-8e896cca7da5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d76e3f5-ae5a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676593973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593973, "uuid": "578d83b4-6f9d-481c-a6db-1bf82bbccd13", "comment": "Malware payload (Amadey)", "value": "2ac96092d83cc5199a3825a9f82c6c75", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593973, "uuid": "fdfbe40d-7992-40c0-adc1-9349aa3d633f", "comment": "Malware payload (Amadey)", "value": "7bcea7f7fd8be2cee501b8ba19f46aa03c00f3764aeea9cbccd1e4f01795172b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593973, "uuid": "27a6c747-0f84-409a-9c70-f0037cc6db1c", "comment": "Malware payload (Amadey)", "value": "2a7f9fa93c357197e21f74bcd1f2d129521e1293", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593973, "uuid": "7b85392a-00f3-4133-bd28-81c75dc0b8e0", "comment": "Malware payload (Amadey)", "value": "fda991c38022f3f0f0139e60434820c21609b22c655169105f04219545d0f130a4ef76c9e451b92ee968e94fce21d393", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593973, "uuid": "6a499e83-770e-40a5-8565-fadefe33e363", "value": "T15D252247FAEC4462DDB85B7108F727C30A367E951A3C834A16CAAC4909B29F1B635377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593973, "uuid": "a85a522b-8eae-4b21-8a6b-a2c93cbb5afb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593973, "uuid": "86355d66-9e59-4f9d-b377-c6598a109e58", "value": "24576:My/LVAVwbG9QpdGUbgs7KKd0aOpWak2K:7/L2VwbGOGUbgs7KBzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676593973, "uuid": "ee6b0671-2270-44d5-973d-71e040d7e8a8", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676593973, "uuid": "6781c3b4-3893-41c7-8b71-37ae84b4f12e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593973, "uuid": "293676b8-9b0c-47aa-88c6-cb7d7da05157", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b74b79-ae95-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676619058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619058, "uuid": "523ddc02-7a88-467e-994d-dcdb4b9d31be", "comment": "Malware payload (GCleaner)", "value": "12b63d2986555bd03966cc0099946b02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619058, "uuid": "25ae4360-1cf6-4bc5-a08e-8a2ec15f3a06", "comment": "Malware payload (GCleaner)", "value": "7c09aa059fb58a7abdd9876e5799b20fb44c34e3dc9736f9a3d41b9c66725716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619058, "uuid": "db60881a-c994-4e50-a418-b9be577f81a4", "comment": "Malware payload (GCleaner)", "value": "e8baa52d257f48ab0020bab4a6a565b3799b4011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619058, "uuid": "8002ed70-cffe-44d1-83e5-d1d3f3e0939f", "comment": "Malware payload (GCleaner)", "value": "46bd9b3c22c7f58b599c9a6ee5e2e730015d389efc9161dbebf7cf8632733568fb360ebc3f027fcf2a8fde10a57f397c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619058, "uuid": "2993a430-5a8d-455a-8f3f-f67a5a8250cf", "value": "T1F8E523E55925C0E2E3FDDFF1780E45E174137EA7DCE845273819BA1A3A3229EC45EA04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619058, "uuid": "33c958c9-87f9-4852-afa5-e3a07caf195b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619058, "uuid": "1d721f9c-980c-4a1d-ba2f-396a2c365088", "value": "49152:vN+Ic6IMbaJJrqqrr2L3zOYebLCwMNi2z82cQcrA+YqkeG86smHmK3Grny2YLCgt:V+IMMLq/c3zOYecNi2YV7HnkeG86sBIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676619058, "uuid": "b636216a-c0cd-4ece-962d-5455de43446f", "value": 3094648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676619058, "uuid": "4a72a251-37cc-498b-abd6-5b94406548f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619058, "uuid": "986bb2a0-3502-4887-a4eb-65495d0be04a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddb291b-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676637836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637836, "uuid": "1b33722b-3c2a-4e76-a3cc-84b16eccd41d", "comment": "Malware payload (Mirai)", "value": "c9b891ce1ab3af049a9a62077d1d179d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637836, "uuid": "7be167c5-379f-4623-8aed-931f2f474045", "comment": "Malware payload (Mirai)", "value": "7c36a034804ac232daa9084dc04ed746b17ea06d7f9e86f5b2656503b5f5a399", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637836, "uuid": "1b3615c7-4465-4403-9ffa-f6f3f9e6c3ca", "comment": "Malware payload (Mirai)", "value": "2f9a90efce4893f15393f1093902a7580ab43f4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637836, "uuid": "7855d4ab-5cc7-4a2b-aa4c-acd1b9f0020a", "comment": "Malware payload (Mirai)", "value": "a24f12200dee80b8f77b1d88c655b7e2f70a6994597617e71b4fabbb332387591ee7d0320235fed769cc291f110d2edd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637836, "uuid": "0241f0b5-cd24-4c27-ab6c-15b65491ccc4", "value": "T1A3633BDAF801DD7DF81BD77A4453090AB930B3D542831B3B63A7B9A7BC721A81D12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637836, "uuid": "27a642d7-b8cb-490f-bf0e-7d8a3bc9ef4f", "value": "1536:fAgVoBExE/VpDYrly8VhyCO1sxyWbxdJiLU11i+VQxK:fAQoBEO/fErlWCO1GySx/o+V8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637836, "uuid": "f66b6e05-49e3-446a-abe3-68fc42b28ac1", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637836, "uuid": "097b0681-491b-46fb-a03f-f13f4f9eb90e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637836, "uuid": "5eec2e71-a2cd-412d-800d-8bd083e12263", "value": "c9b891ce1ab3af049a9a62077d1d179d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648476f6-ae89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676614063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614063, "uuid": "c6b15ebf-1351-4e45-b3c3-042d4cdb64ee", "comment": "Malware payload (Amadey)", "value": "3766153b003bdf1ab8fe30e4bf23b96a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614063, "uuid": "65c6b2e0-df9c-4c0e-8788-96ff76679ed4", "comment": "Malware payload (Amadey)", "value": "7d432ac92112863269188adafcaa027801f472e3d0ee3c3fe0afcf0fab658470", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614063, "uuid": "52f43a62-604e-43d2-8543-9b44a5a2c0db", "comment": "Malware payload (Amadey)", "value": "67f1957ac290d5b825f23000004675b932bdcec6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614063, "uuid": "77372af7-c76e-4398-82dc-683ba2e60b83", "comment": "Malware payload (Amadey)", "value": "c994c71d5f92ae0304c6e10d2daccd13743ce188f583d039c0203d2abbf489ef684d5b2d586488079ef2b9ea1de123e0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614063, "uuid": "d8181bb8-91f0-40b1-94ae-431474c8df6b", "value": "T18CF41207A3E8D133E57687705DFA02C719367E611B78839A138FAC1A0CB22E5B636757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614063, "uuid": "cfa59642-9d45-4ca1-a0a7-22e94edc8f7f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614063, "uuid": "29c26f76-a8bc-4ba4-82c7-e93110ba67f3", "value": "12288:OMr7y90QTcW2Sj1SqcRkXl2rHTSdbSgwLsAHRGRypry4UiZlKZWv63z:5ynnHRSqut3XVGArZUvZdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676614063, "uuid": "8d3a533b-b9d0-4f86-ac00-f22c6792e984", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676614063, "uuid": "596e57aa-47c1-4a7e-93bd-8b7167a05961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614063, "uuid": "a60ae940-0d48-4404-a9a5-6a69b4440c41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a37864-aea2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676624942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624942, "uuid": "a8632b43-c213-48d6-9aa2-289add1fe1cf", "comment": "Malware payload (Amadey)", "value": "3f7628ef708a32e08db6867e37a9f780", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624942, "uuid": "b832ea5c-20c9-427b-9de3-beb7698f486e", "comment": "Malware payload (Amadey)", "value": "7d6238fbb02e1510885e1cce7ef3e7235251cc824be7e4c4a1ee2cd77a310aa5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624942, "uuid": "61233926-52f3-445a-a8f6-cf73de31346b", "comment": "Malware payload (Amadey)", "value": "53b90e8c5e2d650b1bd28e5ad617b18048b2609e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624942, "uuid": "66dd5038-5437-4730-8166-6144c714faeb", "comment": "Malware payload (Amadey)", "value": "b429ae1f236aa356518e54d5cf9a879fff14f65ad6d1ae8fb37131a4cafdcb514456c9bb6b7332e0fc3d859fc0bc7f9a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624942, "uuid": "e3a6a376-2b6f-4ab5-b738-914a4da56642", "value": "T15D25120BDBEC4062E9A5577149FB03D31938BE615A34879A178B9E0A0C737F4B63136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624942, "uuid": "3c572559-7eed-4be5-be61-8b517405e613", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624942, "uuid": "20e1ec75-e8d4-4ada-8e56-f08ec991154c", "value": "12288:9Mroy90hFF2OaVfwf0BylGTSd+61VeA6SL53yOaGgEtZnEY32nbzh/AxXAgj+jYh:FyKb2pV9Byl22DVeA6AuvEtRCbUT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676624942, "uuid": "ca50e350-7214-48da-992a-a4972159e696", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676624942, "uuid": "58fedf99-ad6c-4f81-b403-e31c843115a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624942, "uuid": "eb596394-f159-47ed-a98d-c31c027deac8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345b6b0a-aedc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676649631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649631, "uuid": "3382ff42-7557-4e70-bbc2-4f1c0ea1ccd0", "comment": "Malware payload", "value": "f6b455e75b996de226089d548ee833d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649631, "uuid": "de654db0-60d0-405b-bdac-065cc8343838", "comment": "Malware payload", "value": "7dbd2edb8a69ac319d980473c9a2a4bda05c5699b8a983b38220ff3eb53e46af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649631, "uuid": "d0cb3a0b-2fca-466d-82b3-600d4927dd62", "comment": "Malware payload", "value": "526bf94948e5ae0a6cfb1422eeb73520590d1816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649631, "uuid": "07c32edf-9bfc-4919-a246-b7608a9f8b99", "comment": "Malware payload", "value": "75b622d4e6734dbb03bcdd3624216270fc5a3bd6370fcf150126af127cc8b01abc25e87c5fb0e0603ecbca6216f290e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649631, "uuid": "4220aceb-b071-4f6e-bd8e-7823421ed82e", "value": "T174D523E22819C0E6E7FCDFF1F82E84E075A3BD5B80E51557386A7E2965332AE540E508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649631, "uuid": "c96e0a18-b325-434b-8ea7-1b9495c12381", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649631, "uuid": "534483f2-d142-4a7b-ad65-45324216ede9", "value": "49152:1s+EVF/oRocD5VZuiAc4E4i3188SQs7aRcSjTBIsi/6xOO63HK8eIw8F4/IfUGLV:S+QF/1cDzZcc4E4i318+s7aJj9IAxF65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676649631, "uuid": "9ef2af69-79c3-46c3-81b5-5a0aa3eaa390", "value": 3008639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676649631, "uuid": "5b4a1046-ae5b-4bef-a9ee-8bd48e5e0b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649631, "uuid": "ffe21460-690c-4cba-b60d-cfa5e38aecc9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0060d7cc-aea6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676626351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626351, "uuid": "2596b6fc-dc2b-4b8a-bf65-9a909d4604d1", "comment": "Malware payload (RedLineStealer)", "value": "14de24914c8a35d9ff59c6285faa5702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626351, "uuid": "689caee0-ea3c-4ccd-8c7c-9deec5e98eeb", "comment": "Malware payload (RedLineStealer)", "value": "7e7cf6634e936915ec75d714bb378eca13e7d089342ff672c0c82f6586677467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626351, "uuid": "4460b82d-3a6d-40da-ae3a-40694292ac9a", "comment": "Malware payload (RedLineStealer)", "value": "87059a489f2c71b933bb99ab1164379f2be555b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626351, "uuid": "4457df9a-503e-4257-b923-3373cbdc6b66", "comment": "Malware payload (RedLineStealer)", "value": "1f9e835e3ffbfc56e45ed0d5946dd917c69720ed38621b8ff0e0e7c0f633bb45a3de557055188f29ecfb30ac0d2b7e63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626351, "uuid": "0a672ecd-b3ee-4b7e-add9-42802e9e1643", "value": "T13225228BA7EC5122EDB1173009F602D30A39BD6126389797275BAD1D1C72BB1A77133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626351, "uuid": "e9138416-f33f-452b-a12b-3bb758c4d5b5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626351, "uuid": "55a774e6-da06-4c59-a964-bea676bfdf41", "value": "12288:mMruy90bzUZJMjL4c4od1Xn0g3rCm9wlxE67qcYqY4qEsqQCSFwVRITOw8eXUEDE:gyIuQL4i1vig67qcYF4w62TOFADW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676626351, "uuid": "ac967375-81b0-4d77-8cc2-f1ad89bdbbbb", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676626351, "uuid": "9c86bea2-36fd-40ff-8194-0dbd9c03c59d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626351, "uuid": "4111993a-a157-472b-91dd-6c2da8ec4888", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea8c123-aecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676643501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643501, "uuid": "ec492d52-e27e-468a-adb3-a944ab68b7ab", "comment": "Malware payload (RedLineStealer)", "value": "ac45fd48291c4d4463c56ab0285e851b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643501, "uuid": "d8bcc2f0-a7bf-43fc-a42e-e29dd05da307", "comment": "Malware payload (RedLineStealer)", "value": "7eac5bac9b8d20adcbb6846efabbcc38e22a2402ff407ff4c8eee24a28bb95c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643501, "uuid": "47461bee-79d5-4ab8-b15a-24d246eb4b25", "comment": "Malware payload (RedLineStealer)", "value": "06d28258770f98b69c240c62c0b198f986ff65cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643501, "uuid": "baa7f035-05d3-4ae0-81f3-191b84621d51", "comment": "Malware payload (RedLineStealer)", "value": "0fd23287842315e1b6238ec07d1f46c2f7d882e8cdf8f61b33c18f1bdd1387502f8ad9a2513b5bd107809ae3e4effed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643501, "uuid": "9bcf394a-7d28-4223-96fb-12fd1407a71a", "value": "T109152307B3ECE426E9B45B706CB602D31631BD908B35C22A274F6D6D0D71B68E27176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643501, "uuid": "73d47fb1-1019-43dd-9627-609abf88c2b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643501, "uuid": "0af9656b-6b2a-4065-baa4-f28f4ed6c854", "value": "24576:0yVnoZrTlsFnNTN6aFm3jcfjDWNTORoPZ7:DGEFN5gmjDGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676643501, "uuid": "acf1cbfd-cad3-4b40-a046-47d6696a3df8", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676643501, "uuid": "54bc9d82-49d5-470e-b634-a4ebc83ef8b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643501, "uuid": "1959bd3e-cd76-4156-9a5e-f9e1468cf7e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424877ad-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627320, "uuid": "e3738c4e-841f-4b6d-a2f5-513f07ad5985", "comment": "Malware payload", "value": "25b41ff52fc5b2ea9924fee5b003df41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627320, "uuid": "5d4ecdb2-c0df-406e-90ff-42be02babac1", "comment": "Malware payload", "value": "7ed8a3b31875670520dd7b5d6811720bfda8beef34da53a42a6d1788185ce85f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627320, "uuid": "05959715-1b63-47d9-a1e5-70bc3631c03d", "comment": "Malware payload", "value": "15a45fda555d96a437afd4ad2caad1b13a96170b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627320, "uuid": "8bdca449-7f83-401c-a5c8-f68aaca07b0f", "comment": "Malware payload", "value": "aabf5edc8b6d2c5c0bbb7d61ff7fddedb44e757e82841cd6a34bcadf3754b4581544323d1c57981cb5cf5aafa6e79a06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627320, "uuid": "60b9a2c9-1156-46dc-9bb8-5861da6aa98c", "value": "T11F148CC1AAD8ACD7D616177885EAC32A3738F7C61B834B130834B6351E43BD16F8B55A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627320, "uuid": "08ed2bdd-cffe-4273-a1ba-8442a97f8a5f", "value": "0fec5b870dad6c4991f598c6bf78e2ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627320, "uuid": "9eab8d59-0779-401a-97c5-a3986dcd3fab", "value": "3072:0SN8MbIaLSt9FUCMnP0LU3hLxLE3dDYuWO3d9:0ubISSDyc4k3dld9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627320, "uuid": "098a0a36-eecd-4e11-a27a-c13623119147", "value": 207530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627320, "uuid": "1730e651-b266-47f6-b513-b437babbe426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627320, "uuid": "24d15f43-9e95-4d5e-9f4e-5cb98478527a", "value": "fuackme100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21bc9cd-aedf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676651130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651130, "uuid": "0ad3bb93-245a-404b-a998-005162a3fe41", "comment": "Malware payload", "value": "528fb8f3259d3204b6760b765b942f29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651130, "uuid": "19d9380a-f3f7-4d39-a582-adf6f4ba0be7", "comment": "Malware payload", "value": "7eec73213a062b0517adcd97ffe5f9b8257282d644eb31a7a2d5f1c8cb32bc19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651130, "uuid": "b89d1566-68b9-41e8-9204-60f636bbdaeb", "comment": "Malware payload", "value": "83b965dac1511ff7d49de92a67d26b03b1933024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651130, "uuid": "84d16c09-a552-490e-88eb-005a0c35fa6b", "comment": "Malware payload", "value": "4cb265d26f0eb6451b4443008b57ca99122f4d8824200b84f287b1a317b9f32b4add93a736f2da4b0b86ea30b1240391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651130, "uuid": "880794f2-66f8-4478-ba63-fba238f7521d", "value": "T1B5E53353AAF91632FC99277404FF42C30C727ED26F5D69A3126A7C993972C767822312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651130, "uuid": "2054529c-8016-4e1d-a1d7-7235f7062df8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651130, "uuid": "4627f929-1ddf-4310-b6b2-0dbe0855076a", "value": "49152:/1UT/T7V1S8rTuXTWOHKlZKOgOjeP8IB7aOPTrd0qMCgl454a0LJerXs:qNX+TWOqlFaPHhaOPTrOnCgl45mLwrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676651130, "uuid": "337060d6-6fd9-4887-a91c-4aead3938242", "value": 3126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676651130, "uuid": "a424cc0d-7cbc-4422-8917-01c221b9dd3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651130, "uuid": "38050735-0793-460b-8734-e9ea97df3000", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8eed5d4-aef8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676661933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661933, "uuid": "8e8d017f-2e95-420b-be02-7802bdc63b8c", "comment": "Malware payload (RedLineStealer)", "value": "3d07ea7055fbbcf7ee29124de2d3d62d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661933, "uuid": "6e55d196-dcbf-4c04-be54-35f054cb6895", "comment": "Malware payload (RedLineStealer)", "value": "7f80c77d41405dad381ce4353db41637eb4cd17d7f1d45060cdbd6ba88b43f54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661933, "uuid": "1083acac-5410-4f85-9467-cbb79d3106ab", "comment": "Malware payload (RedLineStealer)", "value": "4c8ccbf6eb22955524032b7876877f766a687139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661933, "uuid": "8193242e-b06d-4627-9fbe-f9ec7e864f28", "comment": "Malware payload (RedLineStealer)", "value": "11575ef691f3627161a5a43d4935af55d237a6822e09650b801f1947154709f7dc41f818e4d66435cbfe96e25ebd7602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661933, "uuid": "3dc29ba4-b49b-4fe8-9384-8040a69b5f8a", "value": "T15FA35D2067AC9F19EAFD1B75B4B2012043F0E08A9091FB4B4DC164E61FA7B865957FF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661933, "uuid": "99f11140-4b48-4faa-8468-2d317756499d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661933, "uuid": "e9322dd2-b83d-4196-912f-6c302cfcf41a", "value": "1536:BqsKFRcqWClbG6jejoigI743Ywzi0Zb78ivombfexv0ujXyyed2wtmulgS6pUl:vaRclyY7+zi0ZbYe1g0ujyzdcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676661933, "uuid": "ca884aca-2fd3-49ff-b7e3-a035824679b6", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676661933, "uuid": "379cd60c-a238-4adb-a939-f3fa452c0e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661933, "uuid": "2195253c-29a4-4e80-9a59-0f106ab3310c", "value": "3d07ea7055fbbcf7ee29124de2d3d62d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7ad4b6-aec9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676641507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641507, "uuid": "e2c899fd-0f8b-48b4-8d47-33cb838adc59", "comment": "Malware payload", "value": "5b771dde57547bb1dc0e92264793c819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641507, "uuid": "40b24ae8-5ff8-4398-b5ef-ae05c9df7d17", "comment": "Malware payload", "value": "7f90f69ad3e0e62a3638a00e2ea5c28e3e710c54b7f3e02ab6b66a7a9187a015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641507, "uuid": "5c1b2723-f7bd-4aa4-955e-e0f82ad0ba37", "comment": "Malware payload", "value": "1981530b04c2bedf8bd0ff9237af9f788efbdc04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676641507, "uuid": "62fd9f7c-c73e-4e90-b33a-e393d86934c7", "comment": "Malware payload", "value": "01e759ce0e9afeb6bd86921d330c870cbace26cb094d5d2476182de4f8545a97aa97b887c739f6bd2773fb4583c0ce71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641507, "uuid": "6d57fd59-9720-4931-9daf-2c6b7373b8f6", "value": "T16325220BB7EC8036F97467B009F701D3093A7EA06A70939227CE7C599CB1264B57776A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641507, "uuid": "b73fc076-8496-4a54-8eea-f77c25af9672", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641507, "uuid": "5cf962a3-cc2c-49f4-b4c7-244765a5911c", "value": "24576:VyH7P0jRhAcQoFIrlKfeSpKfRcPz9vx3jp+U7Sd6fK:wH/cQZrljSp0RoNxzpvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676641507, "uuid": "c837ca01-b8f0-453e-b620-300495eac9b0", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676641507, "uuid": "1c0433d8-8a02-4996-aed4-4e8b62444881", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676641507, "uuid": "902f1f27-8eb2-434c-85c4-d0ddc745b1ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114fd4b2-aea1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676624232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624232, "uuid": "19db5710-4aa6-4dae-902a-e3752d4b447f", "comment": "Malware payload (RedLineStealer)", "value": "939ed9691e69b24ac606419c37f49690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624232, "uuid": "48b8c590-8fbd-4747-a2c5-8f65e6cf5846", "comment": "Malware payload (RedLineStealer)", "value": "806df4f7597a1337c87470bc0633c4b7bed6537e782eb4c90b26aa4caa5de3f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624232, "uuid": "10b23913-416d-4583-9219-f94bfdc32d44", "comment": "Malware payload (RedLineStealer)", "value": "c3a6a3c9ab09421f1c853d3e582f6f8c5eee65c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624232, "uuid": "512f5f6d-e80a-4102-87d1-1b7352eaabda", "comment": "Malware payload (RedLineStealer)", "value": "3384cb69577185c11e8fca1ceff68700858c43d80e1619044a564961d8669f6085023640d85797e55a7028ab2bfe9a98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624232, "uuid": "f1b97cc8-7e40-4a5e-9994-58d9a9378ca8", "value": "T1AA25134BB7EC9071E87197711CB503C30D397E612A3892CB234FAD5A58726B56A313AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624232, "uuid": "0a345273-1ac9-4e6a-aca9-4ec09b981279", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624232, "uuid": "db0d28e3-32d1-4a67-821b-88c3a96b640a", "value": "24576:eyoLwdQwOpJDZR8zjodTYuk1sQdXLoiO5zZ5e:tam1OpDoGEuk+6XstZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676624232, "uuid": "edc8da93-0950-49bf-baf0-98863257e4ef", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676624232, "uuid": "2807b03c-4b6d-4c9d-afa3-a45b89fd691f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624232, "uuid": "30faf9f4-39d8-44ac-8e4e-557c19534fa8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7a6965-aee0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676651500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651500, "uuid": "ca768c4e-93d1-4f48-a220-02fd7e209db6", "comment": "Malware payload", "value": "ea24f245000feac5b86073afd5f5c280", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651500, "uuid": "2f11c7bc-3951-4665-982c-2207920b3acc", "comment": "Malware payload", "value": "813dc9b228032de72a5e3a1dfa2c4ae6c6f6e4477abb9fadb071be637a79a7a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651500, "uuid": "41a76f06-dee3-45ca-aab0-9d08dc237657", "comment": "Malware payload", "value": "ff0efb1f9839bc606dccc74db2b417cedbc1a187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651500, "uuid": "1c650732-d009-428e-be0c-ab75c04d9de2", "comment": "Malware payload", "value": "53b8d87f6564b9aca92c28705184e8024a336b007fd99b3c29435d9bfba79c1e28088e8cae5888d2516b6470f85be711", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651500, "uuid": "771848f5-e5b3-4779-8129-ba4ade0d77af", "value": "T15AE3D01176D180B2E06A96302C70C1A1BB3B7DA25675C9573B9C032F1FB16C25E7AB7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651500, "uuid": "e4376953-2537-47e9-b200-efd404df6050", "value": "8cdad4eae189848d90763fd3d82d253c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651500, "uuid": "f290c365-ac5b-47f2-be1a-1fb174488a55", "value": "3072:CNCzuCMZ69PAlPDu8M0F2AR62D/nmnr5tK/5o9i:CgzuzZ69IZ9FY1+sriho9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676651500, "uuid": "ab4292f0-5565-46c2-9a9a-7aa11ef06a0b", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676651500, "uuid": "3b73654f-305a-49e0-ab7b-a13258a718b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651500, "uuid": "5177fd25-c55a-460e-a53c-1597809d8798", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c730c05-ae6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676601084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601084, "uuid": "b3184ffb-89f0-45c8-a7c1-7ffefef4e707", "comment": "Malware payload (GCleaner)", "value": "a5ac5130650fe0855b4618f7ee98fe93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601084, "uuid": "0060e495-dea0-4bb3-9803-8f749df8f1e3", "comment": "Malware payload (GCleaner)", "value": "815aee5313cb0b7882145e2a187d146588aa93ce25436e74198e5447557c7f82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601084, "uuid": "6aa67ccc-868d-45c2-9b87-e0194397aa72", "comment": "Malware payload (GCleaner)", "value": "581b7bd2f1fb4109f89424aecfa232f309fdd858", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676601084, "uuid": "325aea9e-31d1-4446-9fa3-451b21993e6c", "comment": "Malware payload (GCleaner)", "value": "85fb674d0c48f3879b3716071ae94525b9bee5c524ce2e0719c12ce3378a4826ee944ba6f01e1a2b05185188ec7545da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601084, "uuid": "eafb60a1-b334-43c1-a60c-a3076fa4facd", "value": "T190D522477204C2EDE354CF73991D95A866332D20BAB2C20E35997E1F3AF22D9206EF55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601084, "uuid": "1f3a00cd-f768-4f43-9502-51d96d443a21", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601084, "uuid": "c5d3a700-7854-4c62-8c39-230ae4749c24", "value": "49152:97tZKjzcFCrZrhg0Sm6aKJWGhqJ6PIlWODAy7fFG3bq/AiUXg7qFLBqev8nii/X/:xGEArBhgB1dqwPLsAy7tG3bq/knlqWhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676601084, "uuid": "8431f4e7-44f0-43b6-b001-d7d806f121c5", "value": 2993657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676601084, "uuid": "d5cc0674-66c6-4f89-a5f3-e418df645e31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676601084, "uuid": "d711db86-1fed-458c-9d62-07d8851d3a67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a83433-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676637852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637852, "uuid": "20d7e187-6fa2-405d-b30d-512ece47ee2b", "comment": "Malware payload (Mirai)", "value": "3a6ae3655edae188db3922dcf32d5f75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637852, "uuid": "cb68c314-b3c2-41e5-9d66-148fe1079a55", "comment": "Malware payload (Mirai)", "value": "82511ab220055617eab2dfc2a0711bb95b9da8443dc2d1489c5dc66021dd33b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637852, "uuid": "97c3b014-b355-4356-ba49-fdcd406faabf", "comment": "Malware payload (Mirai)", "value": "33974113daa04691d4bd86522e408fab371ca21b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637852, "uuid": "7707be2b-b0a6-466c-a8d9-b0def42bfb0f", "comment": "Malware payload (Mirai)", "value": "875b005a0d564812dd8ef210ef0d12467fd511d51150703cdb09b6b51b4ef38fecd4b0bdcfcc29f84494d76bb53c1c59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637852, "uuid": "e25f38ae-8843-44f7-b620-b28ac06cb2bf", "value": "T14A83A71E7E229FBDF7A9823447B78E21A75823D537E1D641E16CD6002E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637852, "uuid": "a4e43c5a-df0d-4648-91ed-8627a02d7804", "value": "768:dtRnr6RhnMdMwCnZ2NmeCPSjlpMF864XWX0eP/BjQyJ/cwpBXIggnX/AydgQeits:umjUxPJFkyJ0ws1xesZYWRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637852, "uuid": "d669c2e3-6b47-4dd8-b1c6-7ac9d80f4c57", "value": 84852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637852, "uuid": "c71f0088-20e2-4af4-94e6-a633ca64accb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637852, "uuid": "d7b335f5-f5f1-448d-8566-e8d8d2188bc9", "value": "3a6ae3655edae188db3922dcf32d5f75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3278f03-aec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676639938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639938, "uuid": "3e3ad64e-5b9a-4df3-93f3-14c15c27e8ad", "comment": "Malware payload (RedLineStealer)", "value": "3892b034a9a6f0907096e28f01c2d879", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639938, "uuid": "3edd2c7c-da67-4395-9c6f-eb3ceac86978", "comment": "Malware payload (RedLineStealer)", "value": "825fbc83539b92e7be448c4ce648233a4d7f492a312daeebc3596be62f4be3f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639938, "uuid": "5ad3c960-d462-4c95-ac59-340784d33814", "comment": "Malware payload (RedLineStealer)", "value": "f43818cba4f14efc6142f1cfe99ed6c502e8f657", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639938, "uuid": "7f819fe7-95bb-41dd-a834-dea042cb90d1", "comment": "Malware payload (RedLineStealer)", "value": "6c1a1c138a0104825b0493fb6d077d6d7c968c6f23d42b141ac68ccd1abdc9841d2ab610d7dfe55f5ad2be982e9e0640", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639938, "uuid": "53592b73-fd65-49ec-89f0-d81db6e91a19", "value": "T17AC40207F7F88422E5B4137018F603D31B3A7DA156358797239B6C9A2D736A0BA3572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639938, "uuid": "93e40249-8bd3-4072-b0cf-3e618a3b0377", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639938, "uuid": "05169969-cc9d-4480-8bf4-69e405507e1f", "value": "12288:1MrKy901AnvSh2/Or7egjHqVY2Vdpon665JIf+R:byJvSiOvQVY2VSIfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676639938, "uuid": "e7851979-9b46-4b0c-a0db-0fd05e0a4f50", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676639938, "uuid": "4ee3259c-a242-443c-a55a-26fe4b7ec6d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639938, "uuid": "8dfeb076-bf1e-4ea8-aabb-dd408797bf30", "value": "3892b034a9a6f0907096e28f01c2d879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f9ce8f-aed5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676646620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646620, "uuid": "c0d605ff-92cf-4dd4-ab6b-6dbd2cfc10e6", "comment": "Malware payload (RedLineStealer)", "value": "199fcad1959ac6b8a32821c86de489ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646620, "uuid": "8e442f4b-502c-4cc5-9bff-fea2eadbc2ef", "comment": "Malware payload (RedLineStealer)", "value": "82bf80bc0e0ac25e674f1f3d2a8ddc24f7c99fe1b865dcc69b496d6816314664", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646620, "uuid": "ab04f236-c42c-4d1c-9418-a1e83645dc0f", "comment": "Malware payload (RedLineStealer)", "value": "48a7cfbcf6608588b5d115ceaa9e3f84c693810e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646620, "uuid": "ef86d128-d22a-40b3-a42b-41450c098506", "comment": "Malware payload (RedLineStealer)", "value": "3da62bd21ec81a7a728e4715e6f3031515aba139b86cba75c86cc7357d1bb5bdf060cde9eab86b19d005f381fe8946de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646620, "uuid": "e0980f75-6cd7-4d11-8484-a23ec4a2e0fd", "value": "T103C41207ABFD8062E5B55B3019F603C31A367E612A34935B274EAC5A18739F0B63177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646620, "uuid": "20a5ed5f-ac3c-4f78-a512-54835b757d51", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646620, "uuid": "1bf3726d-9e0d-45b7-a590-10b4a7333df7", "value": "12288:vMrYy90ipGJVkeVuJDAJF8aUZ/zN8eBMbzXI58:/y4VhVuJDA38a4z3OvXI58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676646620, "uuid": "8d1a4201-d0bb-4468-b63c-82793bbe8136", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676646620, "uuid": "9a9ac83a-c619-49d4-a54f-4cd4ba983c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646620, "uuid": "ae42139c-f67b-4ae0-8bb5-5188cb35022d", "value": "199fcad1959ac6b8a32821c86de489ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2441816a-aec3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676638866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638866, "uuid": "0489878e-c1af-4397-acbb-4483d41775d4", "comment": "Malware payload (GCleaner)", "value": "1da17acb5e868fc0a29c32c6d448abb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638866, "uuid": "e4c4a9fd-4522-44ab-8308-7d322ffc8532", "comment": "Malware payload (GCleaner)", "value": "82e82aa0ef3d678a66776fdf700d8e8c9be449c0c8805363ffeb8050108617f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638866, "uuid": "82dd0bcf-db5b-49df-bc17-878cf2ea2ef2", "comment": "Malware payload (GCleaner)", "value": "ff5c7aca083d975fe0852dbbd78076784392e1aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638866, "uuid": "071e10aa-bd28-4fe6-baec-ab9b281d690b", "comment": "Malware payload (GCleaner)", "value": "32b55dd583d2de80ef8b592aa219ad9e78af93c3e156b4cb360c02a3c377287c4064f6c9ac4084e1caab9a84f68481b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638866, "uuid": "78d9d554-733b-4f3a-a8f5-56154789b327", "value": "T156E523D27959C4D6D3FDEFF1B81E88E93A63BC9BC8C049673856B739B53611A800E118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638866, "uuid": "0509ff3f-7055-4ad2-aa31-9739371b69a1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638866, "uuid": "fad2104d-df40-4928-ad05-90608b971d73", "value": "49152:1sipURpaJW6LFGu/eBLt4mnAQXtgX3vovZiaeeKLdfNCsfQ83OmLCgv2MR:SipUxqDePi3vo4Hesdf5fQbWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676638866, "uuid": "f2c40e67-c010-4fb3-9eee-9c9143ade776", "value": 3180381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676638866, "uuid": "86ce2a71-4166-42c7-bbcf-1b58be3a6804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638866, "uuid": "19be3c6b-a0ae-4f91-9222-b90a66cf835b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed139a80-ae78-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676606991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606991, "uuid": "e3166497-7050-4ced-bf16-13f68863565a", "comment": "Malware payload (RedLineStealer)", "value": "1890dd2347f728c8d94ebaa12bf2496a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606991, "uuid": "15b9e65e-d8ee-41a3-a962-7f2f3a632837", "comment": "Malware payload (RedLineStealer)", "value": "8312a4257ce4bc68e2c874594c01447bc75f14be606ddea37a913bcb50b415fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606991, "uuid": "47bbebf0-86ac-4c94-b77d-a03b0d97b2f5", "comment": "Malware payload (RedLineStealer)", "value": "25d4bc0032583bcfed355de8f3e17b247f7ad03d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606991, "uuid": "c92ba6ca-b532-48d1-8e04-098128adb559", "comment": "Malware payload (RedLineStealer)", "value": "93497a8c7de46bdba9368a87551c5169e583a28e9604ecd6603416ce51b4fe8e5773b6f8f61eb4a73030d8e95cf64da4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606991, "uuid": "4594b894-a587-4445-88f8-add27a4d6032", "value": "T132252397B7EC4022F4725B7425F502D30E3A7D505F3C82A76A8B586B5C726A8F67032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606991, "uuid": "7a66e8f9-3369-4217-8d73-e53675286ea1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606991, "uuid": "f44c0b4a-7402-42cd-a0d2-c54d934334e4", "value": "24576:Iyy2bVvPX+MJ+z9cGDosGUyyVXemCR8nicS:PphXPgzpov/Q/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676606991, "uuid": "27a03d4b-c7bc-4ed0-8af0-7681cb9be81e", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676606991, "uuid": "08fa5f2f-d109-4d3e-8d46-a627df0b0525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606991, "uuid": "0a31a39f-6aea-4e61-a9b3-aa755603ff2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ed3fe4-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676637879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637879, "uuid": "f7a3760e-db43-4867-aaa5-895a3a957292", "comment": "Malware payload (Mirai)", "value": "d77beef42febd0353ea5cb9d4b8902a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637879, "uuid": "88738423-b8b0-4e64-84df-41ccb22df9bb", "comment": "Malware payload (Mirai)", "value": "83d832687fbdf30e3229121e2c1ea81e1f9c3853514d99b766c7f9d3d47abeff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637879, "uuid": "f0cc86bb-7a2b-4017-9daf-b04442800a41", "comment": "Malware payload (Mirai)", "value": "e312079a321d016c26e2c68a442ca23d3eb33460", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637879, "uuid": "46baacff-b0d1-4a1d-acf4-d9d7a180a8f9", "comment": "Malware payload (Mirai)", "value": "2575e5c42da73d349a08545713f21cec8e5fba037d61e367f2fa809dc9adbcd7d46fbf9656e51001edb9d0d1c0c15570", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637879, "uuid": "a07856a3-437c-4c2c-a33d-420177f47037", "value": "T18F83D64ABB510FF7DC6BCD3706E91701348C5A8A22E87B367534D928F64B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637879, "uuid": "1444de69-29bf-45ee-b8f0-8dde6800c548", "value": "1536:CchAAWjI2U3bj5edi7HimVYZDZlOW7MBxv5MWJ1:CchAJcJNWeimStOzaM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637879, "uuid": "5bd975e1-6f09-4cdb-976c-29fdd4b9e2f1", "value": 84856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637879, "uuid": "b50ebcf7-fb1f-4e13-8773-cd2cd8de780d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637879, "uuid": "a914cde1-c0e0-4e0d-a622-c510be7dc13d", "value": "d77beef42febd0353ea5cb9d4b8902a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8545f93f-aec6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676640318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640318, "uuid": "70475c5e-45f1-4b86-a763-cc43b9b500a7", "comment": "Malware payload (Formbook)", "value": "ed31d2447e28d7eadff8268b644e179d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640318, "uuid": "4fc86065-6e15-44d6-98d8-ef3c6401b07f", "comment": "Malware payload (Formbook)", "value": "83e90e75eb49fccf0f69331483311ce57f89b33824fbec54e773af910da239a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640318, "uuid": "3b65111f-1d39-4e27-81e2-028eeb7e86d3", "comment": "Malware payload (Formbook)", "value": "144ce69deaa6b2ca6ba42a79572920da3210fb67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640318, "uuid": "a32262e2-085c-4fc9-9f44-84b3028c62e3", "comment": "Malware payload (Formbook)", "value": "7571f88c428b31343bd9b49ff2ab88622c7b0dcef123d8e266b68b370f01fd56297fff2b8cf122b3ff4a64379e454bf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640318, "uuid": "8fdcdb0f-91e0-4baf-95af-2b31f00148a3", "value": "T1F05413192AB0C19BECB3D7331E7827622EF9A12539E7D75B13E0191C7CA2950952FF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640318, "uuid": "c18078ca-fafe-458e-865a-1c60aa4f056b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640318, "uuid": "8c569682-55ec-4f57-bee1-00c45ee40638", "value": "6144:/Ya6S97P/PtfsO2ye3+cDNjriaY92Tsk66wt6wCpYzWvPIUTUnL:/Y0t1+V+chZYgTs4/YKSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676640318, "uuid": "d35d5838-6904-4295-ab8e-036e56e30fef", "value": 302833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676640318, "uuid": "dcc844eb-844b-4d5d-abc7-6436087a62bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640318, "uuid": "eb1e4f04-a8af-4678-852a-4f65db98477e", "value": "DETAILS AND INVOICES 6 PAGES .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d40999a-ae92-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676617863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617863, "uuid": "0a5c936b-70c2-49be-9949-9180f3974dac", "comment": "Malware payload (AgentTesla)", "value": "32637f18fd6b2728d0d023fece62ed0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617863, "uuid": "4c976370-2b8e-43ed-9470-f8dd9823c601", "comment": "Malware payload (AgentTesla)", "value": "85d955830522460b5b0a001b35c7bf6b99962b6a4e8431990f24c077a9474bd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617863, "uuid": "2e3cbb23-cb35-4bbd-902d-d95129f64cb4", "comment": "Malware payload (AgentTesla)", "value": "f1a935df27f8307450ece11578a6e798c394276e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617863, "uuid": "2b1daa96-c975-43ea-bef1-1d5fb7a47e9d", "comment": "Malware payload (AgentTesla)", "value": "f658aa9dc1f587cc96929d0ba2f729b30ac550be89597b2f401d45dee91a5b7efdd65b49d9d3c4d998bd7fda85f717c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617863, "uuid": "831f6a18-9a32-43ff-a133-898079229538", "value": "T1DD055BCCB1B0F67ECA0ACD76AB103D14ABE06553672AC592E253B6D95F3D4538E1C0B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617863, "uuid": "78e1bba8-3d5a-435b-b9dd-c213b0a687b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617863, "uuid": "9dd29562-01e7-41ac-b108-37a94067e8ec", "value": "12288:uhu4qDSu4Dsv9tXGJriI5+iK6MYWCYnOE7RUv4TvebtMDsv9tYVBjyE0Cb9hNZdt:uhu4qDSub8rG6MYWOE7MOeGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676617863, "uuid": "09894ce5-149f-4376-ae78-f2aeb3d05f54", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676617863, "uuid": "e495f7b1-6b7e-40bc-8f8c-f4ebcfc24c05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617863, "uuid": "ac30dab5-d8ad-4db3-b099-11ed06ac1779", "value": "DHL Express Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2035e731-ae95-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676619103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619103, "uuid": "bf54f82e-5fd1-4801-8b48-515023edf559", "comment": "Malware payload (ManusCrypt)", "value": "5073909f599955351f6116a8a7a5646a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619103, "uuid": "34e74a5f-c05c-47fb-b05b-430bef6e9f1c", "comment": "Malware payload (ManusCrypt)", "value": "867a7eaf299f034c5acc0ba7bd662d7336a3c443a51de629eb07392a0173f5b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619103, "uuid": "0964902d-b933-4d12-b904-3630973efd67", "comment": "Malware payload (ManusCrypt)", "value": "ccdd6f3a529a10d9c24d93c02aa81a06118f7412", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619103, "uuid": "97f687fd-4751-48e0-afab-81ae2d657d26", "comment": "Malware payload (ManusCrypt)", "value": "b69f2e313565955af3f1d92d542899c9588fffe562604ccb2bd0086edd210cfb3d8b30b56fb9e5a7f92cc2afd3a07543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619103, "uuid": "72b7ba16-ae44-4dd8-b3e2-89f533bf3746", "value": "T1C224BF1377D094B9F61346318E26D7E4AF2BFCB08E25AAEB3784562F0E712E2C615315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619103, "uuid": "82abc937-0e14-4fa3-ad44-e8514ff63309", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619103, "uuid": "440a9eff-b778-4c36-ae5c-fa1d6e61a3ab", "value": "3072:wN22lvMN4You3S3MZu1BAOuP03AZVY7cuKzg0oSgDowIedapqlD9:wflvfc1ZuDRM0SV4cufBUDediqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676619103, "uuid": "03ce2d30-d9bd-445f-b607-40a9ca933130", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676619103, "uuid": "004a329d-96a4-4612-ad02-60121a539ce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619103, "uuid": "96a3fb7b-880f-419c-b9df-5730fd755805", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d239d574-aecb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676642594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642594, "uuid": "503cb3cc-b537-40f8-a97c-8d74641b01b2", "comment": "Malware payload", "value": "5431f657fc2ee269dd672c0061ee6e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642594, "uuid": "9596151b-ec81-455a-8c86-7ec19618b7d6", "comment": "Malware payload", "value": "86bb64e08b20481ab19b601f30c7ce1800b3cfeb61d66d0bbe2fa799206010f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642594, "uuid": "3e816be5-9554-4a1f-9b6a-32d3c202a567", "comment": "Malware payload", "value": "571436b1e7b0a84994008e098b2944e1b02a448d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642594, "uuid": "53c4253f-cd05-4093-ac42-440c71a6d644", "comment": "Malware payload", "value": "d2dc1be49c3febf536f31bb8984d40b0de3e35579d3d4470494e556c418dfe23fdf3c7bb522f4208d5e57953f6e56b9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642594, "uuid": "7941790b-3ff7-4eeb-b5ad-33dee210c968", "value": "T12C35AD8CB1F0F67ECA4ACC75AB103D149BE06543672AC592E267B6D59F3D4638E1C0B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642594, "uuid": "0e36ac21-0b07-40fc-a4d2-5fa457f9d3bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642594, "uuid": "f47fa5ce-ac48-43f7-ab4b-4e83d556fc65", "value": "24576:buqDSuGb09U1uwcnDea4h7BJubleTx/zS:xZwcnDKdJuJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642594, "uuid": "c1ab552f-aa7a-4340-a8b8-d860b5763cac", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642594, "uuid": "012b2ac4-b5bb-43f7-9aea-ef13c468a37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642594, "uuid": "2c6ca4dc-0c20-4101-b956-8ede6510decb", "value": "EEW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c854a157-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627545, "uuid": "87e3e5b1-7ddb-4bee-9980-7e1c7404d3ae", "comment": "Malware payload", "value": "02fc64fb8266e9c2f30c30f967fc7eef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627545, "uuid": "2fc1c42c-0f18-44c2-a7ab-0c826f5d82fe", "comment": "Malware payload", "value": "87f3c831220c2abf082347e0e5f9023750d244bcd04c5e0435911c76e9e93d4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627545, "uuid": "49d56d65-d0ed-4520-ac4f-b1f382749e55", "comment": "Malware payload", "value": "f117930cbcc9bd62dbb9e5c6b85dc16063d8b5ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627545, "uuid": "46995945-5dad-405d-aabf-10aac221b67f", "comment": "Malware payload", "value": "dade2bf17343efd0249a6549c1db7e34f66becee9658528bb0a2ecbe119ea1b3ba50cad119ef9b4e7c4e15376ed7561b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627545, "uuid": "2193a02d-bfa8-451e-bd8a-3f229a5067cf", "value": "T17A149EC5BA88ACD7D605173885EAC32A2738F7C657834B131C34B6351E43BD1AF8B56A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627545, "uuid": "19b850c7-f509-4570-8090-50c1b4f0c70c", "value": "dae253036ba9d710a708001505bd2540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627545, "uuid": "08fda1b1-0ca7-4190-9372-0770bac6b92e", "value": "3072:xUmAnZduAYB7Erz/OVp5lwf5LtInQIuBMlP:5AnHMjXm3InjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627545, "uuid": "c91d26c8-9089-45c2-96b4-a4e92d858aa8", "value": 206891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627545, "uuid": "d7cb4edc-50d1-44e1-81b4-8d7642c26f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627545, "uuid": "cfab8116-d54c-41ef-b5d1-163a00558c8e", "value": "hey.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5ed7f2-af05-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676667334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667334, "uuid": "f78fad4e-371c-4d1b-81f3-a4b6e28e5a04", "comment": "Malware payload (RedLineStealer)", "value": "d2d01f14892794910c5f04868362cd54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667334, "uuid": "a1b31544-365b-4cd5-b1ca-18b51917984c", "comment": "Malware payload (RedLineStealer)", "value": "87fc6472b819dd58dfe7b9ddc51bda153737eac3e6fa9f8782032f390c47292a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667334, "uuid": "5d009857-0b1b-4c6e-8fc6-2bc53fb75466", "comment": "Malware payload (RedLineStealer)", "value": "304e04ac8260d02b2107dda800e31cc951821c6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667334, "uuid": "98db447a-457a-4ffa-96f3-564aac063efc", "comment": "Malware payload (RedLineStealer)", "value": "f876a0f0bae0269e4f18b35320e5b93b8d38c37e723d45597fb278854f475429c352bc4b41e9930cd10b1888163b975a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667334, "uuid": "1ba58fd1-3782-466e-bac0-cfb8ae736724", "value": "T16EC4024BF6EC8172D872677009F703C716367EA06B34826B278F6C5E18729A4A13577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667334, "uuid": "e84ddec6-0825-4939-8f51-6eeb5c686748", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667334, "uuid": "287d2af0-c984-4cd1-a420-7dcb49829ed2", "value": "12288:gMrZy90HAYoIIKYfH//rUyoDR9KsltkFh5kZ:Jykd92C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676667334, "uuid": "f097b385-9793-4a7b-823c-fb50b65bcbad", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676667334, "uuid": "c5e7beb2-5fd9-4d59-bb56-ef1e2481ab74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667334, "uuid": "aff0e992-25f0-4105-85de-6602948dc9b7", "value": "d2d01f14892794910c5f04868362cd54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65141a6a-aeb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676631674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631674, "uuid": "e77171c3-2644-4446-94f4-674f83239314", "comment": "Malware payload (Smoke Loader)", "value": "30824c41f87523365ea97bb45124e05b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631674, "uuid": "714e579a-b8e0-4637-8eb0-895170594903", "comment": "Malware payload (Smoke Loader)", "value": "887d0e5ed17ce5dfe01ef13131fdc8010202ec5a9eb79812d2bed3ebd72e25d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631674, "uuid": "15dfe4f7-bf25-4320-be1f-552240a0dd78", "comment": "Malware payload (Smoke Loader)", "value": "84f3006abb751f0e3f2379f82fb21192dff007a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631674, "uuid": "a6053596-75cb-4dde-a52f-48a3c44671d6", "comment": "Malware payload (Smoke Loader)", "value": "d14843cc5fd9d6f1ca151f5ab8a4196bdf5e8086e045d2c301be3ff402f50eb5720fe08659be3eb55cc5d54c822ad641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631674, "uuid": "b9b4fb04-a7f1-4889-96f5-588c9ee29fe8", "value": "T1AD14CF223AD3C072E22305395D71C6B29B2BBCB14A71899B2FC5067E5F757C2CB66352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631674, "uuid": "dad7022b-92ef-4634-917c-50de4a3130d4", "value": "31111ee2beeeebc1d1040d6c5884273d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631674, "uuid": "053bd6cf-246a-4f23-b571-6653b685ce81", "value": "3072:thlS+ueCHWotAF4WcoTcFak5HjgwnkK4ArLFt75GaSLtCI6TB0:tDSP2o2Kj1aSHv/fFhgfLtCI6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676631674, "uuid": "49523a8d-18cd-4c8e-bdcf-5a2a1b185516", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676631674, "uuid": "3559193b-b1ee-44b7-8dbd-5b50e76e7986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631674, "uuid": "ff1e0dc6-1835-4e81-bd2e-d2e30620cf1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92829b2-aedb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676649505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649505, "uuid": "43312afc-10f2-4a83-9439-2eab4492ed81", "comment": "Malware payload (RedLineStealer)", "value": "0063b9212bba68cf198aec146f61877b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649505, "uuid": "221ea8ba-637a-4461-94e1-c8fdf59c8bb4", "comment": "Malware payload (RedLineStealer)", "value": "893dae30b3f513547efa915b00756453045c0fd7d4fc1a26fb26004eb0924518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649505, "uuid": "06c23707-7b82-4852-8ff3-9e89240d9f74", "comment": "Malware payload (RedLineStealer)", "value": "f8ccb4b89a6b2eb08eaa60e021fa83190df0af78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649505, "uuid": "a19c96f4-8bfa-4289-ac6d-f909d2c72c7f", "comment": "Malware payload (RedLineStealer)", "value": "a6084843bf0d1e092addafe02ffedbdf9d2e4ea7ef2e3938d69921b4603e74189e9198d21d2f7659ba0cb219b501e60f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649505, "uuid": "0cf90a01-71bf-43b6-a7bd-4c8572f9879d", "value": "T1C2E5334279EA4832E1B96B3404FB43E309367D5369388AA7A3DB5C490DB1DF135707BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649505, "uuid": "8c4c538b-47cf-46f7-ba26-31f789d9b529", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649505, "uuid": "3bcee836-f5be-42ad-b976-67f04447a892", "value": "49152:iEuyhMs4VKL06jtoI6H8z081IXYoTCviV3R7DeVfQX7o124OC5kwh87A3F2:/MTKIjH60fvTCviVh7aVYX0Y4iu0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676649505, "uuid": "a9770b40-1cbd-445e-8dd0-43b79eedc39c", "value": 3127296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676649505, "uuid": "064ed5c9-9a34-4772-b03a-e1a55d66ec6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649505, "uuid": "f5424a45-f954-4654-83a5-26a04acd069a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58921ceb-aee4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676653128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653128, "uuid": "9676e01b-e922-4214-8ebe-fe5799d6f485", "comment": "Malware payload", "value": "56123a85e8fe4dc5defe12a494c64069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653128, "uuid": "83fa0c2e-b9ab-40f7-bf6a-90163582e940", "comment": "Malware payload", "value": "8a6339b6e79033962ce34c39670d3c7cd45550fb23b64338fd3e816bb867b76f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653128, "uuid": "fa299c1f-6b5a-49fe-99fa-c2fa7f81ad08", "comment": "Malware payload", "value": "aa8498d6e3b0152103158208f35e35039849e0a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653128, "uuid": "2a790c91-aeea-4ca2-a4ac-4ff58735ffaf", "comment": "Malware payload", "value": "c3381dc8bbf69252373e4d2dc2ce63f879977b516ea27cfdf977999d13fc9c847d801881a50be73ed08e018329d6a7f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653128, "uuid": "277bd0e6-d5cc-4b31-b08a-3eecd16e14e6", "value": "T1CBE53347B6BB9177D461733011FF67A31E30BEA35790DBE61BAE685A1CE203430A1762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653128, "uuid": "bc7e6ef8-aec2-4fb1-a197-8f935f220c17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653128, "uuid": "3644370c-494b-4c06-bdc9-457321227c57", "value": "49152:Mr55rWmQRauzYqXs2LUmNs8dCUFm4azCGN71xaTwrpW7PUP4Xnv:e5rWmQRaW7XsKUm6xUFm4azCM1xaT2W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676653128, "uuid": "fb563f01-6eeb-4fc5-a8f4-13dee1f37c93", "value": 3099648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676653128, "uuid": "ca3ca6f4-e259-480f-87bf-ea10e5a50d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653128, "uuid": "ba55445c-eace-4992-89bc-ef43d2b351e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0e8524-ae9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676621406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621406, "uuid": "8b524b68-5d5f-4d5f-8a3b-f2b2092fc377", "comment": "Malware payload (Smoke Loader)", "value": "8bd4c8d3ae4e1b0de3a32285b4ada6f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621406, "uuid": "b8dbf024-b7cb-4d2a-9db8-798f3c6b21ae", "comment": "Malware payload (Smoke Loader)", "value": "8a84c44026221268c1a06a156b67ed647dda2246a45e5f97d051a97159bc31ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621406, "uuid": "ac32edae-d5ef-49f3-8d4c-bffd7aff83f5", "comment": "Malware payload (Smoke Loader)", "value": "2c2d7f240c7943e66daaa779c0859709423e85c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621406, "uuid": "005b0fc6-13bb-40a2-914e-1b4458788b3d", "comment": "Malware payload (Smoke Loader)", "value": "35f0c3a03f291b4800fa40860cc914ea45ae5aaa2b76f839bd4d1b198d9f40a085f365a2730e0a1e79ac8fc116cc45ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621406, "uuid": "37a7085b-646f-4e93-9691-55857afaa2df", "value": "T14A24C01337D594BAF12346318E61D2B4AF3BF8B04E35AAAF3784162F1E712D2C656316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621406, "uuid": "9b7e34a5-001a-44d4-8a8f-b5e2ac3bb7d8", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621406, "uuid": "e31305ad-2dc7-457b-aca6-520013249984", "value": "3072:LN2ZIEN4U3Fb4VRF6JWuP0+AWNvgufbvTX6mgtZXlgJ+ZD4:LcIcCVRFkWM0YNLPX6mca+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676621406, "uuid": "7ff03c45-7f2c-4297-a95b-44bc3c5db395", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676621406, "uuid": "fc62f65a-1c7f-4fd1-8b7e-a4bed0e5c1f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621406, "uuid": "7f04d0da-5974-4e90-839b-4d8eb12a0e01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25cd74e-aeae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676630112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630112, "uuid": "64acdcb3-f670-4823-9046-c71d9b75b353", "comment": "Malware payload (Amadey)", "value": "15e6bb64a6abf96c8bcd4813e3e61372", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630112, "uuid": "1679f52b-24f5-425c-8586-51e859ac5c8c", "comment": "Malware payload (Amadey)", "value": "8b009dcc52916db6cad874e826e26187585cb44481c9d1ecb9cbd947d064dcc5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630112, "uuid": "36092b65-0443-4b1b-9172-9b6d4f54979d", "comment": "Malware payload (Amadey)", "value": "c3af1ac39fc9b31fcb299ed7ed65728d0963fe8a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630112, "uuid": "1217ceb5-4407-4d2f-806a-9a22fab778bc", "comment": "Malware payload (Amadey)", "value": "c9a611552085fcb976172c76aca699972ee2cb03ca866482dae2ee71f815cad3dab9b09a74a692298dad20ad885821ba", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630112, "uuid": "f154fc88-a25c-478f-bb4f-c7e9c959d09f", "value": "T184252357B5DC9232ECB5177058F607C30E723E602A78C24A568ED99E18732F4B2357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630112, "uuid": "dde1b274-cc04-4f73-8651-626bcfc83af8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630112, "uuid": "9c08f8c9-d395-43b4-a98f-b4640be1af48", "value": "24576:0yfo1BOi3ETOZUo0Hk25prsAvwy2QMziA8uq1YreQA9yj:Dfo1cIEKW751lzMSuq1Zt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630112, "uuid": "e53c34e7-c22d-4818-b16e-0261855c737b", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630112, "uuid": "0c3b859a-a403-4e44-b108-c1205b247850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630112, "uuid": "e6f4b337-d3bd-4a4b-b357-beed4fdc4725", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c7e3da-aebf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676637097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637097, "uuid": "55415a7a-27b5-478d-91a7-ba63a2b3df15", "comment": "Malware payload (RedLineStealer)", "value": "3137b4c67b35e13aa91410b73e5d3abe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637097, "uuid": "6c1eda0f-a06d-4193-b674-10eaef807a8b", "comment": "Malware payload (RedLineStealer)", "value": "8c232459f8ad1f901144cb09582c3c32d7b6da983ce34ae3e8850a18f3f3cad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637097, "uuid": "643982ed-7d4c-4e39-a4ce-26ea03cb83dd", "comment": "Malware payload (RedLineStealer)", "value": "d26d76f3c512c7f2719ad699f759177048d95359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637097, "uuid": "8ab23cde-0336-4a33-9aaa-866bc161342a", "comment": "Malware payload (RedLineStealer)", "value": "c1c10316d4da1d1e6be24f7677023f9ef2753c5ca61d71233c9dc733f59f4cd34061beae58e80e6d76b76afee06abcc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637097, "uuid": "d4276ed5-9d7c-4047-b76d-cb1444ade1e3", "value": "T11A54F1233AC18072E31356788E31C6A5AB7BBC7947618CBB2FC9546E1E356D2DB24317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637097, "uuid": "5ca38717-5b55-4e42-930c-beb5e42290dd", "value": "31111ee2beeeebc1d1040d6c5884273d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637097, "uuid": "a1a35447-d7bc-42f3-968a-bcb3a737be6c", "value": "3072:cG64obeCpmlzf364obiHTSMNKsjSLubg9ihfmv1vkg8p+QGAofSwBctwZUeCjz5k:cl4IefqHeWGzWLuZfUgHDtzGl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637097, "uuid": "b4a27b2f-696e-445e-a0b4-c0741d026736", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637097, "uuid": "157f7499-c88f-4228-a46c-e7d49689c6f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637097, "uuid": "6f51bc9e-52fe-46c0-9fdd-d7be4bb60188", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fafc74f-aedc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676649677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649677, "uuid": "90709476-7f34-44ab-8ab1-dff6c7ba4e39", "comment": "Malware payload", "value": "d579f62c108aadb9362749a97b834e64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649677, "uuid": "3ea91006-0767-4f77-bd85-b5c6bd0e4a56", "comment": "Malware payload", "value": "8da61969c3c88bf9025e82604dee8cc104316414affdd91014bc5854633b26cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649677, "uuid": "6c2f007a-6f4c-48e7-b293-30a8284bdb6f", "comment": "Malware payload", "value": "ccb9a032d4a61fd9b3145189a51ec34176776bdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649677, "uuid": "d0a45b4e-9e80-442b-a164-6f32aee10127", "comment": "Malware payload", "value": "225968046d784977978f075342959d03b02a9270fc41ff62185478756f67536ef829ed994b3f62b64cf28e2c781373f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649677, "uuid": "dc8fc8fb-397b-4536-aea0-23ec6580cbce", "value": "T10404DF223BD1C072E32756345D61C2B29B7BBDB146768AAB3F94066E0F752C2DB24317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649677, "uuid": "07852db8-a532-402a-ab9b-c3a98483a03c", "value": "04d4ff0968f0d2d964fcf7ad4ec4e8a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649677, "uuid": "1af5dcac-b630-48db-8b4a-95c6d65dd710", "value": "3072:MOydQClFLmVyYAUTV3UvsEIOiN751NgnflCupS8SupG8Vlmazp7r:aflUrLTFA5M9YnflfpS8S2C4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676649677, "uuid": "6e9f53a2-7b54-4b83-932f-1a26ed1b2c9f", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676649677, "uuid": "5ea782d6-3593-4c76-a7ef-700c8e2c9879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649677, "uuid": "aec18726-0e05-4762-84d1-ee15437d7857", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a42ede-aed4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676646195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646195, "uuid": "9292ab1c-fe1d-4a7b-b051-a4483476fbfe", "comment": "Malware payload (RedLineStealer)", "value": "505000a92f9c2a8591ab3b028c2eb0ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646195, "uuid": "ee3a0368-d4d4-46d4-be97-a93cdd05bd19", "comment": "Malware payload (RedLineStealer)", "value": "8e2c6e4a6f2ae3ee09a07cc2bf71a17727853b29638fe1ea6d80903630502cd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646195, "uuid": "a573b471-b083-4942-9eb7-1f8cd6e29a3f", "comment": "Malware payload (RedLineStealer)", "value": "074bb38f02884d8ea7560aaa11a28daac32b45be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646195, "uuid": "71f03136-928a-4b9e-a8ad-bd4ee3cc0d9c", "comment": "Malware payload (RedLineStealer)", "value": "a448501e819542788b1f761aa7b7069ddb273bb49c5ed0458e2da70f0f8a72633ac91b0a4167858059d5b63110f87e05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646195, "uuid": "230991c5-a570-4710-aea9-2bf340a6b093", "value": "T1E554F0213BC0C436F21316399D61C6668B3BBCB185369D8B2F99266D4F357E2CB64317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646195, "uuid": "b624d015-c127-4f00-aa2f-260b2fe94034", "value": "04d4ff0968f0d2d964fcf7ad4ec4e8a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646195, "uuid": "1a00e109-f05d-4514-af25-7eabb6e39d74", "value": "6144:psnySdfas99m1MF3+Vkn5bjkZ+hmPOn6mtB7jae:psTFaD1+3e+kPOn7XT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676646195, "uuid": "83a96801-b864-4aaf-875c-15347c941179", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676646195, "uuid": "7dec6789-1d14-40cc-90a6-7df135374b9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646195, "uuid": "10932133-d96d-4518-8190-fb1730269680", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97096d3-aeca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676642096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642096, "uuid": "7c34b0fe-597a-48ef-b26a-ef157d1235b7", "comment": "Malware payload", "value": "61b0fdfc5f4a75112a4548d01601cffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642096, "uuid": "f33fa298-77cf-47b1-8401-ce538905cbce", "comment": "Malware payload", "value": "8ed63aac9e5077fe47d2593c87081b744ee3d24ca42debe78cf1e457c3782bc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642096, "uuid": "db528c5a-b27f-46ce-9794-45099df88094", "comment": "Malware payload", "value": "25e7d809c0836c492ed4cfdba11898f32d40dcc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642096, "uuid": "ecdd5618-fb41-407f-be0e-75383fa80f92", "comment": "Malware payload", "value": "08f342a559c9249e56f6687dbd1c4e4b57f4ab079575f86fc528ae1ae7a759d2de1c5b6e6a56a626c5c3a67250d2523c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642096, "uuid": "ed5cde1f-b01a-4b10-a77f-5bb78dd319ec", "value": "T118A44AD3B8451298E9795E73712B1C2617751FBA662C101CBACC328D09FD2723EDE86E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642096, "uuid": "7d871d2b-8480-45d4-9c83-eb09f952073a", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642096, "uuid": "33804e11-3dd7-4e62-8e56-99e77abae5c2", "value": "6144:CyIq+DpuPJFjJYILWt3yXx+tHckop1ZZ9Fx0wGkjPAFj3S7WX0FIOKPq:0wFjJnKlyB+tg1nbHGkDAxEWXqIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642096, "uuid": "e16ca542-c59f-4a05-a163-ecf235fc6211", "value": 470960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642096, "uuid": "bff38e2f-c435-4330-a266-4dd02d5ca079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642096, "uuid": "956606cd-b016-4cdb-90a8-e28cf7f92a12", "value": "2023 February Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6844d10c-aeb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676631679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631679, "uuid": "8b2eecc2-190e-4716-80ac-0058b6a1f0be", "comment": "Malware payload (RedLineStealer)", "value": "7e3806ffdbf28c18985713f6e45fbf78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631679, "uuid": "495e8601-487c-49f7-92d7-6fcfd25da9e6", "comment": "Malware payload (RedLineStealer)", "value": "8f09ac367359bcacad0eedd449c18c2d5ba210235b79abcf629e1c1494d93d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631679, "uuid": "87c010a6-1949-406b-81bf-02cdabd07e4a", "comment": "Malware payload (RedLineStealer)", "value": "5818ee3d4ed230912def067c2f8d7703fbc3043b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631679, "uuid": "1ec4b5a6-d693-4f7a-856b-790aecb970f9", "comment": "Malware payload (RedLineStealer)", "value": "3c0b8b7e834e9812431b6265f5c12e348b0d7238afce8d5938d78b835597147911481a3712df5a356edc6741b08be3eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631679, "uuid": "465fded3-1ef8-48a0-9273-18eaecfc526c", "value": "T1CF25120BB7ED8025E571477008F647C3053A7EA05B39865B778FAC4E2A72AB4A13177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631679, "uuid": "f54fac29-bf91-4761-86c9-05efddc2d8c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631679, "uuid": "d8572c00-3106-4adb-ae30-2d3b89485bf2", "value": "24576:SyMmixz2pVIQGuffhsXlnEN8IeMJr6roV4PPF:5MJzqWQGr/yr6roW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676631679, "uuid": "e87c65b7-519e-4cb1-bb24-4cf249b109f7", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676631679, "uuid": "24adfc30-31a2-42e5-86f1-fa325defaa10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631679, "uuid": "e8fba4b7-b27c-4bf7-a7c9-102055b5a9a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a03f80-ae74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676605180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605180, "uuid": "74728da5-6c9d-4c10-9265-7027237bd101", "comment": "Malware payload (Amadey)", "value": "c6902c4ac4b3f701da140e0419acd647", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605180, "uuid": "330fd393-1bb1-45e8-b590-9d89ca73ed37", "comment": "Malware payload (Amadey)", "value": "8ff820a0afcfe204de5c33fb528f80daee417b0cb1556d43c5636f6212a132a8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605180, "uuid": "c68eae65-8135-4ce5-8772-a2a64737479a", "comment": "Malware payload (Amadey)", "value": "0674e8f7c09a68bbeccd24f881462e92f611647c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605180, "uuid": "31471cd7-98f5-4e70-8e0e-65b6af7bf444", "comment": "Malware payload (Amadey)", "value": "56408cbdbdb0e2dac21d917e526530b22c331e2738f99d2471ba3d6e8c9471d66db3166c2f068e84a2f051c798d5eb0f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605180, "uuid": "9464c718-0ac2-4285-b2f9-c17f3cce7795", "value": "T1B1252307DBD89425DCB693B058FB07E30632BEE06A7483D71B5EAD4609736B46931363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605180, "uuid": "f86310ca-67d5-4265-9e38-14a6fbd82c9a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605180, "uuid": "821f2211-9858-4850-bce9-0268b501873d", "value": "24576:Uype6QscBBnGX9yzioaFliTvfWdOb8sU5pVn0:jpR1cDGNyzihETxb/+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676605180, "uuid": "65c76fbc-2d28-4646-9383-851715c6699c", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676605180, "uuid": "22986030-d43e-4a5b-921b-c4a565dda569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605180, "uuid": "3d498901-3e96-4d72-8662-5bd5a5539136", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93a63ed-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1676637801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637801, "uuid": "5988ab40-b68e-4196-be0f-51b172fb601d", "comment": "Malware payload (RustyStealer)", "value": "6fc8601b3c97548e88a32cd71ec0e4f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637801, "uuid": "e2169f73-4a08-4e83-9c6b-4ab8f801442a", "comment": "Malware payload (RustyStealer)", "value": "91e290977590ef22283b1b424bc783bcc4ddaa51d0dd8f84d9900701e2ba0eac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637801, "uuid": "84f0295a-474a-4ce3-ae64-75b953f71f0d", "comment": "Malware payload (RustyStealer)", "value": "19d63f346508f51056d793d6c097159b9c30896e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637801, "uuid": "682c122a-85de-4b36-8004-46565b1a1c8a", "comment": "Malware payload (RustyStealer)", "value": "ac01ef5456a6ebbab2569d350e2cee667b1c0ee7db69a18c4a13434d191c4db01bff32eef33f8fdb9e3f61b1dcd0e729", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637801, "uuid": "d2f40c4d-6980-4bd9-81be-0bccf822e1df", "value": "T12496E06B4BA795BBF68B23F3465E8FDD26AA5287D74F39CA41B11E0C1C28B017B401C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637801, "uuid": "be2ce755-3e75-48c6-b60f-3266465bcda0", "value": "74737a1c73116b0c6a3ee2f6399e6458", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637801, "uuid": "6d93e646-fccd-4831-bba5-db751cfedd05", "value": "196608:VFKFhGtRpxYAU6Hk98L09GHDaHNaSzREy7H:VChGB1k9t9GHDaHNd7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637801, "uuid": "ded3e0f4-0390-4edf-8be4-29646781cb15", "value": 9170360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637801, "uuid": "67eaf2d4-b492-444e-8a47-f36d126ba118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637801, "uuid": "9437b7c5-fc62-4dda-8d52-ea174929d521", "value": "6fc8601b3c97548e88a32cd71ec0e4f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b2d45f-aeba-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676635057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635057, "uuid": "5256f285-97d9-4da0-9c12-0f296ab2184b", "comment": "Malware payload (RedLineStealer)", "value": "524ee469fca6506361672a4daf55f53d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635057, "uuid": "bd32fd09-67c1-4b7d-9a96-b294531dbdc5", "comment": "Malware payload (RedLineStealer)", "value": "925b137f4559f121230433c1917bd4e81783c994b117dccec4ca3e4dd813792e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635057, "uuid": "d95d4189-4155-4816-892f-9a4b313a99a8", "comment": "Malware payload (RedLineStealer)", "value": "7200de6390d12149a7d49812a57eeccaae5da385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635057, "uuid": "5725a151-c615-47fe-b0f7-7f936f43db12", "comment": "Malware payload (RedLineStealer)", "value": "425eea7ddf918f337738ecd34518295184f202936c51cc54ee5d9b0d762f86a6e68d27e20759016725485298095595e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635057, "uuid": "754c9741-0d07-4287-8ee4-58cda334c60c", "value": "T1F8252217A7F8A026D4761B702CF603C3063A7E6063788B56374FED5A1C729A6B53173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635057, "uuid": "0fe3c753-5efe-4fde-852d-4d82720fb6c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635057, "uuid": "f2465626-960b-430d-8355-f38026788c7f", "value": "12288:KMr9y90PgzwqmuUE9B1mC+b2z0q1Yostn8edQuf/BwNtu/KB2FQ0tSNE6WLJ:fyFE4NRgb2z0q1YoO/1wOP20tqE6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676635057, "uuid": "64dc34e6-a50d-4294-b8d8-4af0f41ad96d", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676635057, "uuid": "a498a779-5e74-4d21-b2f5-2412a47d9ba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635057, "uuid": "105b9203-ac77-43ba-b485-d091c257213f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcb15c2-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627581, "uuid": "ec4fe66e-723d-4c17-9f3d-24f60402e33c", "comment": "Malware payload", "value": "3baffae2c9dc65dd0d956bf5876fa7c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627581, "uuid": "0e3e1214-fed9-4058-bab2-6ca7a7d687be", "comment": "Malware payload", "value": "92660d53f1e96c8bf22c97b1a5bff30c30d13e7ce0960cc63e312911ba6b9571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627581, "uuid": "4999fe02-65e5-42c4-9b5e-0e0e8bfe3c82", "comment": "Malware payload", "value": "8c7a24bdf9af0ec7efccc3713128c98f2c10ed9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627581, "uuid": "23cf6ccb-6ab8-4de1-be63-efa6aaff07bf", "comment": "Malware payload", "value": "ce7642049ccb152dc7a7d34cffd94eaf0157c5f1e4c335f3e56342573538cc4c424d4d9f6f617a9239ec2df0f07016a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627581, "uuid": "ecb63e7f-e0a3-4d96-ade0-b9d9556b3781", "value": "T1A7148DC1BAD8ACD7D915163885EAC32A273CF7C21B834B135834B6351E43BD16F8B56A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627581, "uuid": "8ce0f4de-0475-4478-966b-e0c911067c41", "value": "dae253036ba9d710a708001505bd2540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627581, "uuid": "bc13140e-a406-4352-b19d-f739f35ba1ac", "value": "3072:1Ux8FIcbAWsb4BQ9rQBEL/AV4uBLtInQIuBMSP:vqcqJrO4/AVpPIngP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627581, "uuid": "cb12fc67-1451-45b0-9354-3f9d69d206ce", "value": 206891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627581, "uuid": "e852e442-266e-4297-84fe-d8298ea066d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627581, "uuid": "52886b89-db03-4106-ad9a-0cce135462ab", "value": "openmyf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0aa357-ae7b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676607902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607902, "uuid": "e82686a3-718a-4b37-b9f1-0c8100a6f9e1", "comment": "Malware payload", "value": "2010786e1fec36c193195e16a6918c2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607902, "uuid": "5f63007d-aed2-482e-8d18-2c5998c573b0", "comment": "Malware payload", "value": "92beb79ea98ea2765c48e1ebdda43830dc3835912bf60679a300216b90af0cfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607902, "uuid": "ae3ea867-2cdc-4ea4-a1e1-8de7eec0380a", "comment": "Malware payload", "value": "3f7704b2bb63022ccaeba878e07deaac65e703e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607902, "uuid": "879cf940-165f-4f17-b9cf-cab538e8f70f", "comment": "Malware payload", "value": "78c7ab28312b019fa50388bf22bce67d6ec4b78f2a9f16e097d757adef9be80ad0fbf8c88442d2e4299ac81e064b6dbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607902, "uuid": "f93df22e-d90b-413f-b1c2-8e4524556c39", "value": "T14BE15102F7DCCD3AC8D2133D4CA70B1621B6E80097439F5B62081AA49E5B7EDAA26746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607902, "uuid": "1daf370f-2f5d-4ca4-af2e-450914c17e9d", "value": "96:fEAhidBIYub5jYU12pBNPpdrWU7o8gBzgoBe7/mEnw4g3:feQdjYxprP7ZyGoE7/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676607902, "uuid": "ef670cd1-71d3-4f28-a307-15af3929510a", "value": 7392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676607902, "uuid": "6ff8ef67-d499-4fc8-a8e2-729cc4343bc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607902, "uuid": "acddcfb5-0e25-4fbd-b3e1-4ca4fdc3f61b", "value": "givme", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e2954a-aec6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676640270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640270, "uuid": "25027c03-ed47-4d20-a986-bc523b84f5d1", "comment": "Malware payload", "value": "32d8ad4ec202e60388286c01b8c7f846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640270, "uuid": "2ef358c5-ebfe-48e0-8c95-2c31ac67becb", "comment": "Malware payload", "value": "9365c34ac64bccdf316421eb7036d4e8ff8f928161423fae14f1dc5bfda48b66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640270, "uuid": "85f19427-db3d-48dd-802e-10b05b5bef7e", "comment": "Malware payload", "value": "32b3c1379eed70a7178eee83f2ccce18b7ae06e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640270, "uuid": "eac80fc6-fe6c-45d5-b6d7-8620714017df", "comment": "Malware payload", "value": "8cdd3920ed42948688712672d383dd759b7587bd915802bb7a198669461bc64f02f6aa8bda928a6bea089b2bcee8c882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640270, "uuid": "c8bd2427-8de9-4bea-978d-a555f08f4e30", "value": "T159779E0372A501D6E8B7D238CAA70103E772B8674731CADF325D02552FB7AE09A7E765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640270, "uuid": "a954a023-5901-41a0-8deb-157010297613", "value": "d497faed45c9de6c7efb2773034405f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640270, "uuid": "4fb1bf3c-c02c-4904-86fb-320017b74fac", "value": "393216:HIko+ArmqoQNVOlQgforYYqlWVLGGEkWQ1s3B3gGGbYsOnVORvG+0CcLSCVEXWkw:HIdrIyRsZGOVOt0CcLEXWkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676640270, "uuid": "b1069309-df48-47c5-a4e1-309a660a3832", "value": 35651759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676640270, "uuid": "93dbc8c4-6050-4a73-afad-46e526d3dd01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640270, "uuid": "fd717046-2885-48bc-93e8-55da51ca5364", "value": "Santander.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22050c40-aebe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676636715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636715, "uuid": "3cda09d7-ca44-4f57-8110-f03babf7c825", "comment": "Malware payload", "value": "7c3f2d857a7a817eede3fbd8691e631a", "object_relation": "md5", "Tag": [ { "name": "CargoBay", "colour": "#2C84F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636715, "uuid": "fdd92f2a-8cf8-40ad-89a3-e8d678f98abb", "comment": "Malware payload", "value": "9432024a253af6bbbd19d011547117edafff8a18b10c0ac739661999ad9ba2a2", "object_relation": "sha256", "Tag": [ { "name": "CargoBay", "colour": "#2C84F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636715, "uuid": "412d1ba2-3e09-4abd-aecf-48e89a39f176", "comment": "Malware payload", "value": "5e78fe0ce0f10b2560fa582dd645794aec9126da", "object_relation": "sha1", "Tag": [ { "name": "CargoBay", "colour": "#2C84F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636715, "uuid": "145e7d4b-cfec-4ea7-80b1-1c696aeac584", "comment": "Malware payload", "value": "4f742c20ece26d53d13a6409e7c512de36945eac7f395a26ffe8161b367935d3bad17db88c358a5aa21fa38e42033c33", "object_relation": "sha3-384", "Tag": [ { "name": "CargoBay", "colour": "#2C84F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636715, "uuid": "5aebb723-dcc5-42fe-af5e-c41f411a2b38", "value": "T192858D03F6918979C46AC27483479B36AB71BC490725F7EF17C0BA223D26BA05F2D758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636715, "uuid": "6d552c8e-63bc-4731-acce-bac1298f4f88", "value": "c8cbbfa6afb689d4814041eab249c459", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636715, "uuid": "1352f0db-2731-4072-9850-2c2a75aeb402", "value": "24576:vQ7sPOjWwJiswOyL9Ko8iCHhE3Y35BsxybxS9/XCQn6526OaR9TmcMljVIH06iyh:I7sPHw1yL8Bd3ksxS9/p8n1MXIU6io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676636715, "uuid": "4765cec5-f606-49f8-b561-5c8ff0510974", "value": 1847808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676636715, "uuid": "b8c7ce3c-0832-4841-881a-bd95faeb7bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636715, "uuid": "f9a96fae-00ec-4b60-953a-5ad31e6c7e97", "value": "9432024a253af6bbbd19d011547117edafff8a18b10c0ac739661999ad9ba2a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51736cc9-aeb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676630782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630782, "uuid": "229b82a3-dda2-4c22-a1d7-42f6b83bbc2c", "comment": "Malware payload (AgentTesla)", "value": "ae1a7338a05acc69f940b1ff8fd64f6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630782, "uuid": "81616f90-6751-486d-9e0d-01ab22f80409", "comment": "Malware payload (AgentTesla)", "value": "9450b0c1420aae6d8f00f22aa358eab37a25eaa209f9e28ead150cdcb0508023", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630782, "uuid": "9f44bcbb-fe90-497d-b435-03bef1596002", "comment": "Malware payload (AgentTesla)", "value": "53db629c5163b9241a32c7def753efebff3e4812", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630782, "uuid": "13839da2-5ea6-4c88-96c9-f76657fefeb9", "comment": "Malware payload (AgentTesla)", "value": "46b778998bafe95e60084381880f1daec933c6adb7d4e4c7583947d2b45a7e7c72dce2ef127fd54eca1f3e09183bd3d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630782, "uuid": "68532fde-a4a8-4962-9d31-aaefd99ec532", "value": "T1DA055ACCB1F0F67ECA06C936AB103C14ABE065536726C592E267B6D99F3D4638E1C472", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630782, "uuid": "4a716548-af2a-4213-826f-6847110421c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630782, "uuid": "a54078d0-08dc-4bd4-a401-c7a20e432179", "value": "12288:pUjqDSuEDsv9tL9bRpMs/xe24JVyvD1xjOnRVLk2WDsv9tuu5VjKG5xx5ye8Cy2N:pUqDSujxBxQerPOVL+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630782, "uuid": "3bac2642-09d9-4469-9432-0b7e0f945fed", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630782, "uuid": "2f2de5f1-0376-42f9-ab16-c7670626c09c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630782, "uuid": "e9e5ec6e-92e9-471d-a9a7-d61127717352", "value": "Delivery Receipt.rar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed4defc-ae96-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676619771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619771, "uuid": "a5e54af8-c60b-47b1-8b32-474019be480d", "comment": "Malware payload (AgentTesla)", "value": "59d6108b01775149ab2108856e8181f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619771, "uuid": "866bcfb0-f86b-4afb-a2ad-ac77e09db92f", "comment": "Malware payload (AgentTesla)", "value": "94c16c1992a87e6065a9707b3cd260b4122dee7b641421136ebf4b97799c280c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619771, "uuid": "1bef36ce-d167-4e73-8e27-7f09554e9a35", "comment": "Malware payload (AgentTesla)", "value": "9651c657b9a1e06be408737a8106f02f08542a5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619771, "uuid": "6bda69fa-05ff-4cd6-a423-fdce61831c27", "comment": "Malware payload (AgentTesla)", "value": "3ff204b2232722307cb02812b0816c8d46d0c601e7c8095f9e3bb76b1924724559dc03eb8d030e8888549e493fb3010e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619771, "uuid": "477ba004-c4e9-4247-9416-02e51dfc71af", "value": "T1B7B4238CA6C204ED5D9F7C9F99BBD714C6423B6CACD82EA0B5CC059325C847423D7B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619771, "uuid": "deac4d1b-ca89-4610-b6df-187a68a860af", "value": "12288:506NjwRQxEAXYseOXFxta71/TnCaKDyGvw9Lr2MN:50Mjw+ubAMZTnIyGw9/2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676619771, "uuid": "4bb1bf6d-c813-4c3d-baf7-58b30c2863cd", "value": 523731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676619771, "uuid": "b047a126-31f5-42dd-9d76-eb9b1224ff43", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619771, "uuid": "b3defb0c-499a-490c-9790-4de2aaf48314", "value": "PO#3210046374.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f817f51-ae59-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676593439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593439, "uuid": "bd10dd9f-9e18-4733-b5b1-5401bab190e4", "comment": "Malware payload (Loki)", "value": "b5aaeb48aa761e373257a7caffbf37de", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593439, "uuid": "9a36f1ad-75c7-4fa7-8591-d7d7986262db", "comment": "Malware payload (Loki)", "value": "94eaadd216e1f459f8185b9f8cf7fdc61bf981e845cb1e6e9b982524ade8a1dd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593439, "uuid": "ef15fc67-58cd-4a76-b8c8-812ea54e36bb", "comment": "Malware payload (Loki)", "value": "84731b4cfcc84346f37e0afcba5ba0aeb3ba7a0a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593439, "uuid": "c33cdda8-f2ff-4efc-8f05-7b1c3d191eb2", "comment": "Malware payload (Loki)", "value": "9a88a31c51eda231fe5e7fb565d020d9cebf4d9cfa6af43c14e43154c4388f2a6e17aeb792d9e5382724f16fa732480f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593439, "uuid": "2100c108-1efb-4d64-b068-f66f6964f457", "value": "T18B722B510BDC98F1E359D5738239850E4ABEE07238579AD8788CD45137BD20E4FF82B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593439, "uuid": "48eab6b7-ee59-4404-9847-9b0fab6e1ce6", "value": "384:Qii6qE9YMKVo4TqkafsOhg3UkcZWUDZZs6u1HFXXgXkTAyd:LiXlo4Tjafnhg3UkcYUDsjXdEyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676593439, "uuid": "58773234-854a-48d2-980b-109a64f62f59", "value": 17021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676593439, "uuid": "80737425-7eab-4761-a9da-8799c4d221fc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593439, "uuid": "b3595650-c99f-4fb1-be74-d93a4d59fb28", "value": "O.DOC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0eaa1b2-ae7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676609897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609897, "uuid": "225dc62a-35ad-48c0-b268-7f9691d2bb1a", "comment": "Malware payload (Amadey)", "value": "924874b3383a89ceb92a4c501c9ed799", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609897, "uuid": "3ce3ace3-34dd-4aea-9068-3470ef801dba", "comment": "Malware payload (Amadey)", "value": "9509f8a8d0ca53bf7f3c3a03ea9cd8c65e74c1dc686f0f2b6440fdcd2f184b5e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609897, "uuid": "86aef908-63af-4b1f-950d-d5cf67b56d00", "comment": "Malware payload (Amadey)", "value": "f976a8cee08b74c7f0b38da9cbb1844a21fcaf43", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609897, "uuid": "aec65caf-aeb9-43aa-8ade-8d79c4d530ef", "comment": "Malware payload (Amadey)", "value": "e44b87ee4efcb946ebd4c1a9f096664cd2568e831a36ae760527ee786ec4b84f50f7dbe6c6d0e5b69f58ecddad9ba3e6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609897, "uuid": "ff3d37c4-b59a-4811-9764-bf600ad32d2b", "value": "T104252307F6D89873D8A1937019F707D30B377D51CA7486A7368AAC1A4C726A0B7713AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609897, "uuid": "9bbbce0b-62d1-49d6-9943-29bff51c3fe3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609897, "uuid": "20961c8f-75a1-4d02-b3bf-2f283371ba89", "value": "24576:syOBVA4sPyM4nhBRL1zxkGmYPwn1+RI9HmKA:bOBsPyLx1zx3PdOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676609897, "uuid": "a2696c90-0595-4d3d-bd39-6740d5d13ea3", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676609897, "uuid": "c663f9d1-7371-4811-a32a-657afbd24300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609897, "uuid": "093ad1bc-e99c-4497-aa87-53d435bb030d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98b2e7d-ae79-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676607361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607361, "uuid": "20fa0718-3199-4e87-90c6-e149aebfc06f", "comment": "Malware payload (GCleaner)", "value": "4c87461caff43c17f64e7cac9ced159e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607361, "uuid": "d68c0a08-3a23-4dd4-ad55-aabede7745ef", "comment": "Malware payload (GCleaner)", "value": "95129971e04dca04462ef5db4c6dca1f6bf4d6132ca17e90ae197a302817ca94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607361, "uuid": "31526dc3-eaac-434a-85b7-6f7bf1b5fe61", "comment": "Malware payload (GCleaner)", "value": "36f8c63880aff9f052fb92b700effa7ca864cf9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676607361, "uuid": "d4e68463-bdea-42f4-a763-7f19c263ae91", "comment": "Malware payload (GCleaner)", "value": "aee6566891b37fcbf0370c5e6db3d609eb619440bdaec84902985c8f7c146afb74d895e6b293f76c62f2f41e6ad24b08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607361, "uuid": "93685b45-156e-4b30-a3bf-7fa785693f13", "value": "T105D523CA6514C9E2D7FCCFF0B91E84E878B37D47D2E0106B31987A1AB532249952E36D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607361, "uuid": "b330aaf7-1f06-4057-ad9b-4b233f7eedc9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607361, "uuid": "8c53584c-49e3-44b6-baa3-e2abe4476ad5", "value": "49152:XHQR76qQISK247xf6cjdrgLp+K+qfvKXYo5DsbiSfVBNALCgv2MR:35qQISKB7xfZgLp+AfvKIoVsbiSNLovV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676607361, "uuid": "882d93ae-dd63-434f-a0a6-db36286f8515", "value": 2952210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676607361, "uuid": "b1426334-e383-4d15-b778-75620b5a6a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676607361, "uuid": "985d79f2-c636-42c9-9d16-7a036e732dc8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fa2eab-aef8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676661629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661629, "uuid": "2957dda8-9db1-4900-becb-41f6512ae581", "comment": "Malware payload (RedLineStealer)", "value": "9f6407ecf881a360a50e2905c7a703c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661629, "uuid": "6fccab5e-e169-4672-aa1e-e6829c3aff29", "comment": "Malware payload (RedLineStealer)", "value": "955f07166da9dde071b0fadc211e72e78201bea6bf064fe12097cd9d327c14f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661629, "uuid": "f0e9544e-17a4-4eb7-995d-74924c42166e", "comment": "Malware payload (RedLineStealer)", "value": "c76781e2c95a5045a9bed1d93ffa996624e66772", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661629, "uuid": "f01f2e02-86c4-4aae-99f4-6dca381899cc", "comment": "Malware payload (RedLineStealer)", "value": "b2a1e93ff98d60baed1f611e2eeac1d8e4e029213626c104105b3ce89712076c9c8c1adfa94710319e2336d81f0662ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661629, "uuid": "4efc3cc0-55d8-4320-b097-2c00650a808f", "value": "T1F6E41247FBF98021E9B04BB45DF703D35539BD515A38835B239EAC0918B2AA4B632737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661629, "uuid": "739f59dc-3150-44bf-b056-52a49d97e606", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661629, "uuid": "c812dc20-10c2-4531-a9b4-dfb9c9630903", "value": "12288:9Mr2y90juaVgVxQrevTh/affb+j9k11mQ9e8f6xvD9WkNa:TyOlVUvTh/cbQoX9VfAvDXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676661629, "uuid": "e4e0dcc7-e7c4-475f-ab7a-28421d1b5df5", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676661629, "uuid": "f7ce42c5-0975-47b0-9745-8f703bc36dcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661629, "uuid": "6d1f3dad-5c27-459b-807a-251b4318739d", "value": "9f6407ecf881a360a50e2905c7a703c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7219304c-aeca-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676642003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642003, "uuid": "aaa89ed2-b5a0-4853-8c37-56879755faea", "comment": "Malware payload (AgentTesla)", "value": "7c4fee36ff71dc4420363cb50eeb45eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642003, "uuid": "98aa180d-9ab1-4457-a8d3-078c594e4583", "comment": "Malware payload (AgentTesla)", "value": "965f7ef334e44c4a843469061bc4b759693656fc7f7277415e7a156fbc5f414a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642003, "uuid": "ee88cf88-c95d-4d82-8abb-f4a497b0b906", "comment": "Malware payload (AgentTesla)", "value": "79ec8be3613bf2e1f9280cc52697fe755d5701ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642003, "uuid": "5bb9304f-e87b-4bb4-afd1-fc1dcafe720f", "comment": "Malware payload (AgentTesla)", "value": "42e00458541a4476477d3d9c01004cb9e95f654deb309be606f20e146b2fa11bcf3e7c95e7e98f6ff2a0f887265ff3c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642003, "uuid": "d1649c8c-79a8-4b7b-bdc7-bd17f4ad3a47", "value": "T1746423856965D187E97002362E3C09682EF9AB13003867DF7B94DE563DB2290CD4F7FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642003, "uuid": "4009bc8a-a870-43ee-9b75-8bb696dfff79", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642003, "uuid": "3ad6eb9d-c7a5-440e-82cf-5f73655233c1", "value": "6144:/Ya6HGsaQi5kESFbT2F6unX6huLM/x8cipUSZO9OUJHDI:/YdSddGY68X6AQ/qfpUWuJHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642003, "uuid": "e5fc254a-dba1-4352-954d-d142e723bad4", "value": 319595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642003, "uuid": "ead2371e-03eb-46dd-9505-6f94e1eabbf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642003, "uuid": "9042ff55-854a-4736-8ae4-cc8cb5736bbd", "value": "TT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fed6316-ae59-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676593359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593359, "uuid": "80bb0158-f509-4409-8947-b617cad9b1a3", "comment": "Malware payload (Amadey)", "value": "3169005ce473bce48550885785a99c41", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593359, "uuid": "a2137d6e-744c-4e71-b1fd-cc3a1953e062", "comment": "Malware payload (Amadey)", "value": "972cbe848e9da0922bb7320b9c109ccdb136f6525e7eb5dba007238b980b7d49", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593359, "uuid": "5834c067-36f3-4b95-bbbe-21a41012a5a3", "comment": "Malware payload (Amadey)", "value": "3a575c729b94da0f63e5f0079f1e8f22a0a8a393", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593359, "uuid": "d54625a8-03c8-4bc3-a94c-d4e8601d7a2b", "comment": "Malware payload (Amadey)", "value": "91f5e09e8503441474deba0fd07098f69d52058a33b0fb30b217fa50f189eae0eafe5a0c54322c9a514aca050ac707bc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593359, "uuid": "e4cd46b3-d134-4db9-876c-da2321b1edb7", "value": "T12625220BA7C89532E5B807B05AF603C31A3E7D71577C8387178A9C8A28716F1B97572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593359, "uuid": "155c3382-0627-4225-ad9f-75010d04e72a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593359, "uuid": "f51d4ea8-2c69-4a54-adbc-ac3b1ff53cec", "value": "24576:Fy5J7ERKLXkDtjft2I3ZnnWOLSioFQv34:gPE0L0DJV2I3ZnnFLSdQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676593359, "uuid": "ecd719dc-605d-4945-b9be-f6737804b0e5", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676593359, "uuid": "0a88fa78-fe3d-429e-9a71-7b032167d6d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593359, "uuid": "3da6f670-525f-41cb-be80-e165029614a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799c437c-aea9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676627843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627843, "uuid": "a48ef256-6125-4355-bfba-e6b1f4097168", "comment": "Malware payload (AgentTesla)", "value": "9b7419d8b44f89375fb02dd084e21f06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627843, "uuid": "65643f96-3617-457e-9d51-8cfe6a0fee21", "comment": "Malware payload (AgentTesla)", "value": "979e0d45ebb5200e404716fafe0dadf27aa4801c7d99b3bf4088fefa57745f5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627843, "uuid": "5d63af9e-4f2f-4d4e-ba9a-412c946cea0c", "comment": "Malware payload (AgentTesla)", "value": "69b7028dc86ed51392e0595fa0e312bfa6f67935", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627843, "uuid": "e2bd0c39-11dc-4595-86a3-d64117952c20", "comment": "Malware payload (AgentTesla)", "value": "acfe2034412a35be493d19d9c395bb5f03d77032b02baae1309e6b888a7369213ef5e43fad5f352715695f42258bab93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627843, "uuid": "2e5327c4-36f5-42a2-ab8a-c0ad6cf9dd9c", "value": "T1415423412945AC55243EC52D2E9FC29B22FEDD0554C10F4AB6D7A1A4BF89B36C888FBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627843, "uuid": "efd1a067-f65f-4fcd-93bd-e28f40774e25", "value": "6144:8StHkeQVOdGMjVXV7b7aCOTbuXbpMCEZx4kQA51XM4:FtEhOwWbumXbpzEzp51XM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627843, "uuid": "4400f6da-0081-44a1-b6e2-e3d65958fa85", "value": 304611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627843, "uuid": "f3682c65-7f7c-45b1-bada-6b841e476b46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627843, "uuid": "e61f135c-b815-47d4-b65d-e0d744e17366", "value": "DRAFT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f501d3b9-ae75-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676605716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605716, "uuid": "93e00476-b387-4c21-ad58-29b8780e1875", "comment": "Malware payload (GCleaner)", "value": "bb42a2477a573187339196405e7d544b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605716, "uuid": "cc5fdf99-fab0-42e9-ba9b-45efb3776906", "comment": "Malware payload (GCleaner)", "value": "97b2f093b148748d5e82836f9e952709bce1b210c6f517adab4e209bb6183a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605716, "uuid": "37844e48-9e18-432d-82d0-27a2cc38f316", "comment": "Malware payload (GCleaner)", "value": "379dba11c2a2e922c6fc9fbad7b943572d475a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605716, "uuid": "45e8cd22-5c24-42f0-b003-2e7b477ef166", "comment": "Malware payload (GCleaner)", "value": "eb76bd7f8e509d0029b505d648e7f8b72357408bafe35a257f01c6b731012d6053192fc5bdb552381ee8da242aee51ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605716, "uuid": "13fd01dd-1253-44d9-8589-ec3affa3ac07", "value": "T1F3E523E28240D0E7D7FCEFF0E82E45A534677E97D5F9109B75643A2E743212CA88E648", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605716, "uuid": "8294d7fb-bbd4-44ee-bd54-ce63caa10d7e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605716, "uuid": "83952450-902e-4fd0-9e80-d803d598d2b1", "value": "49152:XHt/VhOEYuZaSxFJ8zT/TPj3JAaXFAQDwqZfLP3O8TJD75Wed323VbUz42vS6gRI:3tnYoaSxFWnPj5AaXFAQDwqNLPe8TBAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676605716, "uuid": "8da44c34-1d9b-41a6-a521-1e14d6bb8644", "value": 3137056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676605716, "uuid": "a30a819d-bd78-402b-961d-fcd8cf890ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605716, "uuid": "a7ed2427-b89e-4c26-98d8-58a3389cc089", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3a0be5-aeb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676631281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631281, "uuid": "02dd7411-4b25-4a21-a2f2-ccad0723b1f5", "comment": "Malware payload (Amadey)", "value": "42cc3a5b3764bd0e4b1c5c3c2e5dd500", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631281, "uuid": "7402fea2-a0a8-41f4-8eb5-56c63f92dbb0", "comment": "Malware payload (Amadey)", "value": "9985828408d9775743f0ea77d02951e117916846460de2f2b9367853c33ae034", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631281, "uuid": "f737bed4-66e5-4a0f-bbb5-d76630f593a6", "comment": "Malware payload (Amadey)", "value": "3809972cdbfc8a55e986059394241b993a27c658", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676631281, "uuid": "765cabc6-e14b-4d7f-82dc-2d8c42d12c82", "comment": "Malware payload (Amadey)", "value": "cc4d23bbd7e7567b2deb36570f48374c331ae19051d06cc23aeaf95d02b88e4f68a7217ca70be28a841339b102ffa2df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631281, "uuid": "6c1f726f-b6ea-4444-8232-2ea7518cbcf3", "value": "T11525221BE7E88122D8A567B169F245C302357D709BB8C6CB3A49BD5D0C322F0A6317B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631281, "uuid": "1eed1155-477c-4f2b-9a95-931151a4fc05", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631281, "uuid": "554a9676-5c38-4505-a4b7-22a18bc63bb1", "value": "12288:AMrzy90JJYaI/y9qPSTcYf5F/07DN4x9itDUi1g+4sSavzns0iMPAPZjZ:DysYz/ywahRJnnczntRA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676631281, "uuid": "c9983934-a7b9-4f2b-876d-522f0c61c2fe", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676631281, "uuid": "1de51ef2-e44f-4e5e-9571-bf5cf326c3fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676631281, "uuid": "29cf0fde-0b0b-49b7-8886-464d74515b08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ea7727-aeac-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676628932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628932, "uuid": "c81f0a4d-500e-4f22-83ba-75e61e5c6c9a", "comment": "Malware payload (GCleaner)", "value": "448d0d007c19479a6e24cd75b9190bbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628932, "uuid": "e72dd164-3d63-4355-a7aa-f9471478c5cd", "comment": "Malware payload (GCleaner)", "value": "9afc81080a8453f643f34840d53621806eb7f3a2a61b7aa64773564cc174d373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628932, "uuid": "61a36aed-a8b7-4972-9477-619b0171f891", "comment": "Malware payload (GCleaner)", "value": "cc635734242c1fc0b74c149d9aaa4f10e4ebbfc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628932, "uuid": "19358ca3-a956-457b-ac53-8c050c3ba783", "comment": "Malware payload (GCleaner)", "value": "57e4d34495a2988f3677b631cb114190a389b44f9233fe618dfb2b3166d85079c626e2844156880124a244dcd64b872b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628932, "uuid": "a28ea19b-5a6d-4db1-ba17-e31cf3560884", "value": "T13BE523D256A4D0F6C3FDDFF1BC5E05B07877BD23A2E1051739867A2AB63119EA48E108", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628932, "uuid": "249b5e34-4d3c-48c2-ad5f-3530b40c1afd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628932, "uuid": "5b2f1a79-c92f-4aad-8f61-9b0e3f96db5f", "value": "49152:vN0fe0Rv1VesLhYSG/WhFT6MnwZ4q0ailzs1CuIGdKZIEZDACYW6LRp4BlvheOjP:VyjosFYjezEJ1CuhdKevRW6gldjjBDvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676628932, "uuid": "d818a4da-a772-47c8-9298-9fefc98e84e1", "value": 3087671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676628932, "uuid": "5fdd7282-b392-46ff-ab7d-77b78f5bdb87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628932, "uuid": "9163973e-45c5-4184-9b63-91a64529a7e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f70fc4d-aec1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676637972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637972, "uuid": "c307e0c0-888e-4779-91bc-59ff40b0f881", "comment": "Malware payload (Mirai)", "value": "99f76d2161a178e6808be262806997b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637972, "uuid": "36dac902-5c3c-43c3-a9e1-80afd7ef4945", "comment": "Malware payload (Mirai)", "value": "9b9d035c3cfe5aaa28c91dc752f66c2b0c8eb9750ecbc61d1d0688b72f160802", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637972, "uuid": "14763489-a404-47b6-b443-62efe1143780", "comment": "Malware payload (Mirai)", "value": "db6efbd572dd065acb34ce68f1b07077609eefd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637972, "uuid": "9d33e314-8bfd-4e05-abfc-91fa774577df", "comment": "Malware payload (Mirai)", "value": "285e8fc0ec921a36576c49b05ae4906886ee66c6603b72bd61f987376cce4e9ef9e93a9e162742c990049f31bd117b5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637972, "uuid": "22d592ed-a8c1-499b-bdcc-84a22450734d", "value": "T183632851BC819A13C6D1127BFA6E028D3B2613E8E3DF72179D225F2037C696B0D27A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637972, "uuid": "5ac90383-540d-45b4-9cef-cf3e5be7d72f", "value": "1536:ONKlxkmiig51kRmO//kWUzOviAsDwY8rNRuVAvvWx:ONDWzk1KviAsDHaJv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637972, "uuid": "c8233902-b982-42d4-8efa-b511dec90032", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637972, "uuid": "1a050fb3-af2b-4e06-aec2-34ea463a8286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637972, "uuid": "a49b2366-88f2-442c-bca4-21607ae7e9f7", "value": "99f76d2161a178e6808be262806997b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb38ba3-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676627423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627423, "uuid": "d84bee39-59cd-4587-8070-b96dce96dfa7", "comment": "Malware payload (AgentTesla)", "value": "242bc4ea23bd6e30191f82d3bb2bbf9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627423, "uuid": "6658d6db-d194-4d1c-88d4-6dd7b7920e5d", "comment": "Malware payload (AgentTesla)", "value": "9cb9879c7e69ffbddc7996aa36c506ae6870c1226ec4ee6df8bdab7d50e89911", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627423, "uuid": "0a55a514-c3a4-4451-8147-071b5036d5ee", "comment": "Malware payload (AgentTesla)", "value": "575c8d1949d6b4bd87769445ef44ce1618558f0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627423, "uuid": "17728ed6-0061-48d1-9b35-a2d6245f10ba", "comment": "Malware payload (AgentTesla)", "value": "3b7fc5a36634a7c9ddf5cea20391c2ed5b9aa8d665a0fd81db29af595aeefc0c6784ca6a6403fc692035102dca09187c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627423, "uuid": "c0e8b910-6b1a-4da4-8f68-8abf119cc9ed", "value": "T19B6412307AB0C46AD4635F326D322B5297F9F81A02D8870A17B159E975739C1DA0BB3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627423, "uuid": "c7ba78d6-513a-4410-9454-55660123d6e9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627423, "uuid": "df709f6f-4d2f-46b6-9773-a12e38b7d6ff", "value": "6144:/Ya6DQwb9iBXP1OYtwxH44Nut5ub9jO2NgCzVHKKzblfA919lE8Gkmew+cTi:/Y5hAlP774NY5nmgeVHHzZfqrGPZ+Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627423, "uuid": "1dcb5d31-2192-4b60-af9f-cf4995e889b5", "value": 319954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627423, "uuid": "efd93bd4-feeb-4e81-a736-1463c8afebfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627423, "uuid": "0eb1842b-8efb-42f9-9864-eaaa02f70753", "value": "TT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7026dc1-ae81-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676610766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610766, "uuid": "7ff921ee-488c-46fd-8f3d-26784a277c0e", "comment": "Malware payload", "value": "ffe9c9761c4cc62f8a10ce169de46f20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610766, "uuid": "710e4fa2-ff0b-45ca-85a5-f3bcebc9b0a0", "comment": "Malware payload", "value": "9d0863c76aa5212eee67a9d8e8fa25547d9c99e9c47286027637fb50812a1110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610766, "uuid": "94075c5e-5fc8-44fe-89df-735765e4076f", "comment": "Malware payload", "value": "377e65ddd6c05a3da8ddd9573d16b7c6d36dd193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610766, "uuid": "5e15c982-062c-4fdb-8d2e-72b5943af018", "comment": "Malware payload", "value": "49076b1e59f1280cb3002622268134f03ff1d6415bd93e0c1b66f1df0cb2cfd91a1772ba4182f565a2fbd69fd6071d1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610766, "uuid": "e575a803-13b6-40c3-b1d9-c5dc79b3a466", "value": "T1B5B4F122B588C032E5E312354B66EBA61D3B7D35976664C73B852A6E6FB33C0D234347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610766, "uuid": "4d87d9bd-6e31-4756-a8dc-ee0a385a9492", "value": "6dca3e9fb3928bbdb54dbce669943ec8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610766, "uuid": "9d3501cc-aefa-4e3d-ba16-9687b155241b", "value": "12288:tv1hatp3eCuznPOZo2dcSvLe44VzqdNZ:tvitMCuznGa2vV4JAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676610766, "uuid": "316ccfe5-9837-4790-a896-42311e8b43f3", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676610766, "uuid": "0ad9a0e6-d577-4ff4-b7b5-db303e4609cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610766, "uuid": "70747bb5-d21f-4f88-bf12-90807513a1ae", "value": "2023-02-17_ffe9c9761c4cc62f8a10ce169de46f20_mafia", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4cf740-ae69-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676600574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600574, "uuid": "9c7b8f81-85f9-43d9-80a5-23fdf97c3983", "comment": "Malware payload (RedLineStealer)", "value": "4343b42a4eda05591826ee8e3a992f84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600574, "uuid": "90d10d52-23ea-4789-b165-a1f0546f13a8", "comment": "Malware payload (RedLineStealer)", "value": "9d8bcfa6c26d69d4e54111cbb36d4df396261f2fcdb42fb02224363647dd3bc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600574, "uuid": "fc1ea7e1-be99-4712-b626-268bd43e4f26", "comment": "Malware payload (RedLineStealer)", "value": "34275b3fcb1f7ba36fa160b4182bacf5088e5e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600574, "uuid": "acd136e6-3728-4dea-a537-4ee6ff002933", "comment": "Malware payload (RedLineStealer)", "value": "c7366953339f3f7c762e0cd16283087bbb223a1290092f01fde648bdb40bb1cda5d83a086fa050551cca6451b4d4ce08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600574, "uuid": "97b0d656-929d-448c-aaab-43a23aca254b", "value": "T114E6FC9C726072DFC857D472DEA82DA8EA5178BB931F4213902715ADEE4D89BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600574, "uuid": "2b726f8a-5530-4d3b-be71-d4fda384e3fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600574, "uuid": "64466063-74b5-4124-a318-2dab0f22e127", "value": "196608:ge1KvwkWNU1qfP+tY685DxebtjBCpRdAlK/0F6:YvwktoJ5DaxyRdAlKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676600574, "uuid": "e26e5b23-a0eb-4bdd-b8a9-9aa569dddbbf", "value": 14610361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676600574, "uuid": "b698aa4b-33ae-4914-8f46-046531edffe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600574, "uuid": "1dece9fe-3cec-4dae-85bd-fa7aa3c1be09", "value": "[BLTools v2.3.1] CRACKED BY LOGSPEKKER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5c2968-aee7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676654345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654345, "uuid": "eba0d9ea-3390-4281-8a4b-b3d3b1bd37cf", "comment": "Malware payload", "value": "14190893a8f0187a22c7a2377933c473", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654345, "uuid": "2a987d97-4b5e-4a10-91d1-a8530ce0dbea", "comment": "Malware payload", "value": "9dea67b837119d55b029a37c62df879271d2a6dea9313d0a4256e213bc2a62f7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654345, "uuid": "16fca127-2020-40d6-8947-58e4311730af", "comment": "Malware payload", "value": "bbb5101fe424d910c2f780ff9cb82565dfc7e47f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654345, "uuid": "9b4c6b79-bfce-41a2-8604-b04c1a56fd64", "comment": "Malware payload", "value": "323a03e4d744e354c17e8014b3087a8d4e93c5560554a265b67666d4016d9fb27a67f73b6159c2dfaf532c008abe84e3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654345, "uuid": "30840976-5e4c-4963-9ec9-e8f1f3ceb4ec", "value": "T12362CFF241F320ADC71E09BC9B88F389566FA764D2DD75CAE0BDA07855C463AEE1018D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654345, "uuid": "ff0a84e4-fe9b-49ae-8dc9-614695cefc71", "value": "384:HgfvChWRKaFum2/KDfybrkTFH8LBsUjLD5rOgr8Qr:A3SELr2/K2oTSLBt5rOC8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676654345, "uuid": "f7048e2a-bbfa-40a4-a2aa-5beb12e396ca", "value": 15575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676654345, "uuid": "3bbd2191-4eab-44cd-8abe-e2bdcfdc7673", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654345, "uuid": "ca12d70f-c5de-42a2-8402-f699180c7722", "value": "QUOTATIONS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8775e336-af07-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676668239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676668239, "uuid": "4c24f7bd-f924-4a7f-a03a-a3210490ee3c", "comment": "Malware payload (njrat)", "value": "23f9297f63a3c07002f5092f2bf181d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676668239, "uuid": "6cf72a31-a9ba-4471-84d6-77d25347e6cd", "comment": "Malware payload (njrat)", "value": "9e6e2e02ccb746147b252398e28b2968964fa2b0acecb9b2b4adfac292e1acde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676668239, "uuid": "c6ce068a-a9cb-4419-8295-41fc8f427e79", "comment": "Malware payload (njrat)", "value": "565edf402b1c80759aa74f14fea8e45db572c145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676668239, "uuid": "a9bf592b-742f-48e8-a8ea-70d4bb8dab7c", "comment": "Malware payload (njrat)", "value": "8de6f9592e7b278111a9e62aa4e457a5088ba85166c9086dbaf8c283213ba0a52f644b757131e1c29cca6b9921854cd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676668239, "uuid": "e9bd2d34-8aed-4c1e-8f6f-efa0c17400c9", "value": "T1CE74C002B6C149B2D57219325A35AB21797D7C205F39CF6FB3E42D6DDA311C0A624BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676668239, "uuid": "15c1077c-ba5c-4b7e-b252-37e5f02055f2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676668239, "uuid": "e4e52e2f-b7f7-4306-8424-a127517b047e", "value": "6144:NwYWSbN4lJlvXYnZTtc3wHSqvyX+t4wpQVYcXHCM:5Wq43pXiZT+AzyX+t4wpQVYc3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676668239, "uuid": "6e814d7f-8360-4e16-8419-b4d8c43f08b6", "value": 343202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676668239, "uuid": "636b224b-dc75-4c50-a65b-84f0f0c5d240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676668239, "uuid": "2153c51b-1581-41b2-8892-19e504b6cb63", "value": "23f9297f63a3c07002f5092f2bf181d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42262c84-aecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676642782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642782, "uuid": "1bed77e1-a3b8-490b-9aa9-f2d517dcba09", "comment": "Malware payload (AgentTesla)", "value": "e126077841919eaf6cb22a64cd82072f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642782, "uuid": "cc21e299-898e-4abb-979e-f9bd7a84c99d", "comment": "Malware payload (AgentTesla)", "value": "9e9320a594016b85fe6178277e7536bbfc1a18c69ca4b5e1f1fbc9ad923459b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642782, "uuid": "6a97b55c-d281-493b-87ab-d8b8bedf2a1c", "comment": "Malware payload (AgentTesla)", "value": "90b3cc77e388467007a4972a72eb417cdc512ec0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642782, "uuid": "6cdc3e4c-77c2-4a3a-8152-b9de47413003", "comment": "Malware payload (AgentTesla)", "value": "7d75b2c113702bd00bf716766e532c7414898142f5ee0de66bbdeff4f8ee81c4faa6101e8f8b50365318deab9e756631", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642782, "uuid": "418a3877-b415-41f7-a9c6-9bc220c5e1ab", "value": "T18C84230EFED5C8EBD4B50A311EB2C7039AE246291620976B17905AED3D33F61DB1E790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642782, "uuid": "9fa75d58-a5cb-4a8a-9c59-d04d19412fdc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642782, "uuid": "7270b8bd-17db-4d37-9d14-8ba913687a83", "value": "12288:vYYQ7tvbPK8VFkJq/HYLQajzB3Km5jDGr5L:vYYQ7hrBVueYLdam5jDG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642782, "uuid": "3129c4d4-26f9-494b-b0d8-53f68ba7f33b", "value": 405778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642782, "uuid": "fe020860-a60b-41c5-ae08-f72c59161b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642782, "uuid": "6f2ca896-b101-422f-b838-87ba8ada503b", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d9ad1d-aec7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676640782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640782, "uuid": "2f774797-9507-47f1-86a5-7f99e26eb5ce", "comment": "Malware payload (RedLineStealer)", "value": "073529b2bf467386df7fe7720a86488a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640782, "uuid": "ccfc08b7-5252-4ddc-8439-952900427b97", "comment": "Malware payload (RedLineStealer)", "value": "9eb155e19ee66f186b72ee822fa37be993d1aa063a24aab687ad4f1f7038a901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640782, "uuid": "d2f309bb-a55d-42f5-8dc1-becaebc08643", "comment": "Malware payload (RedLineStealer)", "value": "5e3fd26ff9152210795ae2c6d65632399dd4aeac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676640782, "uuid": "b3ce8b28-8c9a-4277-837d-b1fe48254ed2", "comment": "Malware payload (RedLineStealer)", "value": "b9bb57f58aeb13c56e6e4f829ae330fc265aa511bb7dd243bb85e34e91c96b36d05a755b5a73deb4b302b73a4032229e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640782, "uuid": "d6c2a76e-12f7-4b12-8f20-2978b4955b56", "value": "T1D254F122BB84803AE11711349E61C3F69B3BBDA08A719D973BDC623D5E352D2DB25317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640782, "uuid": "ce637952-67cb-4b99-8b35-2484ac5d4398", "value": "31111ee2beeeebc1d1040d6c5884273d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640782, "uuid": "f853d853-8de7-4a63-a649-53609988e435", "value": "6144:MKjtPXFPgYsv9wC5J+iOoYfNfmPJpiLDmUJl:MKt9gYWJz+iOTfl+J2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676640782, "uuid": "9a9b904e-6c88-49af-a0fb-2d01cb7fc32f", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676640782, "uuid": "f56d6746-a3a5-49ab-bba5-29e317a4f8aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676640782, "uuid": "713e50bf-e16c-41b9-b683-c4cb868055e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f2749f-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676637935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637935, "uuid": "24fe707d-3158-4cd2-819e-06180300f330", "comment": "Malware payload (Mirai)", "value": "50472649e8fa4dbfa868324b94e8f4ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637935, "uuid": "1e2704ed-7f2c-439e-8a16-812dd212bfab", "comment": "Malware payload (Mirai)", "value": "9f487b17072094ab52c33bc6b96fcfcd6858834035b53db725637eb625daa35a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637935, "uuid": "55fd6675-4392-4006-a73b-884bce410e90", "comment": "Malware payload (Mirai)", "value": "6f0074ca6b38586d63b4b8ea9bdc87003b8efbd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637935, "uuid": "ea1d67a8-866d-4375-b97f-55a3e9b3b28d", "comment": "Malware payload (Mirai)", "value": "b6cbc3ac278e8caa37573d9f26e21b256aa1dba8dccd2f165562d8cc7e0451be571dc1ad6f61bee126cd2609f3ff1c4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637935, "uuid": "904cba12-fd11-43e6-9c49-4eb9e2c32a8b", "value": "T1C403F751BC829A77C2E1137AB6AE4A8D336163E8C2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637935, "uuid": "5409aab0-7fd1-4ca5-8921-c1f5bd58af23", "value": "768:AgA/wMCbXsG5f0OJnlUlcOlF5AdwAAb9XDWd2v+bAq77TEXoTJ/NMwWG:AfWb8G5fblUlfbgeaUv+fEGHWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637935, "uuid": "af7be12b-cddd-4e9a-a24a-e78021859dcf", "value": 40752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637935, "uuid": "5270c5a3-7b44-4a1f-a139-e9a6fd3126b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637935, "uuid": "886169f0-667f-4cb0-8e9c-0c99523c52df", "value": "50472649e8fa4dbfa868324b94e8f4ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c09812-aeca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676642090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642090, "uuid": "30fd6992-89ae-4387-bab6-45707c3ef04d", "comment": "Malware payload", "value": "6fea6d1408ccc123061f0accb4314cf9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642090, "uuid": "616342cb-5e1d-411a-a475-3808bce889bd", "comment": "Malware payload", "value": "9fa16e7a4ee87a1ca62802e0a5055a0dc25e1a8d2e058e4ff60fd202af0d0ca6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642090, "uuid": "64f75b99-2155-4317-af04-165409f87824", "comment": "Malware payload", "value": "240c65388cdc0f89bfb10e520fdc32fbdb8e9829", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642090, "uuid": "4903407f-3124-4142-9166-7dd871e0d544", "comment": "Malware payload", "value": "df1075c616adf65924447065d4b3bee1d8e4a02f573bb98672b79a60e26bb18a0ff2f69964d559c404ef573ec1924dbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642090, "uuid": "8499551a-72c7-46cc-b61f-66fb9a8e5072", "value": "T1EAF2D35AE79E12A9CF510273672A0A88A6FDB33DB320557134AC933433DDC3D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642090, "uuid": "cceba4c3-ec7c-4dbc-8762-6e99bd42fd32", "value": "768:lFx0XaIsnPRIa4fwJMlCLubsHqRVNRMeQ9A8NPx4tHoTZ:lf0Xvx3EMl8ubpfRo9A2PxmoTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642090, "uuid": "f9c0d213-2fb7-47c8-b0f3-b5991f0b746d", "value": 37509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642090, "uuid": "1a71412a-74a0-41f5-9635-87f08c38d45c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642090, "uuid": "b06e5c5a-5580-4575-aabd-6c2eea4bd92a", "value": "QUOTATIONS.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b08422-ae8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676616714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616714, "uuid": "a424769b-e95d-4f96-b161-c98ad9562e5f", "comment": "Malware payload (Amadey)", "value": "f3f9a819d74d7b3bb7578979d0b0e1c6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616714, "uuid": "21848ea4-21b9-407c-ac27-98baf3722237", "comment": "Malware payload (Amadey)", "value": "a021adfbf060749ef48664aa221466b0e8aeaf2d75e58b742f5a50f3387a9f86", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616714, "uuid": "74df9836-6d97-49a1-88e4-59537b3aba31", "comment": "Malware payload (Amadey)", "value": "4491c7a35326a852fe62cd1b270ce1673bd02a81", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616714, "uuid": "26e18c5a-342d-40bc-93c1-582dc32e8963", "comment": "Malware payload (Amadey)", "value": "6a9b16ad8d5059fc8c3359ea0d7d1a592855b2579fc1f0eb94e1ae81a6e675f3357693e8e275b559eeaac9178a31235b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616714, "uuid": "3513fcef-419a-4c0f-b152-65c5679a604e", "value": "T1FC25221BA7E44472F4725B7068FA4BC30B317EA15F78879B368E69460DB2A342635337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616714, "uuid": "bcd4137b-c4af-4ded-a03c-01b3f810a4b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616714, "uuid": "94991809-dc01-4605-9c8f-7899271cc5f1", "value": "24576:jyPrctZMPlhrXawM8UomAdd21i30sIQGBnNOsuBSEqmfBtW:2Prcylh7awTUu21iE7NO/SE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676616714, "uuid": "20bb39d7-642e-486d-b530-31f3495dec68", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676616714, "uuid": "8e16aa33-a0d9-4bbb-9af8-ab6e00f6681d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616714, "uuid": "85d4d3e5-6087-455d-a6b6-5f622c2dfc66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434b8a9f-aea1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676624316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624316, "uuid": "17298470-f5af-4176-ac1f-be0bd4b50ac8", "comment": "Malware payload (AgentTesla)", "value": "04c2a959296aad61fa7509ce12684e73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624316, "uuid": "ba2da02e-9dcf-4f36-a563-fbf1f45e78cf", "comment": "Malware payload (AgentTesla)", "value": "a04f1a25163232de8c88097ce4b375dbc6ac9ead24f8d8a27751219858db7a34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624316, "uuid": "2cd3256a-5038-4f26-aab7-ece051b71c73", "comment": "Malware payload (AgentTesla)", "value": "3d15a67c43541dae29012e59e9406c07648daa70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624316, "uuid": "79322c3b-4f08-4d41-87fe-ff961095f5ba", "comment": "Malware payload (AgentTesla)", "value": "d326bd43d1568d625cb8fc76649fad8d50240621887a592e78f3508da25eb67500fa988bca853ecfd58dd983013dd6f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624316, "uuid": "447d95e2-66df-49e7-bc38-e439c9a50db4", "value": "T1495423432E0620DD93EDEA8EB3F453B75D2E08ADDE8797028AC83155175EA287744B3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624316, "uuid": "9c764c67-ad7a-4abb-8d80-fae240d4bac7", "value": "6144:fStT2Jh10nxJHczyOxycZuuybjBqJvOeEwMu55s9b1tNMUGWHnglKehoBjDt6:KtT+kHcb9u5ovOVu556ptN5Hngldiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676624316, "uuid": "cc643015-e648-4ce3-af3e-13e4455156b9", "value": 304476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676624316, "uuid": "74b6d241-097f-427b-ba0c-569809d03777", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624316, "uuid": "d0b25ffc-0dc9-4c3b-b5f9-7ce49214a3f0", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ba3c95-aebb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676635586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635586, "uuid": "dc2ae70e-4d12-4947-8f10-a0b421130b47", "comment": "Malware payload", "value": "4cbfcb55e0baefdf1655c16491212db5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635586, "uuid": "c8eb19e5-e262-43dc-9883-c9cb2c44c500", "comment": "Malware payload", "value": "a1250d9f90f77bb3fe97ce4e6eff21f48c4f9c2c8f679991e15237520d770151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635586, "uuid": "724a2834-2e72-4a57-b108-5a66b1ca7340", "comment": "Malware payload", "value": "c895aac036d33081cb44a7827fc0bedc9a74d384", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635586, "uuid": "d1f47459-210f-4901-b570-9a5269249957", "comment": "Malware payload", "value": "ec5aba843ebc65a3f035c594e048d3fd5620b31b393be8137a9cf7efe79fd710d97dfdc81504eae6c5aa404ba4d5937f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635586, "uuid": "a84e9987-3f15-44b8-bec6-ba28bcfeb39f", "value": "T1DE25220BFBED9062C9758B7118F706D30A36BD905A305353578FBC5A28738A665323AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635586, "uuid": "3fca070c-b1d4-4cd8-9384-700b6a93e670", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635586, "uuid": "4056ce44-4603-4fc6-aefe-e8e51521580f", "value": "24576:jyx1kV/loh5wnXeteC+aCq06n5AjdM/hK7+aXQl:2x1kpKh5wXMeC+XVOmpM/gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676635586, "uuid": "74dedb5f-0f6e-4b9d-9fc3-9b2a2f5d3aab", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676635586, "uuid": "2a0a9e53-b8d5-42e7-b7b7-30757de67309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635586, "uuid": "84b60286-eefd-435d-a6d1-9be62812cfba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042602ee-aee7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676654274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654274, "uuid": "27908a53-4285-40b7-8c95-ee8250440001", "comment": "Malware payload", "value": "1cb521affe71315bf70e09bac3f15882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654274, "uuid": "e36623c1-eba7-4026-93b1-f3d0e90eaba1", "comment": "Malware payload", "value": "a26ec91834c6464cec3909f4eb2d64da6a67b4ed8de5f344c5ab20b57952be55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654274, "uuid": "294bf424-5424-4414-8b7e-5dbe4a19ff90", "comment": "Malware payload", "value": "0e5406b300b606d3bf13b2fd1738ab8c0ac00a34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654274, "uuid": "b6f43754-35f2-4272-8f8b-e0177d67bef7", "comment": "Malware payload", "value": "369f130c7d2d67717272855d4fbdf789e2936298b7520f4f88e1b2a303582cec23358e7b61bb8ae3c7aeb466d8808c0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654274, "uuid": "8b758cde-5e8e-4617-9fd5-bd9db11ad45c", "value": "T17AE5338BFADC9123E0B587F015FB47E30D327E0396351396178A5CAE2C945A0B6A477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654274, "uuid": "98ac1dd1-114c-43a9-8f0d-0aed42680129", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654274, "uuid": "c49ab56b-3917-4d81-8b32-1866d740e257", "value": "49152:tX8yALXj28SNftp0RAIUnjpn5BuwV954KTgs+cGhaMu8PoUS2fOhrwdh1NesR:x5ALXj2Jp0ReVnCOdTgXc/goUirwb7es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676654274, "uuid": "7b40cfdb-b65a-450c-83d3-7cd2ca654f13", "value": 3105792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676654274, "uuid": "48ff9507-0f02-4093-a9c5-48b0223dbf60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654274, "uuid": "445c7676-f42a-494f-a6c2-1c6cc5b5fcc6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b65c67-ae5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676594543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676594543, "uuid": "80c387d5-b820-4761-a54e-cac67353cbfa", "comment": "Malware payload (Amadey)", "value": "ae3bcd4ae9ffb439859878165b3bea02", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676594543, "uuid": "f1f73069-923a-4852-a421-a95319e4a760", "comment": "Malware payload (Amadey)", "value": "a2b15d37a015fe7f6be60a4c1957fb8670603d70f32272774547fd036c45f50e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676594543, "uuid": "5e4704b4-3a6a-4e93-a64c-2abfafe52794", "comment": "Malware payload (Amadey)", "value": "465d23125c1cfd041b9ee24b33261c984bb83acb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676594543, "uuid": "504b2d8a-3886-41d8-aa37-5e4819bc2f8a", "comment": "Malware payload (Amadey)", "value": "bdb45ca582ad58c21da8e2338c0168f19f6a7b911ebbc79f79b3a186eb913e46e2c8f05cebdcc35f2ae9b63bfef300d6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676594543, "uuid": "f16b4d1c-877f-42a1-8601-735617e13e98", "value": "T14325234BA6DD1831E8B45B7109B203C70BB5BCA20334C75B575F78661CB29E4EA70B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676594543, "uuid": "068fd281-093a-4c66-93fa-f87407ab1312", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676594543, "uuid": "b6edab48-0040-49a1-bda5-4bd96d1eb730", "value": "24576:IyiuGE/JvNeJwL1dWbvgOo+Qcc4M37KyL1k/AF:PqANeJUEbIOo+49xkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676594543, "uuid": "df24f3b7-c2b0-4bac-aec4-bf2ed0eeef64", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676594543, "uuid": "b3d7d2e5-2a4c-4a2e-b657-f5502f9a679c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676594543, "uuid": "949c3710-6f46-49f3-b49e-719288676a3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25f656c-aedd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676650325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650325, "uuid": "523da673-6860-441c-a3f2-059c93c5a76c", "comment": "Malware payload", "value": "9a3708dbfbc34ce153b69ac5a8e6ccb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650325, "uuid": "42fd5e1c-4a88-4fea-a228-b5a2b7f2455e", "comment": "Malware payload", "value": "a3413bd1bbdaa60a7c21117e253470c7dd63f62a0a602601643ea2fefdd00647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650325, "uuid": "01543e12-06f3-448c-881f-8fb544864c6c", "comment": "Malware payload", "value": "bf481212118c477811ac88f95f40c0d71d0f0a04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650325, "uuid": "5a2fde6b-36cf-4356-a8df-950989c1f3fe", "comment": "Malware payload", "value": "7e874fd4ac78f36697131aa80c93ceb01229ec9dba1359e30aeceb247d83da0b77d4d382f4e5c09571fad1e05545dfb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650325, "uuid": "be36a64d-ffe6-4050-a772-02fa1f971f40", "value": "T1AD937B322AD58032F62365349AB182B29F7B7CA112729C9F1FD525794F726C2D33835B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650325, "uuid": "ec4330d3-30e6-47da-8927-88b42e824bee", "value": "1536:xYizyqZdCgyp+GFY9K7/91HIuVLzaM/Ay0gl4sclsm:6OyqZdCzlFYUauVCGj+sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676650325, "uuid": "32c4966b-8c90-44a3-a906-4119f1f7e0dc", "value": 89184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676650325, "uuid": "1e7d577e-8600-4ae7-a795-7993bd7a132a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650325, "uuid": "3cc8bcde-a9ba-48bd-bfcd-e09fd0d0af0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea73e02e-ae97-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676620301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620301, "uuid": "d148be0f-6b13-497c-b9c0-4f5954cede4e", "comment": "Malware payload (Mirai)", "value": "e891e24e27b1c51ec9c3c84267ab997e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620301, "uuid": "b4189c3e-961e-42c9-af44-7773f306f87a", "comment": "Malware payload (Mirai)", "value": "a3d6d056f5b7a681744b667bcc9552c74ebb33be93127995b3ded652b53d588b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620301, "uuid": "4c1c0284-f797-4b31-b9d5-8d3d3cf470f3", "comment": "Malware payload (Mirai)", "value": "1aa04693963e6e40d5f33418c1e553a7b9d0fc63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620301, "uuid": "fb1d1d64-8eb8-483c-a23e-4b773731149c", "comment": "Malware payload (Mirai)", "value": "1fffff4646580db7d1b35088e04fd172cbb3ef8beffa1ebd92a320ce56438a4dd170d3090c4ea793b75445a022a953cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620301, "uuid": "3598bc05-7594-4659-8aa0-012f3ff01204", "value": "T177231841B8818623C6E4137AB66E46CE372563E8E2DFB3179D221F503B9682F0D67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620301, "uuid": "f6f77efd-6a80-4d6b-9700-e0c95290c2ca", "value": "768:p9T3kFvFsOvIZg3VevqKxpn9m+/8KlUfPoV1//N+WX7JTzLgwL:L3kFvqOv0Q8lgxfM/z91L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620301, "uuid": "c8111a99-988b-4908-b9b3-658060dd4bb7", "value": 46864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620301, "uuid": "df4e9e39-a8d9-4d15-b178-2678cd5a17f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620301, "uuid": "1b717308-3811-4547-99dd-1d562a2e4ce3", "value": "e891e24e27b1c51ec9c3c84267ab997e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a138c93-aeee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676657425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676657425, "uuid": "89ea72cc-b4a4-41b5-a514-cbcdf9eaa9b9", "comment": "Malware payload", "value": "f5c5a75a790364d013a29f5d72dba7d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676657425, "uuid": "57755cd9-8418-406a-8b4b-274f4991dc02", "comment": "Malware payload", "value": "a52e241bbe989177e21788ee54e5af5d6936938dfebedf1550bcdaeb20537017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676657425, "uuid": "b9935ae2-8f04-4553-8c34-5f7aba96f484", "comment": "Malware payload", "value": "542db41327cafa6a04f0eeb643a29e0ce25de7ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676657425, "uuid": "1e183263-fb69-45dd-8069-b51c84ca9bd4", "comment": "Malware payload", "value": "1567fd86cbe5fddad3ea23615307dcfe7d6021b38e8b9e999b6899d10089a058f43314eec81b6b00385c35d7b6e968aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676657425, "uuid": "1c04f4ff-77b4-4b82-95b7-1cf6bd32917c", "value": "T1EDE523D22825D4E3D3FCEBF1B44E84F87573BD9B88D4191375A9BB2B387218A944D209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676657425, "uuid": "5b1d3844-cec9-4d32-b10d-5e1c820a1f7a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676657425, "uuid": "511a59b3-dbe3-4d30-abb1-0884743903ee", "value": "49152:1sDMRZjstEqrUY1+weAQ1TGQPEuoxMAhzjzXMObaIGsNuOTP4Da+MbRVprYKmvma:SYjFqZNe5o/zXMObnIswaVtimSv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676657425, "uuid": "e8daf695-52ff-4117-bb9b-9015b76ae9b2", "value": 3216878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676657425, "uuid": "f8e36f09-2031-465d-b5b9-60a56b2a1a8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676657425, "uuid": "11569d30-0417-484e-99df-72354b99aa26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69542349-ae88-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676613642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613642, "uuid": "b86cf2d3-531c-430f-b39f-9dd2619b9fd4", "comment": "Malware payload (TeamBot)", "value": "3ed52ebf73938f203f1295bdd0bbdc65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613642, "uuid": "892d5287-838f-4695-92be-54f4d0abad1b", "comment": "Malware payload (TeamBot)", "value": "a5c96cb82cd529a24fcf1cd2d6401bbeb8b8d6a709ddf0744a642d3854879dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613642, "uuid": "a191b58a-4197-4b3a-bafe-bc6b734d4a69", "comment": "Malware payload (TeamBot)", "value": "54fdc9006e5b7198bab8a84f155d133b57278c8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613642, "uuid": "59f93cfe-3182-4d36-aaa9-9516522266b7", "comment": "Malware payload (TeamBot)", "value": "40870045fda3a3da14a5a486dff000742c739050fefe8768016720d8a6cea5e1cb70dc25bd7b76b5153292658b14f851", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613642, "uuid": "6ee6c28d-1c98-4553-a2e6-ba7dfb48c7e3", "value": "T1FF24C01376D0D479F12346358E66C2B5AB3BFCB08E756AEB3788162F0E725D2C612352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613642, "uuid": "1da3d364-2ea2-4d6a-92ed-e0de455f56e9", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613642, "uuid": "d7c96122-317c-4362-b357-0d0c52038c04", "value": "3072:DNFglHNd43soZQcL/ZkKITW7AK4Uig21XeafktHxWFrxW6aulDI:DglKzQcOKOWNig21XeafktHxd6auN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676613642, "uuid": "b9cd1193-438a-429f-8706-73439d90e558", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676613642, "uuid": "c4d21309-b607-42e2-ab0a-1550c8ac6ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613642, "uuid": "29db256e-30e8-4afb-8595-3be9c1d192bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab87a74-af08-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676668835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676668835, "uuid": "b6dacf39-8a85-43bf-92f0-0d7c390835d9", "comment": "Malware payload (RedLineStealer)", "value": "fd333bca0427172fbf79ff04f22ae210", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676668835, "uuid": "1ed8fc9e-c914-4c1d-8031-0b53ac332170", "comment": "Malware payload (RedLineStealer)", "value": "a61cacd0558c2ca1d276c80e6fad0294862a2421f36bb1667ca7ca99c3da3066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676668835, "uuid": "8035c683-3ebd-400d-ba24-91993e6be1ff", "comment": "Malware payload (RedLineStealer)", "value": "c9eddd3d0563e3d692e42af83a8b5993c7a947b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676668835, "uuid": "09440ead-0c27-4b25-a087-a79e91b4962d", "comment": "Malware payload (RedLineStealer)", "value": "7405eddab033f5be0b2eacef34dee470d6a88c9577bc6404ee0bcd43a817fe5b01037fd6baf0fc165fef3495796c5fd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676668835, "uuid": "eb2d0586-15a1-4c9c-b4e2-9f84da374fe2", "value": "T1F6E4120BBBEC8063D478473418F757C3193ABD612738835A668FAC1A0C739B5A63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676668835, "uuid": "b4f7862c-e5cb-433c-ae0b-e61bc17272ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676668835, "uuid": "3e235815-e519-46ba-b430-e00bb2e229ec", "value": "12288:mMrXy90YYhVDgSJi+HV6esmlBfl67MoS/qt9NhbxmU9K1pHluz96k:FyTEVTZHVWmlJgIP/Kb1vEHlvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676668835, "uuid": "3cd3f563-8a22-4f48-9436-c0f31828c15b", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676668835, "uuid": "bce87f72-4f8d-4c53-a5c0-af3814aa93e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676668835, "uuid": "dbe3fa16-1089-466c-984a-99cc7b5b8ca6", "value": "fd333bca0427172fbf79ff04f22ae210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4841a391-aede-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676650523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650523, "uuid": "efb8da23-2b61-4bb7-b0b1-391b41a127ee", "comment": "Malware payload", "value": "02ab99b95fcfdab6a6cd64a9b103ed7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650523, "uuid": "82aef4ce-cd17-4778-baef-5948825b7fdd", "comment": "Malware payload", "value": "a685aa6388fefa41c30843bdcf8eaa2cce2a7bde562d18b0f0122d554eb25bc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650523, "uuid": "de8dfe5b-5dc2-4dca-8e4c-d15992af6bb1", "comment": "Malware payload", "value": "63ce69d8f5e76d1923942cfa7995700e0f854a2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650523, "uuid": "59a09bd4-4371-440d-a43a-137c875ee0db", "comment": "Malware payload", "value": "fa1969595a9dddefda1919053ec0dc7375442fe8ac767f84f8bfe3b30bf5a174d1b1dfbda98e899e2fe5d8a502d75708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650523, "uuid": "cd4ca5e1-cd98-49df-a1e0-b2f1f60b87bd", "value": "T1CD04CF2236D5C072E263023C5DA6C2B59B67BCB04A728D8B3BC5166E1F757D2CB28357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650523, "uuid": "ea6dd006-4515-4438-8f35-a8d789411860", "value": "04d4ff0968f0d2d964fcf7ad4ec4e8a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650523, "uuid": "99164d62-40b5-418a-be23-a9df449de40d", "value": "3072:6+cuuN1YHO7raVJJaixT73PERT1wtnDtqg1yxwOMUVh3TgBGBW4:6m/u7+XIe73PER2Dt/8wOMMTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676650523, "uuid": "8e138f3f-9f99-4b17-8dbe-576bed7cbbc2", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676650523, "uuid": "e4e1cd2a-4255-4124-b0ec-9ef39c14bb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650523, "uuid": "ce759a17-8100-4e90-9e87-488b5094bcbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959a592b-aeb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676633473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633473, "uuid": "4364d3a9-507a-4a30-b9f5-206a1db5cc4b", "comment": "Malware payload (SnakeKeylogger)", "value": "88b6e1e354af37f27e02b75b009916ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633473, "uuid": "46e02c89-fce3-4d26-a900-e02ac4eaf4bb", "comment": "Malware payload (SnakeKeylogger)", "value": "a793cce3832cd041e85e97daafc933b8217052d9280ac9fd2b58f74933443dfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633473, "uuid": "5fe2ed56-506b-4036-9f92-a005c5122096", "comment": "Malware payload (SnakeKeylogger)", "value": "97ffa17876db1f82d2df25650f41443954c14bf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633473, "uuid": "1a40e92b-fbe0-4ce5-a4f8-79ddd9644626", "comment": "Malware payload (SnakeKeylogger)", "value": "0d5adad0abcaadaf1ca084709ab12b5046582efb3d7c3d126800323b0d620ffbd40f64499505779f6731783bae1c8fca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633473, "uuid": "51d59593-0d7c-433b-8179-6996a4d4bbea", "value": "T121A48A01B04B4F89E4653975B6F9E3800E546EF31380867B998D315ADF7DECC8A6252F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633473, "uuid": "396db43e-e2c2-49fc-8fa1-d90af59298aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633473, "uuid": "53231283-807b-4a1d-9e50-4f9bdb94a05e", "value": "6144:gPop6duHKLoZi96+esakXkU12lq856s95HZdfdDWEF+E0MscZ3f:g+6duHKLoZMesl0U12ld/H5dfIvcdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676633473, "uuid": "3b00d3dd-860c-4549-814d-3ef3bbf7ab46", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676633473, "uuid": "3bd9dd59-d02e-4a2d-9b77-ca2eab147640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633473, "uuid": "563c08db-c249-4530-b195-dff301e26c3a", "value": "OTP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa8f4d4-aed0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676644442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644442, "uuid": "00ac2294-0200-492b-99cd-d0d08ab0e3de", "comment": "Malware payload (Amadey)", "value": "7afca2a4b3b73b6ff508660e149c96ff", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644442, "uuid": "439da10c-a7bb-452f-bd10-ee98463d8ee1", "comment": "Malware payload (Amadey)", "value": "a81de3fa99e523255a13d15bb2a5a20023fd83a2b11334b53805f1d0db6e8930", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644442, "uuid": "3bf01049-011c-4fd3-8165-91207af92b2f", "comment": "Malware payload (Amadey)", "value": "92eb5587e24813dbe4d4befe2642ec652abcc219", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644442, "uuid": "e8a7b88d-ad89-4257-91ba-fdc5b936ea94", "comment": "Malware payload (Amadey)", "value": "58367d7976e4b5597dce3acce3f92bf92a7fa88525d65b95768a8538f50c49b0a1e479223fd293aed54c867f403a6a79", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644442, "uuid": "2cf9c65c-926b-46c5-b095-5ddaf7b8a3c2", "value": "T152152217E7EC9072DD719B7144F702C30A327DE26778929F534BAC1A09B29A4A67037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644442, "uuid": "10dd1c86-9b6d-4f83-8ca9-10f724afce5d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644442, "uuid": "2489c888-9c8d-4166-ba07-f26b6da86a0f", "value": "24576:vynVTji0+ShC6G5FInbpLEbHnPztkIiUxlV+:6nZ3Y6SsbtEbLqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676644442, "uuid": "dfd76271-8eb4-43b9-a24f-c72c601afe95", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676644442, "uuid": "b1459529-3362-41f7-9c1c-b16c49bcc468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644442, "uuid": "b3426907-b86e-4364-b06d-d85170c49710", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0691052f-ae82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Floxif)", "timestamp": 1676610899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610899, "uuid": "d6af69da-5845-44ba-9060-9610abd02bd7", "comment": "Malware payload (Floxif)", "value": "f6c8a0e68ede2b11630fc9e18dd1152c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610899, "uuid": "a9c113a6-2928-4b48-ba87-a4cd85abf488", "comment": "Malware payload (Floxif)", "value": "a826f7d6cd5e6419a3c3a1e15486d523347a1762b648969c446e9ecae58d3c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610899, "uuid": "d9fc03a7-6525-437b-8f4a-7c182e7aa5bf", "comment": "Malware payload (Floxif)", "value": "0af4404710cc6b52b68e98709c501f7546729940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610899, "uuid": "82dceb17-9699-4d39-a8e0-b6dd912c26e7", "comment": "Malware payload (Floxif)", "value": "2c8dec64207d7fd16721c501f6d3d0619459f4518dd98cf05d6eef9bc39e7c49fa3a15cd9707be98c1c51698db28d7ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610899, "uuid": "0a9d0479-63ae-4345-a510-6b3d7f2aeff0", "value": "T126350A517D0687A3C9AD40F9B43F588841AB7E546E95A0E3F238B2D25E707C7E23A34D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610899, "uuid": "26a838fc-428d-4ad7-b656-45868b004d17", "value": "b034d9b9bc2a439ea0cf14b922b74358", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610899, "uuid": "e5009485-079d-4ad4-b8f6-23555e6f59e7", "value": "12288:aAZO3FS73bD/H3jTSE0a7G8HA5JNzNP9uvyaeg9PoJZ9AV3fF7Vn9/vBjvrEH7w:aLFQf90aK3TFuvheUP69A99Jn91rEH7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676610899, "uuid": "c0fd389c-c0bf-433e-944d-f63f91553897", "value": 1074103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676610899, "uuid": "5db9a707-0261-4919-8b38-45dd1947a949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610899, "uuid": "0c88f600-2274-421b-81fb-adc543b02a95", "value": "2023-02-17_f6c8a0e68ede2b11630fc9e18dd1152c_floxif_mafia", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5524ce-aebe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676636786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636786, "uuid": "36eb12b3-6453-4185-87fd-965c4946bf85", "comment": "Malware payload", "value": "7ef92f0286f603305c076705ef5cb8c9", "object_relation": "md5", "Tag": [ { "name": "CargoBay", "colour": "#2C84F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636786, "uuid": "6012efef-56ba-44ee-960b-bcbac9072bda", "comment": "Malware payload", "value": "a963a8a8e1583081daa43638744eef6c410d1a410c11eb9413da15a26e802de5", "object_relation": "sha256", "Tag": [ { "name": "CargoBay", "colour": "#2C84F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636786, "uuid": "e137a542-455b-4325-9456-69b618564d12", "comment": "Malware payload", "value": "98a4736bb5941064e0ef477c58918e3776bdc3c3", "object_relation": "sha1", "Tag": [ { "name": "CargoBay", "colour": "#2C84F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636786, "uuid": "a35cffdd-74a1-49b0-bb49-78cf48815b07", "comment": "Malware payload", "value": "efe931e02cf1ddb8ff1811945fa1937442a304f977fd3591d38cb3fbd7f1c27561197a212e659bbf953b87f0b801dfb5", "object_relation": "sha3-384", "Tag": [ { "name": "CargoBay", "colour": "#2C84F6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636786, "uuid": "094a1014-25c3-43bf-8653-f1a8545b8814", "value": "T107959E03F68149B9C469C27883479736B671BC890726F7EF1BD4A6213E22BE05F2C759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636786, "uuid": "42b8b287-c27f-492c-93a5-86544cc55c79", "value": "df355ead100081bb38f430348474e17e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636786, "uuid": "db12d7eb-ca3d-404e-a15f-4e92c823ec85", "value": "49152:+hyoUgDRm4d6TkU+rsqVrhDk1hXIU6i6:AjdZhrs0hDf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676636786, "uuid": "2511c559-ae8a-47c5-909d-1a73bf96458e", "value": 1879552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676636786, "uuid": "d8136ad8-4d07-4c32-a242-5eb0ca10f92b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636786, "uuid": "11227ea0-4c13-45a2-96da-6c1333a977a0", "value": "a963a8a8e1583081daa43638744eef6c410d1a410c11eb9413da15a26e802de5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a14b8a-ae56-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676592127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592127, "uuid": "2360729b-0eac-4309-9e3a-b2ed1f914aa3", "comment": "Malware payload (Amadey)", "value": "12009e941b4d96deecbb69f0fcd5a3e2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592127, "uuid": "8a7ae81c-dca9-4302-9566-f89a7d50dad6", "comment": "Malware payload (Amadey)", "value": "aa3d69606259b9a97430c29403fab42e2f851a1655e020d7f0a74f21e0ea6d00", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592127, "uuid": "c799e3c2-485f-401c-9d3f-22f6f4bdf977", "comment": "Malware payload (Amadey)", "value": "b519e8cc6f3a71beea4a32b8233177f838e665fc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592127, "uuid": "1d406524-51ef-4090-9297-2ea36c5fc843", "comment": "Malware payload (Amadey)", "value": "e7a402e7affb2ed98ce826d64f84add6cf8f166663aafd1c9178e2d596c8254c33a4cb65fce6ddebce9cadbf71eceec4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592127, "uuid": "55144045-15a8-4193-beae-f8180f25812e", "value": "T12F25230BE6ECC012E874677019B602C3077E7CA1AE34875B778B9D1D49326B5A53A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592127, "uuid": "7304ab50-9767-4d75-a4fb-c395f137532d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592127, "uuid": "91e07c65-16e1-4d58-b459-e1f2aed8a5fd", "value": "24576:Pygz3aXmJmp9Hp4ReOEzhslbq3esGtaa:aaWD3nzulbq3+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676592127, "uuid": "43dd6602-1cbb-4f55-a718-1da8cb0adc5b", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676592127, "uuid": "b3e6150c-96bd-4f3d-a847-ea1189e30f7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592127, "uuid": "07da9c60-7d4f-4cfd-b244-d849fa6423fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce126963-af05-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676667498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667498, "uuid": "7ed4ca6c-bee3-4aab-968b-d0a08a00bc9f", "comment": "Malware payload", "value": "319721028b461340a52b5010b293b0ed", "object_relation": "md5", "Tag": [ { "name": "2089507018", "colour": "#49B5AA", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "sprotakepatuz.com", "colour": "#655806", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667498, "uuid": "7687a650-8cfb-4c9a-a93d-a789adc2100a", "comment": "Malware payload", "value": "aafc0ca9681c1f5c368b0f6da85b90e433f6d62fb34ed2e968e53f83981a800f", "object_relation": "sha256", "Tag": [ { "name": "2089507018", "colour": "#49B5AA", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "sprotakepatuz.com", "colour": "#655806", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667498, "uuid": "251d80a0-a6ba-41e0-bc4f-a8cd867ca5a0", "comment": "Malware payload", "value": "b57d3ee75cc6a6d451b96eed76701212d8e89648", "object_relation": "sha1", "Tag": [ { "name": "2089507018", "colour": "#49B5AA", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "sprotakepatuz.com", "colour": "#655806", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676667498, "uuid": "d9d600d6-47b7-4075-b334-9b7c63485253", "comment": "Malware payload", "value": "4af8a38b5a11bf2dbc10ce1aec7bec0cf6cb3f5631e1237f1e2e637654708aadccfa961c8437038d82ba1ae69527ef8e", "object_relation": "sha3-384", "Tag": [ { "name": "2089507018", "colour": "#49B5AA", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "sprotakepatuz.com", "colour": "#655806", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667498, "uuid": "bf6c439e-e109-4ec8-9143-101669d7526f", "value": "T13BB3E1B5F911408CCA25A9398E2E9FCF7637A10155A4960FDFB66638BDF4588CF0170D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667498, "uuid": "95e0b689-fdb7-4bae-9148-21f29997f2d2", "value": "1536:553tBXvjIc2eYO5ogsOTc3/7+M9IvYPRluYv4gjuCnahRIyCJ4wIQtd0o:nDb/2jQocc3D0YZluG4gqQyCJ4wIYSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676667498, "uuid": "e6f16dbd-992c-477b-8755-fbbaf0c52357", "value": 109720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676667498, "uuid": "43fc71a6-36e1-400a-998c-1e495a85884c", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676667498, "uuid": "fb6f621a-121f-4bd0-8d1e-3d18c57a9522", "value": "redacted,document,02.17.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82070f12-ae85-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676612395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676612395, "uuid": "1cb95387-62e8-4f5d-9a92-1985e1dfe586", "comment": "Malware payload", "value": "211552cb9c353e313ad6251507dd2b3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676612395, "uuid": "4060c01a-421e-41c0-a14e-0f00cf38603c", "comment": "Malware payload", "value": "ab7712d2c658df3e092b95b0f39a02683bdfe0c942295dfd4cc46a018f93b542", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676612395, "uuid": "3e0ced10-b39d-4157-9146-0e37839fef17", "comment": "Malware payload", "value": "845d0e8ee5dc1be88f83eadbb5fbdd60befcfdb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676612395, "uuid": "1dff8221-a963-4da8-b631-2384fb3eecfe", "comment": "Malware payload", "value": "e2b5b7043586f6c155eff2d8ec2f75d7d8d8a9ae2086d274df9df0f22254731a99d66c318067ed14eef3ff5ab9c61120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676612395, "uuid": "171a6491-7039-4d3b-8e3c-ad0f8d5d74a0", "value": "T1A025231376EC8073D6F5577018F602C30936BD70DA7E83AA2E8B5D5A89732A0B631767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676612395, "uuid": "60b1040b-5564-4215-a3bb-430509ce8a4e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676612395, "uuid": "04441e26-36bf-4073-a4f3-6d09e7232bae", "value": "24576:ly5MHUn1fQ9rg7wW1vrvbG2bU31AXG5lUNOr:AGQYrgMW1ysIhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676612395, "uuid": "636464fd-9959-401b-8667-3485fde91f73", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676612395, "uuid": "5faa9d3e-d602-41e6-b923-d49378632faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676612395, "uuid": "796839d0-3ab7-47ed-a968-2ab3323a38f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e22187c-af0c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676670370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670370, "uuid": "e2a5de41-8b0a-459c-949c-eecd453067a1", "comment": "Malware payload", "value": "1dce8a181a9c43fdb0bb08bf338e1b1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670370, "uuid": "ba5b4a16-6f67-4296-b893-dabc3a30463b", "comment": "Malware payload", "value": "ac6e477ae972634a74fb7a6cbc20006586cbd6f9ff56c57d4bed36e52a60daa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670370, "uuid": "26015398-e071-473e-b0ab-091ad39eb1ab", "comment": "Malware payload", "value": "b688e09f4eeefbfb1f54f52a4fcdf6f663600c0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670370, "uuid": "be2390f3-8ca4-4c8a-aa0f-5a0df8a705e5", "comment": "Malware payload", "value": "596c9be00435323ac609490a5e7dfeaf4c2c8d065e3ef97ae2f71d52a233affbbcf2465603269f7d50a89391cedac7ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670370, "uuid": "6fa0f356-0bb3-4b9e-86a0-841be441e533", "value": "T167E4124B6BE84436F8B55B7019F503C3063A7E60A63487AB334F9D5A08725F4BA3572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670370, "uuid": "cf38b8d4-b5fe-47f4-a087-00cb1093c4f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670370, "uuid": "72cae10a-d0e8-403a-8e7d-d08b0e390b11", "value": "12288:4Mr8y90EXpn6a02DNYSOjieitgKPEvkXKHSx5Lo3BjxDOTwmJRboebXPT:UylXpF+PEtPPEIL4J8T5JRb/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676670370, "uuid": "eae8766d-c803-424f-94e2-06a368ef5671", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676670370, "uuid": "f2b47042-d5aa-4260-bc05-890fbdbb431c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670370, "uuid": "dcd6925a-d23e-4145-96da-d602343abcf0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4360592d-aeec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676656528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676656528, "uuid": "0c4e748f-e623-4920-bbfe-ecbfe86fbdfa", "comment": "Malware payload (RedLineStealer)", "value": "5b3474d17581913a8d53a1f40c32ecb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676656528, "uuid": "aa412eb3-46ab-4774-8c9b-7c8702206ec5", "comment": "Malware payload (RedLineStealer)", "value": "ac9c0483a9aa1ce1711aa46f43930e475d2698ffb77a11e61572c72e56af8f94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676656528, "uuid": "bb287726-ac9d-4aef-9ecf-fd0b2595efb4", "comment": "Malware payload (RedLineStealer)", "value": "1affb7fe75e2c3820bf3b339101664d068c24619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676656528, "uuid": "68c6ea0d-14f2-46db-b750-ef2fd8e3d17a", "comment": "Malware payload (RedLineStealer)", "value": "2d9edc88a1483ac9d9cbd0e6dbab7e7c286966b952a9be49290fb0fbcdd4da7b08e59834a01fdd7feaf0585e82d16763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676656528, "uuid": "923b666f-87ee-4606-bf56-204ab34d39cf", "value": "T1BBE4121BEBE99022E9B5677024FA42C3063B7E6157348357520EAC2F08732B8B675777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676656528, "uuid": "e7b4178d-b8cc-440c-927b-0dd317880b62", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676656528, "uuid": "b4e7bb5d-0d28-4060-8969-fe7c493da4d2", "value": "12288:+Mrcy90Xd7zWCwFRHoAJfKrgeKBsD6GIJkbaVoHTnB3WphJ:mymd7iVg+Kr73+3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676656528, "uuid": "3501826d-93d7-4488-ad31-2843f4d987b1", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676656528, "uuid": "280b37bd-22d7-4db2-bccf-649f00e8be91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676656528, "uuid": "b2afd5a1-b257-4473-aba1-3495428eca5c", "value": "5b3474d17581913a8d53a1f40c32ecb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d76ec12-aed9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676648519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648519, "uuid": "483444ff-5a43-49c6-8126-a982ea7fa78b", "comment": "Malware payload", "value": "fd2e4904e1820bea687e658c138f8734", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648519, "uuid": "16e6bc0e-6fd8-4cf2-92bb-8b0579194fef", "comment": "Malware payload", "value": "ada3145bd4d0634a34b73d19226ddd9b6b13f1a2b2089fc335d3950a01d3c520", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648519, "uuid": "6f2da1de-c8ef-4e44-8742-0bc67979a1d9", "comment": "Malware payload", "value": "661465bf6254b33cfbf5a39d22ca2d1db21ec0c4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648519, "uuid": "83ab09b0-0215-4bb2-ac31-6e06a7205c5d", "comment": "Malware payload", "value": "f6eb6419af8c0a24d9376609e52769ab9886d30c1b5ecfa87f78bf2266ce99371688c81f1e37551c6e6334d51efe54b2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648519, "uuid": "148fa2bf-f78b-402a-b3e5-cb7ee93ed391", "value": "T1DB35024610E5CB84D718713983DA66537F7BEA1A30379E5E76F0E25BEAA21BC8C00DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648519, "uuid": "3c9143af-d44d-4782-b866-4810e3b75fd3", "value": "12288:fwGplGcNyfeMVR6v0nk/RUfhmsYvLUMwC/kVkAotqMfz4rj5ffigG7vJMVS:oGDLNZMTQsYvLx8bMrky1bJES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676648519, "uuid": "677bee25-893f-4f5a-952b-20154f2801a9", "value": 1059194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676648519, "uuid": "d98cfc48-2e32-4836-a7c3-2579b0a7a061", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648519, "uuid": "99861184-9b62-4ee8-9b90-677a98b53f24", "value": "workoffer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140923e4-ae91-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676617364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617364, "uuid": "e8f7694c-3329-4587-b6e2-9fcb6fc9d9e3", "comment": "Malware payload (RedLineStealer)", "value": "1e35bb9a674b7f6fdb5dc5acf22d93b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617364, "uuid": "8cd95aa8-93a7-4bca-a852-34257b39eeb0", "comment": "Malware payload (RedLineStealer)", "value": "adaf93169377f336cf8d2f27874ad855418a1699533f9f9416fb618aa2569d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617364, "uuid": "303581e0-16b4-4c21-b8d3-fb63bb86d9d3", "comment": "Malware payload (RedLineStealer)", "value": "7619e9f26a7aa43e9fc7298bf5c1d9465deb4827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617364, "uuid": "3b02f1ea-34af-4325-9714-6de433f3d8a5", "comment": "Malware payload (RedLineStealer)", "value": "f3b8a5517476614fe6d9acab740d71c4df698fb6509564f64ea0ae877c3317fcc3977141186829c4afc0c5c8fac9817c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617364, "uuid": "1c3fb662-ebf2-4f5a-b75f-14512f16935d", "value": "T1CA251243E7DC9461D9B4877158F643C31B32BD751F34969B238AAD8608B32B4A23277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617364, "uuid": "ab088fcd-aceb-47ba-9f54-9527787de742", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617364, "uuid": "53423228-6bf3-488d-a9d4-6eae2c2ef55a", "value": "12288:JMruy909GeefE76g0x7yCbYfNJAW49RyKV1OWslooxw23G7hE8zsxlwBlXz:Dyie2qx7N6GTQeOWOG2h84az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676617364, "uuid": "9234fe89-dbb6-492c-998c-ab01b29be289", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676617364, "uuid": "c955a786-7730-47f5-8e5e-0377f4c92cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617364, "uuid": "2dc394ac-5f39-4e25-8b44-7786fecd3931", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97dde553-aea6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676626605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626605, "uuid": "53f85643-8b08-476f-97c5-1eadda81afe1", "comment": "Malware payload (RedLineStealer)", "value": "14d612e77a3e5dd849167c11fc0e78c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626605, "uuid": "7191efe4-1ab6-465e-b8ea-214403280629", "comment": "Malware payload (RedLineStealer)", "value": "ae63de29d217396352a0c64d6ac585f1f094605894ec5a00616c677a39061bfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626605, "uuid": "33cfcde8-766c-497f-a266-348dc40ed2df", "comment": "Malware payload (RedLineStealer)", "value": "6d4013a5bed95af440f60c2ce2ffbe58b1d2ef40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626605, "uuid": "d44ae4f7-3cc7-4a28-910a-71cfd0290a7d", "comment": "Malware payload (RedLineStealer)", "value": "399b8882388309d6fed5b6f455f26868c33aa234d743ad5015603f67cd76d711a6973b3074cda244a25e73eda7d43f52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626605, "uuid": "085f8283-5796-4e58-9d60-9118be582c84", "value": "T17625220BE7E88066E8716B7045F647C30B39BD915678C78B628BDD581973BA0E23077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626605, "uuid": "8dc1fa09-8882-47e9-8423-cfe8c87641a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626605, "uuid": "f9f3acd2-6a64-4eb6-9b17-95bacc242cce", "value": "24576:4yFZ9t4HhD//oQ8vhf4BABk/8yvo1gFN:/X4HhDghf4ptw1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676626605, "uuid": "7e32ce3e-4b43-42ca-a177-2ab5f89bcd96", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676626605, "uuid": "31ff5b14-8c46-4423-86b2-2512ff8c9e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626605, "uuid": "4c3a8822-e898-415f-9e25-aaf4f76163a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2517fd7-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627481, "uuid": "93b55033-2719-4074-9229-393fc3f49e6f", "comment": "Malware payload", "value": "d4286504d9fd691e8e9cd0c6202966f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627481, "uuid": "3049c69f-3477-4555-a461-04db65abd807", "comment": "Malware payload", "value": "aea22bdf30f2b5ece1f867d4193ddbf48a5e8ebf812d9b7586db4aa54f1abf5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627481, "uuid": "4cd7a01f-3fb9-4fb0-b178-968079532c6d", "comment": "Malware payload", "value": "5a6329744a47d659aa6f0be15a450f1c224845b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627481, "uuid": "93dde8d8-a437-4eee-b051-f1c9b89a7d55", "comment": "Malware payload", "value": "18a1e317ee55f01faf5ebddcd15426c194037eff7d74b416eb3c204dd6e678471659ebc3321ced9b4b191e5bc547faaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627481, "uuid": "c5553e8e-8202-4025-b166-ef503ee62856", "value": "T197149DC2AA98ACDBD615167895EAC329373CF7C51B838B030C34B6351E437D1AE8B55E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627481, "uuid": "a6d62028-16a2-463e-bd3e-b9d86799cf48", "value": "0fec5b870dad6c4991f598c6bf78e2ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627481, "uuid": "81f56265-0621-4ff7-b617-c52621218e50", "value": "3072:pSN8QT9w06ZKxZeID8zlqLE3dDYuWOS9df:pKhFhZmz33dE9df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627481, "uuid": "f5729a90-05cf-4b7c-be86-93e6a6c05382", "value": 207530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627481, "uuid": "69d45bb5-3fd0-438a-877d-a3370244c442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627481, "uuid": "9a998d2e-b482-4621-9f08-4d0b8ccfc83c", "value": "Google.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889b6701-ae84-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676611976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611976, "uuid": "9bad6c85-77f9-459a-aafa-93b5a33dc714", "comment": "Malware payload (GCleaner)", "value": "044c49af2bf7c120e1b7bb508c04417a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611976, "uuid": "979a4469-6125-4505-b078-1aac961a8e57", "comment": "Malware payload (GCleaner)", "value": "af51f532b78ee18435deeb491abd5736521f79311cfc9d16bf229519e841cfdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611976, "uuid": "ae566670-0b4d-49d9-9f76-7f6f08e88584", "comment": "Malware payload (GCleaner)", "value": "79232f0bdb7af7e85e8ad287e7dc62a04bcf1ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611976, "uuid": "39e4dd18-4499-49e8-af2a-c4159c8cc911", "comment": "Malware payload (GCleaner)", "value": "15811b539a4536113d4c3fb3eaff0b7789b4107191763d778ebde0929413d7ae0b033fb939e34dcaebd809318a25aa14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611976, "uuid": "9d6be2ca-b1bc-435c-b812-e3adb70b1d4c", "value": "T16CD523C519A4C9F2D3FDCFF1B90E46E2B4A37C6BE59406677428BB29793218D844E318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611976, "uuid": "6f5f55f3-f5aa-4e29-8e19-5bb63408df18", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611976, "uuid": "cac32bcf-8bb9-4834-b483-27fb4f8bd41e", "value": "49152:vNTUxeN3l8iExxYqGb04x7DORZU/HGgrgvaHjPflaQ2dBCiZCT+uirchQ+Op0LCU:VTUQN3sxt4dOIvGghfkVBCT+zAadGv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676611976, "uuid": "f45a1497-e1cf-44da-8825-ede38510a329", "value": 2903554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676611976, "uuid": "7d9996b8-276e-49fe-b9d7-ba06fcb25ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611976, "uuid": "7d7c1036-eaf4-4974-9dba-897abcffd328", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff1ea00-aed8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676647905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647905, "uuid": "0f12eab2-a2d6-4cde-bf28-df717d551fbe", "comment": "Malware payload", "value": "b3840357249bd0b3f683b218ff1ea50c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647905, "uuid": "5bff7a42-9c1a-4ff0-ada7-b9bd30f6672f", "comment": "Malware payload", "value": "af86dd9ed4d6e78298ab4e29b0495a43cbb5bee2f457a158fe1e35c851afd178", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647905, "uuid": "cc9af5d8-92b3-4782-a93e-f3cf361bbfa2", "comment": "Malware payload", "value": "6f5c80dda2183124beaf7d71810cbd6b44cd180a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676647905, "uuid": "794cc534-d49a-41be-bf85-3b47aaf2a521", "comment": "Malware payload", "value": "f886f5162710d36df3251e123a1780a05a1a6975dc8671f7340427dbec8e93840339031c59dc0ceb1c9e1d1fbf72ef3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647905, "uuid": "67f4117b-55bf-47dc-9e52-cd721f6ba0ed", "value": "T1A8E5330AB2744062EC7793B815F54683063F7F278E78566B168688CA2C777703DA63E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647905, "uuid": "37edb11a-042f-459d-88c5-bf599949a990", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647905, "uuid": "affa58c2-a979-461c-b882-4c1f0f35a26e", "value": "49152:B6Kfc/H56MVU5ida2g5vh75f1b1gSoMNtI9RGH/fHyI19CKV2wklnO:sKfwH56MWD5vh791ZgzD6f7IcElnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676647905, "uuid": "ca51e87e-598a-4fed-b216-e3fc24854892", "value": 3123712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676647905, "uuid": "1f24ac96-f2f1-4d23-91b6-4471c8868289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676647905, "uuid": "52ee8f56-764d-46a8-ac13-6ad324a85675", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e7f33a-ae67-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676599657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676599657, "uuid": "6dc0a762-782c-46b9-a696-2fcbe6f04fac", "comment": "Malware payload (RedLineStealer)", "value": "e6acae4cfc06afc902a7b7840ec6d4f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676599657, "uuid": "135bbc3f-b3b3-4f56-a858-375d548da48c", "comment": "Malware payload (RedLineStealer)", "value": "afcc937745f2ddb2ed9a4f5cd78d3c2e869b50c3133fa8c34e9c5631032db507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676599657, "uuid": "6eab7226-b739-4e00-ac27-878127f2d4f3", "comment": "Malware payload (RedLineStealer)", "value": "5d68c83903ca3d2f60a865b5c61727a0322c129f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676599657, "uuid": "13065861-44fe-4c6f-be7c-4b9be3578bdb", "comment": "Malware payload (RedLineStealer)", "value": "7a0eaa61e6d665c707f919d037c288bc711c20a579d163d51926359eb010b3a4242336cc763eb1d769fa28cacb9cc15b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676599657, "uuid": "de354439-b8ab-4e05-8389-d0620fcef8f6", "value": "T14725224BAAEC4435E97517B109F213C30A36BDA1477D924F238ED85E19A2678E37036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676599657, "uuid": "cd0d5a4f-e7c0-403d-ae37-ca6f3fe338c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676599657, "uuid": "4cdc73f9-39b3-49a9-bcc6-f2413601dfd1", "value": "24576:uyKf6zlevtxmLs/FAWnMt426u7OtkOxfF:9KyluR/7KxOyOxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676599657, "uuid": "30578b9d-8b26-44f2-8e75-ba09616f4f44", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676599657, "uuid": "ad5d7495-e4b3-4ce1-ba7b-45364237a91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676599657, "uuid": "a3a5a473-94fb-4bff-8a48-8ca6976027b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59ab648-af0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676671832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676671832, "uuid": "05c4d4b1-34d7-489e-91c3-38a2cd9a3e17", "comment": "Malware payload (RedLineStealer)", "value": "ea166b055576608d04a5e181ec129e2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676671832, "uuid": "002bec51-4483-4e17-a9d0-12314c32fe02", "comment": "Malware payload (RedLineStealer)", "value": "b0cf8442952168f43931a315e48588ac0fb3eae7793f7c568dc1015d3307abb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676671832, "uuid": "913a7eb0-5b12-4454-b62a-fce81d2eadc0", "comment": "Malware payload (RedLineStealer)", "value": "a4f381f519912c429da1fb0e22084de56699212b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676671832, "uuid": "e8d21030-ace1-4b7d-a592-7a28d9eda9db", "comment": "Malware payload (RedLineStealer)", "value": "d833e1416cc9e66176778dc87929576f07ccb6bea160a78e72fe407cfc88e6c28e5ca3b41b9855edd1f08016a1cc7c46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676671832, "uuid": "ea139a34-5a04-4c0f-92a2-d2662421cc8a", "value": "T1D154F12237D9C076E22795348D20C6A6D73BB8A0897198CB3BC555AE0F70FD2CB59367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676671832, "uuid": "a5bb5a82-a11c-4168-b6ff-e18ce5747117", "value": "9d64e6a2a7bb4f74b24f7b7e42936433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676671832, "uuid": "0198f5a3-845f-4f8e-a423-4b900339af0a", "value": "6144:yk8gdbtKz4XDkjjVniup2y189i1laDHlw:ykfUz0Dk9R1U0laDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676671832, "uuid": "f0815dc7-1b07-4832-ba8a-46eed0edeb7a", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676671832, "uuid": "74c9cd69-3011-4e3c-a710-6fc36c206583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676671832, "uuid": "db4f4c77-889e-4098-9051-6032c320db77", "value": "ea166b055576608d04a5e181ec129e2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1959c259-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627252, "uuid": "9bc8de38-5f14-466d-8406-8edb18cdbe63", "comment": "Malware payload", "value": "05973b901ffe811e1a4f6e4ba4490508", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627252, "uuid": "030b6159-a620-42fb-b8b8-34e50c23b106", "comment": "Malware payload", "value": "b19f1eb30638f1f4695fe0741a1ccdb8ce0aa78b6ea343b4799a64ca1f1b1971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627252, "uuid": "a9e79ec2-325a-468a-90d6-d1eabbd06464", "comment": "Malware payload", "value": "e0b2e3799e50112248ed991529cc0a3071c2bffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627252, "uuid": "573c762c-c340-4a86-917b-12fd8232905e", "comment": "Malware payload", "value": "5d57d7f4595c066cae3b69d30157342bed86933eb8032e48a6eea5c6d0a86fc899abbdeb3204de5d4f78e108c2619dfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627252, "uuid": "c7e78a7b-4049-4e20-8448-41a887b012a7", "value": "T1A9148DC1AAC8ACD7D615173895EAC32A273CF3C55B838B131C34B6341E537D1AE8B56A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627252, "uuid": "0c7b33e9-57c0-41eb-88d4-fc6cda6cad21", "value": "dae253036ba9d710a708001505bd2540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627252, "uuid": "198db1fe-ca42-4f34-abf8-ce5a50953b10", "value": "3072:OUMGRahQrA7JdSNPaX7xe4ZLtInQIuBMLP:xMjdSxAxe4XInhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627252, "uuid": "1ca579ac-6113-427d-9354-048f026c81d6", "value": 206891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627252, "uuid": "aea3e96f-451c-4f2b-8ec0-c8d33dc21ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627252, "uuid": "79a67bcb-d4e8-4530-8d6e-d9954f3e2832", "value": "cchome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d338b0f7-af0a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676669654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676669654, "uuid": "a98243b0-654e-478c-af3c-dccaddb7559d", "comment": "Malware payload", "value": "8e5fc56c4008d0f64414ccd33c5443fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676669654, "uuid": "891f4786-4765-4d72-a87a-d68ff42f97e8", "comment": "Malware payload", "value": "b19f659cd712afbf4e0fb205a21f60c3686fc3c851b71fee8969562a05c891c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676669654, "uuid": "3e19d5ad-04a3-404e-a5f0-31847c4269f0", "comment": "Malware payload", "value": "50e85334a685e7c21f337f94546e2e0be6bfebd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676669654, "uuid": "d8fee3a3-caa2-4c92-be20-f4382c686641", "comment": "Malware payload", "value": "9c5d3f7b62bc7ba5f1b70fcd371348d5ea1ebc81ea682fe8eb7dd9af96a8c58ee15aa5616c11fe2ef4ee3a5fafc10bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676669654, "uuid": "29f1f907-b410-4129-b65b-31b556e7a7f2", "value": "T198E4125B6BE89137D9F05B3019F203C30A363E529B388267679F5C5D08722F4A6753AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676669654, "uuid": "a0530ed4-3759-44d4-907f-d774d4fcd2df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676669654, "uuid": "64bb92a4-583e-426d-a00a-399dc7eabade", "value": "12288:IMr6y90P36+mamkfn5zvGZAfVrMLEPk4RHcl5LdlqjlETeBQJg:SyU36z1khzGM2E0LwlXQJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676669654, "uuid": "a8f5d82f-1600-4905-906b-6df0c50f5f52", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676669654, "uuid": "2a3f4aa2-9fa7-4fbf-8256-352cf5d5cfc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676669654, "uuid": "cca3fb5c-58b2-46d0-8185-59b170f4a660", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0146f6-ae82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1676610989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610989, "uuid": "28c29641-52e9-488c-ba7c-f2ac1a4d8b5a", "comment": "Malware payload (Worm.Ramnit)", "value": "c67458b66654620c987e8972a061b44a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610989, "uuid": "c02324ec-6c3b-42bd-b8f2-dad7fcd42efb", "comment": "Malware payload (Worm.Ramnit)", "value": "b1e165a77e4b0de2cd16fdd3994e9cddf0d1f13f1e80bd277385c7d2a8943203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610989, "uuid": "06a9c2e4-d008-49f8-8a0d-c51e9b254a0a", "comment": "Malware payload (Worm.Ramnit)", "value": "ba30abd10090c36a042a3d69b4cea193b61a07a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610989, "uuid": "907ec1a2-0536-4e36-a500-de59cfe601eb", "comment": "Malware payload (Worm.Ramnit)", "value": "256e5b3abfda2728c4bdfe4155af5d80de5d15cf3719c01858dfa7866726f54f023a4bb659bb2f87e0f2f987cf0ea8ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610989, "uuid": "a7950eaf-0cf7-489a-a863-cfe65763f6ea", "value": "T156656C4AA9A3A337C67A7DB9A9A31BC91344B30A8F560BCF054BF46C4CB10C15FB5361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610989, "uuid": "16d9204c-613b-4e44-9c0a-e74e07b322dd", "value": "d491d6d67a4575975aebb4f71e4dc5e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610989, "uuid": "fdab8f7a-8e0d-4fe5-9aac-b52e18362542", "value": "24576:0du5vgFkYZvT6D9fdqFgb2neiQTXYQq+ArdxX1ZYV52ErKB:uu5vgFkYKfdqFM2neiQTxq+Ar7X/SkEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676610989, "uuid": "195dbcc0-357d-4764-85cc-a792baf6e08f", "value": 1449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676610989, "uuid": "7e888f2c-d354-4eec-a491-e656a90c716f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610989, "uuid": "fba56f44-3134-45a6-a71a-fc8e8194f22c", "value": "2023-02-17_c67458b66654620c987e8972a061b44a_icedid_wapomi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e112031-aea9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676627850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627850, "uuid": "439f16f5-c68e-4184-b3b3-cae1dbdcbf20", "comment": "Malware payload (AgentTesla)", "value": "35b02f4fb30db82436b28b952fb3b8d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627850, "uuid": "147c484b-b46d-49bd-8d2a-1a610b3cc023", "comment": "Malware payload (AgentTesla)", "value": "b416c616f9d57f2a71eb4fd905a6a1d7c73e48f0240981d477136b3c448aeaa4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627850, "uuid": "c240d5c9-8356-4612-9d7f-6746c874294c", "comment": "Malware payload (AgentTesla)", "value": "d0a860f242a6fe8a52490eca7bc3c886eec73c39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627850, "uuid": "6c82d5a3-2054-4bbb-aeed-911e1588580c", "comment": "Malware payload (AgentTesla)", "value": "575369aa7df83ff69f25da1e8ff9b7671bca603e8511c15ad8fd0ae3639fa8022a39e5bb3faab0a3675570c76ab12748", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627850, "uuid": "e9c258d1-437d-4e4d-b645-8b283ad528da", "value": "T16A6412503394D867F87687353E7B829B2BF9DD0254E14B0F23A067A87F62762C85E760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627850, "uuid": "e2a2a10e-17d8-4b48-a283-c6f6dda147a4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627850, "uuid": "580b0dbc-1bb2-4272-ac13-30f9d94dfd29", "value": "6144:/Ya6Qy5KQVO5G4jVRV777aCCTLuXbpMSEDx4kQo51nkP:/Yu2dO82zi2XbpREdT51nkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627850, "uuid": "d2892fb4-7fcb-46b0-b85a-f719ff1a8100", "value": 319392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627850, "uuid": "6eca320e-3a7b-47f1-a27a-9af058b15897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627850, "uuid": "4718e052-8854-44d6-9742-b6a618c7f23a", "value": "DRAFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815bf3cf-ae9a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676621413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621413, "uuid": "da95b878-8818-4e6e-9f3c-85b5b3e64ff7", "comment": "Malware payload", "value": "e2aca229405dcda64ad279ba8d2b2988", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621413, "uuid": "8438b1d9-9eea-459c-9796-b34b9b57483c", "comment": "Malware payload", "value": "b46b0ac8aeb738b7d666f968692403a77f5d4537e51b058bc32a57fc759f7702", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621413, "uuid": "00c9cd3d-f382-4d46-9b6b-6c11ab893cb3", "comment": "Malware payload", "value": "5df2a8ce74136160ea0624712cb7429d83d95fda", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621413, "uuid": "d389b789-3d86-4198-bdd7-1f8dd16aa5ec", "comment": "Malware payload", "value": "3bcc8f93ddcdfef7a45b3517ffb4f59e9e183a5cfead38be011714eb6cddedcfcf4895f469901197f1ec067420563836", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621413, "uuid": "02234a17-b5b9-44b5-bf21-0709c94616c1", "value": "T114B42396364EF48DBC591FADC5D909AE16E95770778F1CEBACF84A0E24C0BC500293E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621413, "uuid": "661a1a20-e180-49ed-9991-549bc985c6c0", "value": "12288:Sm6/o5n/IvPZVRcsHIkHoNdOidT2q7KYW/NpAwI:Sm6C/IvLRbadrB8NpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676621413, "uuid": "6760127c-c5ba-40e0-b11d-5f612e89b1e1", "value": 493910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676621413, "uuid": "2edf3564-1b39-4ef5-81b5-455bc3f9d75b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621413, "uuid": "b2cd196c-ab06-4085-a7de-884260e87da8", "value": "PO-IG3BO22950Y.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a0d999-aec1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676637948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637948, "uuid": "93fb34be-3273-4ee3-9fd5-5cf184911f4b", "comment": "Malware payload (Mirai)", "value": "52be76386769251a3afd5dfa485b9e26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637948, "uuid": "4d2744c6-ec6a-4974-b070-aa27b2315789", "comment": "Malware payload (Mirai)", "value": "b52bc60aaa46dae84a3c1da8ee95ca93ce7b2a6064a26b95c9782f5d74835633", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637948, "uuid": "1bf953cb-eabb-4cda-9fce-03148bf50b57", "comment": "Malware payload (Mirai)", "value": "3a44d55e867272d00df716d9782fcc824a0ed975", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637948, "uuid": "d786ea53-e46f-488c-9921-4a83de8e1549", "comment": "Malware payload (Mirai)", "value": "404be76a2ecf4216baaff89a22806b1dc0e1fc11e9f3b396e9d8cc10516a39e30a2cf4d172967a07679a78dedd77b283", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637948, "uuid": "0b7c976d-21b4-4bd7-95ce-1238b0eec260", "value": "T140730756B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637948, "uuid": "167a62c3-7e72-4a57-bfe5-b4d94d6dac05", "value": "1536:2ln25xPBXk1wnnkL7+KE007IIRMqai90DIyiUNbsvHTGcV5GYIWM:7xpXCMkM/3TaFNbsvHqcVERp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637948, "uuid": "2451e69b-5258-4acf-ad74-41703e9ef62c", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637948, "uuid": "151acd9f-7d2b-457f-9454-304fd230916d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637948, "uuid": "ab7480f7-3edb-4dbb-8991-0d889718aa1d", "value": "52be76386769251a3afd5dfa485b9e26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49a9d7e-aedc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676649926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649926, "uuid": "e9524ab7-f348-476c-9d2f-6457b7a1a903", "comment": "Malware payload (RedLineStealer)", "value": "634b7156f707c770b82b87831d8f5bb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649926, "uuid": "2cc839e9-f8f2-4d7a-88c1-847c24517356", "comment": "Malware payload (RedLineStealer)", "value": "b55c3a17f909446d3fb1ad4d43aed6ae732c1af10bfc7e60e32b61732e81e361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649926, "uuid": "a908b80f-c955-40f5-8560-e18fb3db6fca", "comment": "Malware payload (RedLineStealer)", "value": "42fd79ed5ffd5771bdfe68616122c7d778f1d550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649926, "uuid": "6c52538a-76cd-4b47-92d4-0a2699c25e7a", "comment": "Malware payload (RedLineStealer)", "value": "995834c7d94ce6dc786d37236805a6af6fe0309eed5a093efa25d6e900ef385f069ceeba0d047eec8aa4de03a4e0995d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649926, "uuid": "0d527e2b-7a61-4e23-b95e-33168ec397fa", "value": "T108E41247A7FC8062E471A7B059F603C71636BDA11B34439F179EAD4928736B4A23237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649926, "uuid": "80a5ae12-4191-47c4-9a70-e391f9579ebc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649926, "uuid": "612b6c77-8867-41d7-a1de-5292d56440fe", "value": "12288:rMrfy90hGpV1wtl7VvFLm/i7X1CmzPJdZjhYX1ZPbx3sTu3/N6S:wy5VyttTzzrJvhYX1tlH/N6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676649926, "uuid": "4ff36f95-f7b6-4999-9a49-0449d65403fb", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676649926, "uuid": "d3181989-abb0-42fc-9de5-a7e296bd2bcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649926, "uuid": "31c54c90-41c1-4299-80c4-8c9730c440fa", "value": "634b7156f707c770b82b87831d8f5bb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46be583-aea5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676626304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626304, "uuid": "26c50cdf-c4b1-4d6e-974c-878fca9f9750", "comment": "Malware payload (AgentTesla)", "value": "dfdee8e8baa0505407335a33e68d3d58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626304, "uuid": "aa088de7-191b-4f08-a3d3-29eae3640f64", "comment": "Malware payload (AgentTesla)", "value": "b56b5a2d64f4178a0dac7c6ccf263d64abef47abddccaf3d559e54e84433d4fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626304, "uuid": "149cc1a7-4c00-4d14-913e-acdf32f4e7cf", "comment": "Malware payload (AgentTesla)", "value": "20648f35fc911993b13ed70cf2fcf15a0cccc450", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626304, "uuid": "7987bf87-719d-4d82-9d00-d81d7ef1070a", "comment": "Malware payload (AgentTesla)", "value": "073053d917fe82b20d4c3ae28d116930487924654ec92a9bd5f318bd099d80c9e11c5ce88a5eba37cb6b417c02e0bea0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626304, "uuid": "ec926020-33f9-4c2d-be16-2c87dad770fc", "value": "T1D1B423790D4DA0D39D6026FFB6BE18D483562BBA40486A5BFF33860BFBC7D796612104", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626304, "uuid": "583116c6-fe4d-43e0-8770-37611a03dace", "value": "12288:0f0LYiGTpHzbJS6Ydbgg3NLYYemIJMMNLnq:dYiutxS6YdrNLYY/IG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676626304, "uuid": "1c334ab1-4804-49a8-9012-de61b17215c3", "value": 534252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676626304, "uuid": "ad44e24e-0a10-4f4e-8ad1-722e28d514eb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626304, "uuid": "b04b8dcb-7bf1-4517-a202-b490b290c4d9", "value": "invoice2162023-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8bd3c6-aeaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676628493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628493, "uuid": "2758be08-8ef0-4c8f-8641-e4d4d648fda3", "comment": "Malware payload (AgentTesla)", "value": "5fe59f33332141202342497ba4d98246", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628493, "uuid": "055f36c3-76fc-4718-8751-f1146531f803", "comment": "Malware payload (AgentTesla)", "value": "b6e1d1ac5553ff603f596264d03ab743a5c550f8063bea06da1d9a2782965299", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628493, "uuid": "56a806af-ee40-4a3f-9d8d-ad7216f863e1", "comment": "Malware payload (AgentTesla)", "value": "5a2e6ead07f5bcbb8707ac627af720cc16c61119", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628493, "uuid": "23a61774-0af7-4730-864a-451e05950b00", "comment": "Malware payload (AgentTesla)", "value": "c90e28ff84fcdb136bdd0d04cef9839cd6e7112136fd44f1e0c238f8c875060c4747ed10ce0e3c01f9a144ca712a883e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628493, "uuid": "4f12c770-d1cd-4a0e-beae-15b3775f6a13", "value": "T17E542317BE18209B21DA10D6DE66F69312DA5D1F146E5AA9BBC5CB34D1EBF38CC0C434", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628493, "uuid": "f16f9f50-807c-49bc-aa4d-a66c044cc809", "value": "6144:gStnj/2D+b/7pcDKnxk811TCKSHZN63iUvfIFhipcnqX:5tnj/37pwwh11295giUvfIKsqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676628493, "uuid": "a98395b1-ea8c-433c-8d44-786986efdfb8", "value": 305099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676628493, "uuid": "6ec5f617-e3a4-443f-acf9-a54a9402781d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628493, "uuid": "69eb9a05-5b0d-426e-835c-24d8ffef70de", "value": "S O A.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e8fe37-aea1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676624590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624590, "uuid": "e36f0763-cf88-4afb-8b65-b88f8d92ede2", "comment": "Malware payload (RedLineStealer)", "value": "3fad3a5141d89174b4718f0e7e793a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624590, "uuid": "2f57514d-32b5-4e37-b887-e33efe1a2cb2", "comment": "Malware payload (RedLineStealer)", "value": "b721e71c5026f97b35e9b104a12c07d659e3df0f11a8a97c6adb4995a92fc5e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624590, "uuid": "296ce2d2-e2a0-4002-8384-385447d61384", "comment": "Malware payload (RedLineStealer)", "value": "91182864d3910f48eeca6a952ff812f25cad6164", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676624590, "uuid": "830b2b6f-0f14-4532-9e61-1913b65ddc22", "comment": "Malware payload (RedLineStealer)", "value": "3a1fcb3f5975b441841fa71c2faeea1162a6c109f28a5a0e5b3c3b2cd1ac73ff9beae1ff99160d49a85bec6b1c26ef9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624590, "uuid": "2774fd1f-95ea-4833-a670-4385756761a4", "value": "T1E225231BE6E88422ECB587712AF912C315367D517B3483E6278EED5D28B13B4E631363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624590, "uuid": "109029ef-a25b-4d49-b365-60e605d9c07c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624590, "uuid": "bd87f2e8-eded-4631-b763-73df1b282e83", "value": "24576:gytJe9q5iNN5P81GNGz6/gim6v/TcqBDCf:n7e9J5ENzGBno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676624590, "uuid": "7cf637bb-f8c5-461c-94f9-920c61e48418", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676624590, "uuid": "b8563ad4-6eaa-4013-86ef-2bd7827f17b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676624590, "uuid": "5d48ea17-ef4a-47c8-9c64-37820bf51685", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d75a09f-ae8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676616494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616494, "uuid": "52cd6eb2-1355-4521-b902-c65e67956455", "comment": "Malware payload (GCleaner)", "value": "533c7de79274389aff3ca5caae01f605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616494, "uuid": "4126f287-a9a6-4834-9540-a27333bc81ac", "comment": "Malware payload (GCleaner)", "value": "b72ce4db5ea2bf7473198afe403d083ccd63473ce4f8f61af48284e1d18ccdf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616494, "uuid": "d8d7a6bd-d28f-4ca4-bdf4-b62537c17834", "comment": "Malware payload (GCleaner)", "value": "852ae9834a5e03f4672644b39c6d0496db68324f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616494, "uuid": "dddcd04b-7b46-4a0f-b016-e66c0681bef3", "comment": "Malware payload (GCleaner)", "value": "97701b66fec17601c7db46a247d8abcb4f15aa104463afc52129e85ce967f39d243238b33a3b47a2fe5240affcc2e7ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616494, "uuid": "32d59f42-d163-4132-9b2c-a5fff1f45c3a", "value": "T173D523C1A921D1E6D7FCDFF4FD5D85F5B1237E2BD8D045133888BA2A223219DA09E608", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616494, "uuid": "b38a9b8c-58ce-41c8-a930-42a03152f671", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616494, "uuid": "d71473a8-6bff-4bbf-8d05-38f3a1b3aec4", "value": "49152:vNWpfLNErmyYPLAS4cnw2EfgsjLcpsO/rznxWBD8EJBkeX5sSHqszkaEZWCf+Ql3:VKESyYPLrLw2EotxMDce+SKszo/llv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676616494, "uuid": "bd92a22a-c12b-4fac-946c-52373e6ade73", "value": 2933945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676616494, "uuid": "78174d04-775b-4ffd-bb73-280a44bdeaa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616494, "uuid": "95239ed8-1f36-4205-9c76-54fcbaaf4cab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664398c7-ae88-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676613637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613637, "uuid": "3740e5a2-b852-4a10-b592-a0a26965d34a", "comment": "Malware payload (RedLineStealer)", "value": "15bc2afb4a579b6b910681a1f4d22bed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613637, "uuid": "7ed1989e-3b1b-451d-bc96-f6ac5afa5e00", "comment": "Malware payload (RedLineStealer)", "value": "b860053a0af9fe48a31462e091dd488187e0a3f5fdb3190147491ae7cdae58d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613637, "uuid": "8b2feca2-e575-4415-aee2-05b055aa781e", "comment": "Malware payload (RedLineStealer)", "value": "92419871c302a7d37809a41304f9960afe83a0c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613637, "uuid": "779c2cd5-bfb6-48d8-a931-89cb73a3e448", "comment": "Malware payload (RedLineStealer)", "value": "db8b461c0035c53a6a54f75ff50b7bfe40b4094deb0d80d59d08461b1600ede996579467cd2bbd65721631a02e88c7cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613637, "uuid": "65145523-84cc-4f25-9299-6b527bfb0164", "value": "T1D864F11337F19476E62306358E21C6A4672FFC708F76AAAB7784592F0E742F2C661351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613637, "uuid": "efdeff14-a656-49b7-8497-3c8fbf96e0b4", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613637, "uuid": "2a8dd983-5999-42be-a0d7-5f1ff7217414", "value": "6144:f7MHpxlyu4sK9BkS/JlUJEUtn3A442LOKJsx+/D8mKC:TMtH4sKHtwJ3tnwz2LOKax687C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676613637, "uuid": "fad08672-757f-4d21-8f22-851cbdecbe67", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676613637, "uuid": "18f9072b-4305-4663-a798-8200e3a692d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613637, "uuid": "118c2bc3-1bd3-47da-9d45-051a1daaaac1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb2f835-aeda-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1676648786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648786, "uuid": "ba236391-fcf8-4dc0-8a63-a41f699a154d", "comment": "Malware payload (RustyStealer)", "value": "fa64994b6d68bd6e5f7673e6edfcee69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648786, "uuid": "d49f2dd5-2fc7-4041-83f7-f571a3007285", "comment": "Malware payload (RustyStealer)", "value": "b86a7f4e904243a5018bbc43d55bcf47d8157ce6c22df7800cff0fbca0859d39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648786, "uuid": "90244103-5a9b-4f84-a7d7-952c139e05d8", "comment": "Malware payload (RustyStealer)", "value": "6cb2947d2ea2a165fe179e8d1494231abf621e86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648786, "uuid": "caf892ad-9033-4f7a-aed9-2e34b59e98dd", "comment": "Malware payload (RustyStealer)", "value": "e55b45d93b09e2d64bcc64bf243fad4808be00bb89dcfaaa33c3f83eff8729bc62a79690ad575f9c7acba44069867172", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648786, "uuid": "86db9979-0a82-4897-ac44-1e5fa9b1969b", "value": "T1AA76231D8C22EDABFFE3D5F18CAB86E45B106F3D6000ABA613A1A8754B2CD1744DD578", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648786, "uuid": "4238da22-dca6-47a2-80ca-684a19da2ed6", "value": "74737a1c73116b0c6a3ee2f6399e6458", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648786, "uuid": "8e5034b7-ff0d-4ea1-8029-237908772ac4", "value": "196608:kDANPFmCV+OoxomMRb4MGK3oI8XY2OqjoRU:k0HPE+7GK3oVhOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676648786, "uuid": "ef21749c-b54c-4d14-b7da-9a41f13e580b", "value": 7189584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676648786, "uuid": "d01ac807-61e0-4f72-97c7-f2831d10e843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648786, "uuid": "bd369b14-c343-449f-a44c-e1935dbc111e", "value": "fa64994b6d68bd6e5f7673e6edfcee69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae749cd2-ae7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676608604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608604, "uuid": "896f5ea4-ce64-4978-850a-d120b7c519e7", "comment": "Malware payload (Amadey)", "value": "7046c5cabaaa0cd49969aa1d757c2883", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608604, "uuid": "10b03153-9d7d-4ebd-919d-fed77988bed8", "comment": "Malware payload (Amadey)", "value": "b8d62777c1d1a91b7ea1c176a2077a80d74fac749420ec2e44850f50bc0a45cc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608604, "uuid": "dfe88b84-a6cf-43eb-82a3-3a52af62b474", "comment": "Malware payload (Amadey)", "value": "1ff9c038c6a707951c62c73c618da66dffcf5ef6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608604, "uuid": "f5978854-06a2-49dd-a704-e8de185dc365", "comment": "Malware payload (Amadey)", "value": "3535970a4c91d5ffb5e9395eef7f452d4a4548abafffabd7971ecce89d8e0ed933210f7a41e52a4baa7485a35bf1d93d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608604, "uuid": "0f717562-923a-488c-9cbc-68be6821cc79", "value": "T109251217BBEA8072C478A7B019F603D30637BD21973843EF168E6D1B1D72960A67532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608604, "uuid": "cb3c63e3-cce6-41eb-824a-ef02e8f44065", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608604, "uuid": "0336145f-94a0-406e-ac79-460210cb71a2", "value": "24576:Myhu6iW4gv8beJaYlzGZzD5qrRvkjfZjn:7TNvQei5tAYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676608604, "uuid": "f40c103c-019f-4eeb-ac5c-f4f74ef57fdc", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676608604, "uuid": "3fbb273a-e450-4609-96d9-28ddd1d9fd69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608604, "uuid": "55fe6001-5132-429c-9ef7-839924cf60af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22eaf823-aebe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676636717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636717, "uuid": "4f03d723-8377-4475-b19d-74b560bfe03c", "comment": "Malware payload (Amadey)", "value": "0d031495c0345b9073d4c374b87bbc3c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636717, "uuid": "95844d12-f881-4d0a-b8e3-5dfafdfee500", "comment": "Malware payload (Amadey)", "value": "b96d71c071aa664ff90a9d88bb4da1cef0a8a3bda5a373ceed038276bd9af906", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636717, "uuid": "ac26c18b-cd58-4dc7-8f52-c53137dc4831", "comment": "Malware payload (Amadey)", "value": "8c273c999326627b7baffad85c7c1d923a9735ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636717, "uuid": "e1bc55be-4412-400b-bae4-c7aa5c48100d", "comment": "Malware payload (Amadey)", "value": "6ccfbb374c86cfed455aba018fec817717bd5bcf186da1f2b43da0eea0bdbf4289b33e1bc320be5aa0621042e821179c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636717, "uuid": "419aabb7-134c-4191-8811-9f7096398cbb", "value": "T188152247BBE88021F9B457706AF203C30A397F915678522F568F585E08B35B8B531B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636717, "uuid": "db3fd4a1-70c3-4c56-89a5-15be3d98e6d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636717, "uuid": "0af8b9b0-1b04-47f1-b26f-844b3671bca6", "value": "24576:tyHVGTBvnsDuWZm6x+oNg5Gfo9+gXJ91teZkb7QT:ImBPgU6x+oW539+g31te6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676636717, "uuid": "f4b17ab9-6255-4f93-b9db-584100798e59", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676636717, "uuid": "e2d1c446-f1aa-4ac7-b48d-1aab59a20184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636717, "uuid": "15c98103-1f68-447f-abce-ab8a6d04443b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f40931-aecb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676642468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642468, "uuid": "5cf29875-2048-4381-bc67-51292df9cfc2", "comment": "Malware payload (Smoke Loader)", "value": "cdbf26b996520958d104bacecd0b76ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642468, "uuid": "3dc3fa27-e3ec-44bd-b692-2b1568cd03d3", "comment": "Malware payload (Smoke Loader)", "value": "bb7864dfd07179cda5f39ed2981ee93900a62b50e6fad6c8e0a6a42cf0163610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642468, "uuid": "bc062f2f-ce10-4d63-b158-2bd5c6ea62d6", "comment": "Malware payload (Smoke Loader)", "value": "0966b2e1fb9d53b3e7433ed7564bddebea2f4f3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642468, "uuid": "416daa72-84f4-4a6c-b231-6f9579f71b88", "comment": "Malware payload (Smoke Loader)", "value": "053035d977e46ed0b1e33286ae5d4ad51b6eae29431391b13f6ceef457ebca1a631cf47a829f53e951ddf6389b076012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642468, "uuid": "d2daa960-6955-414f-a9b2-d8b04392cdcd", "value": "T1AC04CF2636D1C072E213463599A2E2B59B3BBCA04AF19DCB3BC5126E1F353C2D768357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642468, "uuid": "7250dd9a-ea14-4d4e-93a3-10d5d2e10f5c", "value": "9d64e6a2a7bb4f74b24f7b7e42936433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642468, "uuid": "5da0f02a-2699-4a41-a904-0591e42655b0", "value": "3072:0fboUn54pc8ry3fpaVlXcpAfhRqmN3GNN8lUg:00Pa8GvoXXcM0mgKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642468, "uuid": "b7ba0c0e-2bea-4245-9cc1-3c237e9d5745", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642468, "uuid": "07348b6b-41ae-4fff-86a5-23e3d6000e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642468, "uuid": "f2bc1dd5-5c7d-46df-8680-250f3a3bb8d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b9ff10-af1b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676676712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676676712, "uuid": "139e04f1-e5cd-4010-bf8f-215665cdbc32", "comment": "Malware payload", "value": "a9e463f4f08d89754a695ce5809b3324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676676712, "uuid": "2647d002-37a1-4ebf-8c39-7b15f32fd2f1", "comment": "Malware payload", "value": "bc93341696c3c1ea7a3079cc1dfc0152db125588be5f935739d84bb25658d21c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676676712, "uuid": "65157580-66e1-42a0-8760-32c6915be36b", "comment": "Malware payload", "value": "968947c4a10638ba686e1e6872fbc6737da0cd04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676676712, "uuid": "c7a913f8-2a9a-4aa2-b56e-e1d5222b01c0", "comment": "Malware payload", "value": "63ec729ee81e068701baeb53478b6490101d451e5028d4a62c589e6cc2adebac77ff429413312af55c67982d631ae0c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676676712, "uuid": "aeef4bd6-f3f0-40e3-86f0-39c3d51cb293", "value": "T123E4125BFBEC8432E8B5477128F502C309367DA05B608397378EA85A19739A4A73537F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676676712, "uuid": "bd592b5e-fdd7-4ced-a91a-e4a4389ee881", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676676712, "uuid": "50389ffc-1305-4e04-aab4-35afcbb81e95", "value": "12288:5MrXy90fVD/6WX6GRFWcrKhRiboWpsbgDNYjKVtHgB+jPAftsJWCy0G:iyoDivGRFvr6YoWY6NYGVRwTCFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676676712, "uuid": "3ea2f431-f6ba-4c88-8963-206b9a9c5322", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676676712, "uuid": "db166187-c84d-4111-aa5a-f7ca30606985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676676712, "uuid": "cc304f5a-b289-42fd-ac6f-c936eb394cbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87f49e3-ae6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676602635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602635, "uuid": "4a057b90-69b0-4473-91e1-2fca827b806a", "comment": "Malware payload (Amadey)", "value": "33eff11c7b4e6b3ebd19f96a89d3ed9f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602635, "uuid": "937bc8ad-d572-4abb-996f-51a6c2362735", "comment": "Malware payload (Amadey)", "value": "bcc0750a66ce9f0063d2aa8e157efe0361c9fa28b08169fd22075a1a1cd51414", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602635, "uuid": "fc37ed46-575b-444d-a0e1-bbbef90f7eeb", "comment": "Malware payload (Amadey)", "value": "b41b30ef97dd0c0c2c3e4c5561e4287ea35a322e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602635, "uuid": "7065bb4e-feab-425b-b407-a05fb14dbcfe", "comment": "Malware payload (Amadey)", "value": "b19632dbed5b109b0cb843ac10d046714b4595164667be5bd17ecb2331848cf4367f782f27136a94bb1d9e73a756a7ae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602635, "uuid": "21c76e94-06c2-4cac-935d-ebb046cb69c2", "value": "T19325231BBAEC8421C4A497715EF607C30A36BEF16B3483476B9E1C5D58B25A0A7307DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602635, "uuid": "23bf5b44-f85c-4cfc-bf61-9cc5124c550a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602635, "uuid": "8ab9a6d3-2d19-4be6-923f-a661f77aa1de", "value": "24576:qyT8UOQ/AeAfZ+ewa+5zdd38xSCuXBoh:xXOQIeAfZ1wFbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676602635, "uuid": "44afb0c7-d96e-4314-a9bd-6295f09fb1db", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676602635, "uuid": "38b4be7b-df39-4fe2-aa9c-1b0b5e2f3caf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602635, "uuid": "787aa9a6-e4fa-45d8-bef3-e359e55ba335", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977af928-aeaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676630470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630470, "uuid": "b799cde4-d974-4f1e-800c-f84459850eaf", "comment": "Malware payload (Amadey)", "value": "a7cdc68a728a8d21f50db261a99cf0b2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630470, "uuid": "520341bd-8ca1-485b-b022-3890f8c338e7", "comment": "Malware payload (Amadey)", "value": "bce6f9be4b893cd9fe5072ae28da34c359873a209056cd5c09b4edcf1027a630", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630470, "uuid": "fd04482c-89aa-477a-9351-069557d0ff4a", "comment": "Malware payload (Amadey)", "value": "0cc6331ddca4d3766016267cf0c3a52850eda54f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630470, "uuid": "982e8e7e-9f66-4780-89a2-45b3fff905d4", "comment": "Malware payload (Amadey)", "value": "898622857f21998eb14edb0c149ef9b22796d11a6efb3c01f7aeba4138aa255404e1eeba2d3889584005ed7103a125bd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630470, "uuid": "bd63cd46-d7ad-4b74-b847-6f31d1fa769d", "value": "T19F252247FAED9462E8B6537114FA03D30632BE612A794357174EB94A2CB3A71723132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630470, "uuid": "9ee55750-5082-4abd-9195-72c76898bacd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630470, "uuid": "2ae06d46-4677-40fb-ab83-d654be8234bb", "value": "24576:TyXjmchwlbNLSfaqqHsbtxX0J5NVBv0UyZSd2WiTKBI:mXLwl5LSpssBpKDjd+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630470, "uuid": "a5c19742-178f-4774-b4f4-b8c7c5267eb3", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630470, "uuid": "b4f05798-b7f7-4db8-9671-36150bddb37a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630470, "uuid": "65e9cdcf-ca96-4cda-bc41-d9778c89bc21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328c48ae-ae95-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676619133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619133, "uuid": "72c73ae4-2a7d-4f89-b35e-b9256bd1e45b", "comment": "Malware payload", "value": "c6ac34ba9fdbc22842d4711c30ccf641", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619133, "uuid": "9f745753-08ac-4d4b-b621-1786371f5362", "comment": "Malware payload", "value": "bdb9aed749025c83407a143cc9492bc96e13122c4e096154e79fd59720e8363c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619133, "uuid": "2feaf504-9c04-4b43-8a96-09931f0456b4", "comment": "Malware payload", "value": "0e5bf480394419dbce956a1795e481b4b91c6b27", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619133, "uuid": "f2ef258e-470d-4abe-9d6d-e4ed5c2ef080", "comment": "Malware payload", "value": "1937c6c9321f4c0dba6cec21877d160c26f419565cf8805ee64072adae999816ee79fe59f84e8afc9bd74470d87f7501", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619133, "uuid": "17c8ceb2-6d3b-4e51-8737-c1d2e403a543", "value": "T1FF75AFFC75047DE6266F576BCE96ACDD03A6166399CBA4CC80A4BBC305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619133, "uuid": "36de312c-2630-4099-861a-3e13a4d3c12c", "value": "24576:DrLB7X4hH5dAKLQdVdhVMQvTwSxLzWaQqYR83eRG8u4s7M6ygwygw5AQz9G7AZd2:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676619133, "uuid": "0581fd7b-b5ae-4d4f-b15b-84cef37ee4fc", "value": 1631584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676619133, "uuid": "0f5c7701-3cfb-461a-95a7-3e20bec711cf", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619133, "uuid": "2aa3ed97-1950-4d5a-87a3-04dcf1fd2f22", "value": "Purchase Order YTM0018358.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1787c7a-af12-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676673060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676673060, "uuid": "5af2388a-f695-48b9-9a24-97629e3753fd", "comment": "Malware payload (AgentTesla)", "value": "3a79d815d7d86fa410d2ed2872d1a242", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676673060, "uuid": "b6d78081-1936-4d0c-b38e-607de02b6ca6", "comment": "Malware payload (AgentTesla)", "value": "bde6551575f5b6da2fb5866d94d174c350f6e7de41420e99234551520e595976", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676673060, "uuid": "261d1143-c68c-4292-9eea-e6d8313e886a", "comment": "Malware payload (AgentTesla)", "value": "f732f205289c8e3f7d9a50313c1e43dcbceb0e9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676673060, "uuid": "375bd0c5-c4e3-46cf-a7ae-de59a07a8cc9", "comment": "Malware payload (AgentTesla)", "value": "87ba66d2b39fa48fdcb907be9e66d6866bf0d824504f940d7cc12f2854e644b9b8f95f11b031d055d5c35eaf3d09d6be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676673060, "uuid": "328568d4-e52e-489c-8978-12431b57ad5a", "value": "T186641211A7F4C87BC91315314E2F11734DAD2A1268EC8B5B335097A8B9BB850EF4D7EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676673060, "uuid": "89960067-9ce5-4f1b-8dfa-341fba2492a2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676673060, "uuid": "0fa3963e-cd71-4b1a-baf8-eb2ae324f255", "value": "6144:TYa6x/IO54FIYCYKZoDD346WMdSgodFSsRB+Rb8fVK:TYrgKwMmDHWaSgSFFB+d0VK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676673060, "uuid": "cfee194b-8115-4027-9976-5e3f83743f48", "value": 319289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676673060, "uuid": "f4cbfb93-75fb-4691-8827-83b0795a8996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676673060, "uuid": "ad334def-37c7-4eb6-a05e-afbf7c868cd8", "value": "H-GB3001051.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0213e5c5-aed1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676644822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644822, "uuid": "65158d2e-d6e5-4f8e-90a3-717d643ca4cf", "comment": "Malware payload (Smoke Loader)", "value": "f381b52387022c520dc4d51b342ae238", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644822, "uuid": "fdd43c17-4150-4afe-8cb0-2251ef705b88", "comment": "Malware payload (Smoke Loader)", "value": "be1ac3e20d32bfd5c3ca1c7bbc8f5ad79db8a9a414112b91bad7e2b69700b8bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644822, "uuid": "4f4f1d33-ad4c-4dcb-b404-03448717d650", "comment": "Malware payload (Smoke Loader)", "value": "7ada7c8c4f9c2260274f93b18f03a20ac6bc145a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644822, "uuid": "7f666e45-b5ab-4895-b1e4-34541435ab15", "comment": "Malware payload (Smoke Loader)", "value": "46f27c8b922c955d44cdaac31f272838d35770145635e88d1632d484b6d4f2b923dab797f85c70c68263f904eecda2ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644822, "uuid": "e36957e0-8ba7-491c-8f32-97acc14dc9b6", "value": "T1A204CF227AD1C072E12351389A60E6B18B37BCA14A729D9F3FC85A7E4F356C2D724357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644822, "uuid": "53ce3df0-3f35-4f12-a69b-c58effe5edee", "value": "9d64e6a2a7bb4f74b24f7b7e42936433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644822, "uuid": "0becb9b6-95a3-4299-85d2-a05a8f23dddf", "value": "3072:p/BghwGgv4bxyPJ/Tzm6W6UN9cma9EAS5MzSJzQUK:p/YJ7NyBb6f9Q9lSPQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676644822, "uuid": "09b23e52-ed84-49ca-944a-c20481dc64b5", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676644822, "uuid": "ddeec300-51cf-43d7-82a1-fb484cbe3419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644822, "uuid": "d1003c41-b3f0-49df-9b4e-32a4b23ec53f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e260ec2-aebc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676635876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635876, "uuid": "de77537a-b632-423c-a192-a0a78ef9c7a4", "comment": "Malware payload (Formbook)", "value": "7457a5374f365c3090aa2ddced60ebb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635876, "uuid": "55fb35d8-036f-4a68-8ab6-69cac2173158", "comment": "Malware payload (Formbook)", "value": "bedb5ef007caf41eb52f0331f1fdf5997271a828df7adb1e1132063129eba99e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635876, "uuid": "a0d47311-f3aa-445c-b05e-767a574e36a2", "comment": "Malware payload (Formbook)", "value": "6822cde8f5dee7382b66b3d3bbb77f835a419226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635876, "uuid": "4b230ec9-66b9-4d5a-9298-4edc4a079b33", "comment": "Malware payload (Formbook)", "value": "48b1d8b13c1aaa35b0af8b90c45a6a5a208ab1356510355181b8420b0c6f75b5ed64f6719a928d22e85ec86f566c550f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635876, "uuid": "15f4220b-3a61-49f0-88a3-342ba42183cb", "value": "T1C1541229B3C8C52BF581CB301E7615B15DB1A62338BD061B13585BBDFD66682DA0F3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635876, "uuid": "bcfb7754-09e5-49e3-92c7-be4165fd4f11", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635876, "uuid": "d9450511-b8d5-4565-ab8d-bbe0c20cadda", "value": "6144:/Ya63vfs8mK78H5O2ZtGb79Wu+ON4H7cgcQ73q1kuWZoNRlpnf+Z:/Y13Z8H57XON4H7cgemukonf+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676635876, "uuid": "f464caf2-74f5-4a15-96c5-e915b9b56454", "value": 290142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676635876, "uuid": "46b54023-3498-43d0-aaae-fac5e8b4b55b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635876, "uuid": "02391853-2bff-4d70-9af2-c741604edb8f", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6687074b-aec5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676639837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639837, "uuid": "0f4bf69a-f07a-4c48-bc2c-aa1ca976ec88", "comment": "Malware payload", "value": "b14a85b825b08eab085e55919d316c3a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639837, "uuid": "ca2077b3-4538-47eb-9ea8-d487724f528f", "comment": "Malware payload", "value": "bf4d2b81359fecc1182cd59fd69d031b655eed9a3dedea72910d1a4f244b3b23", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639837, "uuid": "4f87e015-4124-49b0-a458-3fb0c1f5f533", "comment": "Malware payload", "value": "0bc0204c08e44f0de282d2f3a6548b975455bb3b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639837, "uuid": "875dd26b-b160-4cc2-a5b6-080ef66ca7f6", "comment": "Malware payload", "value": "99d989b85a455446a76cf48dff42379a8204280c073ef0a104f694b7a22a77cfbf489fe4c5df72f472c5a855ce88797f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639837, "uuid": "77396ecb-baf4-4c7c-ab83-aa1eeacce386", "value": "T1E3A5333AB0FB78B83645E7F64900DA347AFAC38639BA33221FF89CCA55241577675058", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639837, "uuid": "3878c7cd-123b-4ab7-a3c8-2d2054b8ada4", "value": "49152:ijoGN5J3sAs+aa8d6q3RKNhvqa87NXcHnSySdkOFOd+LgEf:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676639837, "uuid": "7071e8d6-5186-496d-ac69-ec2343cc5bfa", "value": 2080768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676639837, "uuid": "803c2717-daf6-49b0-8d83-1282627817b1", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639837, "uuid": "d0a22b4e-96ab-4c1b-9e78-4174118cded6", "value": "bf4d2b81359fecc1182cd59fd69d031b655eed9a3dedea72910d1a4f244b3b23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6118dbf0-aecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676642834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642834, "uuid": "db51aa1e-90ac-4de2-8ff8-6059475d36ed", "comment": "Malware payload (AgentTesla)", "value": "3e6e9bfff96b418e7f4d2d08ad23e6e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642834, "uuid": "3a353275-6baa-495e-9398-01faaf0e1c80", "comment": "Malware payload (AgentTesla)", "value": "c0b988aa2725d11a6807ba32e974042b4aa21c72307d009c0693d23c725c50a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642834, "uuid": "23b13cd1-1266-45f4-bc08-efdfc00d8d5b", "comment": "Malware payload (AgentTesla)", "value": "bf3a7fe456ee9eb9ff1b06b816173ce669265784", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642834, "uuid": "640d0d66-b862-4b4a-8b64-4fa535883d96", "comment": "Malware payload (AgentTesla)", "value": "58159d379217013b55fb8a3cfde7eea8e1f40bfacdfca2f425628d68e07414be544210ae9c47abe117959b2fc2b6471d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642834, "uuid": "045f9dcb-b68b-404c-90c0-0b3f4e8513ad", "value": "T1CE6412667BA4C963ED620BB21DFA6F295FF9F881250C550B6700DE423E36742990CB33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642834, "uuid": "104bf513-0160-4c58-aabb-2669dbc5539b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642834, "uuid": "e4d43297-db3f-442d-8cef-0ce872c160f3", "value": "6144:PYa6YKS0SbV2I2UarZ2DgE6Vv6f2m9sDhv8ppwpgmXmu0I0AgwjA7:PYun00II2UrE5VvE2mqappwpnJ5g1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642834, "uuid": "4031a36c-8644-4fb7-bf52-cd49975f9881", "value": 320014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642834, "uuid": "3b0d92f2-7004-4e4b-8309-1a3a695609de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642834, "uuid": "13bbc630-1ce0-4f04-9802-9e4feecc77ca", "value": "TT 00189330982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bcc5ee-ae9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676622540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622540, "uuid": "edaa697f-2e74-422e-85c3-437514a27907", "comment": "Malware payload (RedLineStealer)", "value": "f9ec486f6148c2e6c15769c7bfb591c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622540, "uuid": "6891a79e-7fff-4d6a-a266-e5f558e2e357", "comment": "Malware payload (RedLineStealer)", "value": "c0cc1babbe3a60c92049c8c0eac11e9d64b304c29b9f73abe9fc8ad8fcd4ced9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622540, "uuid": "3021a913-5c95-4847-8ec7-cb5d09337abe", "comment": "Malware payload (RedLineStealer)", "value": "9b6e92b51b6028ba1444b990ba864b058f9d86f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622540, "uuid": "65b084c7-e04b-458e-b170-fae6542e611e", "comment": "Malware payload (RedLineStealer)", "value": "738616f6ae0b942eaf93332c79929e55daa402d2c9a3b89c6a3dd6dc4c320e0cc0855b25c8761bba993968e73d2564c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622540, "uuid": "79127dc7-7ed3-4958-9c45-1402cee44f3f", "value": "T1FA25230BB3E84561EDB51B705AB603C31531BF616B3987DB134F6E2E28726B0A531B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622540, "uuid": "c62b6625-3e43-428d-a71a-286660257d73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622540, "uuid": "d90d4371-071c-4eff-996b-26981c4bfe2b", "value": "24576:tyJH53hme7qI/nIK7zQbYVhVAXO/GKL0kmYvkyNdC22:I1WWqIvjz9We/rLw2koZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676622540, "uuid": "1c99069c-1b03-464f-9188-390fb2dd9d1f", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676622540, "uuid": "17f92898-226a-4fb9-b7c8-5a5fa1944365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622540, "uuid": "446ffd86-f68b-49ff-96de-3b6d3bfc3db0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f094c72-ae57-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676592579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592579, "uuid": "0d20f514-2191-4583-8c49-6ab30f9b74f0", "comment": "Malware payload (Amadey)", "value": "ef55f7c2a7623705a5b2af8500252b84", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592579, "uuid": "d45f8535-9776-4781-8d6f-95e4ba6bf9fa", "comment": "Malware payload (Amadey)", "value": "c15a7817759a9aa5260b2ea9f0260da73d70d7863aa8144e93cbc6e748a8a599", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592579, "uuid": "6c2ea06f-950b-4f31-8477-cdf401f44ae6", "comment": "Malware payload (Amadey)", "value": "2a6ee37c2740a6375aa296c9b0fc6da30a207226", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676592579, "uuid": "e3164179-87cf-4963-9743-bf8bf9d7262e", "comment": "Malware payload (Amadey)", "value": "2630039cc454a18f240a7fe115652199252f5f8acd87012563e1381e3941080576665636a0dfe62231c381bfbe1e2eca", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592579, "uuid": "dd03261e-710a-4427-97b1-5fcdcc24c993", "value": "T1B625234BABE88076E8B58B304CF302C3093A7C555A74C6AF77DB5C5A1872665F27036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592579, "uuid": "29008cc1-8187-4641-89b5-b058f2d7ef72", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592579, "uuid": "953b991c-8efb-4076-bdf0-fe0b7ded48d9", "value": "24576:BygMwftMxjXrL38S9LPTNgmGZa8ZO2dbm7IhwCW:0gMwftQLrQShbNyZZYx7Ihd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676592579, "uuid": "22edc2dc-8a99-4542-99aa-8a957ac9ee19", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676592579, "uuid": "a48ce60d-b48a-49d5-9723-cdd78c55b9cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676592579, "uuid": "585ceea6-f599-4ca0-9e84-26910e4d3fad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0911524-ae6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676600903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600903, "uuid": "8967d291-7a93-4f16-a1af-0e6e5ce2f755", "comment": "Malware payload (RedLineStealer)", "value": "25d684527584fb8c86dfce7bbaa3df8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600903, "uuid": "61a0579d-41ee-4bd3-91b6-81abb7fca0e5", "comment": "Malware payload (RedLineStealer)", "value": "c346bae72a1d06011364e86b8e78fd168f40c03caf211459d3598417fae86fa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600903, "uuid": "3349bfb6-c0d0-48d1-a504-694f4ddc96fe", "comment": "Malware payload (RedLineStealer)", "value": "ccefd9acf40474ee35ebc36603bcea91cc717557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600903, "uuid": "58dfa7d9-2df6-4894-8557-c0d8df9be110", "comment": "Malware payload (RedLineStealer)", "value": "f316d01dad7f2f6acaa940ac5c0c17dec61383e296d5b1d956607bd4a29ff73a6caf5da1c3a7fbb7e359c5539cdf555e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600903, "uuid": "3ccb2d87-4442-4678-baa5-40aa0e2a6419", "value": "T10325120BA6E98032E47817712EF101C3073BBDA14779979B676DAC6E2D72270A5313B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600903, "uuid": "aa48baff-caf0-4835-b28f-2dd3944477cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600903, "uuid": "95ecc578-42c6-4f01-bf69-86d0d5b115e4", "value": "24576:zyZc7+C4q3sHFt+lvjCoNGjyZIXH6yGrH+oTu:GBCQlt+lKfgrH+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676600903, "uuid": "5d4f9b37-fee9-4d5f-bcf7-3ab5e252820a", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676600903, "uuid": "15000d60-09aa-4b44-a21e-979db128d6fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600903, "uuid": "6d607d7b-2383-443e-9675-53065f511b00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad79d88-aeb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676632972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632972, "uuid": "c4b2a19b-f802-4e0b-a1f1-54b40256f6f0", "comment": "Malware payload (Amadey)", "value": "dd5edeb2dfad516a35e6ce62ea3cefd5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632972, "uuid": "c6b7ee9d-86db-4bda-bcba-b67de025e0d6", "comment": "Malware payload (Amadey)", "value": "c381336f1a1fc66da57d64888398a3bc657f2cf6c727c4ec52c7e3a6d1dad144", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632972, "uuid": "1b73012f-2637-48f2-859e-2429a5dcb3a3", "comment": "Malware payload (Amadey)", "value": "8fa2c7e8afe785f257c275b80a596cbaa550484e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676632972, "uuid": "032f0e8a-20a0-473e-92db-d551f5e02afa", "comment": "Malware payload (Amadey)", "value": "c889d7a04abfcd2c46e650ab4e79822688d0859a005fdb2d75c8fd765b892025d9e933ad3d3932bd1761f9b7eb49b7d9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632972, "uuid": "2ff18a24-2b19-4431-b468-8442b9b2376a", "value": "T1DF252343E2EC81A2D8B8677059F303C3063B7D6567344787B74F6D3A6823A609635B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632972, "uuid": "c6b87afa-0fd7-4f55-8db6-6aed4e04ce49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632972, "uuid": "93d6041b-d113-4dcb-aa2b-f06c40ed40a7", "value": "24576:AyTew7nH3eNTpCaLCDmMb7Ka12t9T6pT:Hyw7uN/+nKa1Ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676632972, "uuid": "798bec79-0e0d-4def-8e68-ac7fa108b772", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676632972, "uuid": "c2ae2d16-d810-40d7-b655-6723dc4fc024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676632972, "uuid": "93d080d2-ef35-45e9-86d1-49d8a1fc86b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8503d0-ae97-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676620013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620013, "uuid": "04966c57-93a6-4bd6-bb42-bed7f442785f", "comment": "Malware payload (GuLoader)", "value": "91c8c296f1645205ce17a409d90e608b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620013, "uuid": "71750078-11d9-4b0a-b2cb-eb1e197ec8bb", "comment": "Malware payload (GuLoader)", "value": "c4def5aff5d18a806859a71e2a48f8f69ec3e3ea339673e051d770e8c38c1919", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620013, "uuid": "43d7191b-d3f8-4cfc-a407-6b9f06ec2b27", "comment": "Malware payload (GuLoader)", "value": "b0379fb83ac5f1b4c0c8176dd508543a849c5b8d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620013, "uuid": "c2a38c89-e44f-491f-bff5-c57b532cd97e", "comment": "Malware payload (GuLoader)", "value": "4f30eac74d8761283fd8a794316f4e37565b61415d6556c96c85b303357a4087ba0b7643db2902b8b1cb0973065d8a61", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620013, "uuid": "2c63498b-f6c1-416a-91e1-294a6f5690b3", "value": "T1DE450212B2D75CAFE58609B102A1D32A937397685533E2173F2CA621FF672435D1AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620013, "uuid": "4677bf16-f858-468d-aea5-b044d91f77e8", "value": "6144:6yIB9qSljbH5svbNAvVgVX1U8faOsrX6Oc/XR6jbUaEgKLC2K:c9BOvy4UqaOsrE/BObGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620013, "uuid": "62a0421d-274e-4119-bc78-595497eb6d2c", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620013, "uuid": "98c54f45-1b1c-4d8c-bf55-2979fca44c41", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620013, "uuid": "4b7eb04d-3473-40ce-835d-128688bdb1f7", "value": "MPSNTQWR90002023.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71d24cb-aea9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676627946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627946, "uuid": "51716bd3-19c1-4551-aeea-22463d6fd69f", "comment": "Malware payload (AgentTesla)", "value": "8b72b1a9d30703f75c757814c912868a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627946, "uuid": "ee671378-0f8c-4d5d-8195-532d92eaba63", "comment": "Malware payload (AgentTesla)", "value": "c50e616b405db7270d7834339e74dfafbb495ce8e36d0feef6ccd488b704671b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627946, "uuid": "24ed9b0c-1ff2-49e0-ac0b-e91b1bf18d24", "comment": "Malware payload (AgentTesla)", "value": "6e34e78cf2cfb782a090cb66cb3c261fc6886cfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627946, "uuid": "7af05ad5-33b0-40e2-932e-7e946f1eb812", "comment": "Malware payload (AgentTesla)", "value": "528abd6bafc8038a4691493fafb101cce713ad902c167e9283ea05687bb205050c7066428a9a85c904f58510de1b10a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627946, "uuid": "5aabcee8-4ff1-4e03-baeb-57ba9433201a", "value": "T1D3055ADCB1F0F67ECA4AC876AB102C146BE065536B26C593E25376D99F3D4638E1C0B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627946, "uuid": "f25d097f-35eb-46df-b9b9-5a2a69b7d7f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627946, "uuid": "11b3c330-563d-4452-b332-09d7af641726", "value": "24576:paqDSukZ/AuuFeCymDvVFXd7Jjwcfgfp2HhFHBn:C8smZFXd7+cIfohF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627946, "uuid": "8b3f8147-3fba-4187-905c-0dfc7cea91c1", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627946, "uuid": "f75c5165-8b5c-40ad-a1d5-a91d59ba010a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627946, "uuid": "d0ded959-c338-4992-a4b1-58cc3fbecb9b", "value": "57m\u00b3 LPG SEMI TRAILER 7 NOS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfbb3f9-aea9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627686, "uuid": "5b7c92be-a91d-4ab3-906f-3567f021d299", "comment": "Malware payload", "value": "7d9accf060920368bdcc92b40a5b8690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627686, "uuid": "441489b0-6359-4d86-ba48-bf87bd8b79bc", "comment": "Malware payload", "value": "c51d3b8fb5b012ace6b09db6ac16b3fe88b34da3f19ef2520d36dd022fae9b5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627686, "uuid": "0fef24f9-8812-4d81-8aab-9f9b611e1ecd", "comment": "Malware payload", "value": "2b0ff8cf152d3700fea4ec59aef3f823d90497f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627686, "uuid": "f6e24f38-a1f2-48ab-b283-f25c4b5d9033", "comment": "Malware payload", "value": "08290a31b0d1cb4ede35d7abb7fe416cd223c09ae4b211a0fbb8cd2e25f41e2b2c1084fa44b60da3fedc1b34d6f0dcca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627686, "uuid": "2d548d7f-e9f8-449b-b8d0-8185bd84190d", "value": "T15B148CC1BAD8ACD7D615167991EAC32A273CF7C15B838B130C34B6350E43BD1AE8B55A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627686, "uuid": "5cb619a1-0410-4dec-b620-b43cab70f5ae", "value": "0fec5b870dad6c4991f598c6bf78e2ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627686, "uuid": "8ec8986d-0c04-428e-90ad-cb341c38b9ad", "value": "3072:FSN8L/UOb4dWBftY44lgnNm4qmLE3dDYuWOadf:F/b4dM1Ygcr3dkdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627686, "uuid": "901fd471-60a1-43f0-a3f6-59dcb8e455a2", "value": 207530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627686, "uuid": "66b6c5f3-0b26-46a0-837c-a356e9a24ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627686, "uuid": "009c6955-388b-4df7-82a5-457d82591299", "value": "uwuade.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96eb6fd6-aee4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676653232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653232, "uuid": "2ed40391-31e1-48e6-bd42-081881b38003", "comment": "Malware payload (RedLineStealer)", "value": "cddbd387c5c8bb5e8a8ad341f7d05475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653232, "uuid": "c308346b-388a-4e2f-9efd-6f43364ad280", "comment": "Malware payload (RedLineStealer)", "value": "c531095f91211aea5e7ed61228c557ea1718605e8840e9ca61e3e652d4634d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653232, "uuid": "e715205f-eb7f-4f51-9069-af7da7f0a2f5", "comment": "Malware payload (RedLineStealer)", "value": "1ae74b1a19a38a736b5321b41de10a48ab72eddc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676653232, "uuid": "c1c8896f-4519-4f7d-8455-a49c5d2bd25d", "comment": "Malware payload (RedLineStealer)", "value": "9242690661ca10011ea81926ed52326ff2561eaee333532a5cc0727ca8d2652c9301dc6099250db8959797f888292af5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653232, "uuid": "b6607775-93ac-41a5-9b95-800df04c80c7", "value": "T16404C51437FCDD11E5BA1A3F6961A01086BF98026852F75B76C367CD0E32B40FA57AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653232, "uuid": "5a52bed2-d1cb-41c6-9b4f-6bb61b2f6ebf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653232, "uuid": "8070fd2c-e208-4b04-bc52-06f98b972a98", "value": "3072:MxqZWJBaKULo3cgguTVeLdFPhL/xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuj:iqZIcggiMPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676653232, "uuid": "7c268c34-1028-4341-9b45-9e16868e63de", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676653232, "uuid": "41982fc9-c96c-4fff-9d81-6e42779b6602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676653232, "uuid": "312de066-8bef-4bb3-8f8a-d0b6691ede78", "value": "cddbd387c5c8bb5e8a8ad341f7d05475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7daffc7-ae9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676623679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676623679, "uuid": "3e17821c-5161-49fa-98ed-4145d62722fa", "comment": "Malware payload (RedLineStealer)", "value": "7602aac26f368bae7a34f9ef071cc39b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676623679, "uuid": "4c511668-df18-4126-abf2-eba49a4398ab", "comment": "Malware payload (RedLineStealer)", "value": "c591983dc72095708ebe2355a6ee65d72e069505ab932b718dcd1155e97cdefc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676623679, "uuid": "d2c24f50-54d7-4d61-a179-079ff0c4b537", "comment": "Malware payload (RedLineStealer)", "value": "198b26c57c107c490eacd9e12903092c17a39d59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676623679, "uuid": "e2876da9-9ad1-4230-afa7-dcbe8f2cbf43", "comment": "Malware payload (RedLineStealer)", "value": "986d91869555d758e731678dff613252bfb0d890b35ecd37c7c3873ad366990fa8c8c10a939fcf6d934fcbbb2a454ae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676623679, "uuid": "a0fe7bc5-cedb-416c-8a3f-b4f5ec0c0346", "value": "T1EF252306FAEC4122E8F9677009F602E30932BDA11B79535B234F9D5E2CB2A7075357B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676623679, "uuid": "e7782e6c-92de-47cc-9fe7-0c480cf7c1fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676623679, "uuid": "001166e5-b9c4-40b0-ac00-6937d7e57dd1", "value": "12288:sMrLy90NoK53BYvr/EI8Igyx6mkP1ucqWDT+KEZesGxFNnwxmQLWr/1/W8V2r3:/y7K5RE/cIgc6m2NT++QitW8V2r3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676623679, "uuid": "3013177b-715b-41e1-ba0e-c94c4fc84ee7", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676623679, "uuid": "e01a4b39-8c60-40f6-8789-b579714c95a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676623679, "uuid": "b6f63081-8c2b-4ab3-8895-242d77cd2709", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c251b6c8-aee2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676652446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652446, "uuid": "faf30489-ce6b-4a58-aa7c-3c1ab43e0b43", "comment": "Malware payload", "value": "d46ed57c7636f5550ea8dc10bea04e60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652446, "uuid": "91d18b49-397e-4b08-8846-dd81fc638d3b", "comment": "Malware payload", "value": "c6527aace1e6b92a2db34dc54611abd3721c2e02eac8ae2bfa87a5f98f6c383f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652446, "uuid": "3762e3b4-cb42-4629-8221-0ee08a8b7cf1", "comment": "Malware payload", "value": "8f2f7d5d9b3b4821e98487c2a77b40eec0a0d6d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652446, "uuid": "a0aa64f2-26ca-4d22-aa85-68f8686e3392", "comment": "Malware payload", "value": "bda31b77793337408097c4331bc29198fc8d3129f570831f0f4beaca076ed7ba2ea5b9b7f2c3ca154f7c604caf412743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652446, "uuid": "24f6b16c-0016-4c4b-8cce-551f18a7bf90", "value": "T171E523D56420C4EBD3FDCBF0B81E84F136B7BC5BD6D8590A35CABA39A472299D04D908", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652446, "uuid": "1085bc36-7750-4812-b7fe-af2920eb0884", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652446, "uuid": "86fe38a9-8c17-4a5c-84f5-f1f7f2e86929", "value": "49152:1sPltdZK0Pnhd5FewLjCo5vDi4WhpbVjgIk3BIcBA6q35dpyVHZHfBG2yPJLCgvV:S91fZdz957i4WD1q3XA6q3hK5qPlv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676652446, "uuid": "98f5f738-0ce4-44fc-af1c-2c96bfbb5298", "value": 3198749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676652446, "uuid": "7c72c5f7-b270-4092-9055-566fc458f23b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652446, "uuid": "4cb0dd1f-45c6-4d4a-8c94-2ffaecb2f8f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c290ed8-ae8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676614801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614801, "uuid": "56c523d1-a856-46a6-98b1-a8b0f80553fe", "comment": "Malware payload (RedLineStealer)", "value": "e80dc576e2a52879fd9215ae450efbfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614801, "uuid": "30e0d7ae-373d-4a86-99f0-a665410b2d2f", "comment": "Malware payload (RedLineStealer)", "value": "c73107850c99b228d9b462157a53f1b8578c67bb01f12b1a8c90111d46e79c9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614801, "uuid": "1e83d9e1-00ac-4134-bbe1-51ad1a09ac8a", "comment": "Malware payload (RedLineStealer)", "value": "5bd37c870f2edb00bfa9391b1656e7e5af12a230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676614801, "uuid": "17af87bd-54a5-47e7-9374-c8b958f76823", "comment": "Malware payload (RedLineStealer)", "value": "9e55be2bda8c193a3dd9529359f4c4a8c471a9a56de4ea9c6008b5a388788dfd9211127a86505e7ff5ffccbe95bce01f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614801, "uuid": "d5d09e48-3961-41de-8228-291acc51e1b0", "value": "T128252347FAEC5066E5F95B706DFB07C31A32B9611A388256278F6C8909335B0E63136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614801, "uuid": "045bffde-c0fb-4bcc-b22d-dfde34fa2662", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614801, "uuid": "3ee87d1f-31f2-4f29-972d-a58bef43978b", "value": "24576:+yjV1SVKofsiVgTXupbQFPruc9JEffd3IYll/UX3Dv86jQD:NjvSVqkSEMIOc3blKX3Aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676614801, "uuid": "2c7b41c5-61c3-4a62-9dab-aa90b388d06d", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676614801, "uuid": "5aed6dbe-3484-4793-808d-db0db5d3c809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676614801, "uuid": "5bf22dd8-af3f-421c-b63b-c3751ce6e732", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe701f0e-aef1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676658989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676658989, "uuid": "8616c10f-4dcc-409c-bafc-0a9d3d6b163f", "comment": "Malware payload", "value": "0a4aee30f84c3e78f8a7a20f9ce25ca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676658989, "uuid": "5517d91b-7a1e-4d40-8a0d-6c3c3fe3dad2", "comment": "Malware payload", "value": "c8e418a9972b8750c050b6ff4a61172b44c20acc6fd6c21d5e948f98d3389268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676658989, "uuid": "f0f66b09-fe47-4a88-ba7f-0fc8737fb502", "comment": "Malware payload", "value": "1d593ccf2b1c3579124cfc93023b76714c9d68a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676658989, "uuid": "17d310f1-eb5b-42a1-93a7-958a992d7b01", "comment": "Malware payload", "value": "97ce45f9621801fbf33588fe1795245b27be28ce6544b1a801536315ad90055cd87edd9310b91173daf863b618cbc2db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676658989, "uuid": "cc346a5c-22d0-482a-bf2f-9ebaac327b8d", "value": "T1A6E53313B2844073F8A413341DFFC2AB1D317E93AAFA0595558EBC9B1CB06656AB7327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676658989, "uuid": "eb8fe6d5-f0ea-41fe-9cd3-cf97850ac2d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676658989, "uuid": "008d2ef9-9d16-47fc-bc29-0f81d409d476", "value": "49152:xrlgRFPlcHNj4ZmIIS2QROZgsNn4S8bFGP5FswGah09xYglpUOU4ulqlAMdVnP9g:JlglAaZmI5R4hNnZ8EFkasR7UplaP3iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676658989, "uuid": "8fc3ee0e-8788-4adb-adef-e664510e7dc3", "value": 3112448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676658989, "uuid": "59dab640-aebd-4769-a0c4-ff972c7958e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676658989, "uuid": "9ecd4205-3cb9-43bc-98c5-d27459683857", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730a11c7-ae96-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676619671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619671, "uuid": "1c65ff9b-fb66-4c3a-9a9a-759b4a7e5c9d", "comment": "Malware payload", "value": "5e8d37b4e2d953b848d4abd259e9fd6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619671, "uuid": "5363da25-b883-4055-ba16-c9c764aa9c6d", "comment": "Malware payload", "value": "c92a7425959121ff49970c53b78e714b9e450e4b214ac85deb878d0bedf82a70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619671, "uuid": "11f6ad55-4f6a-46c0-aadb-1ed6179e9d00", "comment": "Malware payload", "value": "b3964d85a1472c622075110a7dc3c08bd459f7ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619671, "uuid": "6bb80867-a06e-4698-bd29-8a82b53438f6", "comment": "Malware payload", "value": "b67e13623ae76331f5daec4b58e1018c9c7cbdd6153e891f9800052175845201988b7859d829823027f9248876c33d94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619671, "uuid": "71ed9cfc-9676-4193-9239-87993af1baa6", "value": "T18747AF01E9E1197ACA97F274859F5221B7343C068225EF67343CE7741F22B62EB2E758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619671, "uuid": "95c49bdd-bf72-4464-991b-9104d34b2e19", "value": "719c278792d8e7c3d4569f7ffb76720b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619671, "uuid": "3ee0b1f9-53f7-42e6-bdef-dc7b58e46c07", "value": "98304:REbe/xIemeRV88QgEbArv6tcYle4MdMkzQ4+4QE4w4gYoAUo46T+C9u6bETfR4lo:Kbe/ZEbgujErzQHUKjAyOL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676619671, "uuid": "0d63c83b-2160-4c7a-a917-34a3241f1bc7", "value": 25705095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676619671, "uuid": "6daaaf1b-9a7e-4e35-9e53-b1c4145b816c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619671, "uuid": "4d69fcec-4f66-49a8-9766-02e6edcff161", "value": "Neus Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb520612-ae98-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676620732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620732, "uuid": "4dd4bfef-97ae-4fd9-bc01-b3514ff2b3cb", "comment": "Malware payload", "value": "2ff3f3376bbdfcb311b0f8279c749067", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620732, "uuid": "923336e8-2444-44a8-ab6f-ce70eed09d1b", "comment": "Malware payload", "value": "c96f52ef1e86a9ed4bfed94934bfb4909e4bfa6442a62c88aa03cb41976b7d5d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620732, "uuid": "945a573c-3360-46c3-889d-9076fc69ec44", "comment": "Malware payload", "value": "9e673e6494a2e3a6c489cad4fb0642163870f6ad", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620732, "uuid": "566d63b2-c102-47fe-889e-281ac78b30c9", "comment": "Malware payload", "value": "db496aae8d395cea42d3365a8dae2bee2444ef1996046c9454a3fa9536bd99792be00a0c86a21b451669c7d604cd45d0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620732, "uuid": "d5ff1e52-ec33-4519-a2e0-08df23d8f6d5", "value": "T1C723E807F54381FDC09AC274066BB93EAC2275FE0238F2B67BD4A7226CD5E225D19C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620732, "uuid": "4cfc8e23-2b05-4580-8a24-8c275d10d52e", "value": "768:vZCLNaOGW6bQHT9XmB3OIB/c1cV9KFf8D+wdYFmuqpjikP5jvI04Wx2fEj1szKhN:oLYOGW6bq5XmB3OIB/c1cvK++JMBF9IT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620732, "uuid": "1967a588-6892-4c1a-b306-a5e039c0dc31", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620732, "uuid": "ceed54d3-4b44-438f-8860-1aacf4e7d15a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620732, "uuid": "eca97a5a-2b97-42fa-a326-e271602e7772", "value": "2ff3f3376bbdfcb311b0f8279c749067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aabc0f9-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627281, "uuid": "694c5877-a922-46ee-aa28-18f8c16ea2d7", "comment": "Malware payload", "value": "87926fa5d88b83c03af1cece27065b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627281, "uuid": "c5b4b59a-d433-434a-ba7f-a3d58dac37b6", "comment": "Malware payload", "value": "c9a395ec3fb69e124c672823333ec165fce21a5773618153bc251cc8b2503dc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627281, "uuid": "6edbd47d-a28c-4604-bc93-72c167f09a82", "comment": "Malware payload", "value": "4bbd61168addb8a229c0bf34dc3099221c8c1ea9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627281, "uuid": "3d65a42b-948d-4adb-a694-db2a9a26668d", "comment": "Malware payload", "value": "e759de0a5ee5df4c5ad415157a8a3588d01a91d6cf21d12fb8fec45e62d9f00112bf96fedfc6754c5950847ccd9895be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627281, "uuid": "18f24639-d80d-4684-b403-1991c551e56b", "value": "T1B5149EC1BA98ACE7E515167885EAC32A333CF7C51B834B130C34B6351E83BD16E8B55A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627281, "uuid": "6f9abf86-4aaa-4877-af6f-1f59d7e80f20", "value": "0fec5b870dad6c4991f598c6bf78e2ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627281, "uuid": "82aead34-5c18-4529-8081-c959bff2d847", "value": "3072:RSN85qXo4RxKogjEDz7oHitj9LRUgT5xLE3dDYuWOaXdI:RgRxKoQKuyRLg3dkXdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627281, "uuid": "de2e8313-90ea-4861-ade4-7c67533e7879", "value": 207530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627281, "uuid": "9254c07b-6ec4-4efc-a6ba-c7e8f2998088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627281, "uuid": "dbd87d37-7f21-48dc-90c3-695a534fe25a", "value": "Chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc08b26d-aec1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676638316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638316, "uuid": "0ba85fc2-42dd-4303-8f2c-107d5d09c9a7", "comment": "Malware payload", "value": "dd79e53bf985e1259b91519629b05dad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638316, "uuid": "6e841f25-acb6-4f86-82cf-587d190656f5", "comment": "Malware payload", "value": "c9bfe36759231a2e1b0f5318ca792d341e5a508b6963e3a0023317db436be3d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638316, "uuid": "b1eca65a-b7b4-42e4-9d08-334b640f4fcd", "comment": "Malware payload", "value": "bf0e93ff8a2d341b9fef611fb3abea3f1ff7253c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638316, "uuid": "39e59a8e-615c-4b95-9942-3765d567f6a1", "comment": "Malware payload", "value": "4750972f419365ea744cd2107c9189419e39fa52f897cab04c812efb729e8f5294616f4479b317e807384337ef145891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638316, "uuid": "3d903b38-8dfb-4140-8ed4-d0b26e70c945", "value": "T187C4F0607618E45AC3E47A34DFA6C2B05366BD5C6C28551B29F63E8F3FFD297E801218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638316, "uuid": "25d2e12a-3b24-4621-96f1-b57c8bef8ac6", "value": "5b462f8ebe808b7165e6349acd877897", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638316, "uuid": "7b76b006-8f5f-4dd3-8733-4182b28b1fc0", "value": "12288:87qSVkJmuVblMC60GufLNARQ7PZoVWxInq9PuGpZHE:8hRuVbGdEooxIn8PuGpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676638316, "uuid": "05965bfa-b0bc-4e9e-8c81-ae3763382590", "value": 596368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676638316, "uuid": "559c8d1e-4cb4-4c90-a54a-9be9eee3716b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638316, "uuid": "b6e711ab-3d1e-4cdc-bb6d-8aa67fbc5730", "value": "GoogleEarthPro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9d1686-aed2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676645407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645407, "uuid": "fa7ff9e0-65a2-4937-b55e-6b3f4d358c68", "comment": "Malware payload", "value": "096a6fe57b60f54fc71267f8e7cc0928", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645407, "uuid": "654bec83-d579-4ab2-acbf-6b731fb7863b", "comment": "Malware payload", "value": "c9cbc26c880f3270e69cc287eed51dbca406cd16bab1459704ca70a750deec77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645407, "uuid": "fd507ddb-4932-4f76-b2c8-62c7b0c604b4", "comment": "Malware payload", "value": "891d6c7d6337215d79707916aa05736a25bf4fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645407, "uuid": "bcf4a18f-b186-475c-a6f5-3a96aad1e499", "comment": "Malware payload", "value": "5b1d21ca245096608b5be62ace739d279fadf177c169e5f33fa21c2f84413d8b80b3d6aafbe19ff359982338d7255568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645407, "uuid": "5535f084-d42c-460c-9c34-a32a45a11e57", "value": "T18A14BF12B6C68872E51606764DABC7B45D2AF8244F616BD72784D63E0F323E2DE32346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645407, "uuid": "2925f0cb-92cb-4c3f-ae8d-00d04aeec886", "value": "2c399d381d03e44b02e91ad01ca3c756", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645407, "uuid": "7bde2ce2-41b0-415e-b364-11e19cade263", "value": "3072:wr6uV+U34/MGgI5y5RbohIl5gqMz71V7DJGbj9/6rBxL4uPqrKu/:C60ylp0UilWqMz71lFGErL8uPQp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676645407, "uuid": "9c0a0da2-e214-4561-a31c-9633e3acf517", "value": 204452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676645407, "uuid": "f5e4d7d7-9a17-4695-83d3-769dd4490a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645407, "uuid": "b94217e2-cae6-4b37-89d9-c53722deb565", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d019bd18-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676637866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637866, "uuid": "0070d3ce-f7eb-4621-a075-eeacb5eb37e3", "comment": "Malware payload (Mirai)", "value": "2612deab8aaa367191cb879212dbbba2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637866, "uuid": "81a6e729-b8f1-4af8-9f57-cdcc4b96f8b2", "comment": "Malware payload (Mirai)", "value": "c9d380ad088191f8436ab1e7d3ce86b4e3e39f20f01b5a900cc172b43d4c869e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637866, "uuid": "d182ad7f-dfd1-4178-a1f7-c5bd0b59a5b9", "comment": "Malware payload (Mirai)", "value": "25cd1c8c5fa949e0f74ce48f6eb24187cc8a4eb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637866, "uuid": "1907f74f-5266-4e5d-b27e-3b05c2748a66", "comment": "Malware payload (Mirai)", "value": "e966254f64dc839d71a17413348513745a3d8d5867c2284dbad787aa0861d146131d049c6ee0c9d8fd67ed897e57d439", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637866, "uuid": "ec321db9-dd54-4c58-b53d-88a4f12ce290", "value": "T19C534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979A9671E361181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637866, "uuid": "f3537329-022b-4ed8-9cc1-3ee9c5007163", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG5UmtTy5EMXp/p9OyDQvSFRMNYL6FV+tg6wWB:+5HAdOmGyNtTAdBOyUaFRMNae+aTWaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637866, "uuid": "785b1b83-0ed0-43a0-8e9a-2e8cbf231691", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637866, "uuid": "e9612782-3df6-4904-92fc-1d33dbfd5cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637866, "uuid": "add9a835-8b32-4bf5-8919-c861a1d20aff", "value": "2612deab8aaa367191cb879212dbbba2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9190f23-aed5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676646954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646954, "uuid": "d929ac0d-3ae5-45cc-813a-ecb9afdc89e2", "comment": "Malware payload", "value": "882d59c5be9eee2baf2e89476e269231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646954, "uuid": "7f42d276-79d2-491e-97da-6dae7433d070", "comment": "Malware payload", "value": "c9fd2571fa61d936d53ae70eb75bca9be1029f3bcd428a338de3f5f778173182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646954, "uuid": "c1bf7299-462a-4e87-9223-c9285a2da6e9", "comment": "Malware payload", "value": "0b6f3eeb8637298273afafa953b79ec78d9c7509", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646954, "uuid": "eff61e71-4d05-47ae-bf34-5d98753da543", "comment": "Malware payload", "value": "2dce09b6c8c2d0f97e4cbc3f03cef0d5884c11f930915fc0117fb1170f35db8fc2085661c4d3e53451cbcaaba439a283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646954, "uuid": "1304c08c-6a64-476b-89b0-09a80a1a191c", "value": "T132E523C27866D1E3D7FDEFF1B80D80F57623BE4BCAD4192734A6BA2A2032199911D50D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646954, "uuid": "d704228d-060c-4c6c-8bac-d2cca31f9d98", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646954, "uuid": "2105d762-769c-4c32-bfc4-45d776d0be42", "value": "49152:1ssLYQglXgiQbNJJ+iZx0rwss+NJ4OHildihFKGkUhVV3TmZrkVf1iBZ/2K/4KJZ:STHlXvan+rswilMfkOz3T1KmK/4iv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676646954, "uuid": "7abc9a55-aefd-4e31-9296-d43a8b084e72", "value": 3211872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676646954, "uuid": "7ffba531-bf4f-4e54-a38d-fbd9e824c665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646954, "uuid": "dbaa366f-2b56-4594-b081-d2c9765c559c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f83851-aef3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676659648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676659648, "uuid": "03e173ef-bedf-47e0-b851-3cd2c61edd07", "comment": "Malware payload", "value": "a27435d71d3c86e923a81fd66d5118bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676659648, "uuid": "86d216e0-9be9-42a3-a8ea-d722f0f2bfd1", "comment": "Malware payload", "value": "ca0c0ca69ece78e8d1dcb7b1064a8d76a95a50025b2ea82d907dd9e27b532b8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676659648, "uuid": "a96d8336-1baa-422b-bab2-de0042e60fc9", "comment": "Malware payload", "value": "9d4ed8fb149d0dc4de28e41e66ac17b849b8fcbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676659648, "uuid": "ec1034e7-599a-45f3-a004-e9d5f2854877", "comment": "Malware payload", "value": "5ee7171c55a5d2ec48a3066fe45cd17d6bbeb71fb4089283a01701577247263c19da9ebc7c0d2dd88b3d018fc729b016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676659648, "uuid": "d3b5a8ed-00fd-453e-8bee-07aaeb7a7d5e", "value": "T1DAE5E0ABEB000B17CE9543BAD9198B945721D05A6350F3A7A7BC82A83F5F3C54D1E4E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676659648, "uuid": "55476a61-ed65-409a-b1d6-220efd4069e5", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676659648, "uuid": "bb46fb3d-bce8-4ef8-a8a6-69ba0cbe5e6a", "value": "49152:yUwJvVQThRGeWlW6Bj68c5xI5hH0sIacQXfJgiE5VmJsQQlObhPk0zzxcXG+ojxo:nwzQT7obB3hDJpEmJwU1PXzqXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676659648, "uuid": "ee8da41f-4ea1-4b75-a321-d71091f3311a", "value": 3057160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676659648, "uuid": "0575c3e3-0290-4bae-8443-52be60517a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676659648, "uuid": "0dddfbae-d14e-4261-bbd6-78c5d9bc5e6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e47ec5f-ae92-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676617838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617838, "uuid": "09b97e44-705a-4531-bf88-9e183852c187", "comment": "Malware payload (AgentTesla)", "value": "e03072b5390a0e62ab980f32643fc80b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617838, "uuid": "f96c6cb6-3604-486d-b4a4-285e95947852", "comment": "Malware payload (AgentTesla)", "value": "ca69b2a10374843efe51585a58ffa43f65fd4cb0f78787009d94eeac637db8b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617838, "uuid": "d931ffea-fa02-4edc-8939-90a7820400ee", "comment": "Malware payload (AgentTesla)", "value": "d951ea138cbd936d52f0d2253dc88ebcc8a7bfa7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617838, "uuid": "ebd11308-7044-43dd-9aa1-6caf285282d9", "comment": "Malware payload (AgentTesla)", "value": "e3665eb4ceff2fafd9d8143d8f7058045f5cc462b84a94309658f313cf2a9f67743aa476694ac39aa9b10968912cb4f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617838, "uuid": "0ee0a873-aaa6-485d-85fb-a22782ed4200", "value": "T15DD4F1262FD57FA3C97F473C8852998853F1DE492037DAC63CCD00E599DEB98AB01266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617838, "uuid": "6ae7d706-4d6b-4dae-8c63-59d7137bb6e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617838, "uuid": "8b420fec-9ca6-408c-8f7a-3700d89b7681", "value": "12288:/KFQmymXknLaxx0OZEIKRSvPu9NtPLggsRZ5fC:/KbQVR59NtjaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676617838, "uuid": "bd67f15c-d2b4-436a-ac9b-20ecf8c09fa1", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676617838, "uuid": "dd6b1746-d6a6-497f-a3d9-e19a4bbb0d10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617838, "uuid": "ce994661-bf1f-42a8-b397-950f0602238b", "value": "ORDER_LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0718bd68-aec1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676637958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637958, "uuid": "3ad395df-5756-435e-9c6b-03c41b8b23a3", "comment": "Malware payload (Mirai)", "value": "9f43a5158e5dbf5cd40dfbe59f0dfe6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637958, "uuid": "74a07dd7-fe69-4306-ae8e-488c6c1b09b8", "comment": "Malware payload (Mirai)", "value": "cb91059f6e07dc66002314bf5b53e2ea4158cb084135fe0e6f99c5bc9d771d62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637958, "uuid": "cbaad65d-af2a-42bc-b3c7-6a2bd1d44bba", "comment": "Malware payload (Mirai)", "value": "c8e13e29cd1645e39d91d743988328eb6e957238", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637958, "uuid": "fc205bb9-603d-4f34-bf19-f7c5f8b46455", "comment": "Malware payload (Mirai)", "value": "06df730635a68348d8d776644306da48288dca93c22f8e4f0291865f56aca3641559ce2496c7a45188809cd4b011f159", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637958, "uuid": "1641e4a9-b0a4-424b-9cd3-d87163974607", "value": "T1E1633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637958, "uuid": "09d482d5-4744-47b9-adc4-ead77814d386", "value": "1536:lGRaTYmol/hGIAs4PNvA7QIGm75123tStll:lya7hJkGmVDHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637958, "uuid": "e23fff78-ecc8-4b4c-b125-7e5f34d76c91", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637958, "uuid": "96f2400c-3a7b-47a7-a4a1-3aeba2f80071", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637958, "uuid": "8a1ed6cf-579b-4b27-8eb5-d4b5b34f31ac", "value": "9f43a5158e5dbf5cd40dfbe59f0dfe6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a54a2b8-ae65-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676598450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598450, "uuid": "8aae86ca-ef93-4159-b031-d4b04310780f", "comment": "Malware payload (Smoke Loader)", "value": "38f08ecd9fcef028b0d541a90b485ff1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598450, "uuid": "722b319e-f7fa-4d04-8713-9de34eba7b3c", "comment": "Malware payload (Smoke Loader)", "value": "cbbf203f9cdaccef593ec50a4ab2738a21fbb3850c0c74ea531bbb219a55af20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598450, "uuid": "73c6b209-d0cf-4349-a8bd-49621e0f7c6e", "comment": "Malware payload (Smoke Loader)", "value": "dac03bf2a701131caf695c0c1d1b6cfdeabbef22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598450, "uuid": "b7d5dfe3-38df-4b29-8f88-6e474cb3619e", "comment": "Malware payload (Smoke Loader)", "value": "6b2c2e70c3444b97138e8ddb2a3d26fc4cc07e9c315e0d1070387cebb764192cd49712b380edb6a4611edbf1da6843a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598450, "uuid": "35db5759-3cfb-4213-af96-3b3cb0899ce1", "value": "T153446C5362D13C41E9A78A729E1EC7E8761FF6608F49776E12189A3F24B01B2C367713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598450, "uuid": "0d304147-a513-468d-a80c-0e97c28dea68", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598450, "uuid": "68285376-6ed6-47b3-84de-c250d1e84ab8", "value": "3072:FbQBaUTLopEDUjboo4g7pRoK3CzE6FKfMTHfPVCRVL+3AOcEKHPVvRv:NCa+LlUnv7T3B6FqM0bLzO0Hp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676598450, "uuid": "eb37d3a1-d1be-420e-8733-cd8c82b2e121", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676598450, "uuid": "f3f903d2-f695-436e-aea4-5d519ceee812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598450, "uuid": "9b360ded-f533-49a2-b2df-89ebd8c2e21f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5534dab-aed0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676644801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644801, "uuid": "c68448a4-f045-4ab7-924c-99479db636fe", "comment": "Malware payload (Amadey)", "value": "af6e9cd275eee7e7a75a0d2e5e1dffdc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644801, "uuid": "eb46aaf1-ce50-43d0-8f51-170b9bcb713b", "comment": "Malware payload (Amadey)", "value": "cc9faa4d1d9909f267a14006282af5bf3a16bc25fd056c34a8481bfdf1586907", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644801, "uuid": "2a35e6f3-3aad-40e5-916c-29287f63655c", "comment": "Malware payload (Amadey)", "value": "e978abe8e875c46f693e176bd379d1dba0224c97", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644801, "uuid": "9705708d-8755-4c66-8bc4-b1b6907c7445", "comment": "Malware payload (Amadey)", "value": "a468325d04303c3afefc2d0186bf068847f7118671fe7998e00aa0ce6287812ccfb4df703812e09399d344b405f22c0a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644801, "uuid": "e76d7ebc-e2f1-4f89-b007-f7c6e3de20c8", "value": "T136251207FBEC8122E9752B700CF306C31236BD51AE75C62B579A7C4A08725B56A707BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644801, "uuid": "bdb77660-f58a-4ee1-a742-d58e8d877ddc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644801, "uuid": "f56d512f-4baf-4d09-a9c8-97fa1fb1213e", "value": "24576:py8Roe18n+qtZQZ3RV+A2ACVHHnon002JuMjfnbfX:c8aeq7tZQ70iyy002J/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676644801, "uuid": "1085f1e9-e7af-430b-8375-f947e8d0601a", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676644801, "uuid": "a892b0a9-7240-406d-980a-e56749ca79cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644801, "uuid": "860d3cdb-7734-4b73-9a3a-94772cf7be98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17aa1d08-aeb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676633262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633262, "uuid": "068ce5a8-cbe1-4f09-b7cf-efdaaaebaf5e", "comment": "Malware payload (Smoke Loader)", "value": "036dc6539ac292ce91a31335872b80d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633262, "uuid": "9fb1efac-7d55-4760-8c96-91056d5e8ee2", "comment": "Malware payload (Smoke Loader)", "value": "ccd6abd200a65c6a88127b7f03c7dbb84887d250206f79ad37353ae014a7cb84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633262, "uuid": "a6c46551-5dd5-4bcd-af4c-25c4ca48895c", "comment": "Malware payload (Smoke Loader)", "value": "7a70820f54531e6448f57de11e4c3bb69a56589f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676633262, "uuid": "ca2db421-1722-4096-98b0-bce0151294c3", "comment": "Malware payload (Smoke Loader)", "value": "1d84fb7e4c0c99585d467c614245331115dcd9c401ed182124b0e7a5fe92e8a01010ae9b3dae07edf7c22469acd3e374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633262, "uuid": "1baf7395-0439-44c4-90c4-01b931b658f4", "value": "T13614CF623AC1C073E1235639BDA0C3B1AB3ABCA14A32CD9B3BC5156E5F756D2C724356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633262, "uuid": "0763ad8c-8641-42c4-a89b-d28ce2a406a6", "value": "31111ee2beeeebc1d1040d6c5884273d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633262, "uuid": "cb3fe473-ffdb-4482-afde-77b0cff0f646", "value": "3072:cTi6ELTCJHFLuPxT56e2TKV04MOc3NMT5cp/oQHWEAOP0O:cW6j9FSpNFpFzTy2EdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676633262, "uuid": "56af37bb-abea-4530-92b2-b35b0f5acd32", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676633262, "uuid": "fb412e52-479e-40e9-90db-99b556f1456e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676633262, "uuid": "eb8cc8bb-1b24-4c72-83b4-bd62bfdc6033", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cd1353-aecf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676644068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644068, "uuid": "ac06dd03-ef5c-4ed8-96c7-183e2bd14df7", "comment": "Malware payload (Amadey)", "value": "21c7dee22e0287b9e5e649245c360470", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644068, "uuid": "6835dde4-d841-4a2e-816e-cbd2c6ad79bd", "comment": "Malware payload (Amadey)", "value": "cd3326b2851a2b16bc0b8f23b1e8290b00dddeb2d3d97e1ec816fcf40f8fbd98", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644068, "uuid": "933360a9-b62b-4dd2-93df-647ffb492897", "comment": "Malware payload (Amadey)", "value": "bf875395af9d74d9fb1eabad3dddf68a445e7553", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644068, "uuid": "2c1a11a8-cde7-4e6f-9e14-19fe2d15dd19", "comment": "Malware payload (Amadey)", "value": "7ea1d35e5d50ba2276185b48997d17c0b4beaffe8dcd12eaf92795f6a8947d17b18dc21e5272bf0a53a3547e1069e66b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644068, "uuid": "858729e1-96a2-4981-a820-8f509cc62c7d", "value": "T181152213F7E4C026E8E5337128FB05C31536BDA2AB758247674BBC6B08729B4A53176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644068, "uuid": "52ba4154-e398-4498-9dfb-b986fd12ba07", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644068, "uuid": "31655a2d-4c05-46ed-9a20-273baa5fb896", "value": "24576:+yW8jyOskw5iV/uwUvj5EUpae7x/hgFcqw:NFXw5iV/cvVEheF/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676644068, "uuid": "c78cf203-706a-47ca-a5a1-127129f1d742", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676644068, "uuid": "ddcb1d15-7da8-460d-9540-ab2d66fb3071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644068, "uuid": "32e94321-28a9-4193-a520-612922c14f58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4e2fef-aea0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676623797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676623797, "uuid": "14a646f4-920d-4a42-9085-f8d80e998f5e", "comment": "Malware payload", "value": "d6b05bfe67462705f30496181b4514de", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676623797, "uuid": "ac1af1da-1cc8-4371-82fc-3f84e37a3ecb", "comment": "Malware payload", "value": "cd545aa0d53231adf65cc63cf57124fe8751af8d5db9bb0d958d7cddc2a53782", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676623797, "uuid": "5ef442b2-1fb4-430a-ae3c-9f17f2474815", "comment": "Malware payload", "value": "785186c410c6c5f9f537aad65723585180757c2f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676623797, "uuid": "c382a21b-1b51-4cd3-a449-a2a86b7d0beb", "comment": "Malware payload", "value": "eb3cd317a188c8c9f1dbe21bf4bfd467827e6c683c521180029bf4a4026812a11f1423ec3c16369ebd12d731e2ca4a37", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676623797, "uuid": "54b3cba7-baa1-487f-a0f6-0a2d2a5eac12", "value": "T13464235170EB7A47C978CC7B32E7758321EA8C1408C365EBE27A57B2E62017C639B356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676623797, "uuid": "36042d1f-dc69-4fa5-b2fe-cca3fabf8a5c", "value": "6144:kGJaFAhw3db+LLlmn5SuO4U/WSE9k+pK2vU5m+PBJWE7cvjgBjlJIq:kGaN+snU74UuSEC+pK2cwm2K2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676623797, "uuid": "5b24add2-69a6-4e14-8995-b5aa3229f263", "value": 309753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676623797, "uuid": "bbee667a-a286-49d8-8861-9b524054ea06", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676623797, "uuid": "62386cc7-7fad-4ca3-a642-b979cfcf9280", "value": "invoice settlement.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4b2033-aef6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676661027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661027, "uuid": "42229e03-936e-42fa-b8a6-cc76f3f26467", "comment": "Malware payload (RedLineStealer)", "value": "b9c16ad401194cc476af03dfb49d3eec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661027, "uuid": "6dde1580-3cc0-413f-a789-1ce8089034d6", "comment": "Malware payload (RedLineStealer)", "value": "cea96c1782fe4988ee39bfb6f35a94f620b206e5e1f42d741576bdb1c26ccda4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661027, "uuid": "78cc5496-2ede-4995-acb6-b42a4ccc0699", "comment": "Malware payload (RedLineStealer)", "value": "811b31f08f5817222108e657e8fa2718159142c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661027, "uuid": "b869678d-4b7f-44de-91e7-a6932f902a88", "comment": "Malware payload (RedLineStealer)", "value": "721f5a72c79a9ed10d2aa39ecbb9660169c9c72d4abea258f00a59a185f10b79cd400bf5da8588cb10070b1380b4c06c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661027, "uuid": "38f53cc2-8992-46fb-8a7b-6fffc7cf2ad6", "value": "T13EF41217EFE99062D4A85B7058F703D30A3A7E504A78835B238E5D1A28B35B0B27537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661027, "uuid": "c97ccfa1-ecd1-4ddd-ad70-39c1543b552b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661027, "uuid": "27847e39-fd79-424d-92bc-727ac8023df6", "value": "12288:yMrPy90PmjVv9knJzcax15OfVyD/ihKJi/vljNRtGpOifYwQ9UoIeb8QUzn/iU:5yA8VIJzfyyDaHljNiYD9UoxBUriU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676661027, "uuid": "eab0d3e3-c463-4505-af5a-39b5fe8227e1", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676661027, "uuid": "242ccbc9-e1eb-42f3-9e18-dec087db9501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661027, "uuid": "04f7a107-db5d-454b-894c-112713d26353", "value": "b9c16ad401194cc476af03dfb49d3eec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e37149-ae6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676602984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602984, "uuid": "4fb7b555-528e-4e9a-8d94-7d6e3d5c1aae", "comment": "Malware payload (RedLineStealer)", "value": "09c64bec72062f11176ff4966a05b6b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602984, "uuid": "336ab032-7633-4984-9138-7e637d52731b", "comment": "Malware payload (RedLineStealer)", "value": "ced615244608ac39265bb35496034222a79e8285b99c3f329c293607dafe3fa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602984, "uuid": "3b0e9f62-6495-4a0b-bc6c-ba151f74fd3a", "comment": "Malware payload (RedLineStealer)", "value": "af312cae5d8999503c7d2427c1bb973a3bbb743e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602984, "uuid": "a41cf4f2-42a2-4684-8a03-2c4a4d20db11", "comment": "Malware payload (RedLineStealer)", "value": "0c676ea6d341416a337900a795d1a7b6b3fd287d4dfb180bd07e7d897447ebbd57970272df7d1aeabe3878a44874b5ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602984, "uuid": "e48a12eb-49f4-4319-bc14-4ad152796411", "value": "T13025230BE2EDA467E5B6573005F902C30B327DA12A34974B3BAE7D9614736A0B635337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602984, "uuid": "5c7d73ad-6d16-43be-908b-e7fd6e1b2bee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602984, "uuid": "64b0c796-f2a9-461a-885d-234a6e7da44b", "value": "12288:RMrty90HKUqVkA9k0wlFQ72vgSN2qJhh14LMa+exljYz3HN5CPNId68qBzA5IAja:4yvaxFQpDg14LMNm2NSqd68Kc9/6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676602984, "uuid": "78772b23-31a7-4999-a175-6f9537fbd151", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676602984, "uuid": "45ba4478-0b25-4cd2-ba12-eec48b662896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602984, "uuid": "0d9586f1-c44d-4601-9925-48b09c05d7f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5eafd1-ae65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676598693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598693, "uuid": "689a309c-fc75-43c1-8286-9b9b478b4d38", "comment": "Malware payload (RedLineStealer)", "value": "2348e563cd653e9864230aee580db940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598693, "uuid": "6a2e9c2c-0d0f-43b6-8f09-fd2bc97a2367", "comment": "Malware payload (RedLineStealer)", "value": "cee4624f134cced69b605139911ec5e1fe3018d085df545fb85c045981e43765", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598693, "uuid": "04d15a2a-c539-407a-adc8-7e18ef772a89", "comment": "Malware payload (RedLineStealer)", "value": "e0adcac6cbba7e6e9944d34224814804b6373fb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598693, "uuid": "fa38f30d-2cf5-4704-90d6-061eb771a247", "comment": "Malware payload (RedLineStealer)", "value": "835bc6b372afdd7d2d87fc75366bc45ff57a3c8205c78097db84d121db142be1a3aa45529f92b1990a183b98e72e8e08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598693, "uuid": "ad28a525-ab6c-4b10-ac3a-9faa23db25ed", "value": "T1FB252387A2F48421E8B217705DF503D707B2BE729B78C2972ACDBC4E1CB25B0A535766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598693, "uuid": "0fb5be52-27f6-4883-9936-64ef3529abd5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598693, "uuid": "a6cd947c-f7f7-40ab-9b7a-f293d642b96f", "value": "24576:cy67GglBNJgvCk7/GD5oJjgMd4SeaJhgo:Lc/NJgqk7+9oJ2aJhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676598693, "uuid": "adea2ad1-765e-404f-a358-a81c0a944c6a", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676598693, "uuid": "a331bc2d-8c6a-434b-9595-0242f135da69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598693, "uuid": "1b25fbc2-ad4e-4525-b84a-35200ced2a43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d96660d-aeaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676628091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628091, "uuid": "047173aa-4130-4ede-95b9-c1de1de297e8", "comment": "Malware payload (Smoke Loader)", "value": "872424630248155787ee40b92d729795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628091, "uuid": "84424ff1-3f1c-4c0f-ad90-20a30e27cf87", "comment": "Malware payload (Smoke Loader)", "value": "cf4f0360f834d43d24f4c54fdb0bdaba623b6acd8a44953da8599c8bf25b3a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628091, "uuid": "12d8fb97-45ed-481c-96fb-920d839d7de9", "comment": "Malware payload (Smoke Loader)", "value": "35c615cffa793680d5c50acfdd3707cfc817c339", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628091, "uuid": "3076b666-3b84-4e9d-8d39-1637462ca419", "comment": "Malware payload (Smoke Loader)", "value": "4f4bd1740143b4cc8d99b17e470a64fa0742ccabf5fa3c3a45df0f817d991b19be045349fa5c01db0a3e97282149f0ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628091, "uuid": "10ee9de1-d679-4970-aa5e-364696687c04", "value": "T10924BF2372D194B9F56345318E61D6B46B3FF8718E75AAAB3784173F0E302E2CA56312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628091, "uuid": "babc552f-0e39-4a32-8669-8fdff1ef7413", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628091, "uuid": "496b49f6-3f8f-43af-8154-abb137f2e10a", "value": "3072:87qK3G9c83YenLb32h4zAFpnlqAuG2ANLWnjFR7nflTqJW5DyTk:87N3uvLbmWzMplX2CLsUWByT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676628091, "uuid": "55b7b925-35d8-473d-9475-ec4f68606476", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676628091, "uuid": "5c1515b5-144f-4740-bb66-c71336ae38f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628091, "uuid": "94085c5a-f669-410c-8011-5ff5ba783566", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91aa9d6b-ae6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676602972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602972, "uuid": "0ce54700-6423-4807-85be-aa17d7c8ef63", "comment": "Malware payload (RedLineStealer)", "value": "109628a84a6dab043f379a7094022af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602972, "uuid": "d8ce68bc-32ab-4c41-b5d9-45b46acbd2bd", "comment": "Malware payload (RedLineStealer)", "value": "cf840ed531387a0badeeb83dfb6ecf3ae4fe0e1b0892346cbe175802acf191e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602972, "uuid": "3a278845-0289-4a05-8706-c6f2025bccc2", "comment": "Malware payload (RedLineStealer)", "value": "0f9146a723255b8006578d044e22cf891f3c2730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676602972, "uuid": "fab6fcde-adf5-450d-bfa5-ad422d3f58c7", "comment": "Malware payload (RedLineStealer)", "value": "0a9d5ae59bc2846f4ce305781f89fe4e1070fc802e3c06e3ce7bd7594fd134f89a959e9c04177f2e5f0de753992f59cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602972, "uuid": "ed49eb9f-dd33-4538-8b93-f9bcf954a6e4", "value": "T16674AE13A6E17C44E9178A729E1EC7E87A1EF5608F59776E1219DA3F09B02B2C373710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602972, "uuid": "e3346736-eb4c-47a4-9e71-f9e8da4fda63", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602972, "uuid": "6ab10556-bc01-40e0-8cce-d2ff5a3433f9", "value": "6144:H680wL3ZJv/vSiQjgadZSRI1IAuBCQFkCTVrLmz+MutGHk+:a80wjZ1SX3WZXTVfmz+yE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676602972, "uuid": "9d10afae-bbc8-4811-826b-d413c3ed15a8", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676602972, "uuid": "34adc454-23a9-4c0f-afe0-0951b346b4d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676602972, "uuid": "3ec0878f-5ec1-4765-b0e2-7b2b030f34bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d857ea0-aeab-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676628708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628708, "uuid": "4dcb4bd9-7676-4ebe-a3ec-9b5ea05cb12c", "comment": "Malware payload", "value": "280ca552a722e1ea7f08de96f7f6fd40", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628708, "uuid": "2cd52ad1-f42f-4b88-a94f-7e18f091a020", "comment": "Malware payload", "value": "cf9aa20e7b1b12c545aadeaa792f3cc63f1fcd9e88ad1c83c3819255f9107713", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628708, "uuid": "fac50f49-d0f8-4f4f-84c1-7ab958875f68", "comment": "Malware payload", "value": "58ed2124b1304a1a93aaeefac1043f092e3b0299", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628708, "uuid": "354cbce0-b6df-4250-8d2b-54b4acb4ce43", "comment": "Malware payload", "value": "a32c73d4e506469d4b10181d203a515e410f56d3d7a51fda3b4bd3730b81019d963fa33ec4d589b7dffb0d4e2c9d0a34", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Microsoft", "colour": "#F763C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628708, "uuid": "99d4d200-c8be-456d-b00f-4e65566be4e7", "value": "T13C42CF19F7ADB1B99D10D605A42F8947C0A8D68644135C9CBB67D80C6CA8B7624DCAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628708, "uuid": "7284b321-fa33-4ee9-b3b6-7364330fef18", "value": "192:WUvdO0zEJP8u2L8MYWPV5TRZxtGe/lYZAL9dRQnGROy70AXNiQQFHV9KW:LDq5mnxDz7QRy44iQkHV97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676628708, "uuid": "797217de-8755-4933-b447-031988174f51", "value": 12097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676628708, "uuid": "006bc0dc-4c06-464b-9d40-935f6f436d52", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628708, "uuid": "9eb7bbb3-c592-4eff-a3be-413463b5502b", "value": "aaa5e63a-51f1-452b-38cc-08db10cbca45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5398218-aef3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676659833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676659833, "uuid": "54e33c93-1cf7-4434-85c8-c0ab70da78a7", "comment": "Malware payload (RedLineStealer)", "value": "d117525bc00e770a89245afdd5f74baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676659833, "uuid": "5f8a5dcf-dc66-4e9e-87ba-e37959e9b24e", "comment": "Malware payload (RedLineStealer)", "value": "cfa7335f50e25b2388a136a565983de8249aaa173071ae85d82e6879fe2b7883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676659833, "uuid": "14d84ec7-941f-449b-a7bc-357bf74f6db9", "comment": "Malware payload (RedLineStealer)", "value": "1f9f9f51d270ceac3a9285530b9d3357b234fe1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676659833, "uuid": "05efa7ec-8fac-4f3a-9586-ea2e6c3f8f3c", "comment": "Malware payload (RedLineStealer)", "value": "44da43b824d8875a27453b6e15e30e42f964ceff509956d32480c3521b8255fe06151ff8e611f8459c5ef44c68845872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676659833, "uuid": "dd6505f6-b21b-465a-b36b-fb1c5283e7db", "value": "T1FEE41207A7E88022DCB467701DF702C3193A7D616B39935B238F6C5E48736B4A6357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676659833, "uuid": "93847034-704e-42f2-b769-35d7ba7c2792", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676659833, "uuid": "352b87e2-d454-418b-8926-6184b88fbd92", "value": "12288:wMr2y90vW8lw6pH3+QrcHSzTRnwMCj59ee7N50Fv21NqSUbf6HLf:WyS+6pH3+QgSHtcT1K2I/f6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676659833, "uuid": "2ee1cf44-ea85-4128-8965-e9a380032f6e", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676659833, "uuid": "31615c14-2c4d-4aae-8640-d1524763adb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676659833, "uuid": "501f7d8e-ceca-45b4-a5c3-0dd28fc8e059", "value": "d117525bc00e770a89245afdd5f74baf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e3f1e5-ae98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676620756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620756, "uuid": "db844ab0-76a9-482c-8c7d-5e9d2dd09a06", "comment": "Malware payload (Mirai)", "value": "0fa8d4d5e3211a16a26f75b726336d93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620756, "uuid": "7ea64bd3-0b4b-4afe-af45-675a950e0d63", "comment": "Malware payload (Mirai)", "value": "cfb0340aff691307222d8f03b348d41c1e9717b80f5fdd325333bae6fab8a0be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620756, "uuid": "46b191dd-decc-49b0-a72c-7a85fc39fbb2", "comment": "Malware payload (Mirai)", "value": "74a96e5d0dd8dd82177f19ed59e2852c797a2998", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620756, "uuid": "faee6220-4e30-4e47-a5e4-797339d1db3c", "comment": "Malware payload (Mirai)", "value": "905ee4425369cf8cc10763f2cbd9c8afdd31d427d42ce11c0da84efc857f6b7eb85d1709d4a3a781064f9c1261dbf88c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620756, "uuid": "2b32f4a6-8a52-4d03-a068-bea1c8cb4813", "value": "T126232B25B9761F17C0D1A8B521FB4B68B6F106CE26E8CA4E3DB20E5EFF619405503AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620756, "uuid": "00832577-6671-410e-835d-56dfe3313613", "value": "768:nxoZ6yf3xx1DEmtrBy1ZBJcI7s89AIQjCO+AW31WwWf:nxEjf3xPjrBy1/JcIA8GIQjgjBWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620756, "uuid": "e94f4d30-fb95-4092-8b14-61563dbf8ab8", "value": 48856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620756, "uuid": "285806b8-1e5a-4819-bf7f-e1b2d9d664fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620756, "uuid": "4962c990-9f85-4687-bb47-b0ab82a8ad42", "value": "0fa8d4d5e3211a16a26f75b726336d93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497dd86e-ae76-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676605858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605858, "uuid": "201d0bb9-e54c-4182-80ae-acb2626f8c56", "comment": "Malware payload (SnakeKeylogger)", "value": "8318aec68f9d4c0a09e9a23c3f66bdc3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UNIBO", "colour": "#1AA4E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605858, "uuid": "f38bd8df-dc40-4ce2-bd1c-4018756d83a7", "comment": "Malware payload (SnakeKeylogger)", "value": "d037181a9e8d57201e9cd772144f2ce7e7a0b87f7362ccae4e055096ff3ea9b1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UNIBO", "colour": "#1AA4E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605858, "uuid": "4a4bce7f-013a-4b31-b0d5-073c7309d044", "comment": "Malware payload (SnakeKeylogger)", "value": "15bdd0d6897e80ec1bc80800759981b5f46d4935", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UNIBO", "colour": "#1AA4E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676605858, "uuid": "2768890f-cff4-4aa2-a799-b29a015fc2bb", "comment": "Malware payload (SnakeKeylogger)", "value": "e3d3db433c8882c861311c0bd7247c356cd061770ccf47b41015e801dac95f715b6ce14e62b7dc8668460853f2015aa9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UNIBO", "colour": "#1AA4E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605858, "uuid": "3b4f1502-0e64-4045-bfeb-6e31e5e1989c", "value": "T12B52F8416BDD59B19360E073C11A45560C3EE1BB32A627E8B8CDE58237BC20E06FD6F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605858, "uuid": "a809a265-b4d5-46bc-a769-d91618ce1140", "value": "192:5i+omxyW9hLgzkR2+te8DZ3gxigwLsVXC+31R5KOFuih1X4ykfxzpvq5PHzt9O1S:wm4kRfLte8N3g8AVJ31RhFuwobsMNVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676605858, "uuid": "d9c29033-4851-46c8-96c8-09a2e06fa380", "value": 14499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676605858, "uuid": "08e4da2d-e202-48e7-8292-d6b08af347af", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676605858, "uuid": "5c8ece31-40d5-4916-9992-bb716e0e59e1", "value": "8318aec68f9d4c0a09e9a23c3f66bdc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510dfca6-aecf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676644095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644095, "uuid": "df189711-cbee-4e12-96cd-401bdc365544", "comment": "Malware payload (AgentTesla)", "value": "0ca5e00503228acc73a13aae78cb7183", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644095, "uuid": "9c15556a-a835-4b3e-9618-e04ba4370270", "comment": "Malware payload (AgentTesla)", "value": "d0f69fa1eb40793d0e01472538758f5ef4bc022222672049293773fe9343b4c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644095, "uuid": "f8f0c248-6ebf-4648-bf2b-97f929d9e0d2", "comment": "Malware payload (AgentTesla)", "value": "28c550b18c87a3998fa57e6494b4495063f1cfe0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644095, "uuid": "b62c624e-fec7-4564-9279-647d87687b3d", "comment": "Malware payload (AgentTesla)", "value": "1e487e833640ea0c1833c1a089076653dccf95d088c8782ba8234d49b1309c8e2c1cb0172b185983380c3f9f727e6ca5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644095, "uuid": "4727ef76-e4e1-4cbc-a689-3e09f1a3f2d1", "value": "T1AB6412486BA5D057E9B216F21E7B29767FB0EA1B04F8C78F43505E2D7C74682CA0C762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644095, "uuid": "fa7fa447-728c-424f-98d6-609eda45ce91", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644095, "uuid": "5cb2194f-ba89-4a3d-8073-5e25024982f2", "value": "6144:/Ya6HUjoUi+kz0Yhgj7MifeovOhGauBELyihzvEc9BHj2MFAlYm:/YF8ivz/gPMiWX3uBzYzvEIj2m7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676644095, "uuid": "5dbc4ca8-276a-40f4-88a7-afac3899e83c", "value": 322293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676644095, "uuid": "446fb1ca-9a37-4f2f-9df7-d54d38e866e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644095, "uuid": "80a65a2a-68ac-4465-8235-063c2f2e511c", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3706f607-aed4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676646199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646199, "uuid": "de4b66a6-155c-44cf-b06f-a40d3f2e8226", "comment": "Malware payload (Smoke Loader)", "value": "e91d04a1192454a0da12ef1e1f17ecdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646199, "uuid": "6f34ebdd-7e0e-4d11-bbe7-3aec2a3db542", "comment": "Malware payload (Smoke Loader)", "value": "d1819495e05dc03ac9bd000f792c1392d3a6654ed814a204eabe96cef77241f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646199, "uuid": "99e4df8c-a51c-432b-b434-22697bfd0471", "comment": "Malware payload (Smoke Loader)", "value": "153d5501ad56bc18444c3169beb03ce59ceb53b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676646199, "uuid": "25f84242-ee84-475f-8dc1-cb4e385b17fc", "comment": "Malware payload (Smoke Loader)", "value": "6b013cf913dd064a2a868fe32b80b0e09d2c2267dad735e3c65857692f32baa9c08f407809a1423138ae2910bb527a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646199, "uuid": "347d1c24-422b-4ce9-8415-e3543be8e42d", "value": "T1AE04CF2236D1C072E21356356E62C2A29B2BBCB04A719D9F2BC703BD1F713C2D765366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646199, "uuid": "2c59153e-50da-49f3-be69-be88cbf8fe36", "value": "04d4ff0968f0d2d964fcf7ad4ec4e8a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646199, "uuid": "feda579d-1a1a-49d5-b88b-42af76cb2f37", "value": "3072:7OyLscVJdYOlltT+jakOOijxUNIsSlR45EJjyQK0eE/foXnr94e+ezOSb:DveAlJyXaHsSUoWvEIRp+ezO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676646199, "uuid": "31d58212-8806-4ce3-945f-da28c2ab4487", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676646199, "uuid": "a0af8ab8-493b-4d8d-8207-1115553dbc2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676646199, "uuid": "f2b5656b-9e2f-4678-a3bf-ec9ad4cbeb79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9f6d12-aecc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676642957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642957, "uuid": "fd3456c0-b4af-4267-a9af-6bb6b7d5c5bc", "comment": "Malware payload (RedLineStealer)", "value": "8ca48949436ca0762635110fe250503d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642957, "uuid": "9daa0e45-3748-4ea9-bbc8-db5c904fcaaa", "comment": "Malware payload (RedLineStealer)", "value": "d23218868354efc4107040db6aebf4c097a96353e0ab394730f0b23eaab554d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642957, "uuid": "d3a1396d-057f-4d86-8d71-78730b0fff37", "comment": "Malware payload (RedLineStealer)", "value": "75a5a81a1ceb228313e993755d1516710f426280", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676642957, "uuid": "9ee1e914-6eec-4bd3-a6b5-b6b09323630c", "comment": "Malware payload (RedLineStealer)", "value": "105c9c9fb12a6c386c3df5b170900c20c9f154f2616d9f9fb19071279a123b38495f30495991cdee6c310890576c3624", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642957, "uuid": "c634bc97-42d3-4fd3-978e-1136607a891a", "value": "T122C40247FBF88032E8F543705CF603D316397D506E30C29B274BAD5A18B26A4A67676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642957, "uuid": "5987d1ad-2312-47c9-9d42-8de0220bf9e4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642957, "uuid": "d0f648c4-a4c0-43dd-b83f-3fcf26ff4966", "value": "12288:/MrMy90e2oSF6UemtVi2RhR1/t13mUAr5G:/yD3YDVi2R1LmVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676642957, "uuid": "82921ad9-7bf7-451f-b1a6-f05f9e5098b7", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676642957, "uuid": "af2a2e4f-ce20-4605-89b8-153f6058a783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676642957, "uuid": "81f46eb0-1d49-4158-a4d3-ed8dff2fecd1", "value": "8ca48949436ca0762635110fe250503d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbb6a03-ae69-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676600493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600493, "uuid": "d2c3d850-6234-49ce-a43e-680c28e5e02e", "comment": "Malware payload (RedLineStealer)", "value": "6c90dd8bd462cc8851846c3fda0bde14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600493, "uuid": "9bfa31f6-6417-49c5-bfea-51fdd059dce0", "comment": "Malware payload (RedLineStealer)", "value": "d2b069a8127946b4fd52442fb7f61ecb94435b01f315645d4f1e9e49302710aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600493, "uuid": "4d64f192-b538-481b-a52a-7adcd4ff4778", "comment": "Malware payload (RedLineStealer)", "value": "ff3001aae08201bed7efaee3f8cb7feff669c612", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676600493, "uuid": "922124ee-14ac-4ba0-8c1e-2be29c9d5b69", "comment": "Malware payload (RedLineStealer)", "value": "2589e08bbc72aa08e3c53caf6deb4d0af5e69aa083041a81b242baf6c52fef53a8f81b4873f6aeb32c1c171485226a95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600493, "uuid": "bcb7c93b-ac22-44e9-801f-07ef43956763", "value": "T14225235396ED8072E8B54B310CB206D30B3EBEB0273957D3678E7E99087267496B0767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600493, "uuid": "b968ae0d-df50-4db5-97ac-edfc55284a39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600493, "uuid": "6c274645-3000-4fc4-ba17-f6d38b846309", "value": "12288:BMrby90E2z49dBZrM5Uskrtr1/clTBz1BPsGKnkoCXczr3sJHCPOMmp573qCDHrt:Syd9dHLElTvBETnkoCXcsJoRDuNe9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676600493, "uuid": "849292b1-fe9d-4120-a4fb-26eecfbda2bd", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676600493, "uuid": "828af899-0c4c-4482-9047-7e03b43d2575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676600493, "uuid": "2a4fff59-ed36-4dbc-bc50-d7c9cf1778bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd41b36-ae5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676595099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595099, "uuid": "7f8c8150-35f1-4b3c-8cc6-ceafd8406679", "comment": "Malware payload (RedLineStealer)", "value": "c349561b06a2d6afd1ff630871393a70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595099, "uuid": "5841c2ef-02c0-4cdb-8b9e-977c2bf1a31c", "comment": "Malware payload (RedLineStealer)", "value": "d32f2052818fcb23edc5e67c33efd6504ebc1ae4ce12341fbde722c2786530db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595099, "uuid": "10c39653-4803-468a-968f-1099adfd9bb7", "comment": "Malware payload (RedLineStealer)", "value": "17d56044086cf7fa012583efa48243a140263084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595099, "uuid": "3181512a-e71f-4705-94bd-ee1b54563c73", "comment": "Malware payload (RedLineStealer)", "value": "c46e50636ffb5e8d215b22d4d2e7c8612255decf595a063af4c765b0debc652b34bb6a19e8029304824437ca0b4e374a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595099, "uuid": "0361e347-23aa-462e-82c4-9de4f18324a0", "value": "T11915121BABD84032E8F15B7058F317C306357D955A3993AB274EBC5E28722F4A23536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595099, "uuid": "83484ac7-c42d-4688-94b9-74abf454c264", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595099, "uuid": "f496e454-1852-43c1-87d0-ebafb239b042", "value": "12288:kMrFy90ekglRc0xMfYRHZFENH8y+U4Nif0l59l/pi4LtkgukyuxqNMC4tA/Mf2:pyTlRxVRHZF4cyyv9lZLyTBuuNbg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676595099, "uuid": "b7f507d6-8b78-460d-ae35-6dcfe3a24aa2", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676595099, "uuid": "3fc02f42-2725-4e1b-9f8e-d03788628171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595099, "uuid": "de6e6ae5-8a24-4b1f-b000-906005895c85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d436c2b9-aedc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676649899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649899, "uuid": "533a755a-5996-482d-b21d-9fe3b215e5da", "comment": "Malware payload", "value": "059a9767a2dd29975fd1429c6f867748", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649899, "uuid": "2bb8aa47-73bb-434e-9822-5153ee0f2ebe", "comment": "Malware payload", "value": "d3b2b84b23f79bdf4f9250be0c88d082fed6e142d857fe2a96e4cbe5504aea5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649899, "uuid": "a3949235-57f6-4bb9-ab43-c194388053ae", "comment": "Malware payload", "value": "1d76e6b9fd892b877bed8c7402989fe6fc386f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676649899, "uuid": "150b52cc-53a4-44f5-adb0-ebb3cadd0cdf", "comment": "Malware payload", "value": "6a9161d111170c7069aa1cc1cda9b08740901687de4bb465eb68cee1627368af106ac735a46e5a00e2d09743b0fcd2c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649899, "uuid": "c7b00ae4-ff0d-4c5d-aeec-6a1c3c1291a0", "value": "T1B1E5330760ED4832DCA5877409FF47870D363E770E785D6B0E49A9EA29A2C36767036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649899, "uuid": "25c37214-19b4-4bec-a9ae-9655dcac4734", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649899, "uuid": "8ae69d85-c544-4c73-89d9-e8366554f2b7", "value": "49152:FZAwWvC5b666X/JFnaxOtULkuKRjrg+MG/EbLaH+QJyGNkSch8ZI5me:PAwWvCN66a/vaxOeLkuKRXg+ieHhkGeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676649899, "uuid": "cc23c9f5-36cc-448f-abe7-a050a0522bfa", "value": 3132416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676649899, "uuid": "80f801cc-1f56-48f2-b92b-2ea723fd3493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676649899, "uuid": "1fc31bcf-c00d-41e3-a5e3-9ffc41f45361", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0f15fb-aee3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676652623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652623, "uuid": "db481f28-82ff-4e8d-9711-74b76455d0a6", "comment": "Malware payload (RedLineStealer)", "value": "a1d8df1ad7bf3b8869d93563c4723671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652623, "uuid": "822ec37b-6f19-4bc2-bb76-ba0f04f358e2", "comment": "Malware payload (RedLineStealer)", "value": "d532e607128a8eacc7b85122113f2558de62221ceddd203e75e99916ccc975ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652623, "uuid": "9a58923f-bee0-4c36-b9b7-5eab31ffdce6", "comment": "Malware payload (RedLineStealer)", "value": "b2fe9023536451ff7d83ad5be9d50afc6ca96637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676652623, "uuid": "95f081d5-bfb4-4a6b-ab82-ea78f9412d5c", "comment": "Malware payload (RedLineStealer)", "value": "655f1b9ab5359e408876700a11ea7d0f18794637135ea66b2f72f46067870a37b5a57d8d2aa49b317681df61ffe7800f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652623, "uuid": "92c14347-0e96-4207-94ac-7d22886cc1f2", "value": "T110C40107EBF88172D9F557704CF203C3123ABD509A78866B634FAC5B18B25A4A63177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652623, "uuid": "972fe0b0-6b1f-44b8-a6e1-6f3932a9fdea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652623, "uuid": "10da151a-b4ca-4878-976d-b10bfd5eda3d", "value": "12288:HMrKy909NARpTg8Xu7l/8sLvkt82fRkzR1Tmi9+0:5yJFve7msLvD2fRk7Tmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676652623, "uuid": "125ddb98-2f11-46be-b35e-3182cd05cc59", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676652623, "uuid": "04da18d7-f753-4126-8bbe-e9d259649ccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676652623, "uuid": "30c18b25-9582-4201-8cdc-3077df919e93", "value": "a1d8df1ad7bf3b8869d93563c4723671.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f15b7a-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676637792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637792, "uuid": "388e798b-86d8-4459-b487-73162a55db61", "comment": "Malware payload", "value": "0b400a836fb726c09b95358b3e50e0c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637792, "uuid": "85e055ee-1b16-4b3e-8801-35c323d730ec", "comment": "Malware payload", "value": "d56411c9e15115030c2436dc5404b30f46b33b4be55feaf18a719a303cca7883", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637792, "uuid": "898fbf5d-f503-47af-94ea-218405859bfb", "comment": "Malware payload", "value": "430b2234dac7e89e5e3b480cd0cf05f5c2f93c80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637792, "uuid": "8532ca87-c834-4d9c-99aa-ddbc8a3865a8", "comment": "Malware payload", "value": "4cb55b9ed6214f888c762104263a66d78aaa31b65dc3149e63ca14c3994b758dedc670c1cf937f562055589a289ee994", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637792, "uuid": "717b9851-aa5a-4c3f-868a-dcb2c00c2760", "value": "T1E3F47C8C95F1EE3DC72A8E79271032081FE196437920D9E5E3F6FAC25B369A3099D531", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637792, "uuid": "34b7d94c-44af-4b7e-853a-b5200bacca49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637792, "uuid": "6c2c11a8-ed1b-4834-ab42-1d94af100574", "value": "12288:PQhxqDSuGDsv9tU3Ye61lOYAOe4i0N7o9TObjZg+PYFN0CwR3LsgDsv9t:PQhxqDSuW3A1KL4dJri3N0Cwps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637792, "uuid": "c3621805-7f33-44f0-896b-d59bd0410a4e", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637792, "uuid": "f0231743-1c41-407b-a2c6-30e686fa38f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637792, "uuid": "0cfb31b3-400b-41a3-93f2-ce404c1c8d7d", "value": "0b400a836fb726c09b95358b3e50e0c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38972d1-aec5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676639939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639939, "uuid": "787c132e-09f3-4d40-abf6-719680c60d0c", "comment": "Malware payload (RedLineStealer)", "value": "1c14bf09eb0e5be85567b860bf252d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639939, "uuid": "4f824d1d-f65d-43a4-be34-ffd1729f33a2", "comment": "Malware payload (RedLineStealer)", "value": "d6e17de4322ff208dd2f7df913b5e82b496f55c44007dfaef5f0f2327b53f510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639939, "uuid": "6e980705-3307-4574-b693-271213e911a1", "comment": "Malware payload (RedLineStealer)", "value": "aef789b3a8e86070269547991bfd2d518e8679d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639939, "uuid": "95e9252e-5f26-4420-8ba7-b1eccf7dd4a4", "comment": "Malware payload (RedLineStealer)", "value": "719d1636ace2b1ba627911976b6dad5d0ee767ea32f9185ff56eeb15e78998b278dc83614219476b7ff2026d4ebe982a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639939, "uuid": "592baf9f-aa36-4956-8cf2-36fd9e94a751", "value": "T1F1251207E6E9C172E8B4537008FA47C30E397E502678879B774AB96A29739F07630767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639939, "uuid": "16ea65b8-714d-4139-b280-bed82f7ff573", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639939, "uuid": "e60dd46c-4b44-4de1-9440-f23da999281f", "value": "24576:ryrBZfA3nYvgH0YpMypzbYvlFfuIekm5D9:erBN+YvFYpMyNCf/fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676639939, "uuid": "8bb674e1-dff4-4d61-9c77-ccc742fa0e63", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676639939, "uuid": "bef12c10-eb43-47ae-93ac-43fd65000df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639939, "uuid": "65becf7e-ff85-4a05-b080-2c2aef60d7c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22e76fd-ae97-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676620314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620314, "uuid": "ace90112-8dcf-444e-bc80-cbe9607832b8", "comment": "Malware payload (Mirai)", "value": "db0600a901398bf21c4aeb1b3eb17060", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620314, "uuid": "243bd331-f09f-437f-a5a5-0f73415a924d", "comment": "Malware payload (Mirai)", "value": "d834871647ef1c61f809a62304afadba629dea0aac2cd812c1c4d47248bc30c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620314, "uuid": "e480f309-b671-46bd-954f-b0f92f051e24", "comment": "Malware payload (Mirai)", "value": "a108b52e0fe6c390a8ccb7be5fda414097c15d81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620314, "uuid": "ad4a648c-4242-4bf2-98ce-599fec68647a", "comment": "Malware payload (Mirai)", "value": "4d3366c45c102501b00aa65762afa44b192e9ab3fca6441f6733e1a7690f64b1a89ea6695d8d92055ef70096175e5ae2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620314, "uuid": "07d04bf5-17ed-46c8-bdf3-0f2dba280369", "value": "T19E43F855F8818B22C5D4027AF92D118E332367E8E3DFB2139E106F647B8696B0D37E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620314, "uuid": "cb98b254-be85-452f-b2d1-3c02b6e1e51f", "value": "1536:5Jng2Ke3tTQZoSgLyUN/aKD3ezzIci13FihNJ:A1edT+dC133FihNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620314, "uuid": "b97d2bc5-8b1d-4156-a6f1-43b130acba01", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620314, "uuid": "d267cea7-0b19-4642-a15b-d262f33a4494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620314, "uuid": "7a5cf029-ee7f-43e6-a85d-3c6eb9f8663b", "value": "db0600a901398bf21c4aeb1b3eb17060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17cbc7d-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676637895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637895, "uuid": "c7d353fc-6278-47ca-a22b-5a043888d5c7", "comment": "Malware payload (Mirai)", "value": "46c37d0b16cbc59b5b30e538e8f83482", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637895, "uuid": "86bf7b73-e6da-459c-a96c-71dcd2b82d92", "comment": "Malware payload (Mirai)", "value": "d8d8b6afab6fbdf90cceaaf7865517ae5efbea4ea1b5de2208edc1b4c893d9b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637895, "uuid": "92efabe8-743f-4206-bc38-9cbdd56618dd", "comment": "Malware payload (Mirai)", "value": "72adffc8e453db30b68b638bd1bff00f07984e8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637895, "uuid": "e573de73-9ecb-4302-9612-e2e4abbabd79", "comment": "Malware payload (Mirai)", "value": "513e9ce1d9338a4a8564ba5851220a5ecf05f82dd2b9b7b588af47a6d1eefc784f9b0d33ceb4b36519a521d99b497dd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637895, "uuid": "575f2dbe-d0fa-46a8-bd46-18cbce806db7", "value": "T101438C37E96E1E74C08641B074748EB56F23B5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637895, "uuid": "df972d2a-d11f-4589-9c55-34d471914582", "value": "1536:Vaa0brW/Od9hlCR3KJkKYXwKEpPDCMC2+Wh:Vv0brWGd9X5JLYypPDL+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637895, "uuid": "6f585c89-2c02-4563-981a-25f52afcae8f", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637895, "uuid": "2af3def3-4012-4580-830f-f2da7d36c7cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637895, "uuid": "56e5c01d-50b3-410f-9432-2867605bcc68", "value": "46c37d0b16cbc59b5b30e538e8f83482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4490af0e-aeea-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676655671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676655671, "uuid": "33b38cb2-368a-4b8a-a3d9-a47214aa9406", "comment": "Malware payload", "value": "529e92c9a78553d4fe2bf54549320a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676655671, "uuid": "42d41e4c-a340-43ed-86ab-744c43b24976", "comment": "Malware payload", "value": "d9138283041d58f85b1e3a19e450bd26e8dac1df4e1a5a9df44fd7b7ec9ac06a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676655671, "uuid": "045df2f2-9084-4781-a2c6-dacf50b29685", "comment": "Malware payload", "value": "f42a7a36d0a9fbaa450c7312b5c4efd33b26ccbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676655671, "uuid": "b68d9cd5-eb75-431d-973c-f7dd14e9ee29", "comment": "Malware payload", "value": "be0cc942f201d5122e021a9a06d699e7e3d902f3386798d1f5caa5870c7c9e959787519c45396e463a7c7c08e1afb760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676655671, "uuid": "e2e532fc-651a-4005-bb77-11a1d9be32c1", "value": "T19936233313294005E0E98839CD2B7EB535FB1F3B8BC298787596B9C629716F1E51BA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676655671, "uuid": "fe24b26b-f90b-4011-8578-e6cc824897a0", "value": "b0a438491df559e2ae875aca71787ff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676655671, "uuid": "eebc0bee-fe69-422d-a9e3-21265784ba0d", "value": "98304:q8DHRN3EqJHIOgX5c6Voph+KeVpUkRksrDUnX7+7aVJtBXSfBF:NUMHyX5mh+Dfss8nXq7aVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676655671, "uuid": "2bba639e-939a-451a-9d60-957d97fbfa36", "value": 5175816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676655671, "uuid": "fbc4c0fd-dda4-4daf-a342-e7c3307e0428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676655671, "uuid": "5ab8a200-af26-4179-ab90-e6eb0b12b516", "value": "SecuriteInfo.com.Trojan.Win32.RedLine.RDAC.MTB.26407.26321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a42d776-af1f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676678363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676678363, "uuid": "76817535-e7bd-4cc0-8068-6441380a91c8", "comment": "Malware payload", "value": "4e409a6d518985086a6f6b4dd02c5e59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676678363, "uuid": "044e7e5d-3542-4079-aebd-1a8930cae6f0", "comment": "Malware payload", "value": "d95fe8129872661becfff6574e437cb6e4abec83afa888dc4f39f32c385bbcfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676678363, "uuid": "62b71c07-4581-41b8-bb87-bf67b0641ebd", "comment": "Malware payload", "value": "44dded42cc798d2d8bbd2b6cc158cfb7881664d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676678363, "uuid": "1d0e92e6-e311-4353-b9df-390139f9b054", "comment": "Malware payload", "value": "d6d56442d8a5d24b2e8013b33a304ad1534bcd0f85f92d2546daa242d8f554c018b751cf6eb6a575c2b1af221b3972d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676678363, "uuid": "da2d5460-4ac3-40ca-8048-26e3314c2e39", "value": "T16CE41207FBDC9572E8B1577059F503D306327E60693487AB638E6C6A18732A4B23276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676678363, "uuid": "cf610db2-5270-48bc-a8a3-95e527ace331", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676678363, "uuid": "3ed623a0-fe17-4bc7-869c-fbb31fa3c13f", "value": "12288:JMrNy90jJN/OGRWLYAPqGlPeo7qfKTwVKx50ct/PDKeLpMv5tctYJT4A23CLs:Eyaz/OHL5PqGQfKTao5jtPDKeLGv3c8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676678363, "uuid": "9b397ddd-0a86-4a6a-b601-7405b8fb15e3", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676678363, "uuid": "a3247abe-35a8-4d53-891a-2cc35b112e8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676678363, "uuid": "ec342781-4f23-46cd-94f0-377cbbd77fd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231fe814-ae95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676619108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619108, "uuid": "f67f4b12-88f1-409b-9967-497a62612985", "comment": "Malware payload (Amadey)", "value": "f860fa564997b091cb56e31218c1314f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619108, "uuid": "3f96cee0-dfcb-4b37-ad99-45d8422fcc18", "comment": "Malware payload (Amadey)", "value": "d97845d4708bc1f8a29e7d7db030c7560912889e3f6e57e2aa67318c0387ad8e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619108, "uuid": "e982cbdb-62f8-41d4-8798-5841d89b5de0", "comment": "Malware payload (Amadey)", "value": "d2cc6e4126bec141f2cd255f070f438bc1cf5f83", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676619108, "uuid": "bc3026fa-70fb-4cfd-b06b-d62d0e251a12", "comment": "Malware payload (Amadey)", "value": "fe9d1a474d8b1117d915bf54ab93808464a8928b7e45cf6affa7563ea3832ddc0b7d2f88bd6e1b6afd0687dad309ad25", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619108, "uuid": "175a4ce2-df49-4972-b3ee-cc0ec9bd744b", "value": "T1EA251247A7E95436E97187714CF603C31E36BE715B79839B279E681D08A2A707230B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619108, "uuid": "b4a383f6-3190-441f-a004-8071b9f05b47", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619108, "uuid": "075f6a04-2a75-4f72-b9fc-d274b04858c4", "value": "24576:Uy1VlMSyT53i6b/sdLUw3hSeFSOtBiAKev+/:j1HMz13i+ckp0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676619108, "uuid": "c9efc59f-44a1-4e94-bd5f-dca00c7f7517", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676619108, "uuid": "5f818bd8-78e0-42be-9859-a602fc9757c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676619108, "uuid": "1fd9073d-b9cc-494c-bdf7-663d46d6629d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557a404d-af03-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676666437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676666437, "uuid": "0840bd53-d672-4409-b664-20d656c99f1d", "comment": "Malware payload (RedLineStealer)", "value": "4712c552dcbe7f40c6613eedae028f29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676666437, "uuid": "5a397060-aa97-4a83-9af4-6582457fe8ca", "comment": "Malware payload (RedLineStealer)", "value": "da69823c52df56c82d99f3badebb11a2e6f80f0d9367e0b366461ef7351ff1c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676666437, "uuid": "4df51414-30b0-4508-b6c7-4c2a19d35197", "comment": "Malware payload (RedLineStealer)", "value": "b6e09252e6f2a6ec29ddf546e26f72e125733ef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676666437, "uuid": "bbfe8b4a-fd85-4b68-a78f-c9e52068d814", "comment": "Malware payload (RedLineStealer)", "value": "29b71de12ea1211826615522cf1025b911117bd6c24b20772f4bc701967b4371db799da61714c602f25e9e4e8e5b639f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676666437, "uuid": "59aac054-4df6-44a5-abfe-4c0354b22852", "value": "T10086333F93B5A5E1D86C47B89FF805A24931B6A08058C8FB63E1C4AD9C335642A7CF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676666437, "uuid": "e28c8254-0501-45f0-9bf0-e29aa6f57507", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676666437, "uuid": "e5af5df2-b59d-4949-be91-5df68f20d833", "value": "196608:kuYO0UCRLljm7rZCDniV0aPLHn6lNa1zWuQy0umK9S4:wbXpjyF2niVfD6lozRQy0u1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676666437, "uuid": "ccf0903c-6d14-416d-b11b-c404ebe5628e", "value": 8126467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676666437, "uuid": "22f08fa2-383b-465f-aa89-2e07b95ebbc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676666437, "uuid": "9c1ad118-b58c-40bf-a0e9-b484b6cbd4b8", "value": "4712c552dcbe7f40c6613eedae028f29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c426214-ae88-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676613647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613647, "uuid": "06e94953-14dd-4bea-9142-4389685fd02e", "comment": "Malware payload", "value": "a757280cefadc6dc510623806d8f5506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613647, "uuid": "5af23e2c-adb1-4b5f-9a91-7b21becfc178", "comment": "Malware payload", "value": "daa43650b10ddb159a8db3f7b694135b6f9f2cda89a6a999fda5e204c0ac0685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613647, "uuid": "f0aba278-37da-4589-908c-93ff8add97fa", "comment": "Malware payload", "value": "351ded77cbc266807a401e6ac223d1ace4a67510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676613647, "uuid": "987e1dfb-6488-4a3d-b6e8-aa0e9a6c35ea", "comment": "Malware payload", "value": "a697fbe51cacd7750db4053012304640839ce833db40f9f9115ee015d6d7298de306254bec1150cd8d1bb96525baa6cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613647, "uuid": "a0e0b5e8-fea2-40bb-98ea-4b80762df754", "value": "T174151247A7EC9572EDB617715CF702C32636BE618A788343028AED5A0C722B1B635773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613647, "uuid": "7792dbe1-b06d-4029-a83d-0bf430fde780", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613647, "uuid": "885ad51a-beb3-4107-bf40-bcfaddd9037d", "value": "24576:JyWo3e4t4oR3+J/aVvdKeepfQihnHUiD+rDH5gr0AdB:8WR4h/JLSQUMBgrRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676613647, "uuid": "cdf95cc7-9dc3-4df3-899b-12dc89e2a9e3", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676613647, "uuid": "4984932e-517e-46b9-bec7-7f2191c31505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676613647, "uuid": "445282d1-f9e4-47dd-93e3-0fca4c10ab9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba977c9d-aeb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676630958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630958, "uuid": "3e3b2d15-9540-4fad-a8bd-e2f5db3ac245", "comment": "Malware payload (RedLineStealer)", "value": "9831354402b4610bd67d1055bf6b6000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630958, "uuid": "9fd47d79-0d06-4c87-b827-abd4667d0e6b", "comment": "Malware payload (RedLineStealer)", "value": "dacb19138d73eceb71f3d041755df4e249bb113208345a4193fa2037c907e345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630958, "uuid": "8e18911f-0514-46a0-9a3e-24427d8104e2", "comment": "Malware payload (RedLineStealer)", "value": "13132dd5343eda2e0d182f6bcd98144032f670e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630958, "uuid": "a3eb953a-b7e0-400f-b7e8-bdc705aba065", "comment": "Malware payload (RedLineStealer)", "value": "d4c5b6b327a243b12069f5974982635e9cfa0c16abb21ee4c5009f57368a65b06a7c42e386589d95809eb0c81e84af1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630958, "uuid": "878d9447-8deb-434e-b4ff-83e767c35165", "value": "T156252207A7ED4123F47013311CF912E3063B7EE15678861B6B8EAD6A2D32564D632B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630958, "uuid": "5b19a0a7-6449-4e48-a1ca-1b2645a5741a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630958, "uuid": "ce360124-d28d-4011-bfc4-efe3ba836f90", "value": "24576:IyrINY5XbVO5ugg3Kd0kn4Pz5z21lRWS2IJH:P8NiNXZr56LkBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630958, "uuid": "aad89d24-255f-4a62-98c5-827c469f9062", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630958, "uuid": "dc46cb07-8fe2-4075-b396-c88f266cf308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630958, "uuid": "5dba0168-fcdb-4748-8686-6052b91ca7e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39095eab-aebd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676636324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636324, "uuid": "e0cf934e-6b32-4aaf-aaec-31f6fc2eab53", "comment": "Malware payload (RedLineStealer)", "value": "0b445dbac13ff7847b4ebdfb34e52484", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636324, "uuid": "03411d87-1c8f-4488-ae3d-b9c37b3cb0cb", "comment": "Malware payload (RedLineStealer)", "value": "dba448219f0fcba3fa807523dbb040f820b19b62120f49cce3031306a4afa2fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636324, "uuid": "cff7db3c-22e4-4cb3-88fc-f5aaaa9d43c8", "comment": "Malware payload (RedLineStealer)", "value": "b0f7bde202f11e6feddf9bf0eff0333593a40aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636324, "uuid": "4903e819-4ae3-425c-be93-87266afbcae6", "comment": "Malware payload (RedLineStealer)", "value": "34f6bceca768eb4b076db15ee845593798f56ffcf1a28d034bb52cd26747e2bccc55c5edaa3988d4966a8a1f2843ca9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636324, "uuid": "d1ea4a3a-d4df-4cff-a1c5-5110d013f49c", "value": "T17115130BF7EC9065F4B5277055F707C31236BD611E3882AB1709FC6A0CB2A6562367AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636324, "uuid": "7c072d69-814b-46f8-83e9-d37a007b2acd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636324, "uuid": "07527531-7857-43a9-a9cc-a7f9d025b518", "value": "24576:bynEDDUGmt3SYrqzAvptpp3yGlWNenbOPXQ9Xv5BFlRij:OEy3IzITCGlWNeyCBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676636324, "uuid": "b429a3cc-45a1-46ae-ac68-e28b65dc00d0", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676636324, "uuid": "a452b55c-0b09-4b8f-bc4b-387794b3b3f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636324, "uuid": "79c52170-d0da-4f66-b49d-85a44e92994a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2750d1-aea7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627208, "uuid": "d967a718-b54c-43e6-bb20-b7ed5449344e", "comment": "Malware payload", "value": "5be4e5115cdf225871a66899b7bc5861", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627208, "uuid": "98d00cab-5c39-445b-87d8-cea9b1e0b7c8", "comment": "Malware payload", "value": "dba614a3b64db6ab346bf37683a9d13b5013fb4b7def2acdd8a697d26b62e48d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627208, "uuid": "77431bb3-479a-41be-833d-7fd6b6a5459c", "comment": "Malware payload", "value": "cb6d29f199af0344a47b36f80f752f2fcd84a495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627208, "uuid": "16dcbaa5-63b0-4b20-99c4-ba94810a4e8d", "comment": "Malware payload", "value": "7b4d12d9962cef2ad9943098d637cabfd56d49265fa387d8e54ebedbf925de61873169063d8f5d545c246456a619c466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627208, "uuid": "f2509a00-b584-4933-8f63-e5c031a29e5b", "value": "T15D149DC5AAD8ACDBE615133895EAC3293738F7C61B834B130C34B6351E537D1AE8B51A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627208, "uuid": "d744d224-9d38-4d8a-9a8d-f22f5c62a671", "value": "0fec5b870dad6c4991f598c6bf78e2ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627208, "uuid": "71ed5636-9893-47ba-a3a2-ced4057fc96f", "value": "3072:tSN8g5QagiQ2tdrVZZ1uBu/I6oLE3dDYuWO1d1:tWOD2tY5Y3dHd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627208, "uuid": "052ac64e-b1a7-4f61-84cd-d0106a46bdbe", "value": 207530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627208, "uuid": "7c1d3410-b876-49dc-8173-10887d9d9fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627208, "uuid": "18550a19-40ab-498c-81ba-ae06fae0dc69", "value": "pics.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d814cf-af00-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676665305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665305, "uuid": "f0c14623-1b1a-4841-b760-b5179cccc923", "comment": "Malware payload", "value": "cf9062024ce65bc24107008c66f9b937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665305, "uuid": "bc80273d-94b4-4894-b0a6-a6609f5f1bd8", "comment": "Malware payload", "value": "dc9d065d44fcfcecd44374624fd7f1823d3355ca0a20f19c094fec43087a7d48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665305, "uuid": "9a6c89e1-a8cb-4a21-b83d-457e621f352e", "comment": "Malware payload", "value": "26557dbd46abab82bef24400ff4a7d984f10dda8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665305, "uuid": "ed8512f1-a71b-4a9d-b061-de3411840e9a", "comment": "Malware payload", "value": "52d940e90e66a162d85681ba0ea0909b121c072688039371fcc65a1a7630d2d09043d40fa2622a83a31e0250cc29d11f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665305, "uuid": "5f935dc9-7c98-409d-8d51-c1c3d1e7296d", "value": "T114E4124BE7E95023E8B417702DF203C30A3B7D516A78866F178EAD6A0C735A4A53476F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665305, "uuid": "16bd8425-a121-4b67-990e-f73bf292e4d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665305, "uuid": "ac88b343-14c2-402e-8b25-981e9bf10ca7", "value": "12288:VMrryy90e1QnB5H1ZkuJYUZpBTuct/UHxHNZaPHyEjkSwHQc5LWfsBpn+AjkruL1:Hy9QnBnG+XfGxWvyEeLKORwKVP40n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676665305, "uuid": "e8c3a25c-2ff6-47cd-bd98-bfa723bcc06e", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676665305, "uuid": "60a2cc92-9fea-484e-a91f-2609dbd68312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665305, "uuid": "2168ab17-9c2e-465f-ab6f-a538d1a7ef3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02aae36c-ae5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676595860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595860, "uuid": "fd1e4448-f05b-4942-bb0c-01614f6c4fe5", "comment": "Malware payload (RedLineStealer)", "value": "c2cbb2d01e4f336db87e17915d9e69b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595860, "uuid": "c197d77a-b5b8-4b15-9e60-9ca1b92d37a1", "comment": "Malware payload (RedLineStealer)", "value": "dceb8b37f52713e49b3ff40b167da79b5d9ee4a587d3caabc704baedb16e77d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595860, "uuid": "fb11bcec-e37b-423f-815c-6752b677b97c", "comment": "Malware payload (RedLineStealer)", "value": "a3008b2064aada5755ea18696260d85af0911c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676595860, "uuid": "04ab746d-f587-4793-a38a-94e5c011f36c", "comment": "Malware payload (RedLineStealer)", "value": "3da11748552ff409d0116ba6df44a677793b8e721a3b4e911a0a319655bbe0027299dff8cdbf38200d71ee9a032c5a39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595860, "uuid": "9e5b06af-f783-48d3-a872-cf6343de36cd", "value": "T121152207B3E9D432EDB05BB019BB13C31736BD910B78C793134EBD9954B26A0A93275A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595860, "uuid": "d36b6c40-cc30-4861-8781-9e6223a9f663", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595860, "uuid": "1e56674d-89ec-47d2-b7e8-f30dc03b6c62", "value": "24576:Zyy3DPjsVrXbdBwDS8BPWvdYEL0jiWAnMRquFU:MmLsxbdBqSWOdfL1WAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676595860, "uuid": "f30d770b-fca8-4fed-8c2f-76c38c9d7ea0", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676595860, "uuid": "e8e36a11-2aac-487c-9082-d99f873a1661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676595860, "uuid": "ed7190dc-7a72-4c78-a5b6-d3c782cf7c6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48340934-aec1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676638068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638068, "uuid": "c53f0949-6516-449e-b0dc-2f899b76f507", "comment": "Malware payload (RedLineStealer)", "value": "77a776760fe2e0d176dc6ca876055e51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638068, "uuid": "2bf23391-05f1-418e-b822-756f3d30d204", "comment": "Malware payload (RedLineStealer)", "value": "dfe8b10d567d99e44deed014c4f686a1d28fecf9d763ecaefd24916551a75707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638068, "uuid": "215e695e-4b07-4afc-b29d-b9b8f0760ab5", "comment": "Malware payload (RedLineStealer)", "value": "4b88db7911080a63cdaa0724a59eef35c7937f2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638068, "uuid": "2aee0ad9-ab96-4691-b228-b9908af3982a", "comment": "Malware payload (RedLineStealer)", "value": "ab6baea56074fd22234afab2713d5881d40701d6e68ec3710521b129429a7bae48d5281c447bfd305f833bda6bbc3aa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638068, "uuid": "a3c0b1a7-21fa-442b-9bfe-294f8e9cb1c7", "value": "T17F152357B2E99136D4A4177028FB42C30731BC96AB3453E7279EB91E08736A45E7132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638068, "uuid": "94e0e8da-cc09-4698-8e09-89225face28b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638068, "uuid": "bfd83ff3-4f53-478c-9584-6abc6844f234", "value": "24576:eysqJZgUjB+Qi+/NkxFFMUJHhjvPhPWiHkMCfthi:ts1Ut+Qz/NkxFFDPdW/MCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676638068, "uuid": "b14e5037-f0f7-46ad-ad0a-e672104c32cd", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676638068, "uuid": "2cf49623-eb4a-47ec-9a96-325a69a02b77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638068, "uuid": "72304343-7988-40d5-8ef4-30ee7fd224ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45dc460d-aeb9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676634628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634628, "uuid": "465d0c75-bb61-4fa0-8a1e-1e7bda108429", "comment": "Malware payload", "value": "24d18f1a8658a60c4435443d6fc23189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634628, "uuid": "31e16746-0b90-479d-9c4a-be5b5eea646d", "comment": "Malware payload", "value": "e01692c9d95ff756b393e514e003cc5a8a75d653d10dc4fb3502ac01e1347670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634628, "uuid": "53ef8244-1ef2-4972-ad8f-0cf9befbf663", "comment": "Malware payload", "value": "f1b2c1aed101382d045afcceb96b16b6cac5a089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676634628, "uuid": "a80db3d5-0824-4496-96ee-635df919b0c7", "comment": "Malware payload", "value": "4ae91df3e7b00ba07632d5a6795a04f238034e22e166ed0e486a13c881dd4879fe4821ac0a2dc36ae457a21d039971bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634628, "uuid": "5df199e7-325f-49da-8916-86f727b28ecc", "value": "T10C25120BF7F99073E879573089F606C30936BD51AB69428B374E2C6A4D72530AA3177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634628, "uuid": "b77a66ae-d09c-4e73-a011-b7ce04e0cdc8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634628, "uuid": "e0c0f40f-e0c2-48d7-9aa6-c893962825e9", "value": "24576:JyERqV4njhwItCC6ng9hnrDVq0EOl3tmUK4:8YqejKS++NFq0tl3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676634628, "uuid": "388075bf-0e74-4229-833a-82f35de7459e", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676634628, "uuid": "34edca16-820a-45fc-8a4f-46bb292d6cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676634628, "uuid": "7f6b3ab1-69db-4f95-8f6b-1753e8b7c4a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf5ff3a-aed9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676648303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648303, "uuid": "4dcf4b75-8b10-434f-92bb-81ca0276c8e0", "comment": "Malware payload (Amadey)", "value": "fca5b7c486b5aa9a6876258299f5d8ca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648303, "uuid": "20829888-0574-45c4-9eb8-67ca2bafb3c7", "comment": "Malware payload (Amadey)", "value": "e0ae36ebd06b13f9e34e14f1ef9ffbad22d69f1435c73a2b13110e95d46658bf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648303, "uuid": "a6c7c8b1-3ea4-481a-8b80-79db477e6c89", "comment": "Malware payload (Amadey)", "value": "d55f98804adaebce6bb6e61ae8e2ea30e0f5734c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676648303, "uuid": "1667177f-1a29-49f0-b1ac-01ad34122000", "comment": "Malware payload (Amadey)", "value": "6236cb304c9cce3e04fd2342c8d5f24234d71ee63dc35328af8ac5a9777933438357cba714449073d5b590007efbb475", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648303, "uuid": "72ddbbce-f7a3-4fba-b47f-b4b9294c2a4c", "value": "T133E5330A55E86432E8E503F044EF01D31F717FD72A3C8667174669BD2AB26A1B2F136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648303, "uuid": "141a3c8e-cacf-472e-be5d-2d1c853c4ce0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648303, "uuid": "1fddadd0-d9ac-47d7-b58f-0a938aae3098", "value": "49152:r/08iA/Hw3uvVj8RUON99+E4FAa/UTDEAcJ2e9ovgl30/45i7wg9zrw:I8iA/QI5FON9T4FiTD5i2qoYlk/45mwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676648303, "uuid": "9f6bd389-3d3d-4abc-93ff-7281a9f09eb9", "value": 3123712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676648303, "uuid": "2b82b71c-7a71-4694-8fb0-2a3b004dd541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676648303, "uuid": "46586e0d-e380-4570-848d-0950e75e3f5d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f245618-aeac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676629167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676629167, "uuid": "0c06a76a-2229-41fc-ba9a-3f15ffc35d8e", "comment": "Malware payload (Amadey)", "value": "24e24bd7756450ad2cdb8ff1834566c7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676629167, "uuid": "482a86f4-b631-480b-bd60-fb8dc6fb978b", "comment": "Malware payload (Amadey)", "value": "e0b24cd4d258c945d93ddc101894bcde2e1c6e054c691088ffc248d1b117e5fc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676629167, "uuid": "f01e2bc0-2248-4a34-81ad-fad90a825a94", "comment": "Malware payload (Amadey)", "value": "7a884c51364ca606402bd04f780eea7e67ce3095", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676629167, "uuid": "10c59a9b-0f6e-46db-b93e-2ed086e365b5", "comment": "Malware payload (Amadey)", "value": "e53ddb138fcba73ee1bdeb673f949ecc6a8fd6149c0ea5d23a897be72471af3217a2bf7b3378b1bc616480e099975325", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676629167, "uuid": "5cf02fd6-e650-416c-9a87-b1070702f0ef", "value": "T15725120BF6FD8075CCF12BB168FA03C32A317D217A28839B625F595A2972174A63475F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676629167, "uuid": "f4921ae6-b2c9-40c1-9efc-bfc4be08e5ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676629167, "uuid": "5b87a423-37c5-4b84-a4f7-04d5519b4746", "value": "24576:2yltp+VHfwtIGlQZRHJzWEhXPnvMlui25Tz3SF86:Fd+dfwuBRIEt/lZNDSF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676629167, "uuid": "fdb154a8-934f-4204-8d02-3ba8124d9dc8", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676629167, "uuid": "2bdcf32c-9be3-4e2c-b390-e4f805d8f0a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676629167, "uuid": "c06b191e-5b63-4de5-a403-d4c482254825", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f45cc0b-aec5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676639878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639878, "uuid": "cc78b2ee-8dc1-42ed-88e7-04abf61f4332", "comment": "Malware payload", "value": "4e7bef5f8c8f894512f21fb8037f3d1b", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639878, "uuid": "39348d78-a77c-443b-82f8-1ba2c7bd242f", "comment": "Malware payload", "value": "e24c65eea7ded1cd0c8bab8d49c11d3518e0e31df7b5c9a3d76aec72e731b05e", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639878, "uuid": "2c2cd242-c8cb-4876-8841-5aa3245dca58", "comment": "Malware payload", "value": "d086bf9fefd47074c7bdde351a855388c04e7786", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639878, "uuid": "ebfaeafc-4b7a-46b5-8258-de58d6473f06", "comment": "Malware payload", "value": "d70925942838f7d3ea016d3022d23b81ec59c2d12a9eab19e8fab0ce9274311f0acab73328d498adb76a027fb986188e", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639878, "uuid": "834ec263-f98d-49f3-9028-2995f2bc0f0b", "value": "T16011A58AB7050B87D5370358B72822E0AE48274F0821505704F8C0B2A628B4A3A6FB19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639878, "uuid": "0df2dfd1-23d2-4c10-b4e7-106e725e8980", "value": "24:GzW5xmWx/32fCXaNw7dEtXc2n/8vmQyuHA3ybakeooJktgzT:GqLx/k7wZE1cXtRAyeooJmgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676639878, "uuid": "825cd00c-828a-4475-88b7-6e33300566d9", "value": 1000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676639878, "uuid": "bea80e66-500b-447f-aa53-6b2a68d72775", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639878, "uuid": "c4f8d375-95c5-444b-8ffe-c19216e945e4", "value": "4e.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29c84b9-aed3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676645977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645977, "uuid": "de0a0e0a-c0b5-49c0-87f2-433512ea364b", "comment": "Malware payload (RedLineStealer)", "value": "0dca98e4faa4494edbf16e7c3ca64b65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645977, "uuid": "0c14dd4f-6861-4176-90de-20199771536d", "comment": "Malware payload (RedLineStealer)", "value": "e28d97ea51bd1358c206ef5eefc7ed2d7349bcf493e70bad015c0aeea276eef8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645977, "uuid": "4b561cb8-798c-46d4-8b8e-7f2cee27a6e6", "comment": "Malware payload (RedLineStealer)", "value": "18d169b91eda55a4e88eca001e608247e42e86fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645977, "uuid": "0a61149d-409e-40f3-846d-d28d66c00e4b", "comment": "Malware payload (RedLineStealer)", "value": "e4d6bc5d7cbbdd2955b5fb26a47bcd155d7e651b9c4d3993d01efed3b89cfd43de27511c9386cbfea2b2476d5ea02d5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645977, "uuid": "55767f34-31b1-4b1a-8315-1d75474a6937", "value": "T173C4020BEBF88022E9F5577058F702C716397D60AB34835B274BBD6E1871564EA7232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645977, "uuid": "061dd65a-9b4a-4272-be67-c5e2e9ed8921", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645977, "uuid": "1a6e4a53-8b9e-4b53-9a15-e8612c0f6569", "value": "12288:oMrIy90IltfbBtMI5ZCzRBR1ytgCmUGnRRemm:QyFJMI5ZCzRV+mN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676645977, "uuid": "941d408d-ad3f-4700-a4d9-7cd4329ea4c4", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676645977, "uuid": "59b9d6a1-07b6-40a2-accd-c167f71fa6a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645977, "uuid": "76ea6773-4185-4f16-9074-f490f6bb4416", "value": "0dca98e4faa4494edbf16e7c3ca64b65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cff63a-ae8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676615758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615758, "uuid": "021f5b36-dd41-4705-95ed-feaab82f9987", "comment": "Malware payload (RedLineStealer)", "value": "d7c8da2b0d508b577fac2d9f0bc9f9b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615758, "uuid": "ab9d5c8b-c4d0-4ae5-921b-a58c06acf661", "comment": "Malware payload (RedLineStealer)", "value": "e3703a75bfb2b032f0650b41cb0c3f1db4cf5b65b9893dab4f4654f24d8cba3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615758, "uuid": "7f7ed222-2a96-4723-8b50-501b0211ba9c", "comment": "Malware payload (RedLineStealer)", "value": "4573a55e4200a87ed2ea72d82655b7535aa9256d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676615758, "uuid": "74582646-b02f-465d-9d59-0f23f2c84fbb", "comment": "Malware payload (RedLineStealer)", "value": "8db60893d483bcdcbbbc9b529fb88f1b691d99c2688561ccdaf0567f3313173c5960bc9504a32279a1f489f2634f824b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615758, "uuid": "5158c7d3-e66e-42d3-89f7-5eb62029f064", "value": "T1E425221B67E890B3D8B097701CF243C30635BE614B74838BA78FAD5A5C71AB4A631767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615758, "uuid": "97a6c4fa-c30a-409a-bba2-db0fdfbb8733", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615758, "uuid": "00c8ade4-a85c-4721-9c3a-acc5c1977791", "value": "24576:iy0C/rGDHfJ7yC05gqXsHU9NC6vqRwg5a0xZR:JN/rGbJ7T0JUeLg5bZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676615758, "uuid": "79f77bbd-1ff4-45c0-a879-963c8fc19812", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676615758, "uuid": "be860c66-0700-4e4c-8124-c7969fc7b4ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676615758, "uuid": "06abd026-7795-463e-8d58-6c6966be4fe4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46502348-aed3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676645795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645795, "uuid": "d06c0c4c-44af-4911-a407-e69009e6938e", "comment": "Malware payload (Amadey)", "value": "bc3163be2d61436b00c7c382fbab2cd8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645795, "uuid": "664f70ef-9a74-4b93-b6d7-9308371d8d44", "comment": "Malware payload (Amadey)", "value": "e41ae1b899245242df356489d4c883bd7b6477f82fe1df32371a4d2b471b370c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645795, "uuid": "30aca154-2596-426a-b5d0-f66226c43421", "comment": "Malware payload (Amadey)", "value": "e314eb2e64ee3e99400fa82812029c61def363c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676645795, "uuid": "b3e6153f-f35b-4584-bc78-c6b4cc0eefbd", "comment": "Malware payload (Amadey)", "value": "909f1b44043d6acca184df5599b23c55a3841eb1b7f8a977664fea52a6e2f78d8a865a4887f3016ae93d125c0fc4ae46", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645795, "uuid": "3be35778-c961-4371-a574-3ad34c7faa09", "value": "T1A7E53353A4B10075D8E523700EBF03931839BED3922847571B8FDAAF96B38797075B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645795, "uuid": "6552d8d6-83bf-45ba-931d-961b37797d6d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645795, "uuid": "6a91ce53-6bb1-4aa4-ac6f-273521c64319", "value": "49152:C1aWyiP+kUWgbjEGZyL1zZjFxhpYUILtVdodUn7u6Dg7cf6JxHSa2bmfV0cXv+SZ:qye+Kgbj/ZyhxhLILFU+K68wogQv+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676645795, "uuid": "5b742f06-148c-4013-90d4-a2f9cedeea5b", "value": 3129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676645795, "uuid": "a1d60314-b564-48d5-956e-dae140fea5ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676645795, "uuid": "1816b4f0-bcaa-489f-a275-f88e1b53c3a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0293ad78-aed0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676644393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644393, "uuid": "2b0f1555-ec38-420c-9899-05f1ae2fd385", "comment": "Malware payload (GCleaner)", "value": "f1c13c184218c1b04de81f99e7893814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644393, "uuid": "8d5d137c-2c27-4fd3-a8cc-937d3ea9a1c4", "comment": "Malware payload (GCleaner)", "value": "e4c954b37fed2636c34285b61f04d7f2edbd8552ca934a93fc319ae0366d08a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644393, "uuid": "88e70a3e-a2ba-4033-a25e-40e7a93091ca", "comment": "Malware payload (GCleaner)", "value": "32ef29ec6b2b44127d7bfb6cc1f0cd0662ec28b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676644393, "uuid": "fea01639-41fe-4e81-84fc-73f1d872259a", "comment": "Malware payload (GCleaner)", "value": "de6938d2fa07d4488a26f18677332ac65e76fff380748ea181c1d8137513867cd87e26c5de34018cde64dfd7cc01d456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644393, "uuid": "285cc269-419b-4688-a6d1-0572220d29e3", "value": "T1ADE523C62914D0F7C3FDDBF1B92E44E93AA7BE9BC5D4551738A1FA297931289E00E210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644393, "uuid": "df198455-e5fb-44c7-8780-d6a6500bc999", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644393, "uuid": "6cdfc31d-10a8-46cd-a6b0-81c8a611d863", "value": "49152:1sCIaslFoH6B7gYWVh+Vktv0V6aay4H8oiOFuvHDrRH9nnK7aFcBq+hjYLCgv2MR:SNaslFoH6ZgDoF6aayO12HdK7aCWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676644393, "uuid": "bf19ff21-5efb-4280-9e1a-a9aebf52e49c", "value": 3211179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676644393, "uuid": "1fe584ad-4fa2-4fa4-a0e0-24d402056375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676644393, "uuid": "0bd59acd-fd87-4ede-b226-05bf05c0ef73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57eb04c-aef8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676661847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661847, "uuid": "987d9d19-87e9-40ee-8cb9-2bfa14189ee4", "comment": "Malware payload", "value": "cc491de1cff0874a8a9bc8394861f706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661847, "uuid": "768c091e-f04d-49eb-8108-621e9bc481b8", "comment": "Malware payload", "value": "e55c90dbd62ac351eed18acd582568a7ce5e3428621797190dad972a2eb4702f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661847, "uuid": "f7deaf84-f2dc-42c9-a232-6987221f901a", "comment": "Malware payload", "value": "a00e4c5f1ab50b9c31de04052e221292571966ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676661847, "uuid": "bcfd0d5f-d5fc-4174-849f-182b8da083a3", "comment": "Malware payload", "value": "28eb8128b50b4d807bdb3c7dc8f181a8abfd88b6b30295092cbb277e0e870edf6228ae1250de0035e93872a522cbc51b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661847, "uuid": "93d9854d-8e20-4742-b09e-59f55edf0001", "value": "T1E24601B2F7660786CD99C83187332FA037B5C6E58581E73B069475893D7A8A1BCF3912", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661847, "uuid": "549c0e0a-d863-41dc-988a-12685888145d", "value": "87eb4bc6842457c0bb0fd7289803e078", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661847, "uuid": "24e5d21d-c330-4a21-910c-0e3e152ec5fe", "value": "98304:A+5DUQC4mMKwWfsbL8z6DQG2/FTQ6NJd1U9s+gGxx/Q6gBOvBhr/2vvp:AQDUQCRMqAIO0G2rDd1UgYp/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676661847, "uuid": "85fcdcb4-1e4b-47a2-8df5-632f4617e8e2", "value": 5633536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676661847, "uuid": "2e62baa9-dd90-4fc3-9d4a-43607ac0492d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676661847, "uuid": "2e209266-5b4f-4fbe-8ab0-8bb003cd330e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e19b037-aee8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676654908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654908, "uuid": "3b84793b-f072-4e32-ba61-460834f7e597", "comment": "Malware payload", "value": "d56ec0bd4b9ced932526fb31bb5fc778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654908, "uuid": "8cc1d6eb-4851-435a-9516-419d28967768", "comment": "Malware payload", "value": "e60abaaf17064858d2eaccf24e306f45a1a305f905050b3e5782e5ba824bc352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654908, "uuid": "611e0dad-d6b3-405b-aa93-abc8a48ab8d2", "comment": "Malware payload", "value": "b671373e6f637d8b929e68c91c35b498b0701499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654908, "uuid": "99e59ecb-610d-4ab3-aade-8f75d624b24f", "comment": "Malware payload", "value": "8b8cd21fd1923d3ccf5856e1b2cdb1159aa1bae21d2eb8fb88e7fc44c3a0b4fb235e6895519273f2b92938674ea85566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654908, "uuid": "ec8a7539-d515-4c46-9a02-e0577f4e222c", "value": "T151E5330BF6C84493ECA253B428F747E30B717E931EA0099617DA589D8DB1278E5B137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654908, "uuid": "f3254558-5bb0-40e0-b16a-44c4c89eeee7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654908, "uuid": "09023cf5-30c8-4399-931b-02eff7a3298e", "value": "49152:a5Sm3UhVVdOHylYiA5DQ7hXVXx0r1Fgx5ciADBStBPMLNu4wOK3DncGVT+6dZg/4:lesDdOxiA5MVXVXx0rUvciADBOQjwdjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676654908, "uuid": "e9ba6758-ae0e-4565-892e-375e865a76f5", "value": 3110400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676654908, "uuid": "c96eacd0-e147-4ad5-bf4d-d1158e8eeb3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654908, "uuid": "7afabb2b-bdf8-4d0b-a89c-30111a1e6eb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ecc709-aeaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676628487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628487, "uuid": "a2391a17-e652-48c1-9919-a3a5446a9dc6", "comment": "Malware payload (RedLineStealer)", "value": "2514ef796d29e4734e4a08e756902142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628487, "uuid": "d2bd8abc-9aa6-405d-b32c-03f3e48b6b8d", "comment": "Malware payload (RedLineStealer)", "value": "e65142684179b3315e133d7c485e11441fee0b814fa94e091d1b374db78031c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628487, "uuid": "bd60d52d-41b0-4d57-a30f-d3586c0f33da", "comment": "Malware payload (RedLineStealer)", "value": "27ab749e3ada61179a2ca255c81f6e0b07f8378c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676628487, "uuid": "c78d7b09-ec6f-4ae2-a754-e5e5086ccc17", "comment": "Malware payload (RedLineStealer)", "value": "668ce5f4872542be5e43690ee75ba2eb8872b70db931f0e08ed261f98356d1313cd34f22f2cb54b0717b6ce4162d81f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628487, "uuid": "41c1d9cf-1adc-48c6-b504-f921c4f387ce", "value": "T1E825230BF6ECD526D8B6273029FA07D70A357A506B78820B564BE85B1CB3170E6347B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628487, "uuid": "6e521494-5d36-4098-ac19-092200b8c0fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628487, "uuid": "32d300da-e9b0-4d86-9225-36dcd6e6fbb5", "value": "24576:yytILuJiW1QPk++oc1yqFItX8vet2QgzcLTAe17:Z1iWus9TgqFItMVgLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676628487, "uuid": "dba47bff-e734-485e-83d9-f4892507820d", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676628487, "uuid": "9c0a561d-94d9-4191-ab64-4f132c7bf35e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676628487, "uuid": "91cae7ed-13f6-4f2a-936f-ac5be50a7084", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998df90d-aee8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676654955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654955, "uuid": "c83d1330-6ac4-4a22-a490-ee1a971d6055", "comment": "Malware payload", "value": "e11892c7a1054bafee72038b79d8372b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654955, "uuid": "fa36577b-b7e6-455b-9b98-1d7698ad3f49", "comment": "Malware payload", "value": "e686352896c1cb5bca6e2628a199ca85519b02d10b64e469fef968b099d07a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654955, "uuid": "e905cf21-8e83-479e-831f-655460d6be79", "comment": "Malware payload", "value": "736ff6d3974b863298d087ce51c9e8aeef053748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654955, "uuid": "4c37eb54-4e63-46b2-9b7c-56baa81e6092", "comment": "Malware payload", "value": "9deccea55e9fe1024fe49f3cd2822fed844def8b96a819f87bbf165022c6924005724044f8a839c343763ff5ece9672f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654955, "uuid": "2a045fb0-5888-4c6b-a0e3-836c13d0aea0", "value": "T199156C8CB5B0EE3DD90589BA23302D0827E15D0A292DC6A5D791F7C70BFE35E3D58926", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654955, "uuid": "3b99f614-041b-4591-868d-5a35329828bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654955, "uuid": "f224628a-d609-4ed3-ae1f-c28a7aece215", "value": "24576:6oUSYqDSuU63Jtx1OcXIPxJrw/isfIsg2RBo:8DexzsiXgsgio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676654955, "uuid": "e7adf58e-13c1-4d9c-a720-b1da620e8ca4", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676654955, "uuid": "ea1292ae-0f3e-4c4b-bbea-769ad74de36d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654955, "uuid": "3eb3f303-b676-46c4-a4e4-1344b161cd5a", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044015e1-ae98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676620344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620344, "uuid": "d7a379b6-bfc5-4ba3-83a7-c4f37d4652aa", "comment": "Malware payload (Mirai)", "value": "7b1da482ed94e6260d2574998192d840", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620344, "uuid": "acfc0eab-7f93-4c6a-a559-8857ce7d2def", "comment": "Malware payload (Mirai)", "value": "e74f0221ea8af2680bd5218f730d6c3021693c7f936b91087d5b29712206994d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620344, "uuid": "97144f48-c47a-477e-b783-3276aade818c", "comment": "Malware payload (Mirai)", "value": "5e2b97d958ff790b46e48de505948838f4be9316", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620344, "uuid": "9b05af7d-f822-4b6a-9bb6-8f5d367d482f", "comment": "Malware payload (Mirai)", "value": "23a7dd11b2946ffbf55cb1dc4de18bb330ad15dcf4f7cccf396056498e751ad71e359a72ebff64cee3cf677b9fc8a0da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620344, "uuid": "b4c1f3f3-914f-4b34-9528-033cc9c956f5", "value": "T15AD2F1111904E670F9E2163B8736ABCF6A8B13BCE1E07167A069567212E9C6F86D6203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620344, "uuid": "5c521d51-ef8b-481c-a339-6570a047e073", "value": "768:VEJqrMa3AyNOX/1oF65hLX23QzoVTKx4UjOhJs3Uozw:aJwp3UX/1oFyhLBeL4OhUzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620344, "uuid": "b0590e8f-fe3e-457a-bd0e-b098980223d0", "value": 30152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620344, "uuid": "2521f6ad-a0bf-429e-9547-c06d4141f851", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620344, "uuid": "1d0d0930-39eb-441a-8e5b-ec2873d4440a", "value": "7b1da482ed94e6260d2574998192d840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227b4ed3-ae5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676594196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676594196, "uuid": "644b86d7-4c6b-43f9-9900-e69eea3bad8f", "comment": "Malware payload (Smoke Loader)", "value": "55cf30b2524e4a13443e0b7e903fe130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676594196, "uuid": "8b75aa3d-ca0d-48d4-b875-bd38f024bfb7", "comment": "Malware payload (Smoke Loader)", "value": "e7ad555aa09068034ff92ed6a8cdf356c77b5a9faa20a72d7baddfbd14df5a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676594196, "uuid": "ece32354-ebde-428c-9523-4a42b48bf5c7", "comment": "Malware payload (Smoke Loader)", "value": "dd249a0167b2bfe86c44e2c6843b7291bb416a19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676594196, "uuid": "b979dcb5-9ab9-46a4-874f-deb8c2cb5932", "comment": "Malware payload (Smoke Loader)", "value": "ac041cafa2fd4da6aabf8b3769ff5c08567dd033d1e14c22696c00a40eb5adc777e0b592f864cc5ffea1b1e022928b80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676594196, "uuid": "e38199cc-5a71-4826-92ba-16212c810c23", "value": "T148446D13A2E17C40DB168B769E1EC7E8761EB560CF49B77E12199A7F04B1AB2C363710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676594196, "uuid": "8dda6e63-514f-4b54-8b27-c2a3520f72a5", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676594196, "uuid": "d094a10d-76d8-4b1d-90d4-51d73cad5c9b", "value": "3072:PbS9BdCPL5qpEFAAboo4gSaGH3DsJVia+LWRrnsv5XIOfYTZHPVWv:D0BdsLTAWvCzsGWRrs6UYZHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676594196, "uuid": "06be4635-0158-48cf-a8fc-cc4eb6c4bf53", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676594196, "uuid": "75dbc610-18d9-4d81-92fb-f4addfac8068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676594196, "uuid": "f4cf03f6-5620-4c9b-a8c2-7389ce60dbee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06778b14-aebc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676635810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635810, "uuid": "6c704356-2fcc-495a-aa53-e5b363241c70", "comment": "Malware payload", "value": "d1c7e9c5c6380679430dfc7897c76c6a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635810, "uuid": "65fdf61c-4735-4299-8ae4-223b09b11ae4", "comment": "Malware payload", "value": "e918197fae3f8dfa76d937e4bd9eff85be2171f6d5459467a1818a2438baf677", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635810, "uuid": "15f58e34-5c87-4319-9796-0d0c187408dd", "comment": "Malware payload", "value": "baa5c10685def6b971bfd8455051ab4df62b2a57", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676635810, "uuid": "f9389944-b8fc-4fbb-904b-ad9291876acb", "comment": "Malware payload", "value": "a75fa9c55f8dcd0de461b4aaddbd0e516a11aa50dd9c1bb7c4477cb6d1bd3b2dfa914d14da48dee2cb2cc58871b1502b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635810, "uuid": "86969c3b-d4f9-4b39-9587-088c2cbb1a79", "value": "T121E4333682AA0887FFA510B1D9DD34B5E763B231B29C6176FCDE2139269D06C35DC91C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635810, "uuid": "278d05ea-7230-45bc-8c50-0969f5e247f4", "value": "12288:LuX5k/ZIwC65N6sYlVFML4Y54WsW0c4HfVs4k689EMTHaUWed7QwFOpSD1:L0QZI85c1DuUebsWw/e4kLnT6UWed7QA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676635810, "uuid": "6d189bf4-d7cb-4ef7-9153-cd3b55d7ff0d", "value": 719008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676635810, "uuid": "041c5a32-90e8-4fc6-b251-ca5f4892c863", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676635810, "uuid": "7843e74b-6aad-4b41-a37d-dd08d2c0d953", "value": "ORDERXCONFIRMATION.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcbd8df-aee0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676651549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651549, "uuid": "0f8c5e89-98c5-46f9-886d-cab1c4ba1550", "comment": "Malware payload", "value": "56581a961ae53304756baa114e1349ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651549, "uuid": "25f9c24f-6102-4913-b0d2-9d943f3e3d20", "comment": "Malware payload", "value": "e92f32e606b7be0f21eb43a0e5ee355d8edfa46274e17f483d8ab37755c164cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651549, "uuid": "d5db4294-8eae-44a3-8ee0-a515aa2b9c2e", "comment": "Malware payload", "value": "8999052b1f15959998e926f1579559f2cf963944", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651549, "uuid": "97aedfaa-daae-4246-befa-16072ededa02", "comment": "Malware payload", "value": "4ef7553e2c79da91c85e0e0388509cc6ee5e4032bfa630ac999db7c305da6c2eefe7672292857e00fffce4be5c67765a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651549, "uuid": "f51b9357-93dc-4783-ad7e-c05cc5d220eb", "value": "T1D6A5D03FF268A53EC56A1B3205739210997BBA61B81B8C1E07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651549, "uuid": "2cf5b95c-40e8-46db-a1c5-956f05bba1d9", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651549, "uuid": "b888e63d-9e84-47be-a69b-988ac93c405c", "value": "24576:t7FUDowAyrTVE3U5FmcsT89Zl4rlYEwWMgzquXf5x7awFhJdNo69lOy7KTijl/:tBuZrEUGTMZl4iEHMrA55DdN7POGjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676651549, "uuid": "cd47c28e-12d6-4307-92ae-af09de1e329d", "value": 2094057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676651549, "uuid": "fd772dc8-8ca6-4fa6-baad-dc7d414e17f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651549, "uuid": "30057290-a0a6-4284-aab1-e634cb34f7e3", "value": "56581a961ae53304756baa114e1349ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f06ff8-ae80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676610140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610140, "uuid": "87c75c53-e93d-417e-b4c2-4fa7bb060d27", "comment": "Malware payload (Smoke Loader)", "value": "320bf2b31913af6d96ffe2984af10145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610140, "uuid": "8986e089-c43a-47c9-bbdd-b2f5bbf86ec2", "comment": "Malware payload (Smoke Loader)", "value": "e96f31897f8d9dfd439e0a4ccd3c41658b52a39ac79772016123a51ee8abc453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610140, "uuid": "0eb12ef8-460a-4df1-b1de-9dd1dcd4c52f", "comment": "Malware payload (Smoke Loader)", "value": "e6caf9799d524aa783c99c5884c47a835c9b84d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610140, "uuid": "85981606-5238-471c-afd5-9f8bf6a5aea8", "comment": "Malware payload (Smoke Loader)", "value": "e4f70db2c4f7098e3c3e3fbbe8926b15532e754c665b6d9f116fb1111ffdaca712fb91e5611c8d2df157395ce7f816d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610140, "uuid": "16782a24-1339-441b-9288-93d93a9f72a1", "value": "T175445C1396E17C5CD9168A729E2EC7E87A0EF6608F49776E3219DA3F05B11B2C363701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610140, "uuid": "6e718b74-ee40-4555-af2e-cb7a74206310", "value": "e04960f092e2c265d9974e72e467f4d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610140, "uuid": "1b4eba22-1e7b-4310-8daf-88e76e9551b7", "value": "3072:obmzf0KnL2pENO6boo4gu/KHo+uqGSL72XqoDIDBQwmUxYhOHPVEyRkPRhVv:+Gf0ILJOsvueoKJwqoDWBtmUxuOH5kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676610140, "uuid": "1696a32c-02b6-4403-9236-9654cf928f50", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676610140, "uuid": "7dbd59ac-6501-466e-857d-2f165568e78b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610140, "uuid": "ff754251-b7ab-4ded-8802-150201682bd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166b7f42-aecd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676643138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643138, "uuid": "b3a917a3-9370-4a2a-b41a-ae06aac792fa", "comment": "Malware payload (Amadey)", "value": "f87365528498451d3ad7aef2af371d78", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643138, "uuid": "389d5592-1e58-4886-8e0f-550d1427b495", "comment": "Malware payload (Amadey)", "value": "e974acd3fc49aec16b85d46b91375e04f2f69a5332fe3fbc0182fbcb1c61a425", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643138, "uuid": "efb8f524-1bdb-4d41-9057-6b7f96cdd0bf", "comment": "Malware payload (Amadey)", "value": "54e0fe15ae5e2f099b7663220d2dd915483f37c3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676643138, "uuid": "a71ffd8c-3e70-411c-bfe5-6aa767478c6a", "comment": "Malware payload (Amadey)", "value": "94454efb043d471ff9072f53f26b7d5960fdd53e4120bdc61524041227f1e99516716349525f40588a199a5a3dd61cb8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643138, "uuid": "fc6d8c41-3ec3-4f75-8be2-7d2b6bd5f9fb", "value": "T15E15230BB7E44052D5A413705CF703D31A3ABD61AFB0979B179BAC491CB33A4AA317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643138, "uuid": "5173023a-95b0-4914-8ded-614789b2102f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643138, "uuid": "b4fd76a2-379c-4e38-96a4-b911b5ab93f4", "value": "12288:NMr5y90n9aw4lyHj3r5PevnMClGjAPfyuGJgNcRMmJP216YT9UuC8MqHmhmoAjT:Ay6v4lUj3l4Ikyvm6YT9UuBGml3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676643138, "uuid": "3011262e-fcbe-4825-90f8-128b6f75515f", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676643138, "uuid": "990b697c-6c63-456f-a096-e45123ed99bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676643138, "uuid": "2a9992bc-d5dd-4154-aecf-b8d92ec16932", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42fa54d-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676627565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627565, "uuid": "d0b972b1-97f3-4ae4-85c6-548c101b0f9a", "comment": "Malware payload (Smoke Loader)", "value": "67806b0cd43b6d5e85cae8e221397621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627565, "uuid": "9bccd609-c094-43f3-bd55-51ea9126e327", "comment": "Malware payload (Smoke Loader)", "value": "e9a6f694c7a7847aacf3fa5ca66ea8e4adabc1100708be6f0118ab317eec1bdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627565, "uuid": "ed58b58e-c88b-4bb0-9eb3-cc23c79f19a8", "comment": "Malware payload (Smoke Loader)", "value": "ab653da6913e0a8bfdf9a1e19d39cf9646832783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627565, "uuid": "c69973b3-0513-4ae0-a177-dbd76bfff3be", "comment": "Malware payload (Smoke Loader)", "value": "4c5d7c04b12ccc3eb61acde9ae4115ebcbe2bbf67da9820cc07b11e926626928d34e8e0432b69f1c40da9dcdaf0c76db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627565, "uuid": "2716cf7b-3490-4485-a0bf-d8e70259dffb", "value": "T10824D02337D1D4B9E21B45304E61C6B56B2FFCA08E719EAF3798462F0E752D2CA16316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627565, "uuid": "d5c876c0-949f-4988-a1a6-13258588cbae", "value": "29a62d14d89b432fd6115525abce5c2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627565, "uuid": "35073cd0-443b-4b57-9ba5-4d482f0323d6", "value": "3072:KNziWLNYg3f6BsMHPJ0Fv0AomSgsRUVRgFf3bnok+R4OXKuZDX:KgW/esMvJUv0mzsaof3bjs4Oauh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627565, "uuid": "7cb8787a-ff78-401d-ab60-c16a6bcd05ac", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627565, "uuid": "84c0ecef-2959-4db2-8f74-6e659c1bbf5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627565, "uuid": "ea0a1411-eef2-47b9-a3e4-dd5e346c1bc9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affdd1ef-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676637812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637812, "uuid": "542f2dbb-d420-4a4a-abc8-85c416cd03ba", "comment": "Malware payload (Mirai)", "value": "6877eda43e95a070c2d797bc60d0a1ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637812, "uuid": "7ff51747-44c2-408f-8c00-114b3924c679", "comment": "Malware payload (Mirai)", "value": "ea15263f8206280e212f5455334dfdfd2c2a76302fa53f419d55e5da4d337d9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637812, "uuid": "c327b352-a001-48e6-9fc1-041fb0d8e0c8", "comment": "Malware payload (Mirai)", "value": "03e159d9d263c61b1f21b5793594ba1e3916db78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637812, "uuid": "86068ba0-0ce3-4daa-bc69-f5c8ab16f91a", "comment": "Malware payload (Mirai)", "value": "aa773dee80e163ffc2529f058beff708e175905bf25bee957cac86a46819b35b4ec92fc1de0522ed1b32d880e3c0a719", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637812, "uuid": "f3f9f43f-b526-44a9-90c6-f48642b6f688", "value": "T199436BC4F643D8F5EC8715702077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637812, "uuid": "00c75751-223a-4967-a8bd-53214bf1b90c", "value": "1536:JeESt/basV2rcZhG6ySN7naflSR9zWOIaEjrqMvs:JeESt/basVTgS7nafQRVtXESE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637812, "uuid": "7baaad02-752a-410f-9d68-956c28d67757", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637812, "uuid": "edd47f2e-1e0c-42dc-9e09-43b43aeb1d35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637812, "uuid": "8fc02777-5b98-4d96-9003-e7aa9673e85c", "value": "6877eda43e95a070c2d797bc60d0a1ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c638f665-aee8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676655029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676655029, "uuid": "562d3631-3160-4be5-9156-85c19b7ab7b6", "comment": "Malware payload (RedLineStealer)", "value": "763da57e529e9b862755a09cf031d8c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676655029, "uuid": "84e9dad4-612d-41c1-8e5c-d9602bbb5540", "comment": "Malware payload (RedLineStealer)", "value": "ea20a0d8b9e1cc9b52dc79c6f9b80a040b6a7bcece3c5a26a53f09c137763543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676655029, "uuid": "264bd5ab-312c-4aac-8d87-974bdda360a4", "comment": "Malware payload (RedLineStealer)", "value": "6a69c9abbc40ea708d0f48011aa005bf6c83a283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676655029, "uuid": "9df6a8f8-fec4-487f-a3d4-706be2078fc6", "comment": "Malware payload (RedLineStealer)", "value": "5fc3aca50d61581576ccaab8a05724cc7aba9cf43f678ca494c3e5d4e51287f3837fe02226b3af987fad3af8bf086c8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676655029, "uuid": "575403f6-c7ac-4149-9648-7bb4cb834a43", "value": "T136F4120BF7E88034DAB5677019F712C30936BDB09A355296238F6C5A0D736B4B23676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676655029, "uuid": "e3bc7106-76bd-470f-a65b-49b20855b9dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676655029, "uuid": "994e06c0-c799-4927-ba15-07e2229e985b", "value": "12288:2MrXy905FTQ+V/iAvFDwJRL/Wr46sLfwCk3Pg1mAHms1nvGag9oc4hmES8RO:1yAJVKMKJRr/hftvj7nz2r4hm6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676655029, "uuid": "1c3ede5d-fe64-44b3-b793-e8bd58a00919", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676655029, "uuid": "2347183d-040a-4274-b600-e20a7a1399b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676655029, "uuid": "4ef5c4b9-6add-488f-b42f-a08386f19fc2", "value": "763da57e529e9b862755a09cf031d8c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88feb488-aec5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676639894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639894, "uuid": "58245334-7cc4-492e-88d3-c2559b338950", "comment": "Malware payload", "value": "daef140b315b98b953f3741c2f154ff9", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639894, "uuid": "ff48fed5-59d0-4218-a290-401b0a531169", "comment": "Malware payload", "value": "ec2ca037eafdbed5c37663629fd64d80b3a8c9e306d612add3ffc507b9f50c9a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639894, "uuid": "59eaa00f-adfe-49e2-b5ba-22a395ba6446", "comment": "Malware payload", "value": "9276159c6c2c022f94072df5c09c81b96762b14f", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676639894, "uuid": "39da7d28-6e32-43a6-b4a9-20f35e8c35c6", "comment": "Malware payload", "value": "bb7acbec7acdb81724ed06daa798e8c3fe182c933469ac4e4d0950de4a0281c9b25e8e8d46a15f95fadd2abd66ce38af", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639894, "uuid": "d50204a7-16e6-47d6-ab35-0343a7171bab", "value": "T1DEC53336F4BB79783641E7E24604C93A6BBAC35A3AFA37160FF49CCD912450B756C098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639894, "uuid": "1a713d07-618e-4573-a75b-b18380352ba5", "value": "49152:ijoGN5J3sAs+aa8d6q3RKNhvqa87NXcHnSySdkOFOd+LgEBHVCjzr1UET:ijn5JcAsHYqsnvqZ7hcHVSdkOFOMs6Hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676639894, "uuid": "4b36b388-b429-431c-908c-ddd0e4758788", "value": 2662400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676639894, "uuid": "928cb2b3-b32f-4077-9193-65442fc65f7a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676639894, "uuid": "27a84e7d-c73a-4904-aaba-01b7d9392d41", "value": "ec2ca037eafdbed5c37663629fd64d80b3a8c9e306d612add3ffc507b9f50c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35a9da5-aea9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676627940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627940, "uuid": "589790fc-358c-4636-8727-b68013487fde", "comment": "Malware payload (AgentTesla)", "value": "079e7547f11b77be3cd7c6722b81d2fb", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tbz", "colour": "#802FEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627940, "uuid": "f7bcffb2-e200-45c6-87db-5b629039fd0f", "comment": "Malware payload (AgentTesla)", "value": "ed2e378cae7ebefd436b04d896f55c4a79b319c4c4977d27a7e194510c574206", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tbz", "colour": "#802FEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627940, "uuid": "0a17bd03-d47b-4d5a-9447-3fc3039c8941", "comment": "Malware payload (AgentTesla)", "value": "f50a17a231250434fd916e1005b4915f22a192c4", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tbz", "colour": "#802FEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627940, "uuid": "3552316c-c216-4d39-99c0-8f37e68b74e6", "comment": "Malware payload (AgentTesla)", "value": "1c927ac6058bfa940a3aea7d26ff2aa4745a28c1439ef62bf96753f13bc67b9baa9e7539458ffa2dc4522bcb713f8c4c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tbz", "colour": "#802FEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627940, "uuid": "cdf3d118-5218-4443-8e48-f21117b4cc79", "value": "T176C423F03A36D9D48216F53199F63591CC3AD6EB19D49C09ECC178DD632D821AABDC0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627940, "uuid": "455779db-8037-48dd-b531-cac147e4b97f", "value": "12288:PY/C8mrvqgUiqfLenBwr3TI503KMaFi3csJS3KJsI/kso:PY/93SzBwrk50Ra01JSaVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627940, "uuid": "213dfd23-d6e4-4bd3-9551-7bc65173c8bd", "value": 553985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627940, "uuid": "75b50aa3-5896-4c28-a8c2-b1abfb440811", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627940, "uuid": "3b94224d-d3c0-4171-b255-1f6ab4ab3059", "value": "57m\ufffd LPG SEMI TRAILER 7 NOS.pdf.tbz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9daac26-ae80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676610314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610314, "uuid": "ee19ff39-978c-499b-b4de-4b1297aaa877", "comment": "Malware payload (Amadey)", "value": "ef5341ab3b9405b415834142c41d9531", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610314, "uuid": "83681cd0-8828-4668-98c5-1cf2528b019b", "comment": "Malware payload (Amadey)", "value": "ee1ac506c4aec2ed3c420e812c721c2817b86f362a97929714de529997a23570", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610314, "uuid": "ebe2e657-871d-4951-9a89-07f4d449a2c2", "comment": "Malware payload (Amadey)", "value": "0e0c78934f4fe7ec49f2eec924432f149802de56", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610314, "uuid": "8cb14181-ea9a-4bfa-a2a9-010b1cffcbd7", "comment": "Malware payload (Amadey)", "value": "517597cb5138ef73fcc08f2e14931ceaf0fd0c978206faf17a315dadbcbfc3ef5ca7abc8887807ee09fb550e0f97a036", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610314, "uuid": "94192fe5-d3c3-4901-9768-fe020712663e", "value": "T12B251217F6ECD126E8A18B7168F103D30B327E515775C3AB32CAA84A4D727E1667132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610314, "uuid": "7dbdd4d2-5c0f-47aa-bf53-80dcadcf8580", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610314, "uuid": "af86ac76-c939-48fa-bab0-6094a9f3f2e6", "value": "12288:XMr3y90vVEYrcfrD0IlmCCVnF0Li72kS6MjniP2g6G2TIqzEGhj826aQnV+PdDFM:0yQVg305N7Ghgn4IqzEGdN5FxSY2NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676610314, "uuid": "903b0911-fc62-432c-aee5-29679313ac58", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676610314, "uuid": "406e341b-8ac9-4fb1-95fc-a835945fac0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610314, "uuid": "9c6da586-1b83-4773-a0c2-28890d0500a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb263ef-ae9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676622989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622989, "uuid": "193856d1-3a7f-4e71-993b-601f8ff12730", "comment": "Malware payload (Amadey)", "value": "ca7ed202486fa1519d565dedd62d9d67", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622989, "uuid": "f00561e8-8f67-4a0d-8629-d0db5f67f93e", "comment": "Malware payload (Amadey)", "value": "ef1865e85b00fec50f43b349a979098ddd8332b63ba9c292ee8f5151afc5bae8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622989, "uuid": "0f0fab85-7997-4b88-9047-ae421e380e8c", "comment": "Malware payload (Amadey)", "value": "74ad9e30a7b61a35a7c36fb1170be2ac4dac5430", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676622989, "uuid": "2c19af2e-f5fb-48d5-a706-d59fe5ad4fc1", "comment": "Malware payload (Amadey)", "value": "6148d3de605a580fdd14cb89eb651b86f4a0737db79e0c0c391867091f56d94275644a855dfd4137df68660ce1abd59b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622989, "uuid": "5043716e-c2a5-47b3-bdec-185fbab67f37", "value": "T12625231BE1ED9471F9759B7008F603C322357CA16FB8429B238F6D5A98726F19530B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622989, "uuid": "e2f3f7c6-546b-481b-8c2b-4172b2000fff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622989, "uuid": "20b79e47-a4e6-4d46-ad24-e0e21369a6c8", "value": "24576:SyuciTHExscbCrAGIkIV4ie5pBEi4FJ7OJG:5uciIx9bChIkIOzBGHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676622989, "uuid": "a6d7f418-d466-4477-9300-6d0d4c6cfd36", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676622989, "uuid": "eb65795d-a61e-494b-9fec-7373aff154f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676622989, "uuid": "3e1890b6-400a-456c-917b-6e86de3757d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cf4a53-ae5a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676593745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593745, "uuid": "21354231-3247-4910-b08e-ba5cbe9d6d1c", "comment": "Malware payload (Amadey)", "value": "73421b4d8d2d70c4d82ca7ef7b948b05", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593745, "uuid": "1e3a5174-7d1a-402e-bad6-7f7e413747e6", "comment": "Malware payload (Amadey)", "value": "ef3d7c0488b34c13b797946e6fdbd74a8b6cf2bcd3be296e25dfffa1930d4c24", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593745, "uuid": "57c02ba3-f49b-4fcb-bb0c-21b99bcc4b33", "comment": "Malware payload (Amadey)", "value": "bb02ca29eea153c7bb7f6fd4bd32d641b560c7ef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676593745, "uuid": "0d28a25e-8382-4705-92f1-d758d6558663", "comment": "Malware payload (Amadey)", "value": "1b8a5cc340944e9214728d5dbe1eb94678afc6ab962ff3364958fd0e715f75c48952522f08f3f714b9219b7ca8a91c11", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593745, "uuid": "a1210ddb-f7cd-4d05-8f32-40518b29177a", "value": "T1FEF4120BABFC4067EAB21BB419F606C3097A7D545A7D839B234FAC5E0432674B572327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593745, "uuid": "0796dc3a-b675-4ece-b4be-f2dd2e4c639b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593745, "uuid": "98c69ec5-463e-4fa8-a435-f67171e089cc", "value": "12288:iMrFy908knDgcpFMfy0ALdmUqWXOdTIhdHaWOkipXFc:nyBHy0AsqeKr6uqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676593745, "uuid": "e319fec4-f5de-4a14-9bd3-e199fe4b10bb", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676593745, "uuid": "23765a52-4602-4fa9-b2eb-218f47b3f11b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676593745, "uuid": "a9179808-eb70-40c0-bc98-3238193c9301", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b71ad91-aee8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676654904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654904, "uuid": "790ea0b8-3e78-47e1-9fa8-e318647eef70", "comment": "Malware payload", "value": "30d004613e281a04d15d0dcbcffbf25b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654904, "uuid": "d30a37d3-5847-457b-8965-d54f43773548", "comment": "Malware payload", "value": "ef99b856bfbca0332ad4d34d0c19d3829a5341cb2d43555be92300dec607c2a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654904, "uuid": "55f657e4-6916-4f5f-9268-539f135c8f0f", "comment": "Malware payload", "value": "1061841829c167a657ffc52e3c67fca4b435a9c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676654904, "uuid": "5ccc983f-22f7-4810-b05c-6e4f30e19cbb", "comment": "Malware payload", "value": "a0749e5565577df8d2ac1e9e2d67b20d344ff0e3a10929fe5f60db40d16780821f8f9ce22f6b0f6ca66a3f3fa8e71b70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654904, "uuid": "57df12a9-7e71-49ba-954d-a6a47d18f35b", "value": "T106949C24B3408035D966007AAAAB9BB285AC68701B5167C7FBD04EBD1DF13D36B3634F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654904, "uuid": "787205cf-92ea-4300-94b4-cd9cfa16feb5", "value": "097b1786c0f2d41a1378ec10039d2bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654904, "uuid": "78703b7a-1270-4474-bbce-a306a7228a26", "value": "6144:E3Tda56R/joxZWiT2XVAMVg8SyyEmWfB+3DvGoDU/mr:E3To56ljo+iUKM+n0fB+3jXPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676654904, "uuid": "15849cf7-efb3-43f9-97d0-927a0a740fdd", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676654904, "uuid": "d94b0401-5d4c-4869-87cd-44721b677bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676654904, "uuid": "65312bb1-08a2-4793-b2b7-4f0f0e4a0f43", "value": "ef99b856bfbca0332ad4d34d0c19d3829a5341cb2d43555be92300dec607c2a3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84738bff-aea6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676626572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626572, "uuid": "75e91f07-811f-4d40-a1e3-e469f6f527a4", "comment": "Malware payload (AgentTesla)", "value": "13ea6b6ae351e51bda02b172030021ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626572, "uuid": "4fc2a56d-8181-41df-8ad4-96c40d901eab", "comment": "Malware payload (AgentTesla)", "value": "f0973d03b28daf0f2b99a856a70c3944a43f091846dcd71cf757283fd4cae983", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626572, "uuid": "b36bbca3-4f5f-441a-9840-6c967c7d88eb", "comment": "Malware payload (AgentTesla)", "value": "0f31dcbea7d570bd456b47798e793d9004d75769", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676626572, "uuid": "a4f16ae9-dc53-47f6-a0e8-40655e973724", "comment": "Malware payload (AgentTesla)", "value": "b4d439e166fea64a8cc5a7f5ff0cb57e75bc688daa95b5d89837329fd57c19d764c1687c96feac74a77552ea021569e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626572, "uuid": "fe320a8f-8aba-4b29-8d6d-ab1510759d3f", "value": "T1EB84234FBD4AC9DCC47C2D1E25D1CA03D8D2061A275265F66E90A1E60E37FBC5BAE2D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626572, "uuid": "481ec591-cb37-4e89-8cc5-978f7d3a4b99", "value": "6144:C/jUb7mTTBtxRWsPra8V36Sz4JqpHGLyyI42MwIjoVS3qlRaKojDmCsas5ydRU:CrUbqTBtx5Pm8V14JqpHGLyaZzx3KY5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676626572, "uuid": "c12a8b8c-7ba0-43d7-9f9a-4ea0bbd65075", "value": 391034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676626572, "uuid": "2c9ab87b-249f-4de9-bb33-2cfc2d11fc72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676626572, "uuid": "676b0328-a038-48d0-bc3b-392d31aab19b", "value": "PAYMENT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c627e88a-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627542, "uuid": "662e271f-1d81-4d41-92c6-9ffc1124a994", "comment": "Malware payload", "value": "3c0935c746e1059fd8bd966d4cc3d659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627542, "uuid": "f9522a4a-2d46-471a-a8d6-157ba0f24896", "comment": "Malware payload", "value": "f1189ac8e2b2db653d8f4e27715ee1eead991d43ef8b4bca4536adcfd9a2e569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627542, "uuid": "2aed50c5-1fbd-47b1-ad06-8540d213475a", "comment": "Malware payload", "value": "e269322c0e5ca4cb80eff189c852de03fa3ba252", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627542, "uuid": "5b43bae4-c782-41d3-b383-e71999c16330", "comment": "Malware payload", "value": "ec1c0234fc76af20f2899ae5ae1bd967f087a57b92e3728f36e7573088787d036d922696a0b6d1755bf38803b279852b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627542, "uuid": "89f59510-d163-436c-9cf5-fb3f9098c13a", "value": "T18515125FABDD4032ECF41B3059FA02C316363E265E3482AB965AA55A4C73274763373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627542, "uuid": "0fdcb4af-fed1-4cb6-b595-d32579e02647", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627542, "uuid": "2d7500c9-8f50-4f16-8923-366ce2d68d75", "value": "24576:xyfs17MjnzIDDKKk9Ox2TvHl67lsUNu/2YcY:kf4GshiOxykpnu/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627542, "uuid": "73b9595f-d976-4c5b-9091-b83e5efabe45", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627542, "uuid": "30a1576f-1066-43c4-b868-52cacd1f2f8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627542, "uuid": "bca3ec93-1670-4448-9862-6dfff9f10c22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c056fcb-ae82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676611069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611069, "uuid": "07939433-b87a-49d6-995a-08acf8042595", "comment": "Malware payload (Amadey)", "value": "231b690799ad6813f7ec314791e8d893", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611069, "uuid": "f2d4ce53-3a3c-45f6-95b3-351d0b68e33d", "comment": "Malware payload (Amadey)", "value": "f14e0d6c49c828680bdd7df66ffd87931cc64874cf7bd174d482885e47f8a8f3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611069, "uuid": "66b2814e-3f3d-4bed-902a-000d3e7bccb5", "comment": "Malware payload (Amadey)", "value": "207df594350f08e3633256de4a61c8f9b95b1237", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611069, "uuid": "45f73cda-70ce-4266-ae3c-bdd7589c546f", "comment": "Malware payload (Amadey)", "value": "7e5846494f4b313e304dae913600915bb5e334c082ffbb5b2ee501e8c1bda7826f9196ed1185c1b754411a4e883eba93", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611069, "uuid": "a5198e89-5819-4a20-9da6-d192bd89a218", "value": "T1FC25230BB7D88023E4A5973014F613D30A327DB16F75839A9B8F6C691CB3AB06579367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611069, "uuid": "2095e3cd-291e-43b4-ba99-5facca66819e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611069, "uuid": "ee3a6e50-ed4c-4ebb-aa7a-bc0bacea4103", "value": "24576:9y75/pctO2+GVkDAq7Lx0GyvheRHggYhdiu4:Y7stO5/bn8hwHgNhdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676611069, "uuid": "2bcf863d-e307-4605-b78c-015e66fcc052", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676611069, "uuid": "9b17625f-012b-49f7-8cc9-51f903ad1c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611069, "uuid": "fa554393-a0ca-4efa-9999-b8477048ab93", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70004c1a-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676627397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627397, "uuid": "6409e2e8-d248-4faa-a23a-ac31f916ea07", "comment": "Malware payload (AgentTesla)", "value": "b49a15d8f556296f1a33ea175fe300d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627397, "uuid": "eb6ba561-1fc3-4c67-89bb-46e6b7f90c55", "comment": "Malware payload (AgentTesla)", "value": "f32e1caa6c18c3e501b501693c27fc314bd34020e2bc4c8048713377ed31eff8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627397, "uuid": "5411e828-e3dc-474a-9e06-2b388b998fa7", "comment": "Malware payload (AgentTesla)", "value": "5c99043d49c57c8c01076347b5711d7e178a91f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627397, "uuid": "85171cb5-3ea4-47df-bc42-1a5ef8c4e461", "comment": "Malware payload (AgentTesla)", "value": "aef91746fcf6503d97a0f674d9c1c6c1eab15881650788263dec3e1c314f470183698c8ddaedc63023bde7d90823f6f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627397, "uuid": "1f474d6e-9351-4d45-a2ae-c59bdd11808a", "value": "T1B25423319930945CA029AF3BA421399193F9F91E87CA950025FBA0F582B7CCAC717D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627397, "uuid": "f618ecfa-79ba-4023-b77e-017192058085", "value": "6144:dIL7QUb9iBtP1UYtwXH44NCt5uT9jOgNKC3FTKK7vlpA919lU8GkmYw+cmD:d8MsAXPB34NM59UK8FTH79pq/GPb+XD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627397, "uuid": "a30a0ec8-929e-4a6b-9e66-8ccf5c72bd8d", "value": 305149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627397, "uuid": "0ade6b3a-559c-4349-903f-34a79db6d27f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627397, "uuid": "5633e220-9463-4392-8bad-9d33b261b15b", "value": "TT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffc6d62-ae8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676616579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616579, "uuid": "585fba3c-70d2-41fa-ae3e-4e5e2383ee37", "comment": "Malware payload (RedLineStealer)", "value": "15033967cb3d14ae4df634c5be248251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616579, "uuid": "881109ae-52f2-4b25-9c41-4b4a17b606b1", "comment": "Malware payload (RedLineStealer)", "value": "f3e0262bcb2eb5e0f3640c73ab3ec67b0cf6d90f3abf6eedf88ad0d0d319a40d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616579, "uuid": "27b5cf6d-039d-458e-97d7-2e56cfc9652a", "comment": "Malware payload (RedLineStealer)", "value": "90ef9b6d32cc5b087574e951d117e2905a3c9424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676616579, "uuid": "e80d23cd-03fe-4041-9178-88547a6272f6", "comment": "Malware payload (RedLineStealer)", "value": "5431bf22d069b81531b96f6edf55e8687a006772b343ce7d0bddb9c3c2806171abf76f4d5e3a6fec3a5d18f60b063fbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616579, "uuid": "d5dd588c-dc34-4c53-b85a-2c33781747de", "value": "T17AF41247B3FC91B2D979A3700CFA07C3173ABE6069744387268AAD590D72664B931737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616579, "uuid": "f9d90737-4c30-482f-9f04-078d7eae12f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616579, "uuid": "622d8295-72ea-45aa-b4cc-70e58f01e35b", "value": "12288:RMriy9032UV4ioi8kJvH4rabdeWEIFlPQ99oIth/7sYZQRPlGHPLEg:ny/iR84wWaYO9im/7sGQRlGvLEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676616579, "uuid": "0b887098-d7c1-49e0-b9a8-2c2358fae4d2", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676616579, "uuid": "33445d31-7bed-4f10-a8ff-f014ab101d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676616579, "uuid": "b0a024e6-4fa5-467c-bfbb-3d44b8f02beb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec88e99-aec2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676638455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638455, "uuid": "477cfb82-aa1c-49d6-a3f2-4892788042b9", "comment": "Malware payload (RedLineStealer)", "value": "625860d1ac4ffd2fa470bf85fadae44f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638455, "uuid": "31ce6132-00c3-4946-ac51-163bf195e80f", "comment": "Malware payload (RedLineStealer)", "value": "f3e8d982921d103d8c6e939a826f146205cb79bc3004ecf35e6dc8aa1321e80c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638455, "uuid": "bbfd2233-e2b6-4038-878f-7920496b367f", "comment": "Malware payload (RedLineStealer)", "value": "f1491369cb4090469b55e640304c9bfffad3be89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676638455, "uuid": "32405d8e-dd4e-4e57-bcaf-b6ecdfdaeb54", "comment": "Malware payload (RedLineStealer)", "value": "970ce1a7405dc4fe5a6a0816625292cf5a3b4fe7a4f7930c0956f73a9d49e64b0ede0508533aaeb49d97b86f118ac8ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638455, "uuid": "f8f9bdfa-74ab-4da0-b2fe-9bdf730024a3", "value": "T1DF25224BE3F990B2E970577068F713C315327D626A784BE7064E6CA91C22AE0B53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638455, "uuid": "332e0555-f01b-43a9-b14a-6514281bdd23", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638455, "uuid": "efb95300-c00e-4595-ae7f-d5944fd77f6e", "value": "24576:PyOnV2jb+xrkpf47xG8QW1YGPFgvwbMSFKZ:a0ojyx17xG85YGNgvhSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676638455, "uuid": "ffcbccf6-4732-4fc0-a507-29e317c86bb6", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676638455, "uuid": "cb0fdfc3-7425-4489-a723-0424dd717205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676638455, "uuid": "1c2c607f-641d-4469-a1b4-841af66c4f42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1c1c5f-aec0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676637910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637910, "uuid": "f6fd0688-6d46-496b-86fd-b254775e4a36", "comment": "Malware payload (Mirai)", "value": "4b4bf1fe4e5c313684feee92a503aaa5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637910, "uuid": "58e6ed26-cb21-44bd-b6f0-d43be58d32ef", "comment": "Malware payload (Mirai)", "value": "f458079aa47ea1b6cac1554afdf8730341ac272fc3d025f07b09149c409749bc", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637910, "uuid": "ed9f17fa-483f-424f-9851-f9c7d75d47f2", "comment": "Malware payload (Mirai)", "value": "dde5db16401ba991591f66060075fdb0c58cbe53", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676637910, "uuid": "57b5744a-5d60-498f-beb3-82432e405090", "comment": "Malware payload (Mirai)", "value": "638b1fc3afabad007605d375a053d488781f6dfc88364d636d1c274fba4b6e42ca82dade61c6ed839b954a541307306f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637910, "uuid": "e2833ab6-2ba7-4189-84af-c9ee5052896a", "value": "T1F0534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB262C96D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637910, "uuid": "7811e599-0818-43b1-9825-077821a02bf2", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQJLiKimfFoktCe3fYRMm:WShU3q7cEDlCK/0Dh9i8Fok06fYRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676637910, "uuid": "18595779-a9ec-433a-aec8-6f931e688cd2", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676637910, "uuid": "49765b1f-1318-4d98-88b9-9c1c8cb21d33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676637910, "uuid": "f34d5ffa-9b62-4f7a-9a4c-73d8343d3856", "value": "4b4bf1fe4e5c313684feee92a503aaa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da70c72-aead-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676629406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676629406, "uuid": "ca1d2b1d-025c-4f6b-bc5b-69ba95e692fe", "comment": "Malware payload", "value": "9faddd060caaa8f6b2c285225e9d0fb3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UNIBO", "colour": "#1AA4E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676629406, "uuid": "70fee1c8-303b-4fd4-8a57-cf4d71f2bef9", "comment": "Malware payload", "value": "f4caaca12511a364005bffaedeb802d4388e16f1bbf564386760619e9a15dccc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UNIBO", "colour": "#1AA4E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676629406, "uuid": "e061789e-b935-451a-8654-6f9cac69944e", "comment": "Malware payload", "value": "cbe69cca8e39b881847a03a8f1214412d2c3976f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UNIBO", "colour": "#1AA4E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676629406, "uuid": "a5c3cfa2-193a-48d6-9f4e-1c3b001a596a", "comment": "Malware payload", "value": "346b546926ae1a53d5f988709a545d3945822a555417fd3f616b5f92450e4fd9cdf9a7b72165aeac51e6ae4e636097da", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UNIBO", "colour": "#1AA4E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676629406, "uuid": "c7f673d8-aa7c-4420-bfb7-edfaf0b69b4a", "value": "T15B52B5410BCDA8B6D364E173812A800D19BDEAB734571AD9B49DD4813BFD10E19FD2F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676629406, "uuid": "3b0505fc-5416-4c76-9dd4-5431844f3fd5", "value": "192:gmZETUg/uTVB4szEWH0yXJw4Sx5Z6lUMBruyOeq56KtgmFNwQbwMxmYYo7evUvB2:gbTYjfQWNwzCUMIyOeq+MgDomU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676629406, "uuid": "74a9852f-03eb-425d-aa4d-440f8328a458", "value": 13272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676629406, "uuid": "43dcddd6-cbe0-470e-b06b-9f798f10ce10", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676629406, "uuid": "dfb2321c-2e0c-4119-83da-0aa924877bc3", "value": "O_O.DOC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81ab68a-aeaf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676630605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630605, "uuid": "c4eb4e33-cdf7-4066-b7e6-75feae6d3b41", "comment": "Malware payload", "value": "011ea4103d6978ee3b21ce040f76f090", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630605, "uuid": "cf8c029e-79a5-4176-a242-d4ebec885a6d", "comment": "Malware payload", "value": "f522ebd86d4a7a6e41afccfe5ced54594f066005e862b7494a66ff7cddb2a746", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630605, "uuid": "549f140f-4369-47d0-85e8-6a9a170a0d93", "comment": "Malware payload", "value": "f36dc0a848df47aabf25ff1be53383b0c08351fe", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630605, "uuid": "d42bd4b6-2af7-4085-8e5c-1dd04aa4332e", "comment": "Malware payload", "value": "6c9dad5475b5757fa71cbe269b05879cd6b36684b136ec70029518b7e393abb5e7fff920bc6f5191c880fa34f82e90e1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630605, "uuid": "be181c4a-5189-4aba-a383-7c2e53acbdd3", "value": "T13BD2AF24CD4B6496D24B83B0E941C2B6E2AE94BEC1ABF07B6D5612CC8E47BF46513C1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630605, "uuid": "e074518e-806e-4604-8700-3e1a3b75037a", "value": "768:FB9+rXmRorwwg7mx56PPYzZDQLgHUCyqt:/HCgCx5GP4rvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630605, "uuid": "ca7ad013-9901-4d8e-b637-ae7630a52241", "value": 29856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630605, "uuid": "adfc1210-4d7f-4728-8bcb-f28980dad281", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630605, "uuid": "c1309890-e5a3-4a4f-a4d5-f6414d347fbb", "value": "2023\u5e74\u4e2a\u4eba\u52b3\u52a8\u8865\u8d34.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37275bfa-aee0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676651353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651353, "uuid": "fac7ac86-2b8e-41c1-bddd-5dae7681bdcf", "comment": "Malware payload", "value": "fb32e82693e98c895ca80081bc4a37c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651353, "uuid": "c8322dd6-872b-4846-912b-2e4f3b6060fa", "comment": "Malware payload", "value": "f680bbf5635010db185fe2eadbda4279eaee3a307670945ea1bca8b89085134e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651353, "uuid": "51c26d04-b787-4580-ab3e-ac4157d17eab", "comment": "Malware payload", "value": "2f77f7a0fea569ea1c5f03011fb2f64a991d260b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676651353, "uuid": "2b2dfedb-8b26-4fd8-83eb-743360f20531", "comment": "Malware payload", "value": "625a23f2823a01b21d042922df47e4793bbcf1bd10b94180a36cd5938d35624d5b7b00f1055bc1840a02293b312c48a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651353, "uuid": "a5754996-2fa5-4d73-a17a-a89968b68f30", "value": "T10BE3C03276D0C0B2D026DA302CB0D1A5AB7BFD515A748D4B3B98122F3F716D15BB93A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651353, "uuid": "15c8ba7b-2b2c-4fb5-b3f0-ef52af0ac40c", "value": "8cdad4eae189848d90763fd3d82d253c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651353, "uuid": "438279a1-f030-4c16-856e-35db0eb1daa9", "value": "3072:Og0tqYD8U2IO79ExDyBm7XFkqvcAs0Z/ZuJwuRVtdmkWm:ObtzD8tF9ExDyGiq0AX6JwuRVWkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676651353, "uuid": "777beb03-cf49-4a34-a711-9d44f0bd8e68", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676651353, "uuid": "b2c85c58-d099-4ee7-a44f-9a96956950b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676651353, "uuid": "5cdf5980-7030-4a7e-adcf-0a95aa376f90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1411640f-ae80-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676610063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610063, "uuid": "df01b18c-7c68-4f39-9444-ba7e04a6bbb0", "comment": "Malware payload (GCleaner)", "value": "3faf3ab3a7f511a727e9bd0d458575c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610063, "uuid": "a3242ef9-b50a-4f97-bafa-ff0c12b7e7c2", "comment": "Malware payload (GCleaner)", "value": "f6cf41d81be70a37e2e01fe2fe85fa63fd6a7be1aa6de5dbf2c78c098de205c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610063, "uuid": "21b97089-a157-4a87-b8e2-f02bdf835069", "comment": "Malware payload (GCleaner)", "value": "d407bd8bec722a8bff9e4e5a5bdcfd087fc4214f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676610063, "uuid": "003e5d08-5871-4ed1-ba37-5884151d9c85", "comment": "Malware payload (GCleaner)", "value": "dbbeb826d86d4fc63c0cdb12916c9c8e4ecb5829132a721d814e0ec9df0d9d5088b670337cab427a5f3fece315cd87bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610063, "uuid": "ee936120-85b4-42db-b46b-5989c7be0050", "value": "T171D522CA4815C4E2E7FEEFF2BC2E80B07997BE5BD5E41453705ABD2A763210E908D509", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610063, "uuid": "672bdd30-bee3-4d40-af5e-653add0350be", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610063, "uuid": "50cf7bfe-1d0d-4f02-a5b3-cf1d5f5314f6", "value": "49152:vNojzL5qeQ2FekbSvpog54TVKnNIfk5h2p2LWVbRiEOydAbusGxl7uLCgv2MR:Vojn/3RGKrTVxfgUILGLdHsGLOv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676610063, "uuid": "cedbb96d-0302-431f-8aa5-0351d6768350", "value": 2899501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676610063, "uuid": "4a06ea17-9251-408c-a1e4-823658105c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676610063, "uuid": "dcaa6103-268c-45d6-9106-b6660f8b6290", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac183b8-ae99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676621134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621134, "uuid": "0194ad25-5af2-48e7-ae54-254dc28db83d", "comment": "Malware payload (Amadey)", "value": "46180f1f3137f3faf88a9009a55f8ab8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621134, "uuid": "7a1097e6-fd2e-404b-8247-27b7579ac35f", "comment": "Malware payload (Amadey)", "value": "f6dbd52a15f0a610b4c39fc6237ca963a47070974580d8342fb9035d7b325bde", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621134, "uuid": "43d23593-895f-4856-92cb-50d6d863482d", "comment": "Malware payload (Amadey)", "value": "4084471ce42ec09603fdc99ad9018709cae3d6f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676621134, "uuid": "6c7d9b4c-038b-4f10-990a-912da8ffef72", "comment": "Malware payload (Amadey)", "value": "43ef457ea707aef0a054e9899f14d5fb17d29a09f2fa564b57db04eaa1dcb2500781f0727b5720aa8a62069bb7b5cfff", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621134, "uuid": "ef26515a-572c-4255-919e-fc0def964fe9", "value": "T1D625138BE2F88032F4B5577069F643C306367D71677CC347218AA84A2C526B5B772B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621134, "uuid": "e44cde14-b484-4f06-bafd-088406a62d86", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621134, "uuid": "49bd5a11-38a7-4404-afdc-4f81511ffee6", "value": "12288:aMrmy90ddMfpIJVSc/0+PYHixAMPu3o37YPym4M9XOn+ehxopZNV4rpOLgTLih4K:Yy8eHc96ixAs4o3Et4MuFhxCN+AeLiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676621134, "uuid": "084c70c5-8e6d-4d23-be78-ef1e08eed3fb", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676621134, "uuid": "64d6051b-2218-48bc-98d9-db700fbd8d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676621134, "uuid": "f18bf7a2-17d6-4909-bcc4-fd262d7fb783", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7db3d5-aeaf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676630644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630644, "uuid": "281da7f1-7c8c-4136-8573-5b601062148a", "comment": "Malware payload", "value": "b880eb81ec0cb442eada6e06fc7bfa1e", "object_relation": "md5", "Tag": [ { "name": "1676480611", "colour": "#574C48", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630644, "uuid": "5669b769-ae6a-4730-a6b6-ad1447e215e9", "comment": "Malware payload", "value": "f8360776618ae88f15187275a0222863ad44565568a71e02626a0ff351e3ef9a", "object_relation": "sha256", "Tag": [ { "name": "1676480611", "colour": "#574C48", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630644, "uuid": "b963eae8-985f-40b6-80e9-9e6b37b16265", "comment": "Malware payload", "value": "5ad671dafe9dd2a82f6e42b86dfb7e690c75d76a", "object_relation": "sha1", "Tag": [ { "name": "1676480611", "colour": "#574C48", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676630644, "uuid": "29f8f982-0c5a-4042-b738-93d2bcf2ac52", "comment": "Malware payload", "value": "17bce2c55c9c18f98549c7588eff63e39f794d71b922baff74d4c3311d91144f705d315ddf42cd414e6d1f2e90a97234", "object_relation": "sha3-384", "Tag": [ { "name": "1676480611", "colour": "#574C48", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630644, "uuid": "652468e0-a746-4d69-9258-230360dd1f51", "value": "T1BCF36C142778036BD3B82A77DEF7CD23A2B18A61BA518F5F9606520D0850742DAF1E7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630644, "uuid": "1c062ca6-e034-4c0f-a8ed-9292e60adcd5", "value": "3072:AKBpsk2g8T6AiLJRWKmjIeYKqx7tc7IwdUQqoo73B:A2pst6bDJeYKqkMJQhojB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676630644, "uuid": "709abc9b-34b1-4962-8700-61490bb664b4", "value": 158003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676630644, "uuid": "1bedc04c-c0b3-4ad1-aa03-df078d611ed3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676630644, "uuid": "19cd917d-27ca-4b94-8d5c-b114275f17fa", "value": "item.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deafc1d0-ae5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676596229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676596229, "uuid": "bcd0a88d-cf5e-437d-bc97-42cdbba270c9", "comment": "Malware payload (RedLineStealer)", "value": "c49c3a4edc722594b73050600fd16615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676596229, "uuid": "4ada4d96-4435-49fe-a0ea-4c9385d42c2a", "comment": "Malware payload (RedLineStealer)", "value": "f8b4d66229fa78229097f6fe903ea920177d6099457ec28898df5a1bea043e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676596229, "uuid": "551ee3ea-a242-4856-8458-12d414711df1", "comment": "Malware payload (RedLineStealer)", "value": "f2483b4f41f654819da81426fcbc5afe2ed9a4c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676596229, "uuid": "18c9a251-31c8-4bd8-8c4f-37e19de46ff2", "comment": "Malware payload (RedLineStealer)", "value": "3aa47e5ba5da88e8fa011363ec92cb35dc9850bffb674e6eead4011c609c8a0a01ed7e9368550d0a85f70d3a5c78ca62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676596229, "uuid": "2bec1489-f5e7-4f16-8627-212a120b0850", "value": "T14B25235B77E85023E8B04BB10CB252D3053B7D612F38929A274DAC5B09B36A4E73675F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676596229, "uuid": "8e83c66c-8991-4cee-b44c-4063e2052021", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676596229, "uuid": "f40ebc9e-819c-4707-9484-98a55fb099e7", "value": "24576:6yU6N8p0+n8U4MmHomq0x5XZoEnTEC8rC7aWt:BU60L8UvmomZHK1rSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676596229, "uuid": "29b7348d-6b31-4644-992e-305404d2f672", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676596229, "uuid": "869e8338-27da-47ea-846f-c62ac7ed31da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676596229, "uuid": "b139bc2f-6c91-4a5c-93b7-ea7760fe8799", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7185897-ae91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676617745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617745, "uuid": "aced55ab-8399-406f-abbd-c9634a102d5d", "comment": "Malware payload (Amadey)", "value": "c3029d644347840f4d30611581560b70", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617745, "uuid": "0404b0bd-3ec1-44d3-9500-116a63e569c1", "comment": "Malware payload (Amadey)", "value": "f92b4014f1d46ac848effd09a741dc0135a8d01433ba7cce4346c8235288b61d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617745, "uuid": "0fc1513d-b6fc-477d-8e54-244f512d8c6d", "comment": "Malware payload (Amadey)", "value": "7f365e857e4efe171762641a58fd990624b0908b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676617745, "uuid": "166ac199-70b3-4c4f-acef-a4448a7a993f", "comment": "Malware payload (Amadey)", "value": "b0306f6fb8604cf5a8d4fb5f4e4ba47456a1ef6f13d7f9a10188d5e0ea76da8320c3dc324adb2e1c414f67098b351552", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617745, "uuid": "1ab30eb6-e5d9-448d-86c1-ecba071e4813", "value": "T13C252207B7FC8472EDB5533049FA42C317357D606E388747168BAD5A28B2A60EA31777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617745, "uuid": "e4326c7d-417c-42c8-be4f-9a824e8940ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617745, "uuid": "d913b90e-03ce-4071-b818-ed8294c96a8b", "value": "24576:HyzVOOWC209C/LfE/4huJhQAETrpGxYXrz6:SzIN1/Dq4hsUMur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676617745, "uuid": "275349de-6b9f-40a8-bcaa-4ead65e6bb7c", "value": 972288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676617745, "uuid": "c8a6e874-2fcd-4dab-bc36-a9df3e4a5977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676617745, "uuid": "e4fc4619-76cd-4c7f-a12a-82c401bacc2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d484cc7-ae65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676598536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598536, "uuid": "1ed40df4-2661-4a2f-ab0a-c65642ca097c", "comment": "Malware payload (RedLineStealer)", "value": "4b6804f6fe01810e6a6e6b7422df8b21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598536, "uuid": "b15feb5a-6fd3-4f7a-9f25-0cdaac8bc783", "comment": "Malware payload (RedLineStealer)", "value": "f95a5b5f768aa5a32c9b4aa8396f8cb638e66749edffb61f9fb4ca43b0fc7a6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598536, "uuid": "81ec1306-854a-4cfa-8366-f44a47b9b7d4", "comment": "Malware payload (RedLineStealer)", "value": "60a31e6f50108873a35fa62693000fee49a3670e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676598536, "uuid": "b2314fa2-e4d1-4dd2-8739-6e2f51953004", "comment": "Malware payload (RedLineStealer)", "value": "0f924e74f54e76be402a3fc973c181968782702822d155985f66cc0aeaa1c9789fb13b6657a3354a6d87a3405008efda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598536, "uuid": "2f00b901-0802-4c91-a99f-d6645c6560e0", "value": "T195F41207E2EC5035E8B547B04AF647C31B317DA0AB78C39B275F299E0CB26549636B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598536, "uuid": "6c3e0f98-43bc-43d1-a78a-3530fd709594", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598536, "uuid": "642a612d-24b6-47cf-9e47-692132257823", "value": "12288:iMroy90i64sy5GMdOxR6aBwJ1Su+Yte6i4M/T8WPG/se:ayp6Pw3aB41SPYteYite/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676598536, "uuid": "a42bf7f7-7c78-496c-868a-cffc2c207599", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676598536, "uuid": "c31eec08-e636-4d2e-8004-a8845ae11418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676598536, "uuid": "6b7d7f17-3b81-4522-9bf4-a471cef293ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e1ac3c-aef5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676660297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676660297, "uuid": "d4eed158-7616-4ff3-bb35-b97cdc451da5", "comment": "Malware payload", "value": "ab06e4dde11ffb317aeb89273d80d2c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676660297, "uuid": "5d1e9f3f-a664-4f62-938d-955a42f2c0b6", "comment": "Malware payload", "value": "fa24d870f29ed0a8c8c911872870a66701bc9fbb5dc8bc73e15a4a021f2fea9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676660297, "uuid": "b8c7163e-d42c-464d-933a-1e3c025a43f3", "comment": "Malware payload", "value": "b1a22390b9408b751425ebf3d840ba0e40091143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676660297, "uuid": "ee889fa0-894d-4b2e-8085-f9895ba4ecbc", "comment": "Malware payload", "value": "faaa25cec1ab3f3a5932deb4b0af6c6bad001905a946f21e1fec58db565aec8b567c570cefeb4fb55c2502775917abfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676660297, "uuid": "1c0771ef-4681-476a-ba86-49db05c734a3", "value": "T1F6E53347E2D84022C8B4A7794CFF02D31F653F465B7947C12EDA888B2DE0625B2B5B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676660297, "uuid": "318f2940-2917-4df4-97bb-26ad8599dbbc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676660297, "uuid": "4f03b56e-249e-4b05-ba87-38df93b8e053", "value": "49152:PHLVIWq0HELIQdQHZ2+vY9XaeacuEnJ8lD524ZW/Qpxi22TtQHVUzYDtIPc+j5ht:TVIGZzvYBdTuEni2msQpeK1VID5hIRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676660297, "uuid": "da0a81a1-684c-4b79-ac21-eab42e348054", "value": 3109888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676660297, "uuid": "afa84c6b-ba8b-4275-8052-28fbe509480e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676660297, "uuid": "23389317-f154-440d-8cf3-58c009a001d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d60557-af01-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676665761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665761, "uuid": "10177e42-fbb4-4898-8734-91e8839ad94c", "comment": "Malware payload", "value": "3bc198313344369606703c1d7a5655cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665761, "uuid": "533b50c3-ad21-4a9b-9261-3047d65af747", "comment": "Malware payload", "value": "fa3e6032d134ef96a62d8bc0c83f91e0364719d3ecae4cbb2cd1def74d93549b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665761, "uuid": "8fc1f84a-d37e-469b-8897-97ea6f0294db", "comment": "Malware payload", "value": "c37d769ef1b5ac16f99376db066b0f2a032c9654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676665761, "uuid": "3f970c10-c631-4d3c-ba1d-edc3a3fff3fb", "comment": "Malware payload", "value": "454a619fbad745b2524b4fd265a952588ba5d46bb3106a42b279d93003e093389f7f9c6bd830b2c36aab39049490c611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665761, "uuid": "d587cc2a-fc2e-47d8-b248-437ca6ef3aa9", "value": "T1CBA60131E214B05AFCE200B6F5AB29FA65782630638148FBA3C17ED49AB17D1F539D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665761, "uuid": "93a3971e-06d8-4285-b748-4b4847e859e6", "value": "2fd7cedd88e8728d9e072a062e6e8708", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665761, "uuid": "6aab232b-3cf2-4c59-8256-7df25c1b7509", "value": "196608:qyvNU7c/899sZ/FSrB70py5HddBRAneADz89nMoHBowEIGmbwabVqGc:xvi9sZ/UbteDqnMohowbnbJZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676665761, "uuid": "e36b6fb9-2636-4428-b6a5-01c9c8a7e021", "value": 10058240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676665761, "uuid": "014ac091-8609-4041-83dc-23025208ce77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676665761, "uuid": "d3257412-cb78-4c92-a146-1c7075b9449f", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.25981.31147.15299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50cd026-ae98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676620748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620748, "uuid": "5a5cd275-01e7-44f5-b186-9f626f7e1c96", "comment": "Malware payload (Mirai)", "value": "ed53e64913c6b07bc839f0470d763943", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620748, "uuid": "8c139b91-8458-4872-868a-6509d0a07726", "comment": "Malware payload (Mirai)", "value": "fa8e89929f23618450d19a236daf776911a379767ac04a1d8b0a875c68a5ed1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620748, "uuid": "ffc1aee1-b878-44b7-83af-c558b2e347ff", "comment": "Malware payload (Mirai)", "value": "473f4257f8f0d1303c64c31c6d8e03773f40dc93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676620748, "uuid": "514f6c74-c0b0-4013-bfaa-71b3ab9af87e", "comment": "Malware payload (Mirai)", "value": "245f6483fa86b6faf523a327c7085907a51d43b3e74df08ca5387e3b5d0b47773df1a1a0021153cec81e1780c0168dcb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620748, "uuid": "12ba9097-265a-421b-b929-0ebda2481fd9", "value": "T1A203D651F8825A27C6E1137AB6BE4A8E332073E982CFB617D9214B107BD551F0D63F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620748, "uuid": "90c36bdf-f9e6-48d6-8cc1-83942a86e021", "value": "768:ZqILBdhxPh91eftcG5dm80LyFBWEu/tOr4MkKvlw9QSo8qMurE1Jomsu/NkwdkkH:c0zmf2G5dmSBWjV8kZbJqa1MuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676620748, "uuid": "db0e3efa-9253-438e-a73a-75c83a9944a2", "value": 38116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676620748, "uuid": "ac30c902-8c0f-48d9-bb87-7a1e3ff3826d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676620748, "uuid": "050383ed-1e46-4c5a-aa84-d25434f65367", "value": "ed53e64913c6b07bc839f0470d763943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15516b3-af0d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676670859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670859, "uuid": "94b999a4-3063-4760-b260-fadb031eb5be", "comment": "Malware payload", "value": "1233c99a083261ab5576bc340e384519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670859, "uuid": "dcd14400-3ea0-4968-a3c0-cfe65546d6cc", "comment": "Malware payload", "value": "fad013b8c29d73e3a970da6e7e5e0a778b04ab158949821e8025bd9aaaea931a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670859, "uuid": "da0bfda9-6115-4762-812d-bfdc7f4f8f41", "comment": "Malware payload", "value": "3164a49090aa17842bc21ee4b5d2d8e09df004dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676670859, "uuid": "10af47ff-900f-4a53-b15e-b596050ee091", "comment": "Malware payload", "value": "1609ef2410ea9b1cf3df438f1325adcc7ccbe9d9a832668392eed82a70b1ad926e9809fa270c50b5daa1add7a428d4f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670859, "uuid": "b74b086f-7cbe-4e05-b9cc-39428fba7552", "value": "T159E4124BB7EC8032D8B593701DF703C31A36BE506A7886A7274E9D661C729B46639373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670859, "uuid": "217590ce-0afb-406f-b469-a00cffca2455", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670859, "uuid": "466eed3b-4866-4cb0-8059-ec67c6a7dea2", "value": "12288:4Mr9y90nRgQKT0tUyJyS49EKB7UEXLjEZDZ0U1qECk9rH7g5LzADs6YTNC1qYOa:VyC8WUyJyQKNU4jOeUqEyL/TNCQYOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676670859, "uuid": "d1158a63-cb3a-4d02-bd25-74927dfe7069", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676670859, "uuid": "3df2276b-3f51-462b-9a60-f29f9d8bd938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676670859, "uuid": "3774bcd7-411f-4e85-89d4-ea4e4bb8ed88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1dea0e-ae77-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676606349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606349, "uuid": "1e16435c-0570-47d7-a4e0-a6c45ad70cf2", "comment": "Malware payload (Amadey)", "value": "c684cb2275d89eb4cb2ef17e1a1e0839", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606349, "uuid": "98fa6f17-fa81-4caf-a029-e7700d6575cd", "comment": "Malware payload (Amadey)", "value": "fbc9ef5106fea83db1c8a32b0642f7ebbc426806d791d02d8fc38903db93c0e3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606349, "uuid": "bcf29d5c-14fa-44a1-af20-5d9f8e9a4ffb", "comment": "Malware payload (Amadey)", "value": "266cd781acb2781d9d5c6de97dcf9c66be4650e0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676606349, "uuid": "8ef54a2c-d160-4065-b7d2-2ca174236ca0", "comment": "Malware payload (Amadey)", "value": "e6ae207487e2fd772f70e8eaea3f6c7195ca996d93d2040dfbcb62c8401364f4d2b1d9eb69eabbd9ccffa7998bbcb53d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606349, "uuid": "c6c65c95-4017-4b6a-9c69-d9ac811e0f53", "value": "T1D2252346A6EC9131E035577409F346C30B3BBEB05A38C78BB64D5D5E2872AB0A638777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606349, "uuid": "8c3c2a0e-19f9-424a-8a0e-a8af40653443", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606349, "uuid": "143ec219-2949-4a7a-b5b8-45842bddb496", "value": "24576:TyYXpXoJBLohy8euvasrBmD/WjKtPsTBab:m+YJBLueVU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676606349, "uuid": "c9e15720-1dab-4715-bf21-b0130269636c", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676606349, "uuid": "107444b1-809c-47a8-964a-79020ad6f020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676606349, "uuid": "c084ead2-f3bb-4b61-a897-99ab91719c70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c424526b-aebd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676636558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636558, "uuid": "827f79d2-2d77-4678-ace1-2b4c685cd521", "comment": "Malware payload (Smoke Loader)", "value": "af920d0a81896a09026eda5b84d1721c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636558, "uuid": "ede45645-798d-4f25-8aa1-8931903f6f2b", "comment": "Malware payload (Smoke Loader)", "value": "fbdbc8eead18e80d371843c359ba6ca2122a4e44205bfc7db4f4bf3d130f8e8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636558, "uuid": "32ec76ff-3cda-449b-9571-97f139058783", "comment": "Malware payload (Smoke Loader)", "value": "a51ab9127380f691274c1256d86ae328ca9994d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676636558, "uuid": "58a8ec6e-5eb2-4c3e-8db3-58e2e31352e8", "comment": "Malware payload (Smoke Loader)", "value": "35a7b3552563e7118877d84a7ab2a5e082d107e1948a8b78f9944daf85fd1bcbfef551382e043d5587b3a9ffd2915e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636558, "uuid": "caa4a52e-0705-422a-8a46-2daf3d3a4430", "value": "T12B14D0223AC9C076D19316348DA8E6B29A37BCE04675CDAF3BC411AE5F753C2DB24356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636558, "uuid": "517cd530-0f99-44c5-971a-859720ee6934", "value": "31111ee2beeeebc1d1040d6c5884273d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636558, "uuid": "928b9921-812b-4b19-b739-da45c426de70", "value": "3072:ITVp9uuCYJ1hg2TN6eqT0lN9pU2SP/uUVmQOqmHrx:Ippay1hjhF3j62SPWUVm7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676636558, "uuid": "a84fef8c-c8f5-4d1e-99e4-61dc26ccf612", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676636558, "uuid": "4f5df8d8-5998-48be-b2a6-e218ecefc22c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676636558, "uuid": "e61d5728-a175-4b74-871c-7ca407f0a34b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94856739-aedd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676650222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650222, "uuid": "5ca0fa48-3c4b-40f3-82ef-c8ba3e299284", "comment": "Malware payload (RedLineStealer)", "value": "00e7e51da95fd3b2a0508a222ef787c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650222, "uuid": "868a1524-8c15-4d97-85dd-b5db09b50461", "comment": "Malware payload (RedLineStealer)", "value": "fc11c7743ee5d510bb52732f41f0ba40be8da3be2d820cf91a0774d575f11434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650222, "uuid": "b88864b9-c570-43bc-b113-e542e6a96e86", "comment": "Malware payload (RedLineStealer)", "value": "842239b1cc5432ba5886689c711838703ccf4a9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650222, "uuid": "57c5b565-5668-4daf-81a7-ef097376d117", "comment": "Malware payload (RedLineStealer)", "value": "223afc71bba192401b8746ad4afdb1e2b3a7fb92efe2e75d53b9df6ea4f1518c1722bcdb0ba910e50b5c4bb41e82647c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650222, "uuid": "fe27ee48-cae1-4b8a-81c3-beadec01c45e", "value": "T18A45C031737A9248D86A47B10D7A91D113B73E6E7A04CB1D288A3B5DAE337234711BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650222, "uuid": "eca7d6d3-48e3-40c9-b2ac-abc95df8c468", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650222, "uuid": "2c4a82e4-8476-4f62-8962-bc66c923ea55", "value": "12288:qBlOKQPY/DgK8RP2Ts3rdGzQM0A84VNj0YzhAen+TAgbM1xnFLAu1PD6gEAmD:u4KQPSDBouTq3hA3V10whAe+liueDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676650222, "uuid": "3cf94910-f8f9-4630-ab04-894efb653cf3", "value": 1185664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676650222, "uuid": "db20c12f-b073-4e2e-ba49-f40906b8fe29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650222, "uuid": "db5ab6e9-470f-4749-9a1f-ebb4e176d976", "value": "00e7e51da95fd3b2a0508a222ef787c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f304f9-ae7b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676608264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608264, "uuid": "b138790c-a5a9-4d06-a7bc-8c026c41367a", "comment": "Malware payload", "value": "beb5f18b08213b1c3703a7b3c562329a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608264, "uuid": "31cfd47f-aca1-4388-97f7-4c39b1499fd6", "comment": "Malware payload", "value": "fd0b0fc271ff762c1a7ad826d4e2377c9bc5c4d8e75701470825af958d72e0d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608264, "uuid": "cdf425e3-d5ce-4f47-b80c-9458e1cf668f", "comment": "Malware payload", "value": "dc1ac15a288df98a5983a7795be9c501375e53b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676608264, "uuid": "0b05347b-bb1b-46b3-aab0-0b528d29da7f", "comment": "Malware payload", "value": "bd7c0500336cb2853daf45c15bf3e6615e71f2c29c39078c1c6b68e65af6368ec6c8e27187cdfd7369891619a4d0f287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608264, "uuid": "76566543-3654-4fa4-9e0c-9c82241ee4b4", "value": "T134538D167CE1C073C45364B06074EBA29F7D5A311375D88B0B6A6939AF703E2A3B635B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608264, "uuid": "6532cb54-32ce-459d-98e8-375d1f32eb21", "value": "768:q8S2u9c2Zi2YBVicYYIFaPz02mhhL4Mda3LFLxOBUP9E6iAEIUDwQ4T0g7:qbRt0cZq0hL4Aa3LlSUPy6ipwLT0g7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676608264, "uuid": "50a4cf21-363c-46d3-b9c6-94dcfe39817d", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676608264, "uuid": "05478af4-609b-427a-84ab-3ab27185ac84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676608264, "uuid": "f461e65f-4412-4def-b8d6-3c4c22297639", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab49582-ae7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676609054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609054, "uuid": "4e4717ab-79c6-499d-b667-7cc27e703aa8", "comment": "Malware payload (Amadey)", "value": "48e5fecd0e2157631f41108d041c67ca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609054, "uuid": "0e0cc34d-055e-4d8a-be0a-50b090add2b0", "comment": "Malware payload (Amadey)", "value": "fd1a0922eca447c97dcee38fa96a88ff987107c2b35fce83a830f7f1d2a414e0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609054, "uuid": "76ab537a-11d7-48fe-b729-63a625736662", "comment": "Malware payload (Amadey)", "value": "24a239afbe8a637151b29d3f219848a66de4193b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676609054, "uuid": "43707d4a-d5de-4bf0-b3b3-378180c73150", "comment": "Malware payload (Amadey)", "value": "f6d8275f44e8aef623882069495fa41ef18f8433209e5f50fac0f2368ea485e4155720f36f40d684f106b739c273bab7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609054, "uuid": "23ad4572-fa45-498c-8c1d-0562fafb13cb", "value": "T194152247B7F84132F8B5937014FB02D32277BDA18639839A664A6D5E5C722B0B6313B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609054, "uuid": "fe9caecc-2d1d-4f13-a573-4058e846c909", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609054, "uuid": "d79a57b3-b491-4abe-9ae9-52129b4ca744", "value": "24576:EyRvx/QcAWZPZIwmT/IvGGNOHSa3rOSwb:TRN1plmT/Ppya3rO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676609054, "uuid": "3451afe9-b02c-418d-89a4-cc528c477150", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676609054, "uuid": "2225be7d-33b2-4b3e-ab3c-499c3c48907e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676609054, "uuid": "00185519-b334-420a-b899-07c1e8d4159b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f1ff86-aedd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676650299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650299, "uuid": "e255f81f-b0fa-46c4-bf0a-206179c5e4ce", "comment": "Malware payload", "value": "89a8a3110e1adb1958c9c750a8c42a3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650299, "uuid": "85371027-7d35-43a0-bc8a-fdf0cb8a61e3", "comment": "Malware payload", "value": "fe0af7fa6a03abf75d47059ef6c846638095f260f911bfab6945d2980c98d289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650299, "uuid": "a3b1d709-a3fc-4d91-a4c5-97858156454c", "comment": "Malware payload", "value": "566710c06bb7148c4ed2935d57b1dd4cb350127d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676650299, "uuid": "3a80a739-732f-4da2-8e66-89e04010753d", "comment": "Malware payload", "value": "03973834b3fa63d497fa95598c52348a3bf31346f7431739faadeead1e139e68d76025b452e115726de3dcaa7e7055fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650299, "uuid": "9d9896b4-40b8-45b3-8c9f-9910f7c2fff2", "value": "T1DAE5334175FC8131E4B013B05CFF46E30976BE63BC18565B0A49BC9E7D62AB07E742AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650299, "uuid": "f546f0bb-c964-4c05-ba47-4aa1af5e5116", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650299, "uuid": "d76ae304-fee0-42c8-a7ac-cb6e0f090728", "value": "49152:kngxx78HEbqI/CBcnLE3Z0xMHFqjP0zMMfN5CvaiRLXBJCI9fd6+s4gX4F7uqjMA:aWx6ybif3ZRFqYzdF8va6tJFJszkx03e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676650299, "uuid": "56faf8fb-20dd-483b-8a5d-6e06733cec97", "value": 3125248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676650299, "uuid": "8e2e501c-6909-4572-9670-41d6193775ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676650299, "uuid": "981215f6-4116-479e-b507-fb28d65c516b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aaea13f-aea8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676627334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627334, "uuid": "6ce38bb1-1394-4571-b2c7-fabad73afeb8", "comment": "Malware payload", "value": "5d51a0529768f0c86b3fe99d8326b845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627334, "uuid": "76ea8c44-bc4a-40cb-a37a-ac2b5a3eafcd", "comment": "Malware payload", "value": "fe7266a61f0f01bb5df4ad7bbd4fe1893b51790f6fd5e051796aec6c226be0d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627334, "uuid": "0189e52e-453a-4953-ba10-0f85f05d6ecb", "comment": "Malware payload", "value": "eb8bebd854feac7382cfbd92210da317401d2ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676627334, "uuid": "0db6fae9-ec46-4bfa-9d26-d3ed2791e30d", "comment": "Malware payload", "value": "d223b6b790fd0ee29687f3045d66ef216eccb4470306e15a0852786f1b0362117dd314edd5d1065e655c705bf726491e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627334, "uuid": "707209a5-9e62-4716-937b-d4fe6c5bdfb5", "value": "T113149EC1BAC8ACD7E515173885EAC32A2738F7C55B834B131C34B6351E837D1AE8B56A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627334, "uuid": "ded26912-ce58-4501-b89f-f1d8ca3d1e23", "value": "dae253036ba9d710a708001505bd2540", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627334, "uuid": "3a1bc655-c90b-4e59-b317-51a71b5acaf3", "value": "3072:uUzxT3UISURHbe8eOOUstKAMp3LtInQIuBMvP:RTk8wOOUswInpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676627334, "uuid": "6a891348-10b5-47ea-9435-a1707104eedd", "value": 206891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676627334, "uuid": "720850a9-090c-4867-b770-3a61c533606a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676627334, "uuid": "57c6b371-d29b-4738-8f7a-29e7982656c3", "value": "fuck.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cba300-ae83-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676611676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611676, "uuid": "a7ab8987-c111-49c2-8873-e89c5372702d", "comment": "Malware payload (SnakeKeylogger)", "value": "b202e3126be3e936e41cc9b9cdcb4ba0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611676, "uuid": "221f9494-ae54-422c-8041-990be2a017f9", "comment": "Malware payload (SnakeKeylogger)", "value": "ffe2eeba3c307df2994455331d6c7f19cffdcda1feeceb9ac50d519685f53c48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611676, "uuid": "96839d32-e270-4e44-bb0d-2a9d08ac5f10", "comment": "Malware payload (SnakeKeylogger)", "value": "184d199282085d263d0669f05d4a319da38c4c65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676611676, "uuid": "7e669e8c-6f6f-4078-bd49-a53cd0f528b1", "comment": "Malware payload (SnakeKeylogger)", "value": "0104477d6cda938e634949d30a8b098e2fb95c2e0faf3a50dd4e735f8ca50fa218715a6e172b19715e0af464e365c63a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611676, "uuid": "d19105fa-79eb-4ea5-a664-0d9f3e4c7a3b", "value": "T177C45B8CC5BD4211EAFD0F7DB19F29080DA0054A266D4D7B97E7F880E17326AB07EA5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611676, "uuid": "50f1c1ae-c086-405a-aa61-bad15a8204de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611676, "uuid": "2a9cda26-65d1-4bd7-889f-6041a81afa2c", "value": "12288:fGecesGv4jx/o/9zKoSS2m7CQbZ5+FRZHvLf:/cesGQ1o/Nbx2mtriRNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676611676, "uuid": "62c636da-c204-4ed9-9846-719f654cb388", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676611676, "uuid": "a01087d2-900a-4943-a21b-d3b98bea5271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676611676, "uuid": "de0c1a3f-0b94-44ee-81de-d7a8aa0b352e", "value": "b202e3126be3e936e41cc9b9cdcb4ba0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }