{ "Event": { "published": true, "date": "2021-06-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-13", "timestamp": 1623628982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "4d5c43fd-12ea-446b-bb85-6f89ba66d009", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0b7199-cc04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623560415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560415, "uuid": "657f2186-62f6-4ae4-ad2a-28d0f52d38a5", "comment": "Malware payload (Mirai)", "value": "4134171a4e3f4f6e50ef0204710d58ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560415, "uuid": "2ba286c0-ce49-49b7-a39a-bd370e217d44", "comment": "Malware payload (Mirai)", "value": "00bbe47a7af460fcd2beb72772965e2c3fcff93a91043f0d74ba33c92939fe9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560415, "uuid": "63223651-6b2b-41f0-aa30-b66c9a9d33b8", "comment": "Malware payload (Mirai)", "value": "d9df5ece188a4f9089146621f8696919de5279a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560415, "uuid": "7b09f23e-4f07-43c6-8625-1f6029ebcfee", "comment": "Malware payload (Mirai)", "value": "6170f168c49a369d064dc0d79bd2f611846ae2f1f0d054040c2adca56ad667970877f38f2b223c12897dd3a76829a271", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560415, "uuid": "b9b600c0-b51c-42d9-afd8-f94030a3f8ec", "value": "02733AC8A493E4F4EC28097C3177BB765EB3F23E612ADD9FD3945463A941B02D40A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560415, "uuid": "fa5d3a78-6f8e-4ba8-aa8f-4df00af2f906", "value": "1536:YTxV4n11/qmgH9oiYe0qiglo7JDf45laQ+k1lMrf8mySWgz/ayBWn8qnvBC:NXHxgo7JDf45laQ+k1lMrfISW8/ayBW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623560415, "uuid": "c03471ef-7ab5-4534-9270-a95e728f2e56", "value": 74908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623560415, "uuid": "bfdb20e3-edc8-4af2-8079-04c74deb5943", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560415, "uuid": "fcb7b907-d695-46e3-b5a7-a9afc4cf0683", "value": "4134171a4e3f4f6e50ef0204710d58ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67063320-cc5e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623599139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599139, "uuid": "a4d8e810-8cd2-475c-b7bf-ce02226ec9b5", "comment": "Malware payload", "value": "d6178a9f8e0ed153c4c7ba01c3c3cc04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599139, "uuid": "0b22a972-60fc-4217-8349-9dc5fd4e4b3e", "comment": "Malware payload", "value": "025d389b4f70f107e986c855f53196fabe42385ff87f0cc77dcc1b0471a3334e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599139, "uuid": "8ff46109-bee9-4619-9543-b8f8095d8322", "comment": "Malware payload", "value": "849c4f132d4a8408972ca9964ca9a9619944826b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599139, "uuid": "58d7947f-3311-42a3-9edd-bfa9aac6376e", "comment": "Malware payload", "value": "0c116e1a560f68ccb1b5d0bd0b315c3172b183cfa0fd6592b599ca1863e9c7636244dbb94955c196d8435be6f9e09976", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599139, "uuid": "ec46a41c-36a3-4abd-91c6-6b4b7f21661d", "value": "3D34D02F528A5734ED761B35C3ADC1016BE1F38631938636BE980306476AF9D3E6278D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599139, "uuid": "9e308fdf-41d0-416d-8a46-95cd82b4a638", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599139, "uuid": "682afe5f-0159-4c02-9c7f-93906a3de1a1", "value": "3072:R1LwkVJbIpmrNMwfHg/CaBJn819e6LHtr5SIAOijQaE+JQdOAAJ5qTs+/lXQZwY9:rESJhHgK0n87DptSZOG2fB/lXkz1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599139, "uuid": "dab0724e-749b-4829-89bc-53785182a01b", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599139, "uuid": "7e11fbe6-90b0-4955-a586-1d40e6874701", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599139, "uuid": "06c8f845-a804-4e00-8c7d-f9bf3630d023", "value": "d6178a9f8e0ed153c4c7ba01c3c3cc04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a8c131-cc0a-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623563111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623563111, "uuid": "5e53865a-0be4-4ee8-8d79-611f85b3f28b", "comment": "Malware payload (CryptBot)", "value": "d18dc9cf860133016c0c244b9ad579bd", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623563111, "uuid": "f2e39b23-3d48-4fb8-a075-703554f9c4e5", "comment": "Malware payload (CryptBot)", "value": "0329f707c1e908925f23bc015b422526620f308142a2e75df56257ac3aec4c3a", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623563111, "uuid": "77e0aead-293c-4daf-8c71-5b65085db1be", "comment": "Malware payload (CryptBot)", "value": "1fc0e27cdab3f5ff40cac4448f4023c0693ec071", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623563111, "uuid": "6518c3d5-0ea0-4f5c-b593-f1c7d9228447", "comment": "Malware payload (CryptBot)", "value": "6d03e09de87f47b24b7f01a55f6c1943366199e21b410779359fe38eccc485f20e966d0a71da3de939173f5e630aebe5", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623563111, "uuid": "aaf3af0d-752a-4df3-8fcb-5227ac2f22ed", "value": "B485EF22A599A633E269C3318DA5C97FD125FB640418890621DCEF7B7FA6143DB033BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623563111, "uuid": "1997acc1-db90-4ae7-92af-05df19b83aa5", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623563111, "uuid": "7a92e130-f578-46a7-9602-b3cfeebeeaa0", "value": "49152:cTu+qeLeCJ1rHwHaBwoOfPYDp4Ou9RxhEkplC2wZ:cTuHCJ1rQHMhOfPYDru9XhsNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623563111, "uuid": "3de2425a-430b-47cf-aac2-291220844fb9", "value": 1818702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623563111, "uuid": "7b3db5ac-01ea-4b91-a146-58b87bb24b82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623563111, "uuid": "0d5470dd-0e3c-471e-aa03-c70088b18873", "value": "d18dc9cf860133016c0c244b9ad579bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43de87b7-cc04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623560425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560425, "uuid": "7f76246e-7850-4eab-954a-3f4b87015ff7", "comment": "Malware payload (Mirai)", "value": "764d23a20d5d9efdd6009c27ad38d370", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560425, "uuid": "812e8054-bfe8-4c5c-b416-a1b3a2f528a8", "comment": "Malware payload (Mirai)", "value": "0393a7b9be3f23995155b3ece01e241df96c20fffdb59336b4cf1746efc13930", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560425, "uuid": "11739ef7-4f00-4b9a-89b1-6059753f7d97", "comment": "Malware payload (Mirai)", "value": "d0804868f689d37d504fc3fb6779504a306ff643", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560425, "uuid": "10fd0f25-1451-4ea3-867a-5b44a1135ebd", "comment": "Malware payload (Mirai)", "value": "3809daecf0984b11b52b76a855c0552f74af4af905ba0748f5e900c8a9932e125e0643dddc39e9b0a8bcdbb56b99872e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560425, "uuid": "eeacbe00-c4e3-40b3-856d-c394dcde784c", "value": "B5E34A46EA818E17C0D5277AFAAF414E3322D764E3DB730689185FB43FC6A5E0E23645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560425, "uuid": "d06ac00b-60f2-4901-8c58-cfdb625854ad", "value": "3072:rcuuQ1XTYVa9fG8LiK9mrsplDKZUyQBKXAVaniX+F8JyvYGhLd8Fp89jJNxLZS8R:rcuuQ1XTYVa9fG8WK9mrsplDKZUyQBK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623560425, "uuid": "2a92f692-a151-4389-9887-b96d611a0925", "value": 155907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623560425, "uuid": "415ce558-7d2f-4e03-93c6-a0cded8a6f63", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560425, "uuid": "84969e07-c027-4565-83cc-7d42d861471d", "value": "764d23a20d5d9efdd6009c27ad38d370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4873f109-cc60-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623599946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599946, "uuid": "ee86af0e-8b21-4d76-951f-60b83d1b0c2c", "comment": "Malware payload (Mirai)", "value": "924b077f2d0982c8c725f3640c0c6a4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599946, "uuid": "3a11ee98-7113-4ed0-9b8b-cdbb35914251", "comment": "Malware payload (Mirai)", "value": "054b9da50831cba6177539c58ae496b0d10552bafff63df0048e608cd4c51d47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599946, "uuid": "85c1151e-5f3f-402a-9317-fbc5832b8a71", "comment": "Malware payload (Mirai)", "value": "9705d9f5732e6c0b2061629eb25c4f35c88c2622", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599946, "uuid": "d527c281-a31f-4a40-9991-3d2d43012335", "comment": "Malware payload (Mirai)", "value": "349558df914106bcfd1441dc0169280cc3ca64e95a962c54c5437d136b6b24f4285957401543b9bf4db6e0ba6368fcd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599946, "uuid": "238a3ad5-45d7-4fcf-b2da-a459457ad05b", "value": "9ED2E1B69FBA460FE4CA633C5D9ECCD935AC7C652A79464906401A6630385E2E7DCCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599946, "uuid": "0700d170-585c-4b80-be7e-ac4c755df7e7", "value": "384:M2MzN8f05Rpjk5Yfo2xZUTKmQAHHOvgm0vtsgV7EmQi3iDeGFXmLc1r9aDIqM6eW:UN8fWlfoQmQAXV7EmQciiRcLprDKR1qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599946, "uuid": "1e152ef7-e5a9-45ce-9a52-8ba54ebba48f", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599946, "uuid": "f0f11558-c6fd-467b-afb3-1d78361c2bc1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599946, "uuid": "05760c10-b443-4836-9cb1-8207af0b99a8", "value": "924b077f2d0982c8c725f3640c0c6a4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9fa3c7-cc10-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623565782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565782, "uuid": "3e5a571c-2d61-4073-a493-10e8edfe3e74", "comment": "Malware payload (DanaBot)", "value": "7a43be00bb3ff76da6c777999b1c4f3a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565782, "uuid": "97e4f924-8897-4dc0-b585-7374e23fba76", "comment": "Malware payload (DanaBot)", "value": "0576a006b827b641764898dd0587a8a0acbdc0b217e983cce297a727f3f3cc85", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565782, "uuid": "4716cc21-7519-4c56-a9c1-329ab0ae7e8c", "comment": "Malware payload (DanaBot)", "value": "ef82fd1f589eeadb54bd249d93c6370370924fc4", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565782, "uuid": "620c9233-a354-4030-b370-a6b550a41c49", "comment": "Malware payload (DanaBot)", "value": "5a8b563b05c7b24f5e75568b80a5616d6f2c6f409aeec64ef6db4913e9a37cc48c77ddcf551848e680eb20c33d8d9276", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565782, "uuid": "25f47982-451d-419a-83f6-b55612db209c", "value": "D756330061B1C034F4B356B59C368DB92A9ABDD26F3461EF62C5AFEA1124AF59F70313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565782, "uuid": "77d69794-3acd-4587-b3aa-43dbe9c05d87", "value": "9d489fa94ad807363514196e09b7ee4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565782, "uuid": "053a52d9-cbd7-43ad-acfe-37bb274aed12", "value": "196608:hIggLyZwlunqt0xsLsElIhDVU6xzkULv:h0LyeluCS/hZzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623565782, "uuid": "5a8a2a24-b73b-4f37-a592-b32d1cf4136c", "value": 6300672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623565782, "uuid": "e59d463b-fa38-44d3-b33d-984b3f38078e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565782, "uuid": "ad031886-9050-4bc6-be77-017486b2a855", "value": "7a43be00bb3ff76da6c777999b1c4f3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03b100f-cc10-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1623565761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565761, "uuid": "212e6dff-ba7d-4537-b16f-c27c7ce5ef13", "comment": "Malware payload (AveMariaRAT)", "value": "a6316cadb965c7ed2275a8d8f0a560ec", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565761, "uuid": "82ac6a16-9705-486c-aba4-5253b0506d73", "comment": "Malware payload (AveMariaRAT)", "value": "0968aac5baa3ca0333c06de5803c08300465441092fba720f9efe88f68cde4a0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565761, "uuid": "1451bb28-c441-4b2b-b5af-4c9ec9b439ab", "comment": "Malware payload (AveMariaRAT)", "value": "d30fa3852b7e19fd4b5c8578954c8e8e93341ae2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565761, "uuid": "17c02226-b086-4291-b37e-917a0219e497", "comment": "Malware payload (AveMariaRAT)", "value": "3154cbb679787ae6e5f34e1424ed6722d1adf8e14c0cb4f8f18848fe998f9c2abea5e333d6d5be862cfaccef97791d31", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565761, "uuid": "24fcbd89-7ce7-4a48-955f-c58613344091", "value": "7BB39E13F7E54835F3B201B01ABD7E6ACBEDF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565761, "uuid": "715b6323-8af8-433c-bd54-9d3c5d1c9611", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565761, "uuid": "ce05addf-e08a-4968-b865-60ef3d9b6c50", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01h:K1VmhaH8EFvW+0OVE0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623565761, "uuid": "24b742ad-b37d-4267-a701-081acae36979", "value": 111632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623565761, "uuid": "d2f28da6-3998-4b11-876f-3a0fb5b0b4e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565761, "uuid": "6a88c4a6-e262-4ebf-8cba-75e8df97c062", "value": "a6316cadb965c7ed2275a8d8f0a560ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36ee976-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623548989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623548989, "uuid": "440c2a68-50d1-41f4-b768-a330810c3467", "comment": "Malware payload (Mirai)", "value": "f974b905ef9e3b5e5d08cddd046a597e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623548989, "uuid": "a97f1a49-faf9-4575-8ced-163c946f2c8a", "comment": "Malware payload (Mirai)", "value": "096fb8b7fc0221a6d645aad8d554b2b9bde7fb02acc9a196f933299fa8957cd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623548989, "uuid": "4ce17f53-bfd5-4089-963c-0b261662eb96", "comment": "Malware payload (Mirai)", "value": "101cca7334a5663d1d39447b486f5e8291cee4a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623548989, "uuid": "3a800d70-306e-4b6a-aacc-605035343df5", "comment": "Malware payload (Mirai)", "value": "7742bcc2509b3b23c9121664e0825fed1562ef0fc58bccf742abd590e72c24fca8a2a512055c25ab700e39bed13030b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623548989, "uuid": "da668385-94a5-4a05-b662-1bd06e393759", "value": "A673AE32C03AA9C4D2D80634E4A59C781723B509972BAEFA9EC68797540BDFCF4053F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623548989, "uuid": "2b55e445-6e85-41d3-adf9-df504093b4ea", "value": "1536:4aQ/XUQPYd+fbz3Nh7IjQ125i50/2NGbGS+KKCUkZmd42+LaV38:4tvLwIfbJMa29/2NGbGS+KKSsfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623548989, "uuid": "b82399f4-7392-4116-be1a-dc40f669ef2d", "value": 75060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623548989, "uuid": "982e834b-b72b-4d8f-b5b0-c35fa7ec3939", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623548989, "uuid": "5060d7b7-2c3f-4af0-9ddc-351ba4286e3e", "value": "f974b905ef9e3b5e5d08cddd046a597e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de21cb5-cbf4-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1623553463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623553463, "uuid": "ab7a2e23-7624-4dcc-8f32-48651df501ec", "comment": "Malware payload (TeamBot)", "value": "495703756b9b85800404856d7d1f8096", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623553463, "uuid": "a7f90f0e-e48f-4e20-862c-695f2ad90a17", "comment": "Malware payload (TeamBot)", "value": "0fbc5d24e63e23fb5ca4d84b8219f51e78a8e02084b454e9c4712d9e7364fc3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623553463, "uuid": "3061038c-87ce-4e82-8987-57d4f9b05797", "comment": "Malware payload (TeamBot)", "value": "4eeea40a454995f392e66ce188717e772a5b519a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623553463, "uuid": "cb9024c5-b295-4edd-b52c-dfa33a958ab6", "comment": "Malware payload (TeamBot)", "value": "dc1acc7c7b9d0e171982e3bed714c8e9a48fe4315b2d25520e9c3c1955b3a41bb2f5e45be223bd83bd830d4c1941fc5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623553463, "uuid": "84136511-61d0-41a8-8c00-cb3d011b753a", "value": "A0050100A691C0F4F0B611F96D7ADEA9A2EC78705B6494CF93D52BEE57382D0AC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623553463, "uuid": "b8a54918-1c23-46a8-a143-584d79f0cbba", "value": "baa7acc629fae892f4f615c8c37bd06b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623553463, "uuid": "ad9feb50-69b8-4a03-991c-50fec98a5839", "value": "12288:gXyqxpnLxC08VLR+BCY0Qy4hoSQtYkiIsumGskvmFUhLcVdfQex6zD:gXjrnL8EBlPyTtYkirkvHheN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623553463, "uuid": "6e62e654-3d17-476c-b9d5-4c1bff53a082", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623553463, "uuid": "791224cb-8f13-4aab-be3a-70a8523d8595", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623553463, "uuid": "812fbe58-fcb2-47ff-b7f8-3691de2cc2f0", "value": "495703756b9b85800404856d7d1f8096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc9b713-cc5f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623599690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599690, "uuid": "9890a83d-36bf-4cff-a08c-eb7a3646d50c", "comment": "Malware payload", "value": "652432d0bf1de80adceb2aa54cc9bb3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599690, "uuid": "a54b6393-f609-45fe-b8d2-b172e1343a7d", "comment": "Malware payload", "value": "1111df7d824502e082185158a87cde6d34708c87a5183200b614f2c4046683c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599690, "uuid": "977de2f1-0a60-4be0-abc0-32f08a97c0de", "comment": "Malware payload", "value": "623ebf28e0b65c782dfb35abdaafd1cc068c157f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599690, "uuid": "b6e42ba3-724b-4685-bc86-d4aabd034c8c", "comment": "Malware payload", "value": "f30d239113e47050c4ae582b945752a514ff5c5247cd1688c14d2f14649450129117e12d68bd9f80970ed9ac85d7a924", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599690, "uuid": "b07d05d5-8a76-4eee-8a5b-6d7da42e3da2", "value": "4554011E06C3677CCD46373A8AE8011FC76997C3B007960EBCC9238AAB5375D469579D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599690, "uuid": "8dc10241-1104-4a93-979e-e8e3af2951ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599690, "uuid": "88d0e37d-d4bf-426b-bd88-79bbdb011e8c", "value": "6144:j1Xat8DY8mgYP483qD2D/6ucCBz2oddOWRVXPyc2JhHgK:jgO/YP486ab6ucO2dWRkc2J5gK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599690, "uuid": "95cf342f-8c50-457c-bd9f-d3efbd29d565", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599690, "uuid": "428120c3-0190-4497-b50c-03e31ca1d1e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599690, "uuid": "3d2dd8f6-23f2-46ca-9567-7310edfef001", "value": "652432d0bf1de80adceb2aa54cc9bb3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a3b60c-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623548996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623548996, "uuid": "4db3dcf7-5836-4516-9832-3765895631e9", "comment": "Malware payload (Mirai)", "value": "fa333da4ae0cc499dc6eac054fdf2fb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623548996, "uuid": "1169606c-6c0b-428d-af0a-cb5e8e42a724", "comment": "Malware payload (Mirai)", "value": "12cdfaec6aa8b7ea0a17f9e244043871deb01224f18570d03d1dfd590cc68e3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623548996, "uuid": "7194c704-97b8-4a5c-9755-8f92048f01da", "comment": "Malware payload (Mirai)", "value": "83fd9293da45f781d9f85dff051668606b9ad309", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623548996, "uuid": "05ef2ad5-0eda-4ad6-aafa-78bdbc6ea4e5", "comment": "Malware payload (Mirai)", "value": "5947983a07bb8bc21108c2de0fc897da42c587bfcfec89ca51e1e57630cab0c70b0cafd06f413c1ff19171da3f386d14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623548996, "uuid": "fb73d796-7157-4cb9-aadf-12dc463a9f54", "value": "7FD39ECBFB5B10A0C86317F51BC74F9D6E5322229F2B98E76C0E653E59790CB46063A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623548996, "uuid": "61d50fe5-ce0b-4fcf-a1c2-305bb0db2c10", "value": "3072:PV3S2BlpIujSWofzFO6e4TiAf8xSUQCg+lnq:PF9WNWoy4GNDHnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623548996, "uuid": "15cf1ef5-12c7-4e51-b312-a7ed77b4ed8b", "value": 132376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623548996, "uuid": "82c76d5d-2fa7-4c81-9649-14e1c72edcfc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623548996, "uuid": "20b749f7-bf4d-4e88-8862-c3691081cd80", "value": "fa333da4ae0cc499dc6eac054fdf2fb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b700cd29-cc1e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623571785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571785, "uuid": "2ea3f242-6af8-42a7-9709-b23411df9049", "comment": "Malware payload", "value": "ba4d43e1ea0349b6ea730ebc4b6db888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571785, "uuid": "9c710f0d-93c8-46e4-9218-c81fafc6fea1", "comment": "Malware payload", "value": "143b79b5b22ff538de4b51bce14218a3b7688b6464205dfc66939f26aca8ffed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571785, "uuid": "cf160df1-4d1a-49c7-a1b9-05fd8854dd83", "comment": "Malware payload", "value": "e0cf6faecb8f11c241631955a18f67c8ecc60e9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571785, "uuid": "269cd9a5-03b5-4ad0-bc51-56011ea67eb8", "comment": "Malware payload", "value": "6c1a3242d63bdf9517d3279fbe12e7bdba15c130c3a831778f8d9380fb43bd0195a143720baa3ff51e94d61fcdd718ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571785, "uuid": "53a1404f-fe90-4fa3-a42c-0894ae82df88", "value": "3C05CF2223542FAAF47CE3399015050097F8F51BD336DA8EBEE555DE4926F81C7A2B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571785, "uuid": "f19c7c2d-a8f3-49c6-8935-18699d7578b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571785, "uuid": "2482dfa3-f84c-4ab8-ada2-cbfb3f606283", "value": "24576:yB8QeFvTrNeBUdtTPXN0RfAh5eTEuLclw:yB8QeFvvwBUzXz7eIogw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623571785, "uuid": "3f87a68b-e8e4-4451-b189-b11e0f73b539", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623571785, "uuid": "72919a2d-6086-4729-a44f-64c0e8a98807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571785, "uuid": "7892ab2d-1af4-4098-9dd7-46baa76351ef", "value": "Scan copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39936f3-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623549043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549043, "uuid": "8f6bbd08-ae6f-470f-ac87-bcefd76c9757", "comment": "Malware payload (Mirai)", "value": "e3a78341312b7da49310e1a6af08bfd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549043, "uuid": "4526e997-17b9-4d87-966b-3130d9219e57", "comment": "Malware payload (Mirai)", "value": "1550ae8e301f86778bb9a2aa91df606f61edc51273ab61053817b8322af71afc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549043, "uuid": "67d231af-b9ec-429f-8648-9b0bdf44ca76", "comment": "Malware payload (Mirai)", "value": "20afa46092e0c61cfa0848fe20efbaba8473c1ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549043, "uuid": "74d754a0-379e-471a-afaa-30d8ba25ca7a", "comment": "Malware payload (Mirai)", "value": "2637dd028d61629b45d625514dd274be1f8879fcdd3eb835e99b5862ebc8f0b93eaefcf5ef4a2feb75cc52cc1d7ece1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549043, "uuid": "3a6165a4-600d-483d-96d8-b46b3eb96975", "value": "0183D3C0B98B81F5C51B493050A7F23FDB32D56A1070EAAEEF9D9E35EE67702910624D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549043, "uuid": "b7053033-e619-4b9c-bfd4-656038116f92", "value": "1536:BMB9LJVjndZTbY/ojH6MGNirBmC1yhb3UMYMRl+Xi+hf5UExf32C:BMbjndu/ozCNirBmC1yVUvM2XzfG7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623549043, "uuid": "084388a7-e6ec-4a08-a3a8-49bc6d096c62", "value": 83696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623549043, "uuid": "78b195df-121b-4015-b24c-33e009256510", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549043, "uuid": "372d315e-087a-4a22-8c35-96692b760d8c", "value": "e3a78341312b7da49310e1a6af08bfd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04daef79-cbf0-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623551729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623551729, "uuid": "b4a0b17a-087a-4b16-a599-43c155531bfd", "comment": "Malware payload (ArkeiStealer)", "value": "a9b0f21cb30e239e1f3af96eb376a0ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623551729, "uuid": "1fdbb73c-386a-4ea5-b714-e1e35e37efa7", "comment": "Malware payload (ArkeiStealer)", "value": "18076f163aef93f57db14eece15b18ca68f344da2f4c59a329de178752f14e2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623551729, "uuid": "c2307790-0a63-4d5f-9216-795c780c7a8d", "comment": "Malware payload (ArkeiStealer)", "value": "d72a31a0f8ade8bddab2f4bbc4b0c65886f09b92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623551729, "uuid": "4ebab80f-1f8f-471f-bb0c-fd3acb390e6f", "comment": "Malware payload (ArkeiStealer)", "value": "3b9994ce84fe03eed8adb60950d62b697324bbad2d1bfeafedc4ed5b88ba91b95940efc830ff9418c6f2207ba23f1e50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623551729, "uuid": "bd76a87f-51c8-4a19-903a-80b65a73d53a", "value": "33D4E00067A1C039F9F312F86AB99274A539BEA1AB3491CF53D616F957346E0EC7034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623551729, "uuid": "905599b0-f50b-4083-b6a4-432e46162262", "value": "0b7d0cfc3cf5ef8b4576040fae638eaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623551729, "uuid": "c0725eca-93cd-4d37-8d92-58e92d21c0e6", "value": "12288:8o1cVSyb3yRoBT8f3DC/QyquN26rizg6hXjceAMJaIkPhq4RRk4Ql6:1ALmq/QyquPKJhXjwRPhq8Rfw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623551729, "uuid": "30f5aede-6784-4f49-973f-87117f45d951", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623551729, "uuid": "6a5734ce-21a9-46fe-894d-6da4013f2e7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623551729, "uuid": "65908fcd-4c8e-4163-b139-e57981ecd37b", "value": "a9b0f21cb30e239e1f3af96eb376a0ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4369b361-cc60-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623599938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599938, "uuid": "0eff4e2a-eede-44ee-ab81-b0e9cc88f82a", "comment": "Malware payload (Mirai)", "value": "3a974c593db70347ff809e2fc8f0f83f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599938, "uuid": "3d598c01-8ef0-4659-91eb-f30709c6e1f1", "comment": "Malware payload (Mirai)", "value": "19dccfb3431719476a187ed6db6552814173305e0fca276beb95db7e91760085", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599938, "uuid": "45f7f79f-fc54-499d-abff-2673689954e5", "comment": "Malware payload (Mirai)", "value": "6f45ea3dc12e860772ef0a55f0f152373c73c2a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599938, "uuid": "76ac4073-4b36-4c2c-b285-0f8e7d83e14d", "comment": "Malware payload (Mirai)", "value": "51e801086055f38ad4d053919b901b4b3e96a43a7b4dbd2803f18d9bb797218bff270bfe238b9d8e70704862ca2a28c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599938, "uuid": "774dc906-f1ce-4fc0-a697-cb3ad72c1d59", "value": "69E2E0AFA1F42EFADE8D483E22CC0638AAC65D9713649B85373144C5966D8E8F4DC07D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599938, "uuid": "f45158cf-f7c1-43a1-aaec-dc4daa6fb13c", "value": "384:A3fpCLrsjHIX69URc+hmnulY1qHprFKt6zhS45vDajssVwfr3Loa3FRWGVCz0Nvs:4fpWcehzJFYKgULAssKfrMa3zW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599938, "uuid": "fd6e5ade-d9e3-4049-96a8-1e7b59dfbd3c", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599938, "uuid": "5fdf060e-11c3-4a3e-8a47-982f6c1e382f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599938, "uuid": "838cfaef-5303-4fbe-a8ad-8548eb027fe4", "value": "3a974c593db70347ff809e2fc8f0f83f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5716c3cb-cc32-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623580214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623580214, "uuid": "392cb7c3-3056-4b12-9b35-25059e38181b", "comment": "Malware payload (RedLineStealer)", "value": "38a1bcfa496165b7f289213d39c7c5cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623580214, "uuid": "a9d6f86b-cfe8-458d-a92e-87e9d5d76d4e", "comment": "Malware payload (RedLineStealer)", "value": "1a89d50f3b896f1da29e16f6e7889266cc230b7aa1ca01b04d22d11987745b13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623580214, "uuid": "b69efe4c-bae9-4a38-99dd-b006f1d53710", "comment": "Malware payload (RedLineStealer)", "value": "67c2110b3ca18055aca87fe1a63d2180a6083d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623580214, "uuid": "1830b0b1-c765-442f-837e-ec096b55f2dd", "comment": "Malware payload (RedLineStealer)", "value": "c93e94337831193da3be1cdc6320bdb12fe7341fefe6b8d39cc701b0a7ecaaca8df4d9bc030acd3ec0939e70d0fea79c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623580214, "uuid": "d8d62bef-f6f9-4a6b-98d7-ab9f726d0466", "value": "BEE40111B9D09071D171193859F9AB346A3CBD301F348EDBA3D87A2E5E305C29B36BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623580214, "uuid": "61ce2953-7b1d-4eb9-80cd-a5425ed6f714", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623580214, "uuid": "b5285ccd-6349-463d-95df-16285d08ea70", "value": "12288:VOOfN590uu6opX+t4sP2IGPJ112rYvqefXU+468QZ467XKtFYev6DXcxK:YOfNkuu6oLsuI61WqqeW68QZ46jKLYeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623580214, "uuid": "c245d094-84d9-412a-8e46-028cfdf5af90", "value": 702131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623580214, "uuid": "3638f9b7-e8a6-400f-9eb0-5f3d8fb25c83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623580214, "uuid": "22399232-e63e-4871-8988-4927612e2da8", "value": "38A1BCFA496165B7F289213D39C7C5CC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2a7fc8-cc03-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623560172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560172, "uuid": "fd497147-b381-42c0-995d-ab33490ffa6d", "comment": "Malware payload (Mirai)", "value": "83a37b1830ac21f9865f15f650616b7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560172, "uuid": "ef447c72-76b5-4f19-a654-a636311a9e1e", "comment": "Malware payload (Mirai)", "value": "1b5867644862c697f1033bfbb4877b05f0e220ecd07a405fc55bbaa4d63d313c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560172, "uuid": "8bb8ebb4-f00e-454a-bd0a-27dfe638bded", "comment": "Malware payload (Mirai)", "value": "5076091e2ea5709ac72c5f722f8e94ed5cb9c09e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560172, "uuid": "58eafcf4-a882-4757-97f0-ab0cc18c2541", "comment": "Malware payload (Mirai)", "value": "5bd71d27656c50b72162c12d3b27b93e12b5e2fba1b5030dff184de537d3c97fc63fdb81ab72167a0e1b9ef15c643092", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560172, "uuid": "b2141ee2-8079-47fa-94d1-a03dafc3d6f8", "value": "15734B0276284E5BEAD70AF0252F57E083FFED8024E5B989684FD7424635E37558EF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560172, "uuid": "0cac65d4-8b33-4cf3-9abf-9f4e90a808db", "value": "1536:EoUNbArd4+/0l1uXxyk5vrYXJT9bDMYu4:E7tAr7Qkl6DC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623560172, "uuid": "f6cdd076-5a13-428a-8c73-76fe2a4cee72", "value": 78756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623560172, "uuid": "d9ce6dc9-64eb-45c3-95fa-85b1507e37ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560172, "uuid": "4dcde10a-67b7-4023-8a71-954dbab558ef", "value": "83a37b1830ac21f9865f15f650616b7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90a792c-cc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623613530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613530, "uuid": "bd4db8c6-fe08-4d37-bd6b-e0ddb9ea7a63", "comment": "Malware payload (Smoke Loader)", "value": "b4a164515cccb56971cedd899bf53ae8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613530, "uuid": "b630a7d7-fe59-4caa-8569-7aea3fd23ca7", "comment": "Malware payload (Smoke Loader)", "value": "1b7769f85c3874451b85f83ab1ddc08b0d07fe76f354e0c7b397308894095673", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613530, "uuid": "bf4d47f0-e6bb-424f-86b1-27943a1524bc", "comment": "Malware payload (Smoke Loader)", "value": "e9a68c2b04f9820fdc0f1bb34c270c5597ff250e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613530, "uuid": "f093e587-ca09-46a0-8919-d485657fcfd7", "comment": "Malware payload (Smoke Loader)", "value": "928fddddd9c1551b6191c4e5cb68fbfd6c0b0df0a3b1dfb80dd398f2bad64243d15ad235336e55bf8e746c3de59ac9ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613530, "uuid": "b9ee1be3-d0d8-4c41-84c4-5a98b3c917fb", "value": "9B548D1067A1C0F5F2F316F849B69F79A5AD3DB0677850DF52C22AEA1634AE0AD30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613530, "uuid": "e3be0410-c450-471e-b437-f1eba9c8eafa", "value": "f48d40448beb628ea5f30fab00d7ea57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613530, "uuid": "5ad5ecf7-6854-4431-9c63-aec9c767215b", "value": "6144:6QsvV2LxBGSZSl4DxbZeBaLA5efhOg9szC2l8:RiV2LDGSLmaLA5efQlzrl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623613530, "uuid": "d2b5269b-409e-45b6-97f5-e54a6858e08e", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623613530, "uuid": "6baa3da5-1a4c-4801-b82e-e7cdbd9f5b83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613530, "uuid": "6c1f64ba-dcfb-43a2-a6d9-5b1f05630b7e", "value": "b4a164515cccb56971cedd899bf53ae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fce4773-cc5e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623599153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599153, "uuid": "85676850-7507-4e2a-8ee1-5a3bdb2c3657", "comment": "Malware payload (RedLineStealer)", "value": "005aa2cbb0cd7825ec33f851498723bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599153, "uuid": "b3515bf8-e3ed-4b60-867e-f6007976a109", "comment": "Malware payload (RedLineStealer)", "value": "1c986971354d0a5d668c55fb4242a77ed948bb278053e968fda037996425cfae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599153, "uuid": "dcd68556-d0f9-4297-a111-9093cbba6953", "comment": "Malware payload (RedLineStealer)", "value": "55662172b539b95ce97667e2f6235efaec26d7ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599153, "uuid": "95d7bf7a-7ce8-4119-ac9b-0a9df806cf18", "comment": "Malware payload (RedLineStealer)", "value": "f7885ee682152f8d720caa56e49d23668c68e707711d90227edd207710accb858c45c0ef6198927a434f61d1264e1ac9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599153, "uuid": "ea5997f6-7761-4888-b97b-fda145e9ef3a", "value": "E614D01DB6E48951C5AA96F1C3E3412203E596D36273F7893EC8079B1B433A1DCD6B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599153, "uuid": "f1558bd7-fb4d-4efc-8798-5e3cd515e584", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599153, "uuid": "9ea2871a-941e-4d42-8163-5b2d5c475b01", "value": "3072:JcwJGjo0S0Wsdz7YeDfGUzMCaJWI6j+INAiukbNnY9b27eW+SDYJY:JVASY/GUQCaEI9INAiVNGb278jJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599153, "uuid": "2fbbd586-4e4a-4e44-9676-33adc9709c07", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599153, "uuid": "468bd780-ae16-41b3-8df7-4a54ea4df38d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599153, "uuid": "a98f0e43-c332-459b-91b8-bf67632e9ee2", "value": "005aa2cbb0cd7825ec33f851498723bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c20055b-cc45-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623588329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623588329, "uuid": "4db5636f-6218-4dd8-ae4e-26ef3001bcbe", "comment": "Malware payload (DCRat)", "value": "7f835868617cf73ab02d72ae2ba2253c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623588329, "uuid": "94c1d40a-f90b-49b7-a9d5-28303fc7f35f", "comment": "Malware payload (DCRat)", "value": "1ea1dc5c0feb6724553fdeb002893c3db286c93441bac2a27773e52be62e82e4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623588329, "uuid": "50cf4a34-70a1-4470-a7af-0efafd9d056b", "comment": "Malware payload (DCRat)", "value": "75474c445cfb086055410ef945ced407c3512203", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623588329, "uuid": "3fe20783-8b08-4d84-b277-f33c79a16271", "comment": "Malware payload (DCRat)", "value": "3978b87caa01858ab337e184f339d9db1f8bfccf465403974c3ad4f2a1db3734ab93ec19bc36468d11c8593d4901c78d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623588329, "uuid": "1d69cbae-babb-4f7c-9d8d-1bfb8f9dfd67", "value": "CFF449223648CD11D069063FD9EF45140BBEEE00B662DB167E6FB3AC69513636D0E1EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623588329, "uuid": "e370044c-7516-49f4-84c1-59874c3b2733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623588329, "uuid": "31e4b4b3-5c25-4a6e-b61e-62598379b4c7", "value": "12288:KzFwSlI7JdoVouRjbRfdGovmmOU2M4pQRLWKrEwR7tqn:KqiItGOuLfrxOC4pWqYEwRR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623588329, "uuid": "58b1c7ae-9ae7-4a2c-950d-a5e822673f29", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623588329, "uuid": "7b779fdc-4867-478a-a208-104f8a5b361e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623588329, "uuid": "a266af19-e4d4-46d5-8a7b-1988939fdd91", "value": "7F835868617CF73AB02D72AE2BA2253C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564dd363-cc81-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623614143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623614143, "uuid": "9aad80d4-77da-4c3e-bb9a-a51934ce3be1", "comment": "Malware payload (RedLineStealer)", "value": "502aa916fe7cad59932d5ad329d2d2a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623614143, "uuid": "8546f9b1-ea8e-4cca-bfb6-96dd1cfe5d10", "comment": "Malware payload (RedLineStealer)", "value": "1ec41e2112e0e611ed284218b07159a3d935d093c2a8e2709673b9ca67a13c03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623614143, "uuid": "7c77532f-d178-4d20-b793-124cc021d5e1", "comment": "Malware payload (RedLineStealer)", "value": "7ad065df5f71330370ab6318b994636f504a92fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623614143, "uuid": "3052c825-51bc-40f5-81f9-e443a43e13f1", "comment": "Malware payload (RedLineStealer)", "value": "080c3ae1a387a202090ef8514c814c678fdd51c7a8899b7e3c826e26a45a771016047039875bafb82052a75cedd4cef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623614143, "uuid": "05883426-acac-4cf4-8b17-a9486a2afb3f", "value": "45C41F1865BFC059C9A7EFB12DEC58BAD99A94A3640E713311B4A33B4F52794CE0F078", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623614143, "uuid": "8ff9039b-74fd-4a0c-ac7e-eea7c764100c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623614143, "uuid": "1c1c2536-160b-43a5-9f98-0e650c118dd4", "value": "12288:ASoFGdXy75leenp2BEl2s5G1+B6SmHwaDIOeDqdhtsR:rKrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623614143, "uuid": "01678873-f11e-4524-977a-ac2bacc7a89c", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623614143, "uuid": "489f72fc-b0f6-4028-bd00-2809695b4937", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623614143, "uuid": "927073de-e116-4690-9a42-80855fbd5624", "value": "502aa916fe7cad59932d5ad329d2d2a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22331519-cc51-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1623593440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593440, "uuid": "96e67455-b170-4f5d-803b-cb0620350ddf", "comment": "Malware payload (NetWire)", "value": "dad2086b1dedb37fdfd029105a9e6972", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593440, "uuid": "81cd66bd-742f-486c-865a-104925e8e415", "comment": "Malware payload (NetWire)", "value": "2293e4d40a28a992e65cd5d5ea0cb0561ab1b5dba5ace0db7c241dc8443488f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593440, "uuid": "3f43361d-93d7-484a-8e12-7cb8ec4df952", "comment": "Malware payload (NetWire)", "value": "357dc27ba8a81eaebc7d70adc871b2ad9414a6a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593440, "uuid": "40cd96dc-6b9a-4042-9141-29da6384fb34", "comment": "Malware payload (NetWire)", "value": "e770f6398e7469f6bd0400555e7f1ea89374b14b158af1667bca8ea2d602c67ea905e15a87b57274a4d6f86119bff878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593440, "uuid": "4d360052-404d-45ff-9c26-12922bd34f02", "value": "0846220277D6C075FFABD2739B59B2019ABD79250133842F63982DB8BC705B1276D3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593440, "uuid": "aee4d318-06eb-4af1-ab2d-35c403b51ca1", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593440, "uuid": "cad4c77f-632a-4ac2-ac18-2064b4079964", "value": "98304:u2cPK8DElBOzhPErg5xOQDhZgvwKwuM931pV1MQB5jIdMYo536T9lFH:hCKnlQzhPUg5xOQDhZgvCuyDrMKYca9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623593440, "uuid": "52186f2f-dcf5-4820-b2a3-7cb573d40566", "value": 5755392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623593440, "uuid": "ab74ecd7-3e34-48d2-afe1-dbf0989dcc9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593440, "uuid": "8857b79e-a97e-4f2d-92d5-e4d00f61187a", "value": "DAD2086B1DEDB37FDFD029105A9E6972.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93fb281-cc4d-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623591948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591948, "uuid": "e8df927c-0d09-40e2-a5ab-f49c86ac349f", "comment": "Malware payload (DCRat)", "value": "c99b4088c653591f14ab43fa5b192f14", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591948, "uuid": "9e443a2e-0112-446b-9871-eb4434da5bdf", "comment": "Malware payload (DCRat)", "value": "22f746752a4c1b60ad46d3cf1ed43b12920cb838f755bfd178c46f70ca8eeb76", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591948, "uuid": "1930135b-1a7c-44fa-b30d-d1feb827f496", "comment": "Malware payload (DCRat)", "value": "c57086e864fdc66157971497aa9d44bc67fb4fd3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591948, "uuid": "7350acb6-abe6-4213-8164-978343e685c1", "comment": "Malware payload (DCRat)", "value": "b24e5813487ee695a0384f6592e50e6714c8ab4ee6088d9b00386cc3a268670a2e1d68d17f8c5ca6ad7a59a3f11d3080", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591948, "uuid": "a85bf12e-bf0e-4208-aee1-d60d9e5dad18", "value": "6455333B02885847EF6DCEFE6124AC0D1DA8B5045FF1C71F9EADA8177790A921D78923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591948, "uuid": "963571fa-78b9-4239-bdf2-e787422f0cce", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591948, "uuid": "ab6f2498-7bcb-4a4a-a0e8-a0d3015b8e27", "value": "24576:oAyFIU7a9p9NW8/r3EsTZVrPZq61ZCEkzQKx0rCaQUu8yOAPhRPo+d:KR7a7W8/rEobza1pjquNVZa+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623591948, "uuid": "29c45b39-0656-43c9-817a-25fca34acb3f", "value": 1311896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623591948, "uuid": "290335ea-9a99-4076-93b2-9516ed2d9996", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591948, "uuid": "e3826bb3-2edd-469c-8fc1-e3ca30d36adf", "value": "C99B4088C653591F14AB43FA5B192F14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359abbd1-cc12-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623566414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623566414, "uuid": "d4edd969-4de1-41db-bed8-ed49bffde296", "comment": "Malware payload (BitRAT)", "value": "2f607fcbd684a21335fceb9ce0bc0174", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623566414, "uuid": "69972fd3-7163-4382-ad56-8104e7b7e670", "comment": "Malware payload (BitRAT)", "value": "26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7c2886e26e768eb10a81", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623566414, "uuid": "e221171d-3a41-41b4-a792-cce752d26fcc", "comment": "Malware payload (BitRAT)", "value": "de43eff7cb2d6712c9d458f1700f657741101721", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623566414, "uuid": "dc868034-a463-4762-8871-b2952f282ea7", "comment": "Malware payload (BitRAT)", "value": "67397bcabf2be015235e75c27f5e151e68b38a705b7c617595828862027fed363cf08c3123752a4ed9f2e7246a953c9f", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623566414, "uuid": "4afa21f2-326c-40d4-ae09-1ec329f99cd0", "value": "40A30969A3E01F15F5FE6BF590A31204CF7C7116386EF76A1C96E4F51CA23948A013A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623566414, "uuid": "f93663df-2a16-4c58-8fec-5740c6ba0118", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623566414, "uuid": "3b0b678e-a410-43dd-ab5e-1b5725f32a11", "value": "3072:YWUaV9mCyM8MqZaPFgrahWcJ0mrCELexZb:YsV9mCy2zue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623566414, "uuid": "0cdaf3cb-ff02-46f6-9f0d-1323e66fba13", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623566414, "uuid": "72b43f72-c111-44c9-9dcf-1ec28c387d7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623566414, "uuid": "7cbdf511-0aa8-4a82-bdd3-98257cf4ff50", "value": "26451cc21c9b45f518c361ce5c7db51016fc19cd8aca7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f80afe-cc43-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623587762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587762, "uuid": "9bbd546a-79d4-461b-9275-ac5ca55e7375", "comment": "Malware payload (BitRAT)", "value": "76be657e14968bc4a48510c85af393ad", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587762, "uuid": "f80b7ae2-a4a2-493e-b3f8-759b1a28c589", "comment": "Malware payload (BitRAT)", "value": "26613b24d69bcad580c4f1af05046195494c5581f7e3060ea91f757ecda6ed69", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587762, "uuid": "eac7b6f1-1ab3-4712-9eb0-107b490a3815", "comment": "Malware payload (BitRAT)", "value": "a6671926e4f9d2fc5d13f1412fd1cfbf8a4442ef", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587762, "uuid": "7c245419-5bc5-4253-81e4-d7671ba6c14e", "comment": "Malware payload (BitRAT)", "value": "5d9428bb0b792420fa8aae6506d5e8861c414773a739d109600d0962f0deca86fea7e8956baec0248e37930e97ae6665", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587762, "uuid": "5b728b45-6b9f-4f0e-866d-2ad8d2d83543", "value": "12851200B691D038F2F35AF18AB9526C993DBEF2672450CB53D626EE4B656E0ED30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587762, "uuid": "89a0e3f7-09dc-4523-af02-75bc84f85b79", "value": "79b45dad91ce6fcf67f983d96af30e1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587762, "uuid": "0a1f7fc0-d216-4090-9bd3-8cb13bd60b80", "value": "24576:OEfOZnzo3K9HTEp+Bapv/Vs4uom/VF2FK8MZY5mVbfiP7GpTYl+JqSiI8qiQaQPY:ODdNTnG+4uFF248IN6zG++MSt5daQ4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623587762, "uuid": "eed4cc57-056a-4c1d-82c7-fdff26524025", "value": 1797632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623587762, "uuid": "7392ffd8-d8af-41c8-85e5-a90c2f4e5f9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587762, "uuid": "0ac64459-d3d4-4b27-846c-817ce2c12774", "value": "76BE657E14968BC4A48510C85AF393AD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e4447e-cc03-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623560165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560165, "uuid": "b207dbc2-ed92-428d-8a54-a96d0b3c8141", "comment": "Malware payload (Mirai)", "value": "41ad2babad5977522b0911d93f08696f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560165, "uuid": "ed413a90-80e6-4079-a3e5-960eb27d4e1c", "comment": "Malware payload (Mirai)", "value": "27c4b920c072251ec44aded4e2597e185f1c10376818af7de22491304080cde6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560165, "uuid": "0c4613fd-643a-4f8b-8363-c24563bd3b0e", "comment": "Malware payload (Mirai)", "value": "b4ad37a66fd27a5ff39c7dbf4df9298ec47d86bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560165, "uuid": "531a4378-10d9-42d8-922b-7d518bbba314", "comment": "Malware payload (Mirai)", "value": "2be78af32bb0c7ca702e5a8d0f559b6ff0d3b60c7b8ae82c96b8934a2e2ecea31c7dbcb0e90658bacc573f2197c386c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560165, "uuid": "915ac6c5-3488-4b3d-ad20-1ae07c487838", "value": "B3B3A30A7F320FF7E8AFDC3759A52B0528CD550625A93B39B930D814F64B61F15E78A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560165, "uuid": "d3f8af42-3fb1-41b1-9905-7e890d4b02fd", "value": "3072:cUjrPidXd8RXa+gzJxRBhttPVBPuLAnDnycYV:cUjrPidXd8RXa+ghrPuLAnDnHYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623560165, "uuid": "2b786fe9-be10-4729-ba1d-69c0271d3dc8", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623560165, "uuid": "9a4d2e07-3ae7-4573-a896-7e5e32cd6137", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560165, "uuid": "5e6eee8b-0381-4922-8067-3acc21d3c850", "value": "41ad2babad5977522b0911d93f08696f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5e668f-cbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623555851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623555851, "uuid": "3bdf12f2-adf0-428c-a95c-15f12d0a2165", "comment": "Malware payload", "value": "4cb18717de70d6168cff708cf3eda8e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623555851, "uuid": "48860168-c1b7-4348-9b89-a011017349af", "comment": "Malware payload", "value": "2839a8016d4ca6a59e87347df29dd0d1d3800c9f2c216b6549f8709d9e849195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623555851, "uuid": "7db72875-1a7c-46bc-905a-51c90d59b16f", "comment": "Malware payload", "value": "ace3d02dcd93372057699ff75fe297f62b5caf06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623555851, "uuid": "aa8b4cad-0f5a-4e6c-b03a-691b0d42584b", "comment": "Malware payload", "value": "c70c0cc9df6e7dc79b97aa437db9daa6a05b6d102af4eaea1cebf4d4fa9a9daa01eb2383ae20896a0bda37efe6a47d51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623555851, "uuid": "9fda20c2-f180-41cf-baa5-947827f2fd5c", "value": "4EF63327B695653EC09A27350673A16058FBB66DF813BE266BE4C48CDF254C01F3B722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623555851, "uuid": "8bc1b597-1d79-46de-b3d3-b7c09939366f", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623555851, "uuid": "bfdf59c5-fd35-456a-87a4-62ecd27a44e9", "value": "393216:QFf1aSkG46UKMrl9T76/Ij6R59umFzxqgK2ioc:mta+46huLT2/Ij6R5giz/Fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623555851, "uuid": "0301cf58-a582-4f40-8385-012af4740e40", "value": 15333011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623555851, "uuid": "61c7d1e1-5474-4409-81ad-fad0b1a4d148", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623555851, "uuid": "f937bbe6-d68d-4fe0-8707-ad28151bb620", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.30568.31608.15294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dac5ed-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623549022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549022, "uuid": "3607e92e-847a-4a3e-8e02-fc9cb6fd2c36", "comment": "Malware payload (Mirai)", "value": "23b1b7e07784b1eca8cd09cd91b326b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549022, "uuid": "0e183e3c-6cd0-421a-bd17-a1c27121406b", "comment": "Malware payload (Mirai)", "value": "2938515d1f3baa56c74c51dca26d6e5586794b051c2e3297494480fd459c13bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549022, "uuid": "36584d4e-2e44-48d0-bdb2-a6705e49ea94", "comment": "Malware payload (Mirai)", "value": "7e58f999d2a2ef044a3122d34557e5c32e9f80b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549022, "uuid": "4e2c0228-9d30-4f3e-b4c5-47967964e114", "comment": "Malware payload (Mirai)", "value": "f3751893e41b2f2b7c8203773ac10898dcc6bbae030f3093fc216e465f951cc455bf86e6e80955f91b31b3ffe8f3b5b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549022, "uuid": "39893225-8a42-498b-b114-52eb212a4336", "value": "3C83F642B8929A57C5D423BBFA6E00CD372563F8D2DE3217CD115F24368A82F1DA3756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549022, "uuid": "49acd80d-613f-41e5-a93b-336795556d6e", "value": "1536:1rA8sWi6PWgInILlJF33XbAML8VPHAiJwgCBi5pa8BUCMIGd42+1aV3:1rA8sWCmfb/MPJwgCM5ptUCMIS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623549022, "uuid": "0b3a6b6a-4d66-45c0-a9a0-55eb067b779d", "value": 85040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623549022, "uuid": "8dc3c2a7-0527-4e64-aff6-12f52f02c5e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549022, "uuid": "7c2ee6a5-b6a6-4953-8761-2591a44afd80", "value": "23b1b7e07784b1eca8cd09cd91b326b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78da7213-cc5e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623599169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599169, "uuid": "d0947544-c7a5-4b8e-bd9c-bb6a240a86b2", "comment": "Malware payload", "value": "1f5c585d127ec40bedca025c08dc32c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599169, "uuid": "f2d26bd1-e263-40ec-93e1-3f7fe1ce488b", "comment": "Malware payload", "value": "2c1aa5bb60d80963ec2d4bf2db10966a2b5edcb332d9128505e8d4db2edf61ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599169, "uuid": "a2147d86-f638-4916-b531-c563d429cb79", "comment": "Malware payload", "value": "d0658f7ef3ac20cf51816473306260484e5de010", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599169, "uuid": "f92c932b-7f2d-4359-9c45-95d4e277de24", "comment": "Malware payload", "value": "513544f876239547bf35cca5a15a6820b11566ca32842eeffde92a428be77ea65632e5a72e324eb5afaa0027ae407d2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599169, "uuid": "f4a82b21-33cb-43af-af32-2004d6bcc571", "value": "F234D0240A8A6D77CECD16B24EBC9B1507F7D381F073A5A5BC8F16CEC68324EC591689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599169, "uuid": "db505a53-6a25-4b01-a6d4-6954a6eb7ab6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599169, "uuid": "1ff2b96e-77eb-4a38-95ed-019875f8db82", "value": "6144:CK6nX47zmm9A1oIpGBUUFWy/R5Nbga+gJhHgK:CKc4Pmmi1ZEBUUV/rN9+gJ5gK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599169, "uuid": "c0cf1f49-2057-45b8-86ad-8adb7dbd3411", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599169, "uuid": "b80f3958-01b7-4ab4-a936-e716c90964d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599169, "uuid": "5256b186-47fe-4cd3-b0d8-ce09ca635293", "value": "1f5c585d127ec40bedca025c08dc32c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feeb64fd-cc1b-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623570617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570617, "uuid": "926ad07a-d523-4fb4-b549-d21a84adb94c", "comment": "Malware payload (DCRat)", "value": "7fb364a9fadec5e7741021abace7f0e0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570617, "uuid": "3fc901c5-b7c5-4780-81f4-555c5f476770", "comment": "Malware payload (DCRat)", "value": "2c57f15f554fd7dbb3f4855f43c9432a48b65178a29cbb227f447cdb6afcb32c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570617, "uuid": "3bab666a-bc03-4f2d-bf3f-095b0c6f528d", "comment": "Malware payload (DCRat)", "value": "b84e18ac2f15999bd8d9ee03411f7f8c541e6f43", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570617, "uuid": "4efe2db2-0236-4f66-a470-e11cc242a749", "comment": "Malware payload (DCRat)", "value": "08e5e1d1ae791d82e2df2dffe87891db80452653e4e28093f6eb5f7be292921fcee214aa2829b7d5b544a2806a46eaee", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570617, "uuid": "33cec404-763f-4783-90f6-c87a7b963167", "value": "0D456B127644E921C0691737D5EF45140BBCEE006B62DB2BBE9E376CE9613A37D0D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570617, "uuid": "7a406ecd-b0ea-4fff-9864-3430b6aa4219", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570617, "uuid": "cab17979-a1ba-4d20-9961-28df8ecad4d5", "value": "12288:XRZ+IoG/n9IQxW3OBseSDGbj18POVae4wa5M/bprREF1ou57iEOMIRluR/qnx:f2G/nvxW3WYYjmOwDMoFL57iEEmR/+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623570617, "uuid": "4bcfc4dc-1d8c-4c4a-8878-d40efdaa09e0", "value": 1209512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623570617, "uuid": "6eab7028-4ac6-46ab-8002-439c35dbc308", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570617, "uuid": "f9180fc6-6184-430b-86fb-5aff166e432e", "value": "b84e18ac2f15999bd8d9ee03411f7f8c541e6f43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce37f4e-cc0a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623563205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623563205, "uuid": "ef263e24-48cb-4284-bf6f-f60cf266a805", "comment": "Malware payload (AgentTesla)", "value": "80819ac7d6f73b2bcbfd4c088eb12d80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623563205, "uuid": "e92778e8-b4ac-4cc5-8395-c190f62249ee", "comment": "Malware payload (AgentTesla)", "value": "2c74c934d6e8da3e5968ea367270bf40415ae4a3046b4c504cc694b98a6bf528", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623563205, "uuid": "0e5db11f-04d9-44a4-8eaa-4c74f134f245", "comment": "Malware payload (AgentTesla)", "value": "95928c65474e70971a08e9bf73e7972042fe89d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623563205, "uuid": "726c261a-31eb-411d-9d06-f737e4b855a8", "comment": "Malware payload (AgentTesla)", "value": "e10dddef64a9af292411c4152c09b9a80d2564aa8b9567bf1fd0380c3656891d1e52c4a375e9eac0a3dec94ce4f68ea0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623563205, "uuid": "198ab395-9cbd-4ef5-abbb-f15f7c213487", "value": "C505231860F5A71AFEAB9496DB005FB4BEC84E1950B7F5B13307D8F655FC42200AA92F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623563205, "uuid": "5b52bd62-0a30-4fca-aa9c-ecd7a7b156bf", "value": "24576:1yhFfiyyrJkf4nDQyJPfRuIEwR+HqFI2wMHl:1yh41kf4nDQqnoIEwYHT2jF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623563205, "uuid": "18dcfbf0-53a7-49e9-bcf2-e87a02b0f405", "value": 798131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623563205, "uuid": "6d1bce8d-592c-40c6-b6e4-0b4f852d786c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623563205, "uuid": "4e7345c2-3414-4a2d-9104-6760a13ec840", "value": "GS998M37BeqAVyf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f424fc-cc60-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623599962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599962, "uuid": "5a950343-060b-4fb1-a7ec-19a7e6d6651f", "comment": "Malware payload (Mirai)", "value": "4136a1283ce0b901a4b6aaa21f175c0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599962, "uuid": "026100ba-2026-44e9-aad8-eabc08eb0cbd", "comment": "Malware payload (Mirai)", "value": "2cf7c0eeb2a6f4704b946e9ca640868bcb811d5815c923f10c62ad562a3fcc46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599962, "uuid": "52282d9b-2f9e-40d5-8ae3-aa150e5ace07", "comment": "Malware payload (Mirai)", "value": "2e8395ef088003e0c9efc3b410c3cf0c9e69a5e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599962, "uuid": "4ab978fc-d3f4-406e-82ef-2f8f3116eb70", "comment": "Malware payload (Mirai)", "value": "4fd1c17a26d5c60910a205113055d311afd99c09f2f26f54b7ad64743ad6878f03d93f4e6d4751939b0491ab485991ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599962, "uuid": "501ccd9c-0845-485d-b256-00b2eb2d48e2", "value": "92539FB5C5A8BD99CF699278B61488389723900565E33DFAE741C7A6D00BEECF00D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599962, "uuid": "130d0c76-bb50-4168-b1f1-ebd65473f91a", "value": "1536:B/bivQhunGauwt4IduhosjT1RYeycfs3QtLok1cY3CJma:BjiBGFOdOT1Rhf+Kn1cY32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599962, "uuid": "af2a9fe7-031d-490e-97ce-16d1d41c20e4", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599962, "uuid": "6ba701d0-466d-4bb5-8198-d1274cb0dd99", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599962, "uuid": "94bbb8e3-7e17-4138-9327-f9444f6368ec", "value": "4136a1283ce0b901a4b6aaa21f175c0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d159c7d1-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623549066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549066, "uuid": "fb208b2c-cd1a-4c65-912b-fe02f467470f", "comment": "Malware payload (Mirai)", "value": "a8250cde1e2c22f59613a5b5829fa8b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549066, "uuid": "4a6f6ea2-fb31-4788-b161-47078a07b275", "comment": "Malware payload (Mirai)", "value": "2d115b7bb43411fe88ba4cb929843b5dcf897559a6c9d2ec80554723604ea4e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549066, "uuid": "bc969cc1-ed3a-4f72-9ea4-6836f2e26596", "comment": "Malware payload (Mirai)", "value": "f6dc18cf96bcc36651df52e527e0322fdf67a552", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549066, "uuid": "d2b4d117-2746-4e1f-9372-a07913b88431", "comment": "Malware payload (Mirai)", "value": "ccfe7889ad413821edc8a844130befafce4d202278acf8d23e4c711fb27bf661f5a8006fabbda5586b761b58881ed506", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549066, "uuid": "fb91b44a-7300-44d3-a585-3372525228a3", "value": "D2733AC0AD53D8F5EC1119712433EB329A72E03E2139E7ABE7ADAA639D42741D40739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549066, "uuid": "ae2686e5-0996-47ae-9160-4bc787402147", "value": "1536:C+B5/Q2EuHx9gzinMc5Wo4eTwFs2DeCMH68U0qA82DVrL8EVGHWf/+f32C:CUQuHx9gzCoo4eTSs2DZMaVX9mNQ2ftC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623549066, "uuid": "fad01ba2-7172-48a9-8e22-3ae61412c3dd", "value": 74832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623549066, "uuid": "618d9063-80cf-45eb-8f17-01f2dd343b4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549066, "uuid": "6719c8ce-0084-42c3-85a5-62bb2f6df335", "value": "a8250cde1e2c22f59613a5b5829fa8b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e59617-cc10-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1623565745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565745, "uuid": "9476f2a9-2827-4d8a-b684-c297d381f91f", "comment": "Malware payload (Gozi)", "value": "941ccb3a8c0e865c06cc8a6aa29e1bc6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565745, "uuid": "58a6eec8-1450-48c8-a5ba-0fd5ee7d3a29", "comment": "Malware payload (Gozi)", "value": "339f3c74c70ecad94a1ed77ed695e0e184f4547be4d528c80d37ea7573c4bde0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565745, "uuid": "bba1045b-cb34-49fa-893e-e6cc5c011d7d", "comment": "Malware payload (Gozi)", "value": "454885f5d511ecd33f93cb96e3afbc2c01f37f22", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565745, "uuid": "44b9b863-7a24-4a21-956b-867a449d0415", "comment": "Malware payload (Gozi)", "value": "e6465cc0edc9352df73f7a84d9551461a1d18470f7155aaf50164c070125e65f14b8a681098b7faeec74ffd19c084188", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565745, "uuid": "cf903b05-2a9f-43e8-979c-1d6b22810650", "value": "E615C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565745, "uuid": "6e0cb283-bf22-47da-a6f5-3fde2e4dd1d0", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565745, "uuid": "19e728a2-14fd-4eaf-8329-c2585bcacd19", "value": "24576:HQfpzjXPgfS8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDg+JV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623565745, "uuid": "09553874-8f03-456f-8b0b-ae428549e875", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623565745, "uuid": "d1b35e53-d7aa-42b2-9515-b128ba70f5f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565745, "uuid": "1971a789-40bf-4746-b5d0-41cb3cc69b97", "value": "941ccb3a8c0e865c06cc8a6aa29e1bc6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef9807c-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623549035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549035, "uuid": "75754368-e2a4-4910-8684-ca8ea098d2ec", "comment": "Malware payload (Mirai)", "value": "003df8e74dfd857b18fac9052721bced", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549035, "uuid": "95d8bf1d-096e-4507-85f8-d7178517c9a3", "comment": "Malware payload (Mirai)", "value": "33d1278bd6814501e0c41ad75a48a80a408acee178f403ea2e22f0d849aaf8fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549035, "uuid": "6856f20f-1981-44e6-84eb-f44fca17e105", "comment": "Malware payload (Mirai)", "value": "b5593005ada8b4ef0589fda98b1c08cef1744c53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549035, "uuid": "b7870402-739d-4595-a7af-389929a77434", "comment": "Malware payload (Mirai)", "value": "fb4f09a4baeffd469dbbe3c54f24396dd5d0f61edf2f09e67d4892bd0eeb37be1aeb472a855de3a62a714ff1593dcb68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549035, "uuid": "987e6d5a-b9b8-476d-a15f-0e3e83e82171", "value": "A8733B0233680B07D6560EF42D3F17E483BEF99122E4FA86191FDB6A4635E371186F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549035, "uuid": "9c8e0e71-dbc7-445e-b058-d2fec9fc4c37", "value": "1536:fkOmUMCIThVB1TWYEO72apB2xh+46xUJFdmnsidQGd42+IaV3r:fkOJu/i846hsiNyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623549035, "uuid": "0c813f48-170a-49a3-ac27-b1285328fcd0", "value": 79324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623549035, "uuid": "35ea6023-9e23-4487-b9bb-1d8284d8cdd1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549035, "uuid": "af9b7a21-d80c-4c21-a6f9-0a94041a86ee", "value": "003df8e74dfd857b18fac9052721bced", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45966a91-cc60-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623599942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599942, "uuid": "a45b91d4-1a08-4154-8338-5fb7f323850a", "comment": "Malware payload (Mirai)", "value": "fdfaf67b2368def010804c1b54139b4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599942, "uuid": "946bba67-e2cb-4a29-929c-502c05043dbb", "comment": "Malware payload (Mirai)", "value": "35395eb9776001b92af22aa1b6762271b95bbda622f3ec68665823b5cbb76d58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599942, "uuid": "c174b37f-00d5-42b6-82b7-31bc59eeaf9e", "comment": "Malware payload (Mirai)", "value": "8c84320ead4230c7cf06eca8e8d5c839772a2aa2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599942, "uuid": "fe2bf240-1582-4f04-9263-e8f3160a5dc9", "comment": "Malware payload (Mirai)", "value": "ca823bd2a9e067da13754338c6b6f105b65e43095f2d611ec0061c491862d6bd42888af491a391cefadc2184b8e2b919", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599942, "uuid": "5e4c386c-7a9d-4c3c-915b-880af379d783", "value": "B3332A8A64112E6DE9DA5CB981664F0ADE541210B093171FB3BBFEC339333A4FE66449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599942, "uuid": "ea4473ba-149a-406c-a6d4-6d2bd9f72318", "value": "768:0aOTrZQlDVoueg2me2nPQCHEM/ArPwqLWH02TCmhPol7gSu9+f1prN4nZ0ezi1:0alDoRg2mew4ChAVLB2Y7gSyg1ppWq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599942, "uuid": "4372cf17-ffaa-4b7f-9d6f-68148670fe5c", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599942, "uuid": "3a599bac-3049-4385-85e0-fd95842566a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599942, "uuid": "8746c8f2-8566-4543-a3b6-24ad9c054762", "value": "fdfaf67b2368def010804c1b54139b4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d1d399-cc1a-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1623570017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570017, "uuid": "4a908620-290e-4342-88f5-bb66dbf8bac4", "comment": "Malware payload (LimeRAT)", "value": "dbc5188488d1db31ee6505a6eaf6ec27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570017, "uuid": "33f073c7-598e-4b5e-91c2-a6b238af77ca", "comment": "Malware payload (LimeRAT)", "value": "355b53fed23c55e1a184e85b1c108a09546bd20a2cc5e1e27350406edc0fbb86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570017, "uuid": "eeb27577-c9bc-4229-a72f-1226259cc994", "comment": "Malware payload (LimeRAT)", "value": "9744b2299dfdcaeb12122bd7478d3477c41891cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570017, "uuid": "0884391d-28ac-40bc-8fc9-5a76d81aa12f", "comment": "Malware payload (LimeRAT)", "value": "3f8ff79f76a4aea6d747dedb10604e5a6ce4d43de6f3f82cf3331d94e55b338ab62deff784c845a8566adcd83ac08923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570017, "uuid": "e983651a-e79c-4cd6-b170-13c30ae63b5b", "value": "D205AE2523D4AFA9F13E977951180808A3F6BC27E335CE4AFDB504DAA561F41C7E1A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570017, "uuid": "c8ab35ad-e1d1-4b9d-aeff-886d210f8357", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570017, "uuid": "81c2ce25-35c1-4282-af00-b009f94cf550", "value": "12288:hT+qGgMlVgA7UinZT7KSqnc5YQEeTweqVxcvKHMTBjrXdTrXdJZM4e/ZUdtb:hTLGgc4inE7TQEeMtABfpDNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623570017, "uuid": "11dab590-f35c-4f67-bca3-ce0427c99817", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623570017, "uuid": "0ee4f90b-8f67-4e64-9301-01b951965eb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570017, "uuid": "b582148e-aa07-46aa-815f-b306cf531870", "value": "dbc5188488d1db31ee6505a6eaf6ec27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5a8a36-cc32-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623580220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623580220, "uuid": "727ee115-2d26-44cf-b852-670373f57e7f", "comment": "Malware payload (NanoCore)", "value": "1c4c6737071a7559816a1f443e6dd1ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623580220, "uuid": "22022b16-2123-44f3-b710-5ae4b61feaab", "comment": "Malware payload (NanoCore)", "value": "362ae494bfed3fd5e8137a652139777f3a986bf63fbcd17e74bb9c1f0e2cd500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623580220, "uuid": "ad74f806-d4b4-44e0-b377-a8c25c271454", "comment": "Malware payload (NanoCore)", "value": "422dc56653c22b5c61c1173bb0c38b4fab370221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623580220, "uuid": "4180e937-2ec0-4056-9f73-790b6a667936", "comment": "Malware payload (NanoCore)", "value": "03cfa2a39937c4c96f943df2bc5cf98e9c49df57b379b0ebc152b04c63fe714d0e8eebf5b639547ddba5960d9767217d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623580220, "uuid": "6f280ecb-ed61-4539-8e7c-3f6c6802597a", "value": "A3251202B6D188B2E17328325A3D7716A97DBD201F28DA2EB3D44D6DDE355C1A234B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623580220, "uuid": "73d5cb06-b4cc-4302-b422-44ae012e0157", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623580220, "uuid": "0b40dad9-8b8c-4437-9d9a-be533417820e", "value": "24576:BAOcZpJnDxFacczvk+Li1/PYCmR4H9H721x33+c:b2dF9cz8+LoPYlR4H9Hsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623580220, "uuid": "891d73d7-6742-4b31-a281-ae7400c154e7", "value": 984838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623580220, "uuid": "7cbfe440-9072-4764-9eea-b7c6ef75eddc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623580220, "uuid": "aed4c232-4ba1-4a83-8991-cdbfdcf2b914", "value": "1C4C6737071A7559816A1F443E6DD1AC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec36a6e-cc42-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623587126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587126, "uuid": "601a00b6-706a-45fb-86ca-f0e383e4c7f4", "comment": "Malware payload (Formbook)", "value": "6b87f270d790f7347d9587b9e87e3f17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587126, "uuid": "ad0091a1-1e30-42f4-9f55-8fcc979e3cad", "comment": "Malware payload (Formbook)", "value": "368453224d5fa4791e4ecdaadf22e0da181e6e8b997c49de837d90578fc566b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587126, "uuid": "4ce07ccd-3794-47e7-b4ad-294425dd7837", "comment": "Malware payload (Formbook)", "value": "781f3ebe8feda369785aca58869fe54a379250dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587126, "uuid": "0c10348c-fb68-48f4-969e-068b2d8ffc8f", "comment": "Malware payload (Formbook)", "value": "06fc05e2da11b0cd85c692e3315d8873a9c6f238a905b1a5d8ea5881c1945fb59015431ce5ca283db6a43554ece937b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587126, "uuid": "d1cfa71d-c067-4589-8f2e-be615d5a695a", "value": "E4F438223758CF01D069167BDEEF45144BB8EE00B662DA167E9F33A869523A36D0D1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587126, "uuid": "da0cf804-1571-4019-92dc-34982149ce7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587126, "uuid": "513bc476-3602-4524-a3a8-612390d602c3", "value": "12288:lB660L3A5XoK34wwVZtN2kI4HQnW9lZopKmT5q3UNRL5qn:lBGAR34wKtN2Rgv9msS5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623587126, "uuid": "e52d2b21-8901-437d-bbc0-f8f4938f2fc5", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623587126, "uuid": "f3df83ce-fe1a-4baf-9622-1679e2525f63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587126, "uuid": "b67cf987-bce8-4e87-8666-bcff94c642bb", "value": "6B87F270D790F7347D9587B9E87E3F17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de31dff9-cc20-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623572710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572710, "uuid": "c5f5f0da-6ccc-474e-99b9-381921f7b7f2", "comment": "Malware payload (AgentTesla)", "value": "de9af93a5a6d5ab00fc1cddab15808ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572710, "uuid": "dec90ae0-d9c3-4b90-bbd7-07b96dddb60c", "comment": "Malware payload (AgentTesla)", "value": "39de82a4e41fde4880f70b45cc8bc85337c8f0de7556c5dc55e986f8d50ba211", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572710, "uuid": "7390b941-a18e-4a5d-8ce9-4d9af04436de", "comment": "Malware payload (AgentTesla)", "value": "e3c170fb2b64be0347c51abe831051750c8b1a26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572710, "uuid": "3c7bb673-07ee-49b7-b400-7d79b3210931", "comment": "Malware payload (AgentTesla)", "value": "31bdd8ebdd701ae9e6c578f52dd045b7fff1410a3a6d5f635fd667c336921d8317817802db108054e9caa46ac625fa48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572710, "uuid": "05bfd24b-155d-453f-bc2f-32d3fcc0e75f", "value": "8A9402283EFD0E1AE5FB6FB4A4E466419775B1271613F70E091221EE0913BC2C951BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572710, "uuid": "c21b58be-d189-4bc5-b66f-a632a488ffa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572710, "uuid": "ac4bb8b2-01e0-48bb-aaf2-cf426befd246", "value": "12288:fqu9vpS/YjDicZ+18wcPVnlsdforNKs2or:fq4pS/Yi8y8w8jcorNsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623572710, "uuid": "25344dcd-0324-4e70-b5dc-5394cddbc51f", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623572710, "uuid": "c8dd9872-657e-4d70-a811-cd6da8601711", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572710, "uuid": "9085d31b-fe1c-4b4f-8fef-16c3f1979977", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9b88cf-cc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1623613540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613540, "uuid": "e9cedc22-05f4-4662-b5f1-14e5dbc1e66e", "comment": "Malware payload (RaccoonStealer)", "value": "207f71c5906c453f2428ef99c0729aa7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613540, "uuid": "fb519cc0-7d4b-4ba1-9a02-94e7cec9ba1d", "comment": "Malware payload (RaccoonStealer)", "value": "3a263905c7695f04ad18b655c5ac1233928bf66f845ab9962d23ffa043dcb608", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613540, "uuid": "a8fa5ee8-7445-41bd-b8bd-b9a0d6e6ef92", "comment": "Malware payload (RaccoonStealer)", "value": "4e550fd89735c223f8bce0eb3fb03488468a3005", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613540, "uuid": "c9e72673-64fa-4619-85b5-6d960c44e998", "comment": "Malware payload (RaccoonStealer)", "value": "1f03acb1cfd50093052d8d7a897e7692a36dcb90c329030998bb36f7a71f958b5cbed54493cc3b36612feb636e57c987", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613540, "uuid": "ff16d5bf-d2da-4d22-8ce3-e9ee3a58b897", "value": "0AC4E000A760C0F4F4B735B8597A9E68A5ED3EF1A76480DF13C626EA5A345F0AC31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613540, "uuid": "57e6003f-25b6-439c-89dd-ee7d143585a9", "value": "f48d40448beb628ea5f30fab00d7ea57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613540, "uuid": "72b6dc12-a2d2-42c1-9b55-d5c3bd06264c", "value": "12288:EV28a8nNQLFvvn3nt7PkbNC1/Y9JzrlV:EQ87nuXn5MbN79Vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623613540, "uuid": "3b425dd8-a7f6-4a96-9101-b85e4a0e6344", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623613540, "uuid": "65e4b5b4-ce13-455d-a887-ca278f973adc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613540, "uuid": "92c6caf1-f285-4f43-a139-b6d6597f7458", "value": "207f71c5906c453f2428ef99c0729aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cbb5d8-cc22-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623573478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573478, "uuid": "6e010ab3-d35b-4a43-b6dc-e4f3000c8685", "comment": "Malware payload", "value": "866cae59f4ccfd83e40cc8d1526e077d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573478, "uuid": "8d32f42f-0f20-413c-b93e-ed8798a6ba2c", "comment": "Malware payload", "value": "3bc17069b5039c943c2063ef438deb9cb20653ebf911eebada81c04e67ae70a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573478, "uuid": "733766fd-57be-4b3d-9794-59a345e97ab2", "comment": "Malware payload", "value": "29f9de00c2d9f4e5c7a2d035c65f8736122490b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573478, "uuid": "82ddf94c-752f-4710-a634-0071d05d734a", "comment": "Malware payload", "value": "1c92848a85eca849aa5c0e250c5197263f93cd7b60ed3f79ef7ca04859ddba2148095da1a19875bc3eb363f0fb2f7dea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573478, "uuid": "06e351e6-c6d9-4b9f-a408-6f6419bfa47a", "value": "19059F9D3140BCDFC4179DB2896D9C30A53438AF8317C60F21036A6D99AE7936E167EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573478, "uuid": "bf7f1c68-bfa9-4caa-a6d1-76a2167294b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573478, "uuid": "2a5f8447-6083-4a85-8d3e-8aa9a2269ccf", "value": "12288:XFtBJ0J//ja5HYinyT+hw5INyu9x02HhJkL+bxEnUs2d5DWpLC+NIjlRVZY5SitJ:XFbJ0JQ4i+MwWn9vvjY5dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623573478, "uuid": "93693e1e-7d17-473a-8c64-f242ab2d62a2", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623573478, "uuid": "bb593f4f-9d7e-4fb2-8716-d23479f67b54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573478, "uuid": "8b19095f-cd02-441b-b753-90ffcaa9b11e", "value": "Request for quotation - Stock for East London.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d56a08-cc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1623584720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623584720, "uuid": "fc0a33b4-9eb1-400f-bbb6-d13d5b727a1c", "comment": "Malware payload (ServHelper)", "value": "63c81bd2299db58959013ff55b6f3698", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623584720, "uuid": "ba71b5a5-98ac-437e-baf6-db10d6af1bc6", "comment": "Malware payload (ServHelper)", "value": "3c41569f2ba7a3e123f2156e541c52fc924897a49a34139b87d5a1b93fb1f94d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623584720, "uuid": "da671587-1ef4-46f3-bf46-87175a28db85", "comment": "Malware payload (ServHelper)", "value": "ca9b8ed3f8d10d1e01411eb66e80549039e7591d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623584720, "uuid": "ea0ae604-bd79-44fc-8968-8abf94e8cc29", "comment": "Malware payload (ServHelper)", "value": "f7d27a342bd3bd9f056af2cc154db42c59e638c61a5d23ec2d3bc1f240c071b8d277091ee0fa901a4f51725b0d7b39b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623584720, "uuid": "b77ba3d4-9582-4512-9874-b0756dacd4a6", "value": "E5761110E683936AC86BFBF9B05DF27941A45D7F1B1886D37770FED528E4E848229630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623584720, "uuid": "bd55c06a-dc67-4a61-9371-10e564ec9aa7", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623584720, "uuid": "0a0ad19a-7a32-4d9b-be62-e321c8bc9c5b", "value": "196608:5NhTIvtDeVjU+9cy9Vtg0HPZEPhCQ4eDv1MtWDd:5XTIMVjU+9PtzPOgQ4eDQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623584720, "uuid": "098405f3-a30b-413e-9022-40dffdea8c37", "value": 7298158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623584720, "uuid": "f91b4a20-9930-448d-abf7-b2b00dc54437", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623584720, "uuid": "93eebe28-5134-4ee4-8941-c329bdf08b3e", "value": "63c81bd2299db58959013ff55b6f3698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ce5cb7-cc26-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623574996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623574996, "uuid": "cc84fece-bb12-4a95-975f-07530f3b3e49", "comment": "Malware payload (Formbook)", "value": "5297d4667baf6a516aa7d73b0178024e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623574996, "uuid": "37d7252e-48ce-4280-9c70-8b9da2314193", "comment": "Malware payload (Formbook)", "value": "3d067ddc4024d82db9f90413f6fb76f61552cceab8abbbf3db08bee43730470a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623574996, "uuid": "77943e00-bfd3-40d6-886a-e718d32bd175", "comment": "Malware payload (Formbook)", "value": "41d1b8ff9ede02c637692b4594af1af3ab4cf39a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623574996, "uuid": "0d3d1fd4-acc6-4f18-9f11-ac24b1cefba0", "comment": "Malware payload (Formbook)", "value": "929953785c50a58ace9191bc1ac93799b29b5030f1cfcc83026fd732abd86c5efaa62ab519ea296033d77a330759f775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623574996, "uuid": "26c9c38b-bbd2-4c17-a418-7998802b4041", "value": "5494221769E2A741DD9E4EFF8DC2A0808A9DE0923987C33F1784E1501C637EED78A576", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623574996, "uuid": "4186de28-d4a9-4fcc-8778-2dd0e3b3e576", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623574996, "uuid": "12271266-a2e3-4150-8205-cebe2c1c8f68", "value": "12288:6P+g6bWEMawVpsoh10FZew8og6vl8FqiVhTK:6WH6EIns1Dvl8FfzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623574996, "uuid": "8ac02c8a-ee31-478e-916b-509f84c98007", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623574996, "uuid": "331f1fae-f92e-4f78-bedc-1893c9223370", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623574996, "uuid": "b28bb3b7-1a06-4495-a64b-eec6377ed955", "value": "Scanner_Jpeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f97c5d-cc5e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623599160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599160, "uuid": "e57edee4-5514-4441-a2e2-a6578e3cb7c9", "comment": "Malware payload (RedLineStealer)", "value": "6383d401a22fc0fef17b6b075f526321", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599160, "uuid": "109cd7e6-2055-433f-843b-d7888470e6c4", "comment": "Malware payload (RedLineStealer)", "value": "3f8e6820189b6308f394c0a62e7e025e21d361629ad7b73ffa436508f821eaa1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599160, "uuid": "065a8d6e-fce6-415e-90c5-9a881ecd30b8", "comment": "Malware payload (RedLineStealer)", "value": "c8f291ef14ee51cad69bed6caf16fbd93a10b83f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599160, "uuid": "a7bbc010-0ce0-4205-8954-51104dada201", "comment": "Malware payload (RedLineStealer)", "value": "8001db10ba47bd5d68f066a6441fb20275dbbec4082b70e80ebbf5fba30993f21c691b8c834f8e7f93b737d974ae8d93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599160, "uuid": "88389914-06ae-4f0f-ac41-f9cd1c96718b", "value": "4A04D13A12929631CC5A577BCBFE98165331A3A2A313F7057D98028A4FB36DD4773389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599160, "uuid": "e350e64f-1cbe-407f-94a4-dc348fa34493", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599160, "uuid": "272e1de3-e584-4f29-9772-b1b7db312dc6", "value": "3072:kNHQYnix8b2owN84tc5yXPm7FC8QouKMzIuP39cZlVJbIpmrNMwfHg/CaI:kNLpIA52OHQNzI639KJhHgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599160, "uuid": "8cd63295-60fc-41b1-99b2-8af9b9d8d4df", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599160, "uuid": "b271ce9e-5972-4422-a3a7-7e33c8d35c69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599160, "uuid": "b534db62-5be7-42a3-8279-e3a28755847a", "value": "6383d401a22fc0fef17b6b075f526321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e2883a-cc41-11eb-875b-42010a9c0053", "comment": "Malware payload (Amadey)", "timestamp": 1623586522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623586522, "uuid": "6c99860f-1f71-4007-bc15-abb34af003c3", "comment": "Malware payload (Amadey)", "value": "298c359be4fa9e1d4c341e898a4dbf65", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623586522, "uuid": "716580b2-0ee6-45c9-b3d6-c6edfdf8e758", "comment": "Malware payload (Amadey)", "value": "4047099fa48723c13197f32b1b1c4ca5c450231d1bf8b693df939eb16363f4b0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623586522, "uuid": "36a4e2f7-d3b7-45d9-b03a-b406f4fa2c8f", "comment": "Malware payload (Amadey)", "value": "8e7ac858f1d0260c7b89e5566987593cd9fa4921", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623586522, "uuid": "9fe9d291-f8c9-496d-bccd-a55f0ba3566b", "comment": "Malware payload (Amadey)", "value": "28766193616d2b0fdb1b80916bf25325da9d9c1b3df6b66417a75783d90f42cb13f2bae56647eca12a3023e75883fce9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623586522, "uuid": "64a4c5d5-e102-49e1-8734-e6ba2fd1a6a9", "value": "9D450241B6148AE9CAA9047154DB452803F6FEB7E231B34B7F5C325C29A137B4E16BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623586522, "uuid": "5180d6b6-fbb3-45cf-9c30-c989cd6c2819", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623586522, "uuid": "cccd176e-bb22-4bbe-94f6-319325ae8c91", "value": "24576:Cbi0ZHA5borC5M3fITUSLVT8Woe2l8TrPtEJe375TKeEvybA:CSborGRh1T2UrPtECQePb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623586522, "uuid": "771bb6c3-67aa-431e-a7fa-60c4afd2d77d", "value": 1204736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623586522, "uuid": "25ba6c29-e7ef-464e-bcd4-f92e3b4e2566", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623586522, "uuid": "97169a60-1f34-4426-8261-ddf3f90fd217", "value": "298C359BE4FA9E1D4C341E898A4DBF65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe27813-cc04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623560418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560418, "uuid": "2e63e698-07c6-4b0e-8aea-4a7c3ef6ff4a", "comment": "Malware payload (Mirai)", "value": "e02426c746285e7c1d962f63c9d57047", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560418, "uuid": "1c83eb84-f7c4-4265-aacb-f1ea1c65892c", "comment": "Malware payload (Mirai)", "value": "4669c1daca56f125b91e37c5d42c8fcf4ca541ceb83a6647252f98c40c57c16c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560418, "uuid": "72b1e195-03cf-4f94-8222-d5003655c4ba", "comment": "Malware payload (Mirai)", "value": "4f833c6c320201c4ca2e8469ef2a4da7546b6021", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560418, "uuid": "95672f1f-2f56-426b-8791-dc17ba06706d", "comment": "Malware payload (Mirai)", "value": "ae7dc9cb5e79d30c9146a5dee6b2cd9425a53f56d62067b519e52da51d39c5ad9bd11ba3bd04f9ec816b4844723760f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560418, "uuid": "38eafe1e-32ca-43f2-a178-0c021050d89e", "value": "5E531A8D18521D2CEAC69CFD98254F0FDD98231095D70B0BA2ABFDC33EB3269EE15945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560418, "uuid": "77111010-4051-4bf9-9f56-4c8a3debfe60", "value": "1536:NcsKajCljm6sccM03Fggze70Rwg1pcqBTWwCn:NchcJciRFpcY6wCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623560418, "uuid": "d927c376-72c7-4814-a785-dfd0b36e9746", "value": 64884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623560418, "uuid": "63b132af-c3ad-4da4-92f8-a9436ad134aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560418, "uuid": "369a8206-581a-4848-94b1-7a546a6eeaed", "value": "e02426c746285e7c1d962f63c9d57047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9966f7-cc58-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623596412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623596412, "uuid": "d8e615a4-6d3c-4840-92b5-ac54901cb975", "comment": "Malware payload", "value": "5c02be60d05b65e7b32e7e2050837a74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623596412, "uuid": "12bb8969-042c-48da-bd4a-face0facdd4b", "comment": "Malware payload", "value": "4bdb253127557e7a62e50311b22a830f62feeae4329a21123f7e0478bae362b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623596412, "uuid": "48db386f-3982-4cb6-9387-fcbf9d191040", "comment": "Malware payload", "value": "9cd59ce51e11e516163faa3f85b164e4080d9b68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623596412, "uuid": "db60c4a3-8442-45b6-9e3d-91bbf2584809", "comment": "Malware payload", "value": "18d6f0864777b18424d3ac07eb2c672d36188ad73d9fbd096f52d578fa9c9f755f61db4745687307379582ac59016ebd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623596412, "uuid": "86680a7e-3695-4c8c-bce4-3aa66abcc601", "value": "60A4E10577988E06C27FC4B99460F3158772818A2F33D3161EE264DCA9767D2BA26F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623596412, "uuid": "3d5166f0-eb77-4f94-9cd3-799b87e541be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623596412, "uuid": "5b99974f-5ed4-42c2-ae1c-d5c427af274d", "value": "12288:Sdzg5bOEfSBdYziDTBfp/99tmqxlWALoz48bLz4:v5bO7dYzkB1lmGEALo0AL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623596412, "uuid": "2492ceb5-01f8-47c5-b36f-098f88d8c726", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623596412, "uuid": "d5d3217d-7f35-4b9f-929e-074f01a8806c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623596412, "uuid": "a4dae527-033a-4c66-b2ce-48ce621e40bc", "value": "5c02be60d05b65e7b32e7e2050837a74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9e6a29-cbf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623555855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623555855, "uuid": "a4dc1a22-e810-4fee-8a6b-823675a8ac25", "comment": "Malware payload", "value": "f205719f8a6567c385cdcc1ee4a41247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623555855, "uuid": "419992ba-4bc0-492d-943d-3a4d3eaa2c37", "comment": "Malware payload", "value": "55b8487b8a8ca2990bdc80cdce9c5006ae886dfcba120679ac2df2078f7e0050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623555855, "uuid": "9210d8c2-5979-42e7-aa6b-569916e601bb", "comment": "Malware payload", "value": "983227d1ffd47b5c732602b8bc8a31e67240e0f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623555855, "uuid": "03b5028d-7981-40da-ab0a-bb42f2d4d254", "comment": "Malware payload", "value": "b48b88a3ab4fd6b666d87dd1fa909da1f5e45e16942963e17466006842ed83567e3149739463b13a08a10c0817128a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623555855, "uuid": "381ab33a-b80c-4844-b818-d7d0343d4107", "value": "FDF63317B289643EC0AA6B320673A45054FBB66DF8177E2766E4C8CDCF760C01E3A765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623555855, "uuid": "b6dcfcc9-ca19-4f27-9949-30cb2d6452e0", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623555855, "uuid": "eeb8c37e-efb1-43ba-a107-70db5ead0637", "value": "393216:xYon0nJIzsBrKx/SYrKXPiioukOcPlpNVsauWp4MtEy7:+oSIzsBmmtounElPiauWL6y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623555855, "uuid": "8aeb4a27-3432-4274-a7f0-0d9da10553f3", "value": 15333012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623555855, "uuid": "0aba07c1-4c32-498f-a436-87a1c88ab50d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623555855, "uuid": "78900cbe-a4a9-4fba-9bab-7e16c3cae143", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.30568.22629.20726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2765acc-cc0a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623563241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623563241, "uuid": "c3220f36-7437-4356-8cf1-37e5390b9868", "comment": "Malware payload (AgentTesla)", "value": "554535e9473bbc8d8b622a7a0367a506", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623563241, "uuid": "94bb7bfd-1262-45a4-93f4-72b837327cc4", "comment": "Malware payload (AgentTesla)", "value": "5819733ed35e38adfd24c6c0b9da7efcc49e611b82c3fa5ab3e716c3fe63d295", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623563241, "uuid": "839705ae-d978-47f9-8ed3-94be5144df9e", "comment": "Malware payload (AgentTesla)", "value": "5be3f98aa373512f51bb32cd8fee1e78005b97b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623563241, "uuid": "23343016-a891-4640-bb00-ee6842fce67f", "comment": "Malware payload (AgentTesla)", "value": "e1b2bd2e0a03879f65be731cd326a4dd8e303d98d5a83cd3cd8cedb064f884647dbb064d16ec16b6067341d3e9114baf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623563241, "uuid": "c9011fc7-dbd9-4428-8012-d2fe25659b89", "value": "08359C1133546FAAF0BD477B99480444E7FEEC06A735CAA97CFA31DE50B1FA192A0607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623563241, "uuid": "da9be241-0afd-43dc-9e23-3916ecc2819f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623563241, "uuid": "9196795d-b26f-4a17-834b-f030cc117f8d", "value": "24576:Qq/EQ40dBIgyIfJQf4nXmqTdfRuqJfNeBUdtxe:C0dBdtQf4nXm+FoywBUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623563241, "uuid": "36ee0521-365c-4949-b283-1467d75997a1", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623563241, "uuid": "7c576d1e-553c-4ada-b285-db42f6852cf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623563241, "uuid": "5a60bd81-c318-4316-8e18-ac88f3a3359e", "value": "GS998M37BeqAVyf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5be6f2-cc43-11eb-875b-42010a9c0053", "comment": "Malware payload (BlueBot)", "timestamp": 1623587768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587768, "uuid": "dbf57365-f8c2-47e7-a430-5caba5f4f57a", "comment": "Malware payload (BlueBot)", "value": "9154558e751f127a9ea12af0597fd4ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlueBot", "colour": "#520618", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587768, "uuid": "dc566ad2-4101-49a1-a853-84b8890d1b75", "comment": "Malware payload (BlueBot)", "value": "59210bf219446c40191677ce23ddf2d2274c28234e98ffd18a610dde46d6e405", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlueBot", "colour": "#520618", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587768, "uuid": "3df6b7d0-48f0-4efc-8a83-1963f232d10a", "comment": "Malware payload (BlueBot)", "value": "b4b9d6767afa1d72bbaa2b4671440686107bba62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlueBot", "colour": "#520618", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587768, "uuid": "f0873d34-1236-4fc4-9fcc-c78256ddb969", "comment": "Malware payload (BlueBot)", "value": "db7fc1b6a806826f556584ec46462516af96dd5330ebedad5e644385b73747e1b56f1e407b25c241466d19970ba9bb64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlueBot", "colour": "#520618", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587768, "uuid": "d44faabe-ee25-4d11-a275-7a1b7bafd5c6", "value": "9E03E808B3E84712F5BB57BE68F745064736BA22CD32DB9D256D814E0BB27048942F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587768, "uuid": "255f38e0-35a4-4e81-8cdf-6d5dd54bb66b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587768, "uuid": "18c1b615-ded3-4ad9-b31a-91760968e1f2", "value": "768:P9r8vm0w2Fsd1eWBJVvz0X+8hgzuhjZd6XhkhGhDY6r1dQrLhx56ZVz9sYcpAGP4:Pavxw2uJ6Xh6CBnwiAhY6r1dQrL/56ZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623587768, "uuid": "d0544663-3cb0-480e-8382-344b57a9fadb", "value": 39962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623587768, "uuid": "ee210676-0dd7-4996-9ddc-71669db1efcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587768, "uuid": "ed245c7c-56a8-4a12-ae2f-9582caa976e4", "value": "9154558e751f127a9ea12af0597fd4ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d639f6-cc5f-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1623599430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599430, "uuid": "98528db3-21bc-472e-9111-cea08422e34b", "comment": "Malware payload (CoinMiner)", "value": "a06f7662b29f5e3e2831cb96fa1db1d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599430, "uuid": "13ec9576-9aee-40f0-b346-0237c1c622ef", "comment": "Malware payload (CoinMiner)", "value": "595b0ddd1f7940d37401a95f6a856496f7200068e0dc9f37e3eb4990002bac28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599430, "uuid": "ac563683-ad56-4380-a0c8-c61766b468d8", "comment": "Malware payload (CoinMiner)", "value": "a34f1f5353f8239907642cc6b01df4a0ab3ccd1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599430, "uuid": "1b597af8-d177-4cca-a3d5-a6b941343061", "comment": "Malware payload (CoinMiner)", "value": "2e41814d6aa5405e815b4267efadd18a4c43ef9c8b74089e31e3633d36c32aeedd14afe3ac2d5594ff95e5fc64dfc0d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599430, "uuid": "1a042af1-940e-4884-9412-68b5d58ea769", "value": "CDF1E600FBDC8365FDFB8A7464B3231107B5E7848D57EB5E4684A11E2C273228D62B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599430, "uuid": "27a46dd3-89d8-4751-b880-d7319564dbc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599430, "uuid": "8b2f52bf-353b-4555-8d51-bfc7f0835d78", "value": "96:1Vt1NC4GV1i/2/k0cNEgii93Rpog9NVH7rO22aopwlVitK3o1QhgzNt:1QTKqgvVbrO2VflV3oOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599430, "uuid": "ee92aadc-513c-4ba2-82ee-9325adde74b8", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599430, "uuid": "2db65c75-d8b8-4e4a-b372-02dcf5c0b21e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599430, "uuid": "5d915f8b-a702-4e17-841a-f7afd806249c", "value": "a06f7662b29f5e3e2831cb96fa1db1d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b86b85f-cc04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623560411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560411, "uuid": "502706d1-95f3-469d-9908-c1de38935a8c", "comment": "Malware payload (Mirai)", "value": "364afa73c990893dd33c69d8ff6598ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560411, "uuid": "0bfa75c2-d9ad-40c1-b34d-459983530c7e", "comment": "Malware payload (Mirai)", "value": "5a1d7a5d9bafda2ca24b1db2d43f38970b32cee4342ad9334b939e8187b85b31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560411, "uuid": "766b4df8-d016-44d4-bfc5-00fec675bd57", "comment": "Malware payload (Mirai)", "value": "99bd645f0e64efdf669f3bb512575d3b8b749bbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560411, "uuid": "e95667b4-0ae2-48c6-ab31-ca0e9ea5037b", "comment": "Malware payload (Mirai)", "value": "a8e620b6182b817ed055b49e3d692e378f3fafcac3b135a5ceeb58296f5c5b3edae147a895c91f2144a33e150b5a2414", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560411, "uuid": "dca411bc-916d-44bb-a4ad-d7d995013087", "value": "12A3A41D2E229F7DFBAD873947B78B21A14533863AF1D4C1D15CEA012E7024E641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560411, "uuid": "a997c532-dfce-4c52-9408-dcf871ce5d3c", "value": "1536:WJdoxWp1TCqwoYNSNUBw2CwCaV10vfkCZxT9KZlnkxNYHRmGkcTti6h/th:Kopq80HbZMnkxNYHRmGVTtH9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623560411, "uuid": "ab81d829-cc1a-4226-9f3e-a6e70598e370", "value": 104444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623560411, "uuid": "314d7a87-4c94-4090-8246-8dc7376015fe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560411, "uuid": "b5156c5c-cd89-4f1d-b0a3-51b197fcbd26", "value": "364afa73c990893dd33c69d8ff6598ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8df1ca-cc60-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623599952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599952, "uuid": "a43b6d56-1f57-4257-8425-33fd0d163d7d", "comment": "Malware payload (Mirai)", "value": "860d8f9d64170276c9e5ee56815a90a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599952, "uuid": "27268e18-790f-42f3-bd7b-0bfb5372621a", "comment": "Malware payload (Mirai)", "value": "5aea5068d29632c377c5d0c04557268b924659bb53d05f28a55fba3878f6255d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599952, "uuid": "64f55484-16b4-486a-aeff-9294d851a956", "comment": "Malware payload (Mirai)", "value": "bff01a5f335b42578fd6dc625002d4ba9ff6026d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599952, "uuid": "74f30d8c-cd58-4bbb-a097-fd484a48d24e", "comment": "Malware payload (Mirai)", "value": "9d0e9a72192d7a4541503b9be6c9b15b11b05564addd9db84f93426459fe3d948fd584330336e9764ebcdb07934bb7cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599952, "uuid": "a5aa79de-e403-48df-8d05-4d28e1fd1323", "value": "0BC2D0742801B970E330013DFF9D86875BA7C1F482F93215199416FE960B49AB9BBB8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599952, "uuid": "a7dbc187-52a1-4eba-bdcc-314846213001", "value": "768:xRSa8ZS/L6rze3OXrFKg9KZrqoDuWs3UozYw:vSjFJXZBCJDu7zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599952, "uuid": "dcfb177f-7e06-41ea-9aae-8c949a3efef5", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599952, "uuid": "4cc02b1b-e4e1-459e-afd5-6dc88a7e09ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599952, "uuid": "49d21936-2a9b-4ab9-bcb5-1b55e763d205", "value": "860d8f9d64170276c9e5ee56815a90a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6a0342-cc5f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623599683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599683, "uuid": "5ae7e030-bb96-4a1b-8474-d0b7f7491420", "comment": "Malware payload (Mirai)", "value": "baf64f6ff9de6971178a689046033573", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599683, "uuid": "2fa4ad09-a095-4524-a345-6be05dfd6ca6", "comment": "Malware payload (Mirai)", "value": "5c9a4bbbdc471e97b886f1201ed9d36d57717c4b01f349509305ebfdf9aa6542", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599683, "uuid": "98bae793-4db8-442d-bb34-bb0c41b90146", "comment": "Malware payload (Mirai)", "value": "4d26dbbedb3cb88f1ef82e8d85d70f5e04563616", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599683, "uuid": "74da0a4f-ceb1-4045-9902-236559a7b777", "comment": "Malware payload (Mirai)", "value": "7b1203ce19eb95976c2062c71a707eea2139e9cecf9fddfbc5ce989c7894cdea8c7c07dc10b58d98fcd6c36d7d082725", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599683, "uuid": "64ab9795-001d-4f85-8d41-7a856c039377", "value": "2F33F156B0057421C7703637F82611D3BF491BFE96D334370A2843A8E8E94A77AF6DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599683, "uuid": "1f65d6ab-2096-4776-b832-83b84f484655", "value": "768:yMte5B4PACtw/YcmRIe18D9q63TxZQbSORe7Su2QJnKE79TLrQxk9q3UELbOs8qk:yM84ISRX63dZQbS5rzZQNLIVmWjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599683, "uuid": "6df8e2cd-b31e-47ff-bd83-5ed602b741f0", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599683, "uuid": "2d681b70-5243-429d-9767-c26c58502df8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599683, "uuid": "fc7d081a-d6ff-4367-83c7-6e99d6b2abb1", "value": "baf64f6ff9de6971178a689046033573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b732933b-cc48-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623589824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623589824, "uuid": "ae4f3ea6-4380-482d-a3dc-5d5844d92ca3", "comment": "Malware payload (AsyncRAT)", "value": "a46512509d72d2162e0fae7857bbc351", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623589824, "uuid": "6c0f7217-3100-44ac-93b9-5e4bb9d5b9c1", "comment": "Malware payload (AsyncRAT)", "value": "5e10b13c7ddc3ebc3165d2860a6ac93a0b32018e66fdc883fb23cbc6fab1e815", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623589824, "uuid": "cbb2aeae-03d3-42c2-b275-a3b5cb095284", "comment": "Malware payload (AsyncRAT)", "value": "f688ddbcbe9b67015c78567dbc39920d8d14b76b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623589824, "uuid": "9fc0cdc8-2cd0-4a6b-987c-6e03400ce6fa", "comment": "Malware payload (AsyncRAT)", "value": "889935dd1ab07135350e6118a0af58cb6942eba7c022d663f018fa6891aea86c89354019ce38a22acd4d477500ce64ee", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623589824, "uuid": "8b82c718-28e5-4cb5-8efc-c992c3561159", "value": "2454A94BE016C6E9EBA28CF8252F4987E2465EC12461375FECD1F5050B3259F8B92F8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623589824, "uuid": "3d1c1b19-8c5e-4f7e-8481-299b0e72f13d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623589824, "uuid": "1eb93f96-9b2a-4f94-bee7-2e1bd04a8b72", "value": "3072:33dSo8Hl9k6h4YUooxk+7hoJ4xRLrSYXf7f4qSg+GEQ:HJW415kEhoyHPSaUqYGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623589824, "uuid": "dcc89097-ae9b-4be6-93da-e23382306add", "value": 303728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623589824, "uuid": "54eed3ac-787e-441e-8556-857960f07a82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623589824, "uuid": "cd079b0d-b796-41be-ab7f-4d1b10850e38", "value": "A46512509D72D2162E0FAE7857BBC351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96ac012-cc1f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623572246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572246, "uuid": "5fab5b80-1284-45cf-8af9-4bdf8276a54f", "comment": "Malware payload (AgentTesla)", "value": "d7e593a9bb19873a2d0676c1f47c5a27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572246, "uuid": "c6cfcba1-9507-4847-a8f5-2f8ee2ffc9c8", "comment": "Malware payload (AgentTesla)", "value": "5e4d97fa23c49729822d93d2eb4e2cb87d8da20392d368e9ed46b97f971c01ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572246, "uuid": "23edba00-d1f9-4e1c-b3d5-5d95d52e3ebc", "comment": "Malware payload (AgentTesla)", "value": "053b1887d4569d1ffd3a139a5f44acab66534d9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572246, "uuid": "1476f5bc-9c94-4cdc-af25-1643793cf726", "comment": "Malware payload (AgentTesla)", "value": "b976d8ff0e4c9205df66276ec97eb9a8d4ba686642e139924637aad1756d1a4570d9c6ba713decaf01f0c68172707e8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572246, "uuid": "e570d31c-cf86-4efd-929c-9f62564ba888", "value": "E8A4022C7EFD4E1AE2F79BFC94E06A5197B9B12B3A13E31D458110964923FC1C8416BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572246, "uuid": "578ab793-50ce-46b2-ad50-eede9b2123a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572246, "uuid": "eb8eea74-ba3e-43a7-bc2d-3bc5d29f6220", "value": "6144:Iq0f9pGRpP/5wPtU62ZranXBfFOmu9bxpOuVUDdEoZybc7dbj5Mg057oXJJ:Iqu9+pP/5d62ZranXsbrO6ELgUdJg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623572246, "uuid": "ae231afd-462e-4071-b93c-a2f641bf5e12", "value": 456192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623572246, "uuid": "dca0c62a-eb98-4fd8-a986-305eb1835e90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572246, "uuid": "3fbd9b3e-ee64-43d6-94d2-c02586c5ce31", "value": "Details #147987 BMD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996def89-cc21-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623573024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573024, "uuid": "ced55dd1-0e6f-4d8a-8fe3-25742def4d71", "comment": "Malware payload", "value": "26764c44a036d887bda704555e48db4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573024, "uuid": "7c1e296b-578e-4655-8a98-fb48375e7414", "comment": "Malware payload", "value": "5e6b89915432b64a3205f68d49db2ffc02007600a2a82a439aff431a95fcbeef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573024, "uuid": "978e5533-6ad1-4dba-b58a-4ff9e3dd238a", "comment": "Malware payload", "value": "aff8264f6f129321925cab9eaff2b439a974fa9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573024, "uuid": "89c1bd5e-4e15-4d0d-a303-e95a72c3e540", "comment": "Malware payload", "value": "3effa47ddbe940da7c08ca38b431821b41d982feb1d8b3d0f5ffac0edcb5bca53a6ce847de21d62a1a11964d50c92c9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573024, "uuid": "5158b150-93cd-454b-a71f-8558723e2ee2", "value": "583412063BD9C4A7D6520F722B73676BCBBD1382AB09544FAB806FEE69180D7581D3C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573024, "uuid": "16212a43-cb20-4572-adf4-59739f054727", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573024, "uuid": "223c1ca6-bfc4-4fb4-8205-0aaf9ff35bf4", "value": "6144:Ds9ixxvmQcFzdwc+DrMQ/1TVPMlrJYeoOLo:yiDpKdOzGrZRLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623573024, "uuid": "a33b0332-e1b0-47be-b250-4414fef470f2", "value": 241711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623573024, "uuid": "54acd5e6-f84e-468f-a65b-0d28ec73a00e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573024, "uuid": "bf2c21d8-1606-4814-853f-1261f561b502", "value": "54333218976.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfbdbee-cc80-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623613805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613805, "uuid": "f6079174-886d-457b-84eb-4fde796d6d1b", "comment": "Malware payload (Smoke Loader)", "value": "d3095534ef1a54fcc96985729c70c932", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613805, "uuid": "4d7e4ba3-67fc-4857-9427-1d3f15f7f630", "comment": "Malware payload (Smoke Loader)", "value": "63761462358e1f880dafe51b3de8036f10bc60354b981cddc8075aed22e1251d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613805, "uuid": "a58375d0-826e-4750-81f7-97b88b9c4a73", "comment": "Malware payload (Smoke Loader)", "value": "dd25501c1958af1885ec0b47c10e0cad54c6d994", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613805, "uuid": "20a40e8e-e863-4fb1-a290-fccd84012f37", "comment": "Malware payload (Smoke Loader)", "value": "ed2b40e64276006cda6952b9e35ddaba2cf46952502cc54b42969c29f4568eb8fef0c3a056cc256e912da073b436dc79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613805, "uuid": "90a39681-e81f-4419-9d1a-1b214757f9e4", "value": "B4548D1067A1C0B5F2F312F889B69F79A5AD3AB0577450DF53C22AEE5634AE0AD30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613805, "uuid": "9cd507fa-e7c2-4283-851b-7a0cbb76fd55", "value": "f48d40448beb628ea5f30fab00d7ea57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613805, "uuid": "c3237f02-0600-4cd5-87ac-ff94c91427c7", "value": "6144:8Qsv02LxBGSZSl4QxbZeBQ51jZ3ADgbLTvRwpzC2lA:/i02LDGS4m+1nbvmzrlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623613805, "uuid": "88de3df2-32ca-4c85-9ea4-46dafc1081b6", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623613805, "uuid": "e08699f9-2ecc-45b5-b233-60352d5c2918", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613805, "uuid": "5dd50bea-6d9e-424e-813a-5d5550fb67e8", "value": "d3095534ef1a54fcc96985729c70c932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a28ac7a-cc23-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623573777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573777, "uuid": "05d46110-f409-4eba-b296-b399bcf91ee2", "comment": "Malware payload", "value": "dd46750cf1dab681b255cdb7b18eb0d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573777, "uuid": "be0bc819-8981-4e7f-af8c-74dd71fe300c", "comment": "Malware payload", "value": "66d10a75304e6eb7841bc4563060f88cd29218cea4b82279edb48b3c0c9d3282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573777, "uuid": "0745f96a-f84f-4824-9afa-da5259a10f5b", "comment": "Malware payload", "value": "a6f292374bec84504985462021a04f162cc1a7fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573777, "uuid": "5c07f2bb-c641-49bb-a506-6949972c059f", "comment": "Malware payload", "value": "3862fa06649b3646a1867a93d76e99eb94ec265d2780a67daab5c9cab2222ae1709b28bb7d505b508bdc4402e01e3357", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573777, "uuid": "0d74b264-b47e-4a54-9a74-1a9d59612bc9", "value": "F6F4F12B738C1F6FC2D951B472B1427142E89F536196EA08BEE1EDBD01A339C0F215D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573777, "uuid": "2669c27a-512a-4fd0-bef3-a1544fb3b398", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573777, "uuid": "7373201e-f748-430f-b817-b3573f7056b7", "value": "12288:vWlDYZM4e/ZUdtbd9pV8AIaqLdpnYvMxj1+sW3/KWy3skn9KaXQTZ:uYNeBUdtDpV8A2JpnYh73iWMATZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623573777, "uuid": "ed12e922-6385-4e53-ad7d-f09aaacaabad", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623573777, "uuid": "90d8f8ff-3b8f-401b-afd0-39145da6858f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573777, "uuid": "e473a225-23ef-4cbc-ba03-c9cdcc654ccf", "value": "INV 8462924546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c18a37-cc3b-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623584124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623584124, "uuid": "a336df93-6c77-4698-a286-2a5161688324", "comment": "Malware payload (DCRat)", "value": "377a3e5c7669e6be0f95805ae2372b1d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623584124, "uuid": "7293737f-dc01-4ec5-8639-557b55066896", "comment": "Malware payload (DCRat)", "value": "68e8cbd3093c7052d73542e523eff98306cbaaf536860661ab4a3ead8dd81eae", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623584124, "uuid": "5cd16bf6-e967-492b-87b9-fa478a7c744b", "comment": "Malware payload (DCRat)", "value": "fdf2b496f07060deb4e93e0393923fe437438539", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623584124, "uuid": "a55d1fd4-1080-499f-9a4e-b4507ead53ef", "comment": "Malware payload (DCRat)", "value": "0530fa4226a0b21473e0411dda1193a2c433bc93b2c90ac68f212523a9c3165b9686b80d406975f5f147185af1321987", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623584124, "uuid": "84232a9c-b108-4895-ad84-a35cbe858f4e", "value": "6BD47C40572AAF32C0DD067395D2FE57D7F4E8A7AAA2F30B1DCC6DE41842B938946607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623584124, "uuid": "c4c32670-fdc7-443a-a4ac-4dcd6ee071da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623584124, "uuid": "c2e28764-1fb2-4af1-80e8-cfc46840b3ab", "value": "12288:TOcCNQQSEsHTYylAzeYqcK6DsqnrQ5QQEEWKOKeluXabx9Od5:lXcy4xqcI+rCQQ3Br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623584124, "uuid": "6a01d249-77f4-450f-8b1c-9fcbc4ab692e", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623584124, "uuid": "1f553a9c-7536-487e-a89a-f165d71b6755", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623584124, "uuid": "a0862fab-8a69-4170-bd2c-90e926317d1c", "value": "377A3E5C7669E6BE0F95805AE2372B1D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11656337-cc78-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623610162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623610162, "uuid": "783edfee-2497-4f74-9b3d-314a1157c04d", "comment": "Malware payload (AgentTesla)", "value": "af5cae098af57b3425a4c41eca29f5e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623610162, "uuid": "e2d2fcca-63f3-4feb-8983-d9d243dd4690", "comment": "Malware payload (AgentTesla)", "value": "6bc4f7cefe9b7644afd50a8ece2b0f68c547eb925842ab8005cf40a637d0b5fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623610162, "uuid": "5de884b8-14ab-4b1e-a085-3793170ebdfe", "comment": "Malware payload (AgentTesla)", "value": "d9edbdb9c2c80c3e14d4ac51792da5fdbee53895", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623610162, "uuid": "11af130c-f800-4467-92ce-685b592b3fd1", "comment": "Malware payload (AgentTesla)", "value": "8d470ed053f00f786bec323ae0e4e4c94ad858c4ccdc081bcb21a289b6805fa201089b847efa8a263160af401ccc98a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623610162, "uuid": "d89ebf46-e521-455b-a009-6bd22f8d7c86", "value": "579402282AFE8129F1325FFD4EE46784ABAEB6737A02D55D2501138B0623F40DD63677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623610162, "uuid": "ab7bbe0e-aa6b-4141-ab8e-78ed32a15cd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623610162, "uuid": "1037d772-05be-45f9-8471-6fd92ae9218c", "value": "12288:/0MQkcUR1Wyf5Q6cxr0Z4tuUmS0I9n5WWy:kkcUR155k0edmO94W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623610162, "uuid": "686eb06e-32d1-46f4-b6ff-b90d2a5fb2d9", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623610162, "uuid": "126df76c-e12d-4c73-8a76-d58ffe6d6f5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623610162, "uuid": "867bc586-6f2f-4c7d-ba4d-ab926e0e0600", "value": "AWB & Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ee335f-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623549015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549015, "uuid": "3b9061cf-2f5a-4900-997f-e0d33bb714d0", "comment": "Malware payload (Mirai)", "value": "29be28520d6da5d65e7df4255f0c2fc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549015, "uuid": "e4e0231d-8c29-4acf-bbd2-61127039d435", "comment": "Malware payload (Mirai)", "value": "6c24a809f9174957cdca778743acbfefd624bb920ceb587936220c92b815e0a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549015, "uuid": "7ba0c607-d129-44df-a64c-5bf4377ec795", "comment": "Malware payload (Mirai)", "value": "a48a342ad64af00ef4f9671d1aa14e1b1855c072", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549015, "uuid": "30cb6130-751e-4634-a91e-75d37e456e81", "comment": "Malware payload (Mirai)", "value": "b7f3e3f0d2b52c2c2ce0f1a07f925538851b8a66810a66153554a2951d77cd9f573e9cbc612d41819e19c479e3360f59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549015, "uuid": "8f45e9b8-e2b0-4a49-bc2b-b6e73acc9a43", "value": "62832BD6A4014DBCFD5BE5BA85220B0DF52033005FA31F3B96ABFDA36C632E5AD06945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549015, "uuid": "a489dde2-7f09-4b63-9a03-5a1bcc544180", "value": "1536:AzlPEHgwJoYSVTyf0J20L7876OLL2i8TlLuChlsjGATvA:AjyfsovP4Vl0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623549015, "uuid": "3f76cd93-aa61-4e5e-ba80-e69e31e8be8d", "value": 80736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623549015, "uuid": "63b86cb4-5cd2-451d-9e80-269c0ea3f2f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549015, "uuid": "38b1e046-9b0f-4a15-b488-cf125da674ae", "value": "29be28520d6da5d65e7df4255f0c2fc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01b5c7e-cc43-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623587745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587745, "uuid": "df319e7e-8fb4-47ea-bf4d-a3fa2f0cdfc6", "comment": "Malware payload (DCRat)", "value": "7dc9435074560c0eba662b3eea6cfa68", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587745, "uuid": "8070277e-7b13-4b81-b3a6-f18cae783c6b", "comment": "Malware payload (DCRat)", "value": "6c3a2575d3325e7a0f520a5fefa0384855980461683e6c7463debbd668ab3258", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587745, "uuid": "41118cd3-931d-4e7a-9d0b-92260c76b6ca", "comment": "Malware payload (DCRat)", "value": "df37a230d7dd153a2d9078c7f8753847279f2f33", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587745, "uuid": "870af557-df39-4b14-9456-8867d79ef583", "comment": "Malware payload (DCRat)", "value": "013af969896a6f15470f4df130511be91423134c913b77c9e3118508abfde925ae45d72d2a295e3261834a1267e482d4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587745, "uuid": "b8770ffb-bbb1-4d08-b178-08068c94669f", "value": "0106F1127684D921C0690637DAAF55140BBCFE006B12DB1BBB9E376CE9613A37D0D2DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587745, "uuid": "6f012e57-a758-464a-8ba3-551dcd7df7d3", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587745, "uuid": "e238378a-d229-4cec-ae7d-9d03ebda648c", "value": "49152:+V2qpnu9CHdfXynbvSFkzyQgJ2bO715eDf2UUpOIguVjkapjbA3IJwYY5+EEm8j:+QXCHMvDbgLh5UpUARuBkapjbKYpd7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623587745, "uuid": "d80821c6-3446-468a-95e5-06f967ca384f", "value": 3660924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623587745, "uuid": "78b262c9-4fb6-4535-8008-13b8e5e0531a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587745, "uuid": "0f4bf31d-d67b-4170-a276-8f3ac965d6b7", "value": "7DC9435074560C0EBA662B3EEA6CFA68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8abff0-cc24-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623574237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623574237, "uuid": "224cc565-9b8a-4354-8c06-4d3d9da182f9", "comment": "Malware payload", "value": "bf69a6121eee0c64ec95d90e30616706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623574237, "uuid": "55b2b947-08a5-4884-af5b-0790c1783cdd", "comment": "Malware payload", "value": "6f0e0464d2b53a64d759797466ef62ba865c0391d22a4749e7a068618d1b139e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623574237, "uuid": "4cf70a62-8776-4691-b2f4-aef366077c02", "comment": "Malware payload", "value": "9b49071f2996a32cdd235236ef3e0d50e54a8b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623574237, "uuid": "f11bdfc4-c1e4-42f5-bc1a-c3f969be7fd1", "comment": "Malware payload", "value": "62bd9b3d5485a49c3c8351d9ac5002acab85406791551ed40695f2d534ee7b2db60fa9e0759d261d7c1528bea6403c6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623574237, "uuid": "ca9f6508-921a-4dd8-9f21-06b839965214", "value": "C7258C93F61C0A9FD3B801F4F03D046562F88B5BA13AEA8D3CC95ADD81D2B8877255D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623574237, "uuid": "ce276ff3-3730-4876-90f1-f684738c4559", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623574237, "uuid": "db41e0a0-df41-4336-8446-080562b9e2ae", "value": "24576:t5ONtqJSqub3QwjqBPW0kPco7ZNpjNeBUdtB:t5ONrqC1jqtW0kPn7ZDwBUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623574237, "uuid": "f55b49f2-6300-4732-840c-932fb0b397a4", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623574237, "uuid": "63eefb01-f6ea-476e-ba98-a7c4698e931c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623574237, "uuid": "e2ae8090-9a32-4953-9bf6-61c1c58860d4", "value": "Scan-Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ef37f2-cc4a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623590597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623590597, "uuid": "833eb0ca-e8f0-42e6-a4f2-36773a7ddc24", "comment": "Malware payload", "value": "074864f130c538a3a1268cccebed7fd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623590597, "uuid": "02c752de-8333-444d-877d-0f7b45748579", "comment": "Malware payload", "value": "70e80d25b4e643406dac611e08a23bfabae754731d533584101ffa7bb62bd273", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623590597, "uuid": "59268c51-441e-4830-8280-58db0bcf78ee", "comment": "Malware payload", "value": "56ed68f955339356591ff299baf628bbd13b9a2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623590597, "uuid": "e5f9d7d5-e419-4f0e-9b31-4e878faf68dc", "comment": "Malware payload", "value": "0ed2f745fab8f2f3d5cb94dfcd93da7ef07c2498eb0de8717ac141a7950a128b7cd440af395b6c6ca7a7a8210073012f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623590597, "uuid": "7e693c4e-7e14-4817-9b0a-e31faef6dd9e", "value": "85247D21F2C24876D1631F78BC2BB26D5A36FF112D29654AA6F95D0C8E3E3C17C185E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623590597, "uuid": "eabd13b8-3cc5-4857-8bec-d182d64fed72", "value": "ff5a8f4780f2dc45750b55ab89f4b357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623590597, "uuid": "f8fc536e-ffc0-48f2-8e05-7a367622e41c", "value": "6144:qJ+WK/pvT7arfwKFzDTsv5oaTh45CjBscX9Td61C:RJpb7Y7vf5i5X9T01C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623590597, "uuid": "81dda6eb-7a0e-47b0-bebe-afe92107269d", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623590597, "uuid": "654c96be-05ba-48bb-beb6-fd88b38a9e12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623590597, "uuid": "672e5386-ee39-4eb1-bcb2-d2e2e99706bf", "value": "074864f130c538a3a1268cccebed7fd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a977d6fd-cc65-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623602257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623602257, "uuid": "ad33112d-e151-4415-ada6-b085879ee550", "comment": "Malware payload", "value": "b97b650ca091ac961cf92c1a071d5625", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623602257, "uuid": "a9893198-14a7-4fe1-b2bf-d51664e1a672", "comment": "Malware payload", "value": "7247a615b6fe4bad954c3b15691e4cdf308fca5075444b326bd5e4c101dd39ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623602257, "uuid": "55ac4cf9-5654-4950-b9e0-8684d9f6b396", "comment": "Malware payload", "value": "b6ccddfd0e89db606da28b3937f158a19061ed5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623602257, "uuid": "e178b579-8248-4c64-ac3c-35abc905cb76", "comment": "Malware payload", "value": "36f3d468e273be9a6f0447ff84a72d78bab8ca44ab109f0b84f7ad4a8395b84beeba4f2052bc3bcfab99fbc9bfbd629a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623602257, "uuid": "338be8b7-df51-46fb-8d68-44210ff1acec", "value": "29847AE77B38988EC448637B2A138A570610FC1E947CF7092E57EB5B1AE02387506F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623602257, "uuid": "38795501-e1d1-4866-9e87-5a40abefa567", "value": "c4c241d9a2484a3f79da3f4d2aeccd54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623602257, "uuid": "a8546391-c92f-49a9-977c-a518cc2c9fe4", "value": "6144:2fMG9RFsULVxbPEdGV0AIsBVjvx9/LB6pK9:ZGV5bYGdIsDvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623602257, "uuid": "c3f9de3e-4de7-4928-877f-3ff46fd92629", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623602257, "uuid": "9d947a57-5924-4fe9-9851-60eaa1283384", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623602257, "uuid": "89b4e316-2f41-4d41-85aa-61bce55a2615", "value": "b97b650ca091ac961cf92c1a071d5625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc9c8c6-cc4b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623591043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591043, "uuid": "3d8ec462-64f4-4cc7-bd19-8c3efbd9c9ef", "comment": "Malware payload (NanoCore)", "value": "0b1d339690aa42985c82aa77b266d6f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591043, "uuid": "5ff2090a-0eb2-4c31-a906-da0cba967cea", "comment": "Malware payload (NanoCore)", "value": "75b2633f758fe5df695225f111dd5b04bbc1753062be544c2e217cad289e1ddf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591043, "uuid": "110a9d9e-e0d6-4637-9f26-eb10384ef26f", "comment": "Malware payload (NanoCore)", "value": "878188ae46ffdde9f0502e38d60f493d608496f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591043, "uuid": "4153eebc-ce70-4e24-870f-7b9e19ede307", "comment": "Malware payload (NanoCore)", "value": "0f8b92a30a6356a825c1df3766c30160b9c3fcc244818eea37516b3da9c9272e9d0992364697098c39097816a0d16933", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591043, "uuid": "8d02d8d0-2d7c-4c6d-9812-8dcd5252ad53", "value": "F94402BE02C46BBDCE9B37365FE64612D36412C2B016821579DC53CB23C9DA981B62DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591043, "uuid": "86eb6e18-246b-4c31-98bf-d74f3315568d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591043, "uuid": "3c1cf735-83ca-4e24-957d-cb00d6b7a064", "value": "6144:K/JhHgKse6K7+M9CebzXLaji1cp+r2WJcinHSRbPmfwQpW4er:mJ5gKRiMI0XL11cp+xHSRrm0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623591043, "uuid": "31a80958-e17d-4d0e-9c3f-87a8d22f2b25", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623591043, "uuid": "715e0033-f085-4022-af15-4854db730d59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591043, "uuid": "07e9f8bb-0487-4d9d-8b32-d4a1a348d2f6", "value": "0b1d339690aa42985c82aa77b266d6f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c39e070-cc47-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623589242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623589242, "uuid": "5030accd-e4a3-4aef-9c7f-5861b06e4b6e", "comment": "Malware payload (RedLineStealer)", "value": "97ba6416992f882cda5096152c1287cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623589242, "uuid": "9d9d6724-7981-4163-a702-8d08c35a5ef8", "comment": "Malware payload (RedLineStealer)", "value": "76739da9af8671f174d1d2af687df094168370c898e17a81b7e275aa2c221f8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623589242, "uuid": "ea7c29fd-c71e-4694-b8ee-991591a18735", "comment": "Malware payload (RedLineStealer)", "value": "4b1a2ec2077adf665a6dbabf37c848d7d924dac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623589242, "uuid": "a68efad8-76ec-4c76-897b-a1460fff08b1", "comment": "Malware payload (RedLineStealer)", "value": "f819d21cb795f290e91b10b32b6ef7f5cab9cdd54976b12ed9aa4c62103287b93ded9d3559b2ad6cb56525223591db0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623589242, "uuid": "71ffb5b9-f659-4e2c-b36b-14b144a7c476", "value": "9AB4123CE080B088D79B3FFD9463501AD992EB70B7F4A7C718311A2B79315A5C25E26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623589242, "uuid": "98ad975b-3971-45c5-aa45-64b4a2fd6e3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623589242, "uuid": "6c09f492-b0a3-4968-a7a6-81c6456a7d62", "value": "12288:jkwfZ0HDZKGXzIdmEsO/TbccNBOc9n0fH2XKzb8Cazkki/:TuNJE5bPBlazbszXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623589242, "uuid": "f31dc221-9b3d-48a6-adf8-6b12b9484c1b", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623589242, "uuid": "ef0af457-5efe-460e-a4bf-769c4ec19fb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623589242, "uuid": "dea099f6-5b63-4d4a-9c93-3d247e643799", "value": "97BA6416992F882CDA5096152C1287CB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e31ccf0-cbe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623548443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623548443, "uuid": "94662e89-0875-43a6-9293-144bdffcb2b3", "comment": "Malware payload (Mirai)", "value": "c8110d8daa6a465b2173f99de4a546bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623548443, "uuid": "bdfa9e19-897d-48b0-bc66-a20e5627d0c9", "comment": "Malware payload (Mirai)", "value": "7c69f3d242406363643bb1ab845788c2faf46b839d8b46e6d52b5f0db2137349", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623548443, "uuid": "ebe981ad-154f-4266-9cff-4b64688ca368", "comment": "Malware payload (Mirai)", "value": "4339ef67c240af383f86871679ee7b42c3ecd5de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623548443, "uuid": "100af3ab-5285-4d35-9dcc-8e3f9dfa33cc", "comment": "Malware payload (Mirai)", "value": "dad6e313aa56325a94a094422f66ffe15cdc95685c5eb509852726b3b27ff191bbd4870be785ee8d3dbafc0865e308eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623548443, "uuid": "bc862db5-084b-4954-850f-6e19efc23462", "value": "31A3C7092F218F7DFF9A423987B78E11965933AA3AE1C545D15CEE022E7034E341BFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623548443, "uuid": "5513a0ee-27be-4fb3-8737-da2f50a8cde5", "value": "1536:dL4E6pRDjvcnrcF+nJWYEQEAl5AMkf8lMGdxrkL1ax0n9d42+Ia13d:tT6p+nrM+J2ZAlwkIL1axUPSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623548443, "uuid": "23bccf10-3d6d-44c5-af45-d89cdb0bc0e8", "value": 106280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623548443, "uuid": "dcdd7ce1-9712-46c9-9812-5d714321a0d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623548443, "uuid": "9d984c1e-43d3-4aae-a249-9a67c2c981cc", "value": "c8110d8daa6a465b2173f99de4a546bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0369b9-cc0e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623564953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623564953, "uuid": "41cdc573-e6bf-462f-852b-c4efb8e2c68c", "comment": "Malware payload", "value": "96c8d1e2f8e79d729efe0d69e983640b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623564953, "uuid": "5bad1f67-79bf-4757-9b05-abed2f95d364", "comment": "Malware payload", "value": "825c3aa67440f740887effe8f86e5d4e014eba94f9d8d756aa2c6767bd272eb9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623564953, "uuid": "7c39a997-a061-42b0-b972-88c092a588e9", "comment": "Malware payload", "value": "8eebb4f9b504188d87c548f4be5b9d1b7def60f6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623564953, "uuid": "00f5e6e8-7c18-4270-9fcf-f1fffa31a630", "comment": "Malware payload", "value": "e742bdc686148e63d1d141a7e6135cf29df358496ab3c83e27e41e0d04fd479d8a2a69a615ef60dee4f4bc368f263543", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623564953, "uuid": "8143441f-121e-461e-8e21-bb491a03566e", "value": "8482E1B0123D262FF39AD5B4FE8B5A0B1F7B1C021FD93E9BD8D444483890B1D81B4951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623564953, "uuid": "90740aa1-beb8-4647-9f20-cefb9f654b43", "value": "384:2Pv8voVq9etszNkwtOEMPS/gutFCunpdUI7kU8SU2tcgiFqcJlJ:mwosbMPmf4gpdU3ORsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623564953, "uuid": "71daa6c3-ca13-441e-9bd7-77e464e836f6", "value": 18288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623564953, "uuid": "a52c3863-bf08-4615-939d-69a0cd4e0cb8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623564953, "uuid": "32c0ed36-abcb-4745-8d3a-24e0bbd373f2", "value": "96c8d1e2f8e79d729efe0d69e983640b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066fe2b2-cbe2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623545719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623545719, "uuid": "d1abc774-9c2a-48f0-8330-cd10e70bce3e", "comment": "Malware payload", "value": "68c1dbaa1961f37f07a17f23bcba2e3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623545719, "uuid": "0939fe54-866e-4823-8e81-6dfba0cc3508", "comment": "Malware payload", "value": "830633482884abbe3375cbca297f1192b08a3b8c8c17470a630751cb5528c9f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623545719, "uuid": "3c8c2b9b-877a-4f37-880c-6a2c57b0599f", "comment": "Malware payload", "value": "edf74a035b9d7729ca918e389c94011f6e0102c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623545719, "uuid": "0a8ff47a-d173-49a0-a650-77e2a158910e", "comment": "Malware payload", "value": "75b198d070b0ec3e48e516f804d446a807872ebfbfa8cfabea78f96cdd039e36dc26bc0eda8f6be4d425dfc048222753", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623545719, "uuid": "86afcc49-0201-42a3-b5cb-596fc4863a11", "value": "19F63327B199A13EC46927310673A51098FBA6BAF053BE167BF4C48DCF624C01E3A775", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623545719, "uuid": "e858f80f-d7e8-4cba-a15c-55bfc044f2bd", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623545719, "uuid": "52554938-92ee-4fbe-87b8-ca1bc0492e86", "value": "393216:wY+NQdOiawfb6+S9eC+FB7nOgt+3B+oONT:wPud5O/YC8xOgtuKNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623545719, "uuid": "a98b95e3-bde0-4eaf-9f09-3ea7117b9d7b", "value": 15333015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623545719, "uuid": "843ca67b-995f-479d-8bed-5462bf49f7c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623545719, "uuid": "14cc50ee-1302-4142-a65e-958cd5ae601c", "value": "68c1dbaa1961f37f07a17f23bcba2e3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b595a6ff-cc23-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623573930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573930, "uuid": "a09c4f67-990b-494d-a27f-4083989ca980", "comment": "Malware payload (AgentTesla)", "value": "34a1985dac1f133daa08752e1382f2ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573930, "uuid": "16d78459-1346-40b8-8a98-9df5ccf46501", "comment": "Malware payload (AgentTesla)", "value": "8663395c9d2ce10e5c1dc795b0768889466221003be7915e5ca99cfcf858479c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573930, "uuid": "4072d85d-5118-4afe-9a70-bed6c0203869", "comment": "Malware payload (AgentTesla)", "value": "e006cc0fb5a3ba5f6c61503ec5936ab282fd8d10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573930, "uuid": "ba6a47d3-5054-4118-bbf9-388f4c2c32e1", "comment": "Malware payload (AgentTesla)", "value": "84326dbdfbe631b402a22ee662239c621294781b386eab34995122514553b0d8ea7536bf062373904dcffa09bce63f4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573930, "uuid": "828087af-ca1e-488e-aab9-8c3374a842df", "value": "A865BE1022449B50D13987758C23D6B04FB0AD0EEAE5CA4E7DEB7C9F38717B25A1E25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573930, "uuid": "7355a328-1e57-4931-9339-9388a04ed27d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573930, "uuid": "9f143c43-10e4-4f4e-a1b5-2c2e2c191b0b", "value": "24576:MlNeBUdtwsEgwswe/z8YEoqSg5LlJfH6zMIDsxTt8M8zKMddQAIly628YjL:GwBUwsEgwswe5U/BldOE2PddE5VYjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623573930, "uuid": "04629948-dae8-4a7b-b5a6-3e7895eb7832", "value": 1531904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623573930, "uuid": "fb3b47d5-fc4b-4605-8a96-fb100c399f09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573930, "uuid": "1b7019dd-fd85-47e5-930c-65d1399fec3d", "value": "Following abusive email letter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cb0cf8-cc30-11eb-875b-42010a9c0053", "comment": "Malware payload (CrimsonRAT)", "timestamp": 1623579621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623579621, "uuid": "440e48fd-5e9c-49aa-9ad8-9839c7ed40bf", "comment": "Malware payload (CrimsonRAT)", "value": "239e62a661c7cc6dc366ab83322c2372", "object_relation": "md5", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623579621, "uuid": "3884bb7a-68d5-4434-b624-b3ffc3f4ed20", "comment": "Malware payload (CrimsonRAT)", "value": "8671989853c9f4dd07adedf6a825cc9def8723a73b6308d2aa749f7f03c9f2be", "object_relation": "sha256", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623579621, "uuid": "8594e8e2-3cc3-40bd-ab72-0ca32c447505", "comment": "Malware payload (CrimsonRAT)", "value": "0ea25009df50fd0837a65908b5f712da99f59e46", "object_relation": "sha1", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623579621, "uuid": "afca64c7-211e-4410-8b3c-395909d8c915", "comment": "Malware payload (CrimsonRAT)", "value": "f57b0f2fedb73043cccd69ebb5862bc7a88a9e86263dfd6cf5bf20e36af1d200e9844b25819f303c257b8b1844f8b24c", "object_relation": "sha3-384", "Tag": [ { "name": "CrimsonRAT", "colour": "#D90F59", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623579621, "uuid": "89ebbd6c-0327-4358-aed0-5e8262f26bc5", "value": "62A6B20533991F7DF5BECBBD98105AD2D3219C922801E25E5EAAF189EE32390D1D18DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623579621, "uuid": "5235f5af-0ab8-4126-a961-91ae83b2ce3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623579621, "uuid": "8015df10-05d0-4604-adaf-f06a60fb61d1", "value": "1536:6rL1yPW2IJo/tbGOjcGTuMIUWKgSiYqZeXzOHpmtU:6rL1yPW2IJo/li05iNeXzOHktU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623579621, "uuid": "ed607c2b-6e58-473a-8696-d0b0a8b6ab69", "value": 10192896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623579621, "uuid": "cd65d505-0397-4eff-ba95-892f6abd67ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623579621, "uuid": "ec91e94f-97b2-4e88-a24a-4225281f3f13", "value": "239E62A661C7CC6DC366AB83322C2372.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fcf21c-cc4f-11eb-875b-42010a9c0053", "comment": "Malware payload (Amadey)", "timestamp": 1623592834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623592834, "uuid": "0ff5f1b6-70ab-4d4b-8eba-1aa7d3c15b36", "comment": "Malware payload (Amadey)", "value": "d1e1eafbd2412bc033ac1e5663b9ec12", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623592834, "uuid": "c5ca7617-512b-47e6-a4ad-c39c2c2e6232", "comment": "Malware payload (Amadey)", "value": "8671fdd17b267316b996ef4bfce2416f7709947499266205175160a68dc18565", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623592834, "uuid": "c04d62bd-6433-4dff-aa85-c621073a02aa", "comment": "Malware payload (Amadey)", "value": "1396e68f3b31c31d65067c956dba6d32051e16e0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623592834, "uuid": "7fa907bd-6629-414d-9d10-cd4b11dabcd0", "comment": "Malware payload (Amadey)", "value": "ee9bec45faceff6ee4659b79d65551048abcc84e4d61bf7900f7d8c99a914763c1092c5bb155811bb9ca9d2ab829efbf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623592834, "uuid": "1a1c95a7-d125-4d11-8c7a-b9a0d57365ba", "value": "3A1438653852C072D16165B129F4BFF6C5ADAC14ABB149DF2B800F76CA222F37931E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623592834, "uuid": "d822de97-3381-44eb-9059-1734a41ecb9b", "value": "0f44a2f1d36bf1091a52378e29f684b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623592834, "uuid": "9287edcc-a434-4e74-ba4a-b597b5c35d0f", "value": "3072:NS1WsKs/PRHRYwZEQSf8cH3TLdAlhSeQSmVc4mYrluwKNd+XilQRdYQ0H:81WNs/ZHf87HDLKlHwmcuwKowQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623592834, "uuid": "a63027d2-4198-4a7c-98c7-78f3541bf423", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623592834, "uuid": "b5409cf3-691b-45cb-930e-da6a5e69cd84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623592834, "uuid": "46b1bdd6-ed71-4925-94fe-859f3f7fd069", "value": "D1E1EAFBD2412BC033AC1E5663B9EC12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c22c2ea-cc82-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623614448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623614448, "uuid": "10f72a72-ad24-4ac2-9019-604c47ba2b25", "comment": "Malware payload (AsyncRAT)", "value": "4c37da95ed7ad234013cc68a3b5ead58", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623614448, "uuid": "377e2472-6247-4778-b994-e062ee32d8a8", "comment": "Malware payload (AsyncRAT)", "value": "880b18145e64ab802fcef6b07de69e18bf63bfe27f07760a9ef22d5d38861b5a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623614448, "uuid": "7f517c1d-b41a-43ba-b17f-6fa402b755e2", "comment": "Malware payload (AsyncRAT)", "value": "d15d64d8019bb59e2ab388f925ce7f6aba4a9ed2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623614448, "uuid": "fd3979af-8ff4-4a38-adb2-ffe379870d54", "comment": "Malware payload (AsyncRAT)", "value": "d40d9378cb5151190e5f8284f46a4c70ddcc0e07c59c8aa77a9d82a0de3070262fb7910d75a67199bc4ba644360fd628", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623614448, "uuid": "a6c9415b-060b-4dae-a565-5b97f8cfeb08", "value": "D5C4AE1535A59B21D4765FF015B1A1900BF5BAAA3968E50E9CCA73CF3EF2F004891F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623614448, "uuid": "b5592f0c-46ad-4963-8621-08b9876c24a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623614448, "uuid": "2c7686ad-6383-49a7-add8-8f1ef24d6e15", "value": "12288:WWW/OGwLOi20Cj9lAJiJo1ojuXEt5D05Rncqm:WWWOGwLOSCXAJKoWjUfHcqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623614448, "uuid": "dff1522c-9f51-4845-bdd7-b05287a78008", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623614448, "uuid": "c9aba302-ebe6-4ef9-bef6-303c0cf9a763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623614448, "uuid": "ab9fadf2-571d-4a37-8242-4359865a1eb8", "value": "4c37da95ed7ad234013cc68a3b5ead58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aba42c0-cc77-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623609829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623609829, "uuid": "c3bfa6a4-dc22-42fd-b4cd-d4d8922a4707", "comment": "Malware payload (AgentTesla)", "value": "81eceff75cf2b34526e9c5a38645459d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623609829, "uuid": "f04f2a10-344b-41b3-9939-c948f435a9a5", "comment": "Malware payload (AgentTesla)", "value": "888783905b422f7cc69160d7942071330fc8261ff64c0c727b02323a17cf8175", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623609829, "uuid": "1a9b75fa-5a3f-49c2-a142-3dec067f30ac", "comment": "Malware payload (AgentTesla)", "value": "f5533b0c5614e9e4ed3b5ecee4a8d3c5c846de3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623609829, "uuid": "c3cd1f95-e42a-460b-afb3-fed8d92021b2", "comment": "Malware payload (AgentTesla)", "value": "220ef4fd22f31af84a84346acd5e6b600be4ddaf81814fe7524ddd678547e935ff4025438e3a0913bb3a45eb7a1d02c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623609829, "uuid": "17761f8c-d94f-4d18-ad55-6d05d948713f", "value": "8B058C9A369471AFC467CE76DEA41D20EB217466530BD307A06301EDAE0EB97CF106B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623609829, "uuid": "47f964ab-1be4-4add-81c4-8a988ef45e47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623609829, "uuid": "abc3efb7-b372-4b3c-b8e2-4d1a8ce6f0af", "value": "12288:XQtjbgcRVEPXMGN982GsnD2tVbbvZ+1RpH2DdmNMyH9bUYCjbBVhx/gaJqJqwGt3:A9/W9YE2kDpydmNMYvCvBVX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623609829, "uuid": "91c677ef-f2fd-4f2b-bb43-30efd2ce328d", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623609829, "uuid": "3e70bab2-7721-4f4e-a4e0-d4caf78159f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623609829, "uuid": "84e85fce-8e3a-4cf4-8bb7-324bb6a9155e", "value": "AWB & Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64b93e2-cc43-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623587729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587729, "uuid": "a6a15eb6-8a0c-463f-8721-1148b00ddddd", "comment": "Malware payload (AsyncRAT)", "value": "7925d5ba4785c4836a2420701fed8af6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587729, "uuid": "07859983-f22d-436a-a86c-36224fec87f3", "comment": "Malware payload (AsyncRAT)", "value": "88d270ea074ab2ee7f37b6e6788d7d74019e9de7423e893f4fe620332f6d4085", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587729, "uuid": "5b57a340-afcb-4409-a37b-73b6c2849012", "comment": "Malware payload (AsyncRAT)", "value": "32414981c919eb0394baabafdb3b5897f3c750ae", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623587729, "uuid": "8870bd1e-a096-4ba6-add9-29366199a2d2", "comment": "Malware payload (AsyncRAT)", "value": "42744841d8e35b7d02251bbc0f186a7271fb257d19a7832fecedf4ed4785654a5d7e625fc387a71685d777b696f46cd5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587729, "uuid": "4752ea53-f24a-4f7f-b6e2-1afd012c3ab1", "value": "6B354D307B5E8C3E9E9BD3B0C8D239E719E590DC8871A6DC13928733B71694B267191E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587729, "uuid": "13144b16-2142-448b-92c4-8df110c4fd7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587729, "uuid": "34f32f28-03f9-4db2-a37d-724faf9d13a1", "value": "3072:6huLTSgu/G/mFuVE+PWGPWvXPN9PGnfcVs6HREj+/2PVPZ0d/GOsMfz+t8+31kcA:SuLTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623587729, "uuid": "3a47db86-5451-48d7-ae36-1c0c4f63dc9c", "value": 1071104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623587729, "uuid": "2623cb82-dfb6-4e3f-a8d2-337e0938af1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623587729, "uuid": "544cd19d-d08f-4b9b-a3b2-0913202c2604", "value": "7925D5BA4785C4836A2420701FED8AF6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d3add0-cc1e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623571485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571485, "uuid": "3499c57d-e2aa-4fd4-a04b-3a8890a956ac", "comment": "Malware payload", "value": "4462cedcf8bbd1da943b991396a729e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571485, "uuid": "9f15143a-7c7f-41cc-be98-68f2c65c9bdc", "comment": "Malware payload", "value": "8ad0fddce1bb4505448cfa06f72e25ba3fbf10e211cdbae670b2d22018d1bb8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571485, "uuid": "c3126a85-9392-497c-91c9-e20945d954bc", "comment": "Malware payload", "value": "10cc8b057e7b7a1011003621e011d8975bf8ca44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571485, "uuid": "c7075aee-5287-4787-a6ae-102147dcb2eb", "comment": "Malware payload", "value": "83f0c0c1325b2afe194969ca4dfae73be253b1918e13769f388f11e2fda1880013cf1c67a63f6cd110f15cdbab51aa3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571485, "uuid": "be71ca8c-5a14-400b-9653-0f636f74f88f", "value": "DEF4121023989B5AF5BE0F794576510007F8A121EA3BE70C7F9B61AF2E77B064781B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571485, "uuid": "f2032e7a-267f-45dc-9786-dbb5d13eecb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571485, "uuid": "8ecf1225-2bc8-424e-90c5-d61ca6b43049", "value": "12288:lRYkCLDgl9pVeDL6jZM4e/ZUdtbv1jZObImwrahvf/01uUQiZMLq/bSf9fe7th3o:VNeBUdt75ZOpzn/01uUQiZMvfyLl0Lc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623571485, "uuid": "bea5724f-c39e-48a7-97de-f3d1b7fe9cab", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623571485, "uuid": "c06f870e-094b-4e98-ba8b-c11573effcf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571485, "uuid": "0996fb15-43da-4362-b541-b667d02d6d69", "value": "statement prfma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec948d0a-cc45-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623588625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623588625, "uuid": "97f8ffdf-4159-4e9c-8ad9-7bb756296b78", "comment": "Malware payload (RedLineStealer)", "value": "d2393d36560b7fbaff47fd07fc2e9c9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623588625, "uuid": "44cadba1-78eb-42b3-b3fc-e915dffb1371", "comment": "Malware payload (RedLineStealer)", "value": "8ad41cf1697af8378f02c7ef5abc51949261c1363f2aa07e4cd99fde6b869690", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623588625, "uuid": "9dcef97c-c0b1-4a81-a547-d3b99ca531b9", "comment": "Malware payload (RedLineStealer)", "value": "d8ac53b2c047f917eae0e877c9d25dde91a83e7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623588625, "uuid": "8bac1ca2-e971-48e7-b806-c30b4a5bbaf1", "comment": "Malware payload (RedLineStealer)", "value": "1f6d71419abff04c3f9c721b6e28728a240fa343d649684b9985b479040ec1828193f1e61e067f8bd94e25ca62ae2430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623588625, "uuid": "fe2ba28e-ae42-407a-adbf-ea188601737f", "value": "B4255B32380194E2E17D03F5C2878A200BEE6C3B69D1DA557BDE32F945727A2994D6CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623588625, "uuid": "941a4c3c-ab52-491d-bd96-1047599dda7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623588625, "uuid": "22e72f59-720a-4385-b782-4ad3c472d25a", "value": "12288:kxPbBXsieRs7tPz8/LiBmwzZjXCo6KyiXU3FV7UnWqgXSEZS:ETeRsBPOiBm+QSDXUrcaSEZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623588625, "uuid": "3d5ad9ae-55cc-44e7-aca0-3de05e2fa4d0", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623588625, "uuid": "25904538-e077-4247-a677-276c1c2026a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623588625, "uuid": "4d5b7dff-bf80-42a1-a68d-afdc7afd920d", "value": "8ad41cf1697af8378f02c7ef5abc51949261c1363f2aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e452d9a0-cc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623613522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613522, "uuid": "93d37e75-8ed3-4229-837e-3b87302532ea", "comment": "Malware payload (Smoke Loader)", "value": "d53add148bb9bccfbd371c87c3b3e558", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613522, "uuid": "79f3fe2e-97f3-4375-9ab1-8f351a057853", "comment": "Malware payload (Smoke Loader)", "value": "8b7e447356ade4824db0565f713751a6c0b37cc560269ced9cc6176e1d1fdd24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613522, "uuid": "7fd5835f-3d87-4897-ae62-220b68d09a6a", "comment": "Malware payload (Smoke Loader)", "value": "fb6466e4ccd52d615515e64ed99cbd7c8e3d9636", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623613522, "uuid": "be1e5f98-f15c-42de-a55a-21c4e9e48b69", "comment": "Malware payload (Smoke Loader)", "value": "76cc59ae11a19248dc7c8a5291b8e708f82b0e3ca298f64db0e5915ddb20b2d414f4abf2774ccd069f800cd6e6b7c377", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613522, "uuid": "354b18b3-652b-4f57-8b73-f3d2d5104d6c", "value": "68548E1067A1C0B4F2F316F889B69F79A5AD79B0577490DF53C21BEA5634AE0AC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613522, "uuid": "db226c2f-bb77-4405-bbc1-07129300192e", "value": "f48d40448beb628ea5f30fab00d7ea57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613522, "uuid": "99a52667-609f-4f15-9c23-f30c0b7bcfe6", "value": "6144:3Qsvv2LxBGSZSl4QxbZeBbx6ij2ueMZmBeehI9cLzC2ls:giv2LDGS4mNbj2ueMZye6JLzrls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623613522, "uuid": "cafc8874-1c84-456a-acd0-6a29c4c4d963", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623613522, "uuid": "d1919375-603a-4989-9ebf-d440e52bcc88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623613522, "uuid": "2931d649-97fa-4134-9cee-0c794a17c9c1", "value": "d53add148bb9bccfbd371c87c3b3e558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abaa34f8-cc54-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623594959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623594959, "uuid": "031c8933-7669-4c03-bfab-736df1f6f728", "comment": "Malware payload (NanoCore)", "value": "f3168b2fb23901b24bc85b9eab832b3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623594959, "uuid": "a2b23b9d-51c1-464b-8f57-0f8bae7e60bd", "comment": "Malware payload (NanoCore)", "value": "8bf168cab8cc7f031c5ca954a3e901bcbec6bdf8ab177763568738153b3ff270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623594959, "uuid": "87e96d30-67de-4754-9f50-c76d5a2ecfe6", "comment": "Malware payload (NanoCore)", "value": "c6c7585dc391b0f9d2694da85e5fa58a6b2e7d4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623594959, "uuid": "9760f303-efa8-4632-9590-397727ebe17c", "comment": "Malware payload (NanoCore)", "value": "0269f686da84ce599caf69ca1948eb630ece292bcd81c23e04eb10ddc87f6e6160f61edee2f3f18a2a9c729cd2ea252e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623594959, "uuid": "ab797df3-03fe-4580-80fb-3bd1fd1f7334", "value": "76342234E24CC70BDAABC5B8FFB27C1123B35F0F65A444DBD4EA61871A5D1540A628FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623594959, "uuid": "301ea2e9-987c-4277-ad98-0f5775b24a0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623594959, "uuid": "c229de1d-8b27-482d-8c73-f9b2d74b00b0", "value": "6144:qNva8aP6rWzCo4QBdtiePZ9Dpu39xWiU:0mbeh8dT439xWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623594959, "uuid": "90010948-9c2c-4744-a9f9-62c148040bbb", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623594959, "uuid": "86dcd420-f202-4ce4-a665-fd09b497f76a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623594959, "uuid": "2b2a9d8a-ab92-4106-967f-cb89e985de18", "value": "F3168B2FB23901B24BC85B9EAB832B3C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f821c2d-cc50-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623593140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593140, "uuid": "7416b7c5-e2a9-4f37-8f19-265e52086f62", "comment": "Malware payload (RedLineStealer)", "value": "ddf763244e0006b411ed60cd30b77b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593140, "uuid": "5b840a3a-0f89-4469-841a-3c852c87f801", "comment": "Malware payload (RedLineStealer)", "value": "8c4c86b5d1d59a283b2a6843eeba0c74747613046ce8c5a1d3e3aa58f23d71cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593140, "uuid": "c2f29825-da00-4110-ac23-35e6b2e0a041", "comment": "Malware payload (RedLineStealer)", "value": "e781c85a69febcb7166c7f3ad1ba3ddc47735950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593140, "uuid": "250f8d29-055b-480d-88ae-ba7e1e97f00e", "comment": "Malware payload (RedLineStealer)", "value": "442ab6f808cbf38d283b42b4cd14000e5cd45a49bffd07814740d459cda6edf8551e4cc3130fa76ab6b2d5d532131f85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593140, "uuid": "7256a963-1880-4bab-a1c0-e849d5316b06", "value": "6E3522A2BBD5C0F3E0FB1130488627511579ED250759CBCBABC0350E6EB62E2E6795C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593140, "uuid": "dd889b1e-5166-4ae8-ae41-66b06ae3d0d5", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593140, "uuid": "db6efecb-8987-46fb-950a-34e8416bdd91", "value": "24576:B9btxEOvWGBq5rpdOaRfxo6q6KHhArxIIFWwq4d:BNNvbWyLT+yIcXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623593140, "uuid": "937b61bf-2fd7-4a50-a25f-66ecbcfd0122", "value": 1114812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623593140, "uuid": "2346ee14-c475-4910-b040-3086392140e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593140, "uuid": "6d3bd5de-9850-45ef-b63e-1e1fdc51c38b", "value": "DDF763244E0006B411ED60CD30B77B04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba51d42-cc8a-11eb-875b-42010a9c0053", "comment": "Malware payload (Heodo)", "timestamp": 1623618232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623618232, "uuid": "b7ea15ed-60c6-4413-b0a8-cd347ac16afc", "comment": "Malware payload (Heodo)", "value": "0a82064af051bad014b77038d60474b6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623618232, "uuid": "588e5ab2-9b99-408e-b463-0af9ecfcfbeb", "comment": "Malware payload (Heodo)", "value": "8f165a26d7e9ad72cb0d51cf01076cc4b0099a244cd4e702645d36dc788dd0cc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623618232, "uuid": "dbaa50d4-09f6-4932-8af0-ef3f1bea6b2c", "comment": "Malware payload (Heodo)", "value": "f7bf190091d5fe307cfaeed630eeb341c935bda0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623618232, "uuid": "58e4c3c1-e85c-4f8c-ac57-c911251bddec", "comment": "Malware payload (Heodo)", "value": "bb6957ffc0139f0bd6b7e629dcaa7901868e62c8709b5180af9d3f31f52f98def95d037e4213b736014c291cf7544acf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623618232, "uuid": "60668c4c-8095-4b84-a63d-a6cd6aa7cad0", "value": "73C49D1ACAD06241D84E88718C3945B91A7A5C36AC11BF07F690FA7939719C7BCFE31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623618232, "uuid": "6025505a-3c69-4dbe-aebe-cece4ba45aac", "value": "ee32a7d07aff9fd88159f3d8028f0500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623618232, "uuid": "4fd22a50-9e65-4709-8919-a241e5578fee", "value": "12288:ggyDT8PLvvaKrtURPnMXSVL6ZRwO+4DQDf2TPexaaiWgyDTj1cib:gJDT8PjiKZcPM86rw0WJDTj1cY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623618232, "uuid": "5e315100-12eb-4a06-a4a9-61cbdc61e8f7", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623618232, "uuid": "afec4223-7b02-4522-b97e-54f4d7339939", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623618232, "uuid": "db34552a-8c64-4c74-b0bc-c3a8085b25f0", "value": "kNapJZuUHcrPV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa5abbb-cc93-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623622104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623622104, "uuid": "13e0ee0c-a67b-44ef-a3ab-7a6d212bc5d3", "comment": "Malware payload", "value": "68a4da3147d1e3295d04a0629ead4b0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623622104, "uuid": "7ba93985-1a6f-4fcb-a93d-024257b3843e", "comment": "Malware payload", "value": "955f8374fb9b6f509dead8f29f3990ab02dc762345fcd3248886da10659c99e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623622104, "uuid": "9b6145f1-d773-482b-bb9e-aa6d0975407c", "comment": "Malware payload", "value": "3f515cc41c9dc71067236390b4ff32e688ff1722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623622104, "uuid": "e6ac28b4-d605-4702-a81b-e91b48ff2756", "comment": "Malware payload", "value": "5374b0fe4ed57fe51e61c3cd8e3b6a96003b6c90b81f78877a4b9ba71de98958e8b2352c86b3cc60cc590752b3bedad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623622104, "uuid": "f40bc35a-dd83-4366-a3e6-44933d612fe4", "value": "A526335002ED3C00CEAF747DE7DD0A872714880615336E96AFEA8A1FB16D6ECA59335D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623622104, "uuid": "21f1d2b7-727a-460d-b072-458e9eaf3f0b", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623622104, "uuid": "9e9e8104-63f1-4e1c-b5dd-18884e8d559d", "value": "98304:KJec5ziRk0mc3p4W1+WV+1InDezqka+BRGfKaieZv6aOdG4ykKfUY:ozxi11p46k14YqkaKGfKneh6U49Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623622104, "uuid": "6aa5b299-a2ea-4450-92f7-a39a5d450dd8", "value": 4846080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623622104, "uuid": "3369b12f-ca24-463a-8c41-52b88f21e0ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623622104, "uuid": "ce52ee6a-6a5b-4d9e-a765-2921e4504f5e", "value": "Silent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f6db7d-cc51-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623593741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593741, "uuid": "92996c54-476e-416a-a2c9-99b0e1e7a169", "comment": "Malware payload (CryptBot)", "value": "e1b1b906b90d0996a66f7132aea2add6", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593741, "uuid": "e165d89f-be9f-4d6a-8c4a-b662f90bad82", "comment": "Malware payload (CryptBot)", "value": "9d27976b21da5fc419da598ea44456a528b9fbf83f24fc5e14f697f610a5b295", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593741, "uuid": "8355686f-9167-49f5-911b-66e6d95d3ef0", "comment": "Malware payload (CryptBot)", "value": "6f1957598ee5f9bef19313d10665d599353960f9", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593741, "uuid": "49094d20-3000-41af-82d5-32a689a3198b", "comment": "Malware payload (CryptBot)", "value": "cc19e6f74187886607b200ea8be4f048ad8bba4cd7ea1b141aaa973576104b33cafd2b01074c582e17474837d987999e", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593741, "uuid": "3bc4b35b-425a-41ad-b8cb-72ddd147043b", "value": "438512B3A1D86A36D561C37570B4DF7BE4B8DE200618864616CCEE137AFB30C9B5622D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593741, "uuid": "f30ea171-6863-486d-abfc-887198377c2e", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593741, "uuid": "45c7272f-b2c6-4566-a908-8e16594d2383", "value": "49152:8TTjgpUs4trfHM68Hj0hzuuHC9k7qSQ8UiLCKMPWaROGIH:8TTy4trfaIhCuASUNuaRIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623593741, "uuid": "e0aed545-3a8a-49f3-94b6-0f877713400d", "value": 1821501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623593741, "uuid": "8f2880ad-d044-4d1a-aa74-0a1ef4bb924e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593741, "uuid": "9fdc8c1b-6ca5-437c-acec-5bdedee0b9dd", "value": "E1B1B906B90D0996A66F7132AEA2ADD6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdeb460-cc12-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623566722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623566722, "uuid": "1795452c-adeb-4a7f-a84f-7ea301e0c739", "comment": "Malware payload (DCRat)", "value": "bbd9eebe30cf8c3c92fd4dd04992c059", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623566722, "uuid": "3dd32634-b2c7-4761-8285-6257fcfd8d4a", "comment": "Malware payload (DCRat)", "value": "9feb2c77e2075ceead609d767a760e7a9b6e9433805b22d06d37d21fc5363cf8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623566722, "uuid": "59abbb10-4309-4e4c-813e-11df5f5a2cc4", "comment": "Malware payload (DCRat)", "value": "81a403af6577558075685f121270c7eda7d2ce7b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623566722, "uuid": "4ebc9655-0afa-414e-b7d9-ef2810e0eb9b", "comment": "Malware payload (DCRat)", "value": "e6f966081b7691a85ada7b903c90d50718fbf2dcce1f9ac26fc80e7ac95bcd8a6c580cde7170947d50cc4578be259a58", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623566722, "uuid": "e2930c30-3e08-49ee-96d3-2b0867164e1c", "value": "91356B263644C921D0690637D5EF5A140BBDED00BB62DB1B7EDE336CA9A13A36D0D1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623566722, "uuid": "80b4bee0-6aec-46ae-ac0e-45b3dbca60ea", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623566722, "uuid": "190fb5ba-5c02-454d-829c-e10889c08044", "value": "24576:/2G/nvxW3WLth/+xetpJCzcnZwG51lf2Zh+p:/bA3A1ce9TbHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623566722, "uuid": "11e9bb64-f92d-40c6-824c-53ad267f37ee", "value": 1058950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623566722, "uuid": "ec2d581c-e645-434c-a48c-3f9594389ec1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623566722, "uuid": "3ba79b31-52c3-4de5-b4e8-8e0da952672d", "value": "BBD9EEBE30CF8C3C92FD4DD04992C059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c03ea03-cbe0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623545084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623545084, "uuid": "456d11ba-9b34-47f0-bba1-dd9f6b1c402e", "comment": "Malware payload", "value": "c087d6972db5aafa200e4dd270ec9103", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623545084, "uuid": "b6e564a7-a4d3-458e-8dfb-931a03c4561f", "comment": "Malware payload", "value": "a21bb77cbf31a4d7221c1d831b120f285c9e1dd20098313fa7ccd3f7d7138f2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623545084, "uuid": "f57260de-ac0b-4417-9699-6567f55dae33", "comment": "Malware payload", "value": "778dcda0f928d1cc387c3e245a8ef56364cfdc53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623545084, "uuid": "e4c0382b-f9bd-42d6-9edb-0c8437b8e1e8", "comment": "Malware payload", "value": "67a78355e7178a53ccd73d62ac1cb8b9e4d73739369321b1687da49d9e5b47a49cb132f782b236019b54b0c5dbea1fa9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623545084, "uuid": "01703300-5fa3-4243-8d6a-181139336cb7", "value": "65F63327F648653ED46E27354A33A42054FFE669F912BD1A77E0C88DCF260C51E3AA34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623545084, "uuid": "f441f170-2951-4a9e-b606-b6a491ccf260", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623545084, "uuid": "95454746-a0e3-4bcf-a35a-285684ffbd59", "value": "393216:g5NRux/JDPUWPOD26LmBRGg0MGfDuJq3GTf0Ar:QNox/JI66mig0MyixAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623545084, "uuid": "7ae1340e-db8d-410a-bf5a-3039a0cc441a", "value": 15333038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623545084, "uuid": "f55aee85-e57c-4456-894e-eca315f785d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623545084, "uuid": "27fb5011-1501-4d99-b267-d12137baf9af", "value": "c087d6972db5aafa200e4dd270ec9103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b3d527-cc04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623560408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560408, "uuid": "bb9656f4-193f-4ec9-a5a1-b0e46f177408", "comment": "Malware payload (Mirai)", "value": "ab69f4aeac7958064cb792c41a383ba4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560408, "uuid": "4c8bb99d-0517-4f67-a1c5-57ef3db057dc", "comment": "Malware payload (Mirai)", "value": "a53ce99ee433c76d4595e7712b9195303ea5044f05d0f01f140402ef60a1b29a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560408, "uuid": "95fa402e-314f-49f6-8014-e8592bccedf8", "comment": "Malware payload (Mirai)", "value": "d8c5002de0c266432051bec2888c8b613ee7e172", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560408, "uuid": "16d3d8d9-6598-4b18-a616-8aa6f6dec167", "comment": "Malware payload (Mirai)", "value": "6eba71b8d31ac545ebc68b134e83341e03b7574cb32d4b60a9791e0cca8484e8bd9250050093fa67b67db933f9cba5d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560408, "uuid": "1ccc3fb4-2867-43e8-9d2e-b2d0cf484502", "value": "8C833B21A93D2F26C0D4B57F22B78311B2E2270E16B49A5D7DB60F4FFF2064068576B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560408, "uuid": "4ff3b83e-9e79-4e78-abda-936c0878ed6a", "value": "1536:/eaqUNv+C003uR3EOEuQ7JIcpv38q866VYNc/Oo5v6vDmMJrRkFFh:W2yViNcmvDBd0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623560408, "uuid": "fcee4688-056f-4a06-a1cd-03a238beedea", "value": 85052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623560408, "uuid": "f32a9b2e-3ba8-49e0-b98d-dcc83cd81372", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560408, "uuid": "544d6f7f-130f-4840-b867-09ffcad92d1d", "value": "ab69f4aeac7958064cb792c41a383ba4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4282fd3a-cc04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623560423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560423, "uuid": "d24c6767-a7b7-4519-8f04-28314f0caba2", "comment": "Malware payload (Mirai)", "value": "7a316007d2c62a2b4c770035cbaf6ddc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560423, "uuid": "2ce1d1e9-94e0-4538-bd8c-8691f94d490d", "comment": "Malware payload (Mirai)", "value": "a6dc1df2b59bc24b0ca6e21e97918da8f5c1636331dced5a34eb977041612b66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560423, "uuid": "f7c79d56-6417-44b1-b8f3-a4ca357eedbd", "comment": "Malware payload (Mirai)", "value": "fe07dd8d944b53fb36b5c7f4fce0e11997ab3d51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560423, "uuid": "7f54b125-cef1-4cf9-b8e2-efb77f925e6a", "comment": "Malware payload (Mirai)", "value": "b3570849d6cfa7eee8bbad4039a35ae3a3707d51ab0c077e9d07345732853d19ad3b8aa2e1888993590d120e9c839178", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560423, "uuid": "91b5721f-fbf8-4d98-9b0d-c3c3cfa0be11", "value": "E8931981B8819E15C6D417BBFA6F008E331297A9E2DEB253CD105F6477CA82F0E37685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560423, "uuid": "1ecbaacb-4d11-4446-aff7-8d939357a63c", "value": "1536:ZRnQL5TwOCmwd8gQ9+jQmY/IyJzcqWuySPI9mrsplDKZUoQBKXAVan2X+F8Jyvsi:CTS8x98QmqIazLWXSg9mrsplDKZUoQBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623560423, "uuid": "5e03f7c1-ac8a-46ad-8504-377127dfb5b4", "value": 92700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623560423, "uuid": "f70dc27e-d0ac-48c4-9caf-40410544fcab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560423, "uuid": "27ed6793-681c-49b6-8874-23e18ef37671", "value": "7a316007d2c62a2b4c770035cbaf6ddc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52cd3e8-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623549072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549072, "uuid": "93baa1b3-2c12-4341-8f81-00dbdc958e3e", "comment": "Malware payload (Mirai)", "value": "48f84ab59c9bf52ec39d40f82bb9f2fb", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549072, "uuid": "5c518445-2dee-478b-8ab6-ec189cbc5ba6", "comment": "Malware payload (Mirai)", "value": "a7010000da9597bb37061ed7287760e3835c06523fad1938715697eba5c61151", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549072, "uuid": "f8016210-469c-40a4-9450-2efa3a437b27", "comment": "Malware payload (Mirai)", "value": "31fe6341b7c8dd1c0a028264d85cab0737f542d0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549072, "uuid": "f2cb84bf-93e0-4f30-bdfc-b3a530f13a72", "comment": "Malware payload (Mirai)", "value": "76347c63d0721cda73a06921e09b6524f7cde707edf9e850c22d7242f12f6012e477a925158325377407951f28308873", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549072, "uuid": "c8b055b9-8bb0-49ca-afd9-e0b8ff714966", "value": "FA83F707B9C189FDC149D1300B7B753AD825F0AE1239B6E72785BF162C4EE704E5E8A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549072, "uuid": "76670d89-770a-48ee-aa03-6b2b611224db", "value": "1536:xLXCj7443kbw8MlwWb7poDeVP6Z3APGyzCRD0bBiu/2A8Eitf32S:ZXCj74408dlwqFWC6ZvyzCRwbV/2Ax1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623549072, "uuid": "d9ee6bb2-6ae9-4ebc-8ffd-a87968b90459", "value": 81312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623549072, "uuid": "bc9feea9-a529-46c8-82b9-344c67595e6d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549072, "uuid": "29f7ebff-26bb-4e67-b1eb-1f6b0541dfc9", "value": "48f84ab59c9bf52ec39d40f82bb9f2fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b1236a-cc10-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1623565829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565829, "uuid": "024bb7db-3ad4-4b03-9646-f7f4ae318d5d", "comment": "Malware payload (TeamBot)", "value": "b5f10a0069728d047f8a7502399b5044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565829, "uuid": "95897c10-a47c-4c6c-8500-85d352e47231", "comment": "Malware payload (TeamBot)", "value": "a8179df80d8b09d292559366fa3883b27b9ab84181292a065a869a93b7d1cb92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565829, "uuid": "82b6de34-69eb-489b-bf80-e862e7afea82", "comment": "Malware payload (TeamBot)", "value": "8c8dde56d205b01c04c4a14bf720f60e1ec920f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565829, "uuid": "4f61073e-e407-47e4-9cd3-27d9717eda08", "comment": "Malware payload (TeamBot)", "value": "b2828a71f84f0232fd35732a9ad14b034c7346fbf7d1762cd5bbafe29a01c155dc85d9408be9928efdd4d141fe2c5053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565829, "uuid": "a15394f9-2f99-4d3b-8668-a6f14d736a24", "value": "86050200B790C0F4F0F756F99A769EB995AE3960AB6450CF53CA6AEE13346D0AC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565829, "uuid": "5ad55357-373a-42c7-bfdf-8d2312ccbd23", "value": "baa7acc629fae892f4f615c8c37bd06b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565829, "uuid": "c7f69b31-a564-469d-a857-1ea554e83839", "value": "12288:XHyqxjnLxC0+8ksLez9mKFxhDNvEZUaMxXRbZYrbsrGztmhpWzvJ72tp9r/q1bKM:XHjRnLxkfz9mABvESxM0rkGEBG7rkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623565829, "uuid": "ff01fccc-7dea-407c-be93-5fbb4f29db71", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623565829, "uuid": "4f7f6901-0ab3-47e8-a8f3-d092386e262c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565829, "uuid": "13350d4d-3d8e-4be9-b3a1-4df204d12c26", "value": "b5f10a0069728d047f8a7502399b5044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6a5b0f-cc03-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623560169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560169, "uuid": "6e7edc3f-fda0-48fc-a107-a59d4c264f8d", "comment": "Malware payload (Mirai)", "value": "97db305609e8ece0d64873a3985653bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560169, "uuid": "a840ccee-6687-4973-9762-09925728107a", "comment": "Malware payload (Mirai)", "value": "ad36c2025f9ffdae2d04dc904454028db8466e1b90dba026edce88723b211257", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560169, "uuid": "00405522-afbb-4b0e-bab4-e4fdc9df3d14", "comment": "Malware payload (Mirai)", "value": "5bbdbf639708299a27438a9ec06fee899e47de71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560169, "uuid": "89f0bf85-4f51-4ce7-8f22-d65d2de503ae", "comment": "Malware payload (Mirai)", "value": "4b78f056f9a418ee4f83cd055ac4c527b4a36a625d024450b0748fb2a102462c466f1f2865b92e2093d01d4b3246676b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560169, "uuid": "61a311cc-961a-4f51-8df1-801f68924875", "value": "9C739E65C068EDE8C66446B8F55988364B13A00991633DF7DA82C7E640BBEFCF5097F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560169, "uuid": "8a379f13-df18-44df-9637-c810207e8065", "value": "1536:EaE/Zl+iKJr+++tX2gvBF7M0geisY+Y2KMRfs3HL4oFanhCjC6i:EtRlwBgvBVM0gJ+Y2Kaf+rzanhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623560169, "uuid": "8743d887-105b-4047-b5bf-023ba89c984c", "value": 75608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623560169, "uuid": "9ab6d850-5d23-44f5-b5db-16d46361af53", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560169, "uuid": "6fb040d1-324d-458c-8860-6f2322c1a4a8", "value": "97db305609e8ece0d64873a3985653bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d6a315-cc41-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623586527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623586527, "uuid": "2ad5428a-b757-4d6c-b719-efcc1a320287", "comment": "Malware payload (DCRat)", "value": "4e699636367fe56514f08e99cf25ac63", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623586527, "uuid": "33fa7fc4-b60e-4dfa-9907-9e6050a0d60a", "comment": "Malware payload (DCRat)", "value": "ad9772d6f566a170aff937281169b6fab61afa91478d7c9339441092f5914748", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623586527, "uuid": "9ffeb54e-1cf1-41d3-ad55-da2a381a8b94", "comment": "Malware payload (DCRat)", "value": "cad43afcb95d91b701b389e58d19552daf1d5dd0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623586527, "uuid": "01f1788b-70d2-4782-96bb-02ea22037889", "comment": "Malware payload (DCRat)", "value": "76967c1e8102b758f97946b59881611284abbe4ef442eb4b6774a9a840eacfaaa4ff5ff6b95af81ba8294746ad242046", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623586527, "uuid": "ece5418e-cb27-43da-bc3e-8f2ee9e0e9ed", "value": "3A356C123684D921D069063FD9EF45140BBDED007B62CB177E9E73ACA9613936D0E2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623586527, "uuid": "46945c10-23b6-420f-9574-3e092a86d34b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623586527, "uuid": "71bda1cf-65cc-42a6-9477-8489699aef15", "value": "24576:U2G/nvxW3Ww0tFqiItGOuLfrxOC4pWqYEwRR+a:UbA30rISLtfq9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623586527, "uuid": "e2c3e3dc-3707-4a20-8c5b-6b4195d060fb", "value": 1060988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623586527, "uuid": "6210a7c7-b540-4b8c-9e67-5f89c91b7a25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623586527, "uuid": "72eac070-e7e1-4f26-90c4-a0de9940e690", "value": "4E699636367FE56514F08E99CF25AC63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af87bf34-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623549009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549009, "uuid": "5368c721-2819-4ae5-8fd0-6af0700eed3c", "comment": "Malware payload (Mirai)", "value": "dec9fa7c573925ff6ceea21041db9b8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549009, "uuid": "d850c597-8bbf-4cc4-9d5d-626122f62031", "comment": "Malware payload (Mirai)", "value": "b341416a460ac1a4a70eb17fd224b53247d1f1ccbf32b9001e1b70a7c9ddc453", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549009, "uuid": "f6af39cd-fb72-4fba-9b15-e657aa1aef4a", "comment": "Malware payload (Mirai)", "value": "bf435ab34f01335cbbc3fb05041506f53627d732", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549009, "uuid": "93ebcd9f-f3de-4208-98fb-63818dc05b62", "comment": "Malware payload (Mirai)", "value": "1f805b0ae35c6049e7065effb0f412e8a4d800b7d6c8f387b89c660f5037d1d4675a395d3198da801152b76ea1192dbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549009, "uuid": "5ebaf9ac-993f-4888-adf3-17f270d8c1fb", "value": "12835921B83A2F17C0E1A47E21B74355B2F5275E26B8CA5E7CB20F4EFF1625029435B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549009, "uuid": "8290dfe0-c3cb-498d-acd0-ea6fa6b4afeb", "value": "1536:Sv9SkUJ3p9KTfE5I6e5pJKS97mjOVazOJSck4WdknxLSdYm+maC3j:w9LnN397COVaz4Sckixykq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623549009, "uuid": "3389b0cc-dd20-47be-82ec-97cb7634f212", "value": 85040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623549009, "uuid": "35144b58-0d61-4e0c-9dda-fedc54adaa20", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549009, "uuid": "c442a8e0-e3c6-49da-bb5a-e4885d40377a", "value": "dec9fa7c573925ff6ceea21041db9b8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946df344-cc5b-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1623597926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623597926, "uuid": "a88ba94c-c354-405f-911e-b0f5abbaf587", "comment": "Malware payload (RaccoonStealer)", "value": "b499d366f01242597e6386fcbbbacfb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623597926, "uuid": "0bb1f0d9-a33b-4f8d-b1f0-3230ada58b9c", "comment": "Malware payload (RaccoonStealer)", "value": "b566e04e4dde55640065fa942fcfa35ec3cb5f0c8b6057bfd0039ac4ebbc65f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623597926, "uuid": "a257441f-ebe1-431b-8ca2-15e0fe665ee5", "comment": "Malware payload (RaccoonStealer)", "value": "f4555ab40925523a3183adb353cde2d80aa5fad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623597926, "uuid": "469802ef-e9d2-45dd-a90d-0d8369414643", "comment": "Malware payload (RaccoonStealer)", "value": "0a68310e70fad0dc1627c24e28ec089bdcea68fc54bfe08533b052013e4c555f25a92f8a643fbc65076449f27986e741", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623597926, "uuid": "71e95dfe-f692-4bd3-8b9c-481eb817da31", "value": "B50633827FC9C4FAF55262304A5A2F7025FEC68C07F4BCABB324D50A4E5CB61C969D16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623597926, "uuid": "585f3b8d-372d-4112-8760-dbed86305563", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623597926, "uuid": "d9543506-80f0-4420-8b19-c726bddb3827", "value": "98304:xTCvLUBsgtGTlSQMlY2Xqn0JvuQErXZPNTQULOTLATU6sK:xoLUCgt7Xq0Nl0XZZnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623597926, "uuid": "52605afd-a31e-4565-bdcf-53ae64a525d1", "value": 3940561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623597926, "uuid": "b4428841-8461-4fcc-ad7a-0e49ccc862db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623597926, "uuid": "fdf03786-ef2e-4fdc-9e1a-7440d0e8925a", "value": "B499D366F01242597E6386FCBBBACFB7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba23e78-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623549003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549003, "uuid": "0499fa08-38f9-4a73-ba10-a727f55b94d8", "comment": "Malware payload (Mirai)", "value": "4df54302de99a03a758700bb0c5a7826", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549003, "uuid": "b1a93866-a7b1-4607-879b-4e898620a8ad", "comment": "Malware payload (Mirai)", "value": "b6962331b803e3fb855e176b028caf887539a81303c723cd4c24f28bb74f37b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549003, "uuid": "6dcb6e82-8a19-49e4-85ae-ebf50cc9d89b", "comment": "Malware payload (Mirai)", "value": "5c960bd85e71e306eb61805993de177be2d23450", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549003, "uuid": "6d1a0dd0-175e-45e8-bf5b-dbc91a8e77a6", "comment": "Malware payload (Mirai)", "value": "c3d3f09406a6ab21bb37e1dcec2977e300fb88380d97f1a6debceb1911f7d3255769831b5899ec9f67da86df6a2ce1bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549003, "uuid": "cd8e1a71-84a8-4e08-9cdf-d78967403103", "value": "3693F946B8818E12C5D813BBF92D118D332267F8E2DEB112DD105F64778A93F0E77A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549003, "uuid": "5e29672a-c384-4762-be4d-3a42823110f5", "value": "1536:5qnikc6eLNNYEt1JATTljQtzbK+LPlTKzZe+DnnyPUCZ8u2eVmxbztcIkiPqVR4a:z6ANYE/JKlAbK+LZKFePPUY8u2ewzZqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623549003, "uuid": "1fdbfeee-8ed4-40ed-93f6-f90df22fe56e", "value": 91768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623549003, "uuid": "d999b7e3-e855-4760-b47e-eabf0d204166", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549003, "uuid": "96b73bed-f52a-4641-8fe1-d2864e5b2e25", "value": "4df54302de99a03a758700bb0c5a7826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb73f2f5-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623549029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549029, "uuid": "eb6b8d0f-ba6c-4a83-a409-24a0120f89dc", "comment": "Malware payload (Mirai)", "value": "664d4494e289e2a4a75750d9150b155a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549029, "uuid": "fd5638d4-60c4-4d77-b764-ff7ea9e4812b", "comment": "Malware payload (Mirai)", "value": "b6f4f5eebffa88ce6c8593ea9ca0c9d789818a338b49f6179a4a7c7543b70b92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549029, "uuid": "8324c9fc-e5fb-4b87-9c82-99ab041f0c93", "comment": "Malware payload (Mirai)", "value": "864cb990a6297a3a8454dede306f7ca1a88f60ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549029, "uuid": "c44bf34c-e630-4671-9739-e4e8e9344b89", "comment": "Malware payload (Mirai)", "value": "5e73e009b8b58826b3a38f33d2585fbff7778010b5487f4b4308cc50482072aa4f3d02552c3b7e96b076f2181a6f332d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549029, "uuid": "ff8ee87c-0b09-48fe-9b2b-b51ad25f38be", "value": "CFE34D46FA418E13C4D527BAFAAF01893332A7A4D3DB73069D145FB43F8666E0D63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549029, "uuid": "3db74712-355f-4c2e-9c2b-2b167c260a5a", "value": "3072:bHVKXnKR7MjawygcnAunJz2ZAeD8kDpJH+JYWfmULOgL0SdUXM/9U4pXS8:zVK6R7MjawlcnAuJz2qWpJH+yAmAgSd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623549029, "uuid": "b0efa75e-dd3d-4f2e-b55e-ecd309a3b185", "value": 156616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623549029, "uuid": "86b45660-9866-426e-81eb-b78b5f1c861f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549029, "uuid": "eddda14b-2be9-4bb4-a7a6-4bbddf9e4fd1", "value": "664d4494e289e2a4a75750d9150b155a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be46a88-cc5e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623599147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599147, "uuid": "5536416e-22f4-4c71-acd6-6a4da550c1a9", "comment": "Malware payload", "value": "e590634fbc2e55249d2c4044d92dcad4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599147, "uuid": "32290c4f-f9bc-41e4-b720-4aa9d8e13450", "comment": "Malware payload", "value": "b811328fd6ddf4562a9f6066fd93193e3a344fc482dd9303c131d81888017b9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599147, "uuid": "4e356d55-ec4a-4934-8604-a479ff1ebabd", "comment": "Malware payload", "value": "cb5c3bea23b54aba08f1efaec5f511e2544e0552", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599147, "uuid": "78c802e8-b387-4810-bd83-919002c25933", "comment": "Malware payload", "value": "d0e1ae2a496295766a1856c681def44a72a3208bbbb2377afcf1d1a4d8b6c8fb97937c553f560ca4a836acc486cc50f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599147, "uuid": "2856d8f3-a06f-4759-99a8-7e490246e501", "value": "7DB4F10A7A955B46C554D4F1D0FB463403E3B5C7A636D2867A8807DF2E123E88DCAF8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599147, "uuid": "376fea48-4889-4ba1-945a-a4de5257e000", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599147, "uuid": "79d102fa-df55-4d9e-a95f-6382d84acbaa", "value": "12288:N6oKzvNway4ETsjSkYr9fUAKz9WASWUUrwtaLnvE:ezvNsCGXr9fvKzVSWqtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599147, "uuid": "9a324832-358e-4527-85d3-f8475b684c65", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599147, "uuid": "6b817d31-9d36-4b0f-8a64-770c041e9c88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599147, "uuid": "098fbda6-22ee-43d4-8f56-907172cc3cf7", "value": "e590634fbc2e55249d2c4044d92dcad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5037ead1-cc4e-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623592229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623592229, "uuid": "af9f8550-d231-48ec-91b0-5ac2f10d7e10", "comment": "Malware payload (AZORult)", "value": "cf3e02420036747df018012ab33dec0a", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623592229, "uuid": "fb4505fe-b35d-4884-aebd-5b0c9962bd09", "comment": "Malware payload (AZORult)", "value": "b85f098f87d269c3dddfb92af4f85492a0da382e0ef03c8b6a10a54ae45998ea", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623592229, "uuid": "6cd339c9-c185-42de-997b-631b271f6a15", "comment": "Malware payload (AZORult)", "value": "ce9db535821d7d43efeaf7e23df75977cb36d908", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623592229, "uuid": "ea649eea-cc8f-4cf7-9f86-fa56aef4345e", "comment": "Malware payload (AZORult)", "value": "50739e781ed10a43718f32743e502d9ae7202248975877d3b9d911fca841015c5a20e37a7dce684e23c41bc88cfbea9b", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623592229, "uuid": "e5ac7f92-5da4-4e7b-8bbf-13347d708e77", "value": "7264BE5EB6E4C532E10205701A91BEB1537EBC71D61A9A0BE38CF9D83AF2F815B61317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623592229, "uuid": "37891c53-928d-46fa-b9dd-aae5c902ae55", "value": "6930eddef69ab61e6824340dff912310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623592229, "uuid": "6d7f0fca-4bb8-4099-a80c-d9a5249b1ab8", "value": "6144:fAoHZp0zwPbKu5MsW1A0aw7m3YRLZIXH3YHL+HE:bp0zAlMsW1AC703g+HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623592229, "uuid": "331061ca-ba12-494b-bc31-13cd2a2f636b", "value": 327056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623592229, "uuid": "06742aad-5f40-44c5-ac22-03690aa52b04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623592229, "uuid": "f6a3801e-3e7d-4db0-9e7e-427ca6d7e46d", "value": "CF3E02420036747DF018012AB33DEC0A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f62cd98-cc10-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623565625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565625, "uuid": "7bfe9f7e-a313-4bbd-94f7-412f3c735857", "comment": "Malware payload (AsyncRAT)", "value": "a0b95c9001937f20bdb4cb6d18fc5564", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565625, "uuid": "ea39a0f6-2dad-42fe-9137-2afa08610628", "comment": "Malware payload (AsyncRAT)", "value": "b8e64cbed6c500a10cedbc02d590cc8ad4fdb67ea15fd963b8ce0c0701df2fc6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565625, "uuid": "76954484-26f7-42aa-90e6-2a5b95abba0b", "comment": "Malware payload (AsyncRAT)", "value": "0b40d2ee0b6036dff207aa91c4dff7cfc149a378", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565625, "uuid": "92675dd0-0952-4b7e-bb2b-bbcfa533272c", "comment": "Malware payload (AsyncRAT)", "value": "7d5d97bf8ff7df05b3ea029a49265f56fd973e04e1a0009036898888f9fc0bef252216803f51377a0f81a754f31d9184", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565625, "uuid": "c76150af-05a5-4b1c-9244-f9abf5ac4b73", "value": "DBD022FBFE19CC811302E19C817EA409C7C010F8B3B4881CB2E6E26428727D2C825AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565625, "uuid": "6d27790c-cf01-4564-a599-04bf0b97b3af", "value": "3:TNVgwX5MQLmcYoLvLLpuEoNHovRWIBHwMQTRLDQTvmQOP7VKYQNsXe753mm:/RE4vpZoNHovRW3TR/+vm1KTl3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623565625, "uuid": "2c78825a-2b3e-4960-a500-969310261606", "value": 205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623565625, "uuid": "c87a3b02-63cf-4cf6-a929-a123ce17aec8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565625, "uuid": "b866982c-57d9-4549-bbc5-015239fad5f2", "value": "eStatement-ID234222721494835.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7903a2-cc1f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623572093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572093, "uuid": "6ce9d16e-39f3-42f8-9eb6-81549a72296f", "comment": "Malware payload", "value": "dcb3207ed1e0d5b644d94690f07eb243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572093, "uuid": "5082ebc9-fe44-4fa1-97e6-fdc5ac47b85a", "comment": "Malware payload", "value": "b96afd0fce1152553d77414dbe3bcfdc63657bc00d5a49dab8f5e3d838b3e21d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572093, "uuid": "0549a60b-0ee0-439b-814a-e7e219d99c6a", "comment": "Malware payload", "value": "101dd667981d684939e24dd154bff36f48571110", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572093, "uuid": "128a8a65-a91b-455c-a740-969f3b712dad", "comment": "Malware payload", "value": "2287e58688504155ca6a3a208ec39790595fad7e71df1a1447ecf9d6e9d0282ec641e4f22ab38130f1c99057df1729cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572093, "uuid": "6f2fd33f-fed5-4882-8a0a-fc92bb81a913", "value": "AE758D90B2408B95D82B47B1AC2795301FE2BE5DD9E4C10D799B7A1F29B3372205FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572093, "uuid": "cf2b4ed3-4599-48ca-8c46-47f9bdf91679", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572093, "uuid": "8428d5b7-6df5-4454-bbbe-f3b81a72af56", "value": "24576:YGNeBUdtwsEgwsCe/z8YEoqSg5LlJfH6zMIDsxTt8Re4maCiGN45DMSY:FwBUwsEgwsCe5U/BldOI5iGqfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623572093, "uuid": "ba2bdf5f-4b49-4221-8f01-b32b274da146", "value": 1616896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623572093, "uuid": "d2e868ee-2d69-42e2-aa6a-caf3789778d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572093, "uuid": "d30e9935-1a5d-4f0b-ab17-277cd4e57059", "value": "PI- 1836 Revised on 11th June.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23be43ce-cc51-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623593442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593442, "uuid": "5ebec914-2005-4ad5-86a1-22f961283f03", "comment": "Malware payload (NanoCore)", "value": "e3a6f432ae83f97bff01e4b90aaf814f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593442, "uuid": "5fcce0ef-e91e-4d95-8e33-82eab9049a4c", "comment": "Malware payload (NanoCore)", "value": "ba8a52eb4502e01366ce32f812fcc9ed922022c492135ec09e9644cbb7f9a51c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593442, "uuid": "ea9c2c1f-3a56-463c-abe2-40c0f3d083b3", "comment": "Malware payload (NanoCore)", "value": "0c809f2cb6344330303bca95a9dac7d0d3be43b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593442, "uuid": "d9694c94-ec41-475a-8f58-93443e7cffd3", "comment": "Malware payload (NanoCore)", "value": "e6b074d183361cd8a9440b837a33d7819e19ddfd087dd9c2c4f68e9216f594b3522b23d93ccc4cab56aa218d87be1072", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593442, "uuid": "d9e3a192-2b60-4c63-9700-6f7995897e52", "value": "BE14BF2577A94A2FE29F86B9B12241139379C2E399C3F3EE28E455B34F163E106071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593442, "uuid": "fc127d94-5c8d-4c6c-911c-318e34e86725", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593442, "uuid": "534db4ca-c420-4c85-8cf7-931a31d793ac", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HInqVWLjxKXC0CSlMBjJtS9v3u:gLV6Bta6dtJmakIM5bWvUo4MBNti+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623593442, "uuid": "eb8422c3-8653-45bd-8e51-2b0d685e20b1", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623593442, "uuid": "dac58569-dd6e-4131-a762-e8fb4f8fee9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593442, "uuid": "ef57c9ab-f905-4d32-9a56-5921e9a023ae", "value": "E3A6F432AE83F97BFF01E4B90AAF814F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09624cb0-cc5f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623599411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599411, "uuid": "5e66e61d-5ff1-4196-b917-21660e1416ae", "comment": "Malware payload", "value": "463ceb2526abe326f2b8de4a3c55665a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599411, "uuid": "30ee7f28-b099-4836-be2e-30a4f251fe24", "comment": "Malware payload", "value": "bd352fa9760813debe498bc11b633f43dd230ffc9e8e3e071cff13e471d0f77c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599411, "uuid": "7fbd8a52-8e37-4252-9b71-63e875f0cef9", "comment": "Malware payload", "value": "ed26fd30211564f28740bcd6b03264c64fb214e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599411, "uuid": "bc38807b-521c-4d0a-8a70-8ce0b3e0c8cf", "comment": "Malware payload", "value": "5bcb0d97495c43e8d6eed8edca732966d1fc878d20d534fb56db68154cadf86195f1fc40af0ba46ed2363d53412ffb78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599411, "uuid": "ed11d69d-a70b-4e82-9a14-466041327e0f", "value": "1454012D12926635DD9B67338BAC4107476243C7B067CE1A78DD138A8F93B8F0D65ACE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599411, "uuid": "057aff0c-f246-49ba-bbb9-c9c70ff91ba2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599411, "uuid": "80286224-3880-4129-b163-8135a4c76525", "value": "6144:qxhmNeTnjumdxsvgISPEUpXHr+B/dkZYFMOnICPJhHgK:2fbSmdxsv4cUp7ekZYp7PJ5gK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599411, "uuid": "8435ab46-0e8a-4fe0-b1a3-fcbd5cba451d", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599411, "uuid": "9d90b600-5f27-4107-885e-2935b4dc4e1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599411, "uuid": "5d0513ab-a0f0-46f6-b49d-1b2399ac7ee5", "value": "463ceb2526abe326f2b8de4a3c55665a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380f8950-cc04-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623560405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560405, "uuid": "47cb1549-1b24-4f3e-aea1-55a1a9a7185e", "comment": "Malware payload (Mirai)", "value": "dd00c1e060a3dc3e941a978903f20f77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560405, "uuid": "7aae410d-05b4-4c9a-b67a-4672259d5d61", "comment": "Malware payload (Mirai)", "value": "beddc2448021034351b47ca566255b94e94bea7978ed010ee74a679ee29ec657", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560405, "uuid": "d8f474ca-c426-4f3f-a6bb-25a7331a9612", "comment": "Malware payload (Mirai)", "value": "30d856d87c5160a3c31b759770fe003ca0677e6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560405, "uuid": "37f54de8-addc-4a63-8ed0-7e2cec819760", "comment": "Malware payload (Mirai)", "value": "f87106d00f478cfb8637392d1716564efd538e3332dff68201de457c30b313fd9319d5a04c20f3312c2049840b4cac55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560405, "uuid": "f31daf5c-21f6-426f-8c24-2975ed6ac132", "value": "238319827881AA26C7D057BBFA6F108E331567A8E1DA73538C141F5477DA80F0DBB786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560405, "uuid": "eaf751e4-cca2-49c4-8e5c-88b7e721b283", "value": "1536:6DykGV8aEECo0FA/UrBVCSOeR7O5o/RMHyytdhpJeZWaxRlM:6DykGV8bEsFAZdhTwnbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623560405, "uuid": "8e8e048a-6ad3-47de-a068-5b6da20f6baf", "value": 84088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623560405, "uuid": "841b54d1-ebbf-4c62-b6f4-15de5dd0fcd3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560405, "uuid": "16cab549-aa5d-486b-8791-d580443131ab", "value": "dd00c1e060a3dc3e941a978903f20f77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a9bd4f-cc26-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623575296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623575296, "uuid": "d582d5e1-d2ed-4f8e-bc50-4b5d9765b743", "comment": "Malware payload", "value": "7912612e3a9b508fb4f35f536c2852f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623575296, "uuid": "2f368388-9e33-4727-a46f-bb69b5c93124", "comment": "Malware payload", "value": "c2f4c54b3dc30f0d8a46876480d08136f1c455a1f65b6b1adc45261b0a402304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623575296, "uuid": "4a43f24a-06f3-4cf6-ab02-861f5e24cc36", "comment": "Malware payload", "value": "433eaa603189b7bf7edb684a906ac3fd54793f80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623575296, "uuid": "2e1eb89b-3e8a-4ee3-8bc9-ba4b1f790802", "comment": "Malware payload", "value": "4e35bf3f331df1736154beae3c059a64b4545ac5a9070f63207a6a9c83ad12f6d70f2d387b7dd26f9eb85d1c0d727755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623575296, "uuid": "2ed3bef2-37b9-4906-b955-6e125da76c4d", "value": "45C423AC29C14EFBD52326300EBBDB42C17C9A963D54A9431F4D6F7A56004C6B32FB5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623575296, "uuid": "f4930fb2-d31d-4e90-b146-822f66ff0125", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623575296, "uuid": "ec6d73c1-b82b-4778-b0d0-c1202fde9087", "value": "12288:y+ngM6IKOJhNlzlC1/EFh2U7OnTl6J+38aRIN1aa/tswWfG0Rm/sF:y+ngM6gz/Q1ICTl6J+Ma2NEQ2ZuvsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623575296, "uuid": "db32277a-1c15-4741-966d-609dc6534fe9", "value": 543192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623575296, "uuid": "6848c0da-9326-4734-8393-846ce66dd85f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623575296, "uuid": "da0e580c-4b20-4d7d-988d-1e2a4b0b14b7", "value": "Payment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b5a20e-cc21-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1623573177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573177, "uuid": "9e394f81-deda-453f-962b-75e469aee4e7", "comment": "Malware payload (NetWire)", "value": "be2cc1521dcc84524d3ed8f294eef607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573177, "uuid": "44856cbb-8c22-44a0-a201-c999550a9dc5", "comment": "Malware payload (NetWire)", "value": "c5d3c1c7cd8f5545abb3c07b6a5676c1a4979acdcb14e180591a5c36f8cfcebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573177, "uuid": "41a15b16-4141-4e9b-b9e6-fa2f58525608", "comment": "Malware payload (NetWire)", "value": "ea84805a9d4e45aba026033a15730678fb6ac957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623573177, "uuid": "ae47a78a-28fc-42a1-9f32-79176c443287", "comment": "Malware payload (NetWire)", "value": "2f7637c4760e7e7cce61e6663ad82861b75f2a7357fcadb557284ad15b5a105f6ce58eab78eb4cdd62a2431e34a66c03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573177, "uuid": "38193628-349a-433c-b2f0-2eb9e47bf705", "value": "26254A59A243C9F0E92727B84C2956A8D4EA7D333B748C4A25B07A4C79FF2903D1DD87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573177, "uuid": "14b4f957-f658-4cc9-a622-57aa320229ef", "value": "a08047ed05d96265100ca97553e90f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573177, "uuid": "d54e373f-ebce-4b6a-bb54-f1916ab8ab81", "value": "12288:qKWXw4bc1NhDVFvci6VXI7ikDOHFR6ly2WGTZt6zqX0uNb+T0HXX+jBnnXLVgKRs:q5XYfDjAVrk6FIl5Ztmq/XQB/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623573177, "uuid": "a9892573-fc47-4552-ab1a-2f6c373ec0fb", "value": 984704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623573177, "uuid": "9c914680-9bed-4c8c-8a39-b959a954e1e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623573177, "uuid": "850fdba6-5711-42e1-8e42-0200faa0df97", "value": "Orden de compra mv85894.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763de623-cca0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623627511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623627511, "uuid": "9b5849a4-74a1-4b26-ac8f-1b010d6125b0", "comment": "Malware payload", "value": "05e7ce3eec8c5045c77f9e5794b2bf9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623627511, "uuid": "558d5c20-0ca0-42c6-a85c-f46998a5732d", "comment": "Malware payload", "value": "c631675aed0970b18fd818bdbf0586c9443cdf5487d40935aa30517e4ff36a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623627511, "uuid": "4e900a85-b921-406e-b9c3-2da43f3ea3dc", "comment": "Malware payload", "value": "cad3def5eff8c0c13f837382a5a28b5f132c97cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623627511, "uuid": "22b3e3ea-ef71-4079-bd88-b608cae29b30", "comment": "Malware payload", "value": "bfc18fca3df15c060778a921d9fdd99683bf5675140b48e88f784b5a738bdd1866d9e4b2ec3f3b1fc82fbdf4f3cd503d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623627511, "uuid": "f8ed114f-2067-44ff-a58e-fa8118639b21", "value": "0405F1AC725075EEC85BD1769AA81C64EA647D7B531F4207902370EEAA7D987CF200F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623627511, "uuid": "b806a37c-ee43-4564-8162-c1717a92d8f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623627511, "uuid": "5d8220d5-95bd-46a9-a062-2c465e5cbfe4", "value": "12288:QZM4e/ZUdtbHmklQPfnjCWquur81yAobfFnFjPnTaZJnHrBa+9m5jH4aGENEpB:QNeBUdtCpnn8u6CmflxneZZLBa+Gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623627511, "uuid": "165e76cf-dfbf-4e0e-b57c-23b81efbff5f", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623627511, "uuid": "6af494d4-ca64-4055-a4ba-7cc18ae2ddb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623627511, "uuid": "7d5fcec3-2913-440f-8d48-782dc44ddb65", "value": "SecuriteInfo.com.Trojan.YakbeexMSIL.ZZ4.7373.32693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1ce26f-cc12-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623566724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623566724, "uuid": "04828059-6e0c-4a02-abcb-c793636f5590", "comment": "Malware payload (DCRat)", "value": "9466bec85a4d8444b8f1038ce921b82d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623566724, "uuid": "1bdfb9ac-2822-46bc-8cfd-97c3d2edfd7f", "comment": "Malware payload (DCRat)", "value": "c9120f125ce5df82a27f3bf281d683e8738f21baccbd542d3bed52d16311dd0c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623566724, "uuid": "4ea5a8b8-6fc7-4142-a4dd-694b2c3f014b", "comment": "Malware payload (DCRat)", "value": "ecd3923d0b8c619fd6556e02e684f47b46ce4581", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623566724, "uuid": "e790b86e-2693-4ded-9425-f10cd03230a7", "comment": "Malware payload (DCRat)", "value": "75979ab257f01cbb32aff4fa82ebe4bfce3e605515deacbe5f39e501c3fdc842a48e481cfec18900e0e4a890e0f36131", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623566724, "uuid": "11e53f68-9fc5-4934-8c32-3135c629f975", "value": "28356C123684C921D0691637D5EF55144BBCED007762DB1BFF9E33AC6AA13A3AD0D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623566724, "uuid": "2bd8d866-d87c-455e-bccf-282ff38bae58", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623566724, "uuid": "6ad11f10-6f35-4c06-8b98-4e3f2d1d145f", "value": "12288:3RZ+IoG/n9IQxW3OBseS4Rb6krIVM5sn/Fehnmo9P4eV8Yp1B7gSmoqnP:/2G/nvxW3WLt6krqGsn/Fehmo+08sL+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623566724, "uuid": "482ee381-5791-4f82-8fd7-12355d012561", "value": 1095842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623566724, "uuid": "5e5bba6e-724b-4dd6-ac90-32bfc2814a46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623566724, "uuid": "972a6af6-3eb0-45af-937e-9ac4ce06ff5a", "value": "9466BEC85A4D8444B8F1038CE921B82D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b495ecff-cc10-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623565768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565768, "uuid": "4632340d-8534-439e-8707-d325ad0b4fd2", "comment": "Malware payload (ArkeiStealer)", "value": "77f9391a6ec4572ca97bb0d8d9d35214", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565768, "uuid": "c3776187-5ee6-4fd6-9e12-30e6e086b7ec", "comment": "Malware payload (ArkeiStealer)", "value": "c981039d18dfb3004a9b04aac2826b0fb32bde0f56539f3b14b65fe494088139", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565768, "uuid": "09aead6a-f2a5-4158-9d5d-bd1265d4071b", "comment": "Malware payload (ArkeiStealer)", "value": "d8b5bdd2b3fd0761707123da3a0036972801e5bf", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623565768, "uuid": "f66c5410-31ff-4e42-b406-96d6d353f0d4", "comment": "Malware payload (ArkeiStealer)", "value": "7d4c25536a0c67b5efd5554d9a0b8c7efa029266eba98fe4bf9aa739245c0ee23ab6028c61b077aa610cbd51ec3fd1f6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565768, "uuid": "95144f7f-9a89-4c5c-8216-06681da9b77b", "value": "EF05010177E1C0B5F1B316F559368EA965BB7DA16B3494CF22C52AEE26342E0ED32703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565768, "uuid": "4b92b2fb-4f8e-479b-8a5e-c2a8b13e190d", "value": "9d489fa94ad807363514196e09b7ee4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565768, "uuid": "49f32de8-1246-4fcd-a9ed-1346e7da5ec3", "value": "24576:ZvpSFoT/laOu09hlBu0o8QPa6N9ESfAnWHEIoclW0t:ZhLeOhXVQPjESfAWacl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623565768, "uuid": "be5f4663-00dd-4db5-8565-a0c742b07776", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623565768, "uuid": "4a47ea32-e4cb-4fb3-9b18-2e80e6e14635", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623565768, "uuid": "8ef3bdbe-8fbf-403b-a5e8-5e715e1bc004", "value": "77f9391a6ec4572ca97bb0d8d9d35214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da1b401-cc50-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1623593137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593137, "uuid": "60271fc4-6c17-40cd-87c3-df511b5abc0c", "comment": "Malware payload (QuasarRAT)", "value": "ddcbbeddaaf6d7ab99551f36655a00bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593137, "uuid": "1493ee55-c3ab-47cd-9766-8de2498e257a", "comment": "Malware payload (QuasarRAT)", "value": "ca7cc54257ffb69254f191196182c949535febc4e58e09cbc1d11c0e59f3ae7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593137, "uuid": "e64d8c57-0761-40d1-8df6-31ddac3d2f57", "comment": "Malware payload (QuasarRAT)", "value": "5bacc0cc6e8acb461e829224cf14af9a9c7fc545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623593137, "uuid": "ba5a7a08-a557-45d4-81da-635abd082411", "comment": "Malware payload (QuasarRAT)", "value": "96939c06162970165c888da7c6f543bc8bf32cb2747d731641a2e8f1f5acf576d941259732f4ba7355bbe6db1942fc9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593137, "uuid": "18025b33-822a-4029-b171-bb882bb501aa", "value": "47C419B11FA881D6E07DCF7994F334D15EB5E406A3F6E70A450C61A8E8667C58F432A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593137, "uuid": "e849a6a5-ac03-45b1-bef3-30782af7c143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593137, "uuid": "1bdaa08d-7491-4b38-a0f4-ed4a2fa86ed1", "value": "12288:XTEgdfYwbgTfwx/4OywdGp3Z34TcdOUUUUUUzd:AUwX0VywdGpCcdOUUUUUUzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623593137, "uuid": "f7104d2f-b1f8-4043-8549-c08cc2463d07", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623593137, "uuid": "f62dc3bf-fcc2-402f-95c5-a173e47c0fd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623593137, "uuid": "43a3f1ce-5370-4166-9802-de7d58ef7bad", "value": "DDCBBEDDAAF6D7AB99551F36655A00BD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb42e3c-cc5f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623599447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599447, "uuid": "8459e32d-90b7-47c2-98e0-908d2d2cbe26", "comment": "Malware payload", "value": "cf1048a8362b93b9cdf47260b50d8f37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599447, "uuid": "b86e180e-cc63-4d8d-a4ce-78d3be92a26a", "comment": "Malware payload", "value": "cb9cd8363620446c577396dd11ca16cd0ac377534c7a708cac3f94ce6d898279", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599447, "uuid": "147f7425-414e-4161-96f3-c91d8ff67fe6", "comment": "Malware payload", "value": "67f23a599e4a54a2f3ce121998445e12c97ba1ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599447, "uuid": "2c032d63-576c-40eb-8a4d-6488666a8f9d", "comment": "Malware payload", "value": "5a1fd0424e1e303feb9c1a5032701d2c64a75af7a6bb9f51fa5ad6bb1bbd465fc7963bce3d291a07dac583e8ab280d0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599447, "uuid": "0943adec-3dfa-49e3-b1fc-ad66bb3df58b", "value": "7B05F5B2D58F43E7994B4EB11863CC404C98F2C78653B8F52DE43C6A2B35B998DD7886", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599447, "uuid": "929e3643-3adb-41f3-8483-8536020b49fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599447, "uuid": "4bb15e3e-a8f1-400c-bf80-11829ac681af", "value": "12288:wZJ5gK0I2omOHu1/CQ8tl//tR05iIm5Cqz7cQuBcTex:s6KlifUQ8bHtUm8qz7IBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599447, "uuid": "9ad6f01b-38e1-4115-b7c7-541faf16759b", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599447, "uuid": "979b1793-bec8-4054-8bec-f55001bd1bf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599447, "uuid": "09c56d50-eb95-4c3a-8c11-d0df8453b243", "value": "cf1048a8362b93b9cdf47260b50d8f37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e89a602-cc61-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623600467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623600467, "uuid": "b1fb0491-84ca-4504-83ea-defc9d38dcb9", "comment": "Malware payload (Mirai)", "value": "8f8927568e2927fdb64f997aeeca7c65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623600467, "uuid": "b8c8d509-a71e-4450-8ea7-15bf7bd93b83", "comment": "Malware payload (Mirai)", "value": "cc5bd4c03252e2e3237583e99ac105bc516d13b4085ea0febc98b545a8be55f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623600467, "uuid": "3469579e-9a50-40f2-8bc2-db182dda0a9c", "comment": "Malware payload (Mirai)", "value": "673405f786a02e50af56b46e136cbf2f2854f6f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623600467, "uuid": "2a07b530-23dd-448d-9f61-62630c062136", "comment": "Malware payload (Mirai)", "value": "1fa00c7f9b966b3db9b58ddf3de41bb4369ae5bc0e066df8dc913cb68862cc48a77d56d3810b330dba3269a7202d64d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623600467, "uuid": "865850d7-ccf3-47cf-b581-fe737c4afebc", "value": "15735B24A93A2E27C1D4A17E62FBC321F1F6230E25B4961C3CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623600467, "uuid": "a3e17531-c478-4e0c-b64f-7d903e933f0e", "value": "1536:ubHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNicKzf8Fx8:kmcjaq+Dcc5J+vN4FzfQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623600467, "uuid": "b8b94f46-f335-4efe-a054-f361f922c660", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623600467, "uuid": "48f025f4-338d-49b3-989b-ca26ccfda1bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623600467, "uuid": "6b5e2511-9ce4-4252-912c-d934143e72ce", "value": "8f8927568e2927fdb64f997aeeca7c65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebb1c4f-cc1d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623571181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571181, "uuid": "bdb92e36-33e2-44f4-a984-fa78cfe0baab", "comment": "Malware payload", "value": "c820f75a5ee89d45a2fadeb392d01fa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571181, "uuid": "04516080-9f3b-4133-ad9c-66a26cb65623", "comment": "Malware payload", "value": "d032549cce5e530bc217bac9a9f31df13b17a54f3dcc943625a2014cef358fdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571181, "uuid": "43a9bc93-bb2d-470b-b5f0-aaf01bae8a3e", "comment": "Malware payload", "value": "b7f1a2405b5cf13768aec8ffa20a4349ee29938d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571181, "uuid": "1afacd62-862f-40f1-a8f1-71674596f71b", "comment": "Malware payload", "value": "cfdc5d151b6a9d658466cc7831a58bacef0a7dc35aaab68bc36d5d5d2bf0fe50e13cb198275a23fa4fc88a8bc8ffb833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571181, "uuid": "bd249ea4-4d8d-4f52-b650-67803424a90c", "value": "E7E4E1132ADD4762F27F9FFC68526814937A7993210AE6AE4CD515CF2A22B01CD41B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571181, "uuid": "432c3132-d4b2-46ff-a0d9-2a3a113231b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571181, "uuid": "c02df0e7-8b08-42cd-ac5f-005f5a8a53ed", "value": "12288:rEoQHlI/3MGN982GsLeshpOj27oqJLwf2gCg1Ug0hKd60Be9O:r0I/39YWOVqVu2gj12e60B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623571181, "uuid": "e7096b02-a6b5-4579-9bea-b16b5eb5ea4d", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623571181, "uuid": "60c9a376-a3bb-41fc-a721-092e1fbf840e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571181, "uuid": "d43aae33-289e-45f3-891a-a9b38c5fded6", "value": "demand.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaad9f23-cc4c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623591629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591629, "uuid": "bfe373e8-129a-4d1b-9464-cebd9219793f", "comment": "Malware payload (RedLineStealer)", "value": "03fe0ba790854b4dcb41cec688bf96e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591629, "uuid": "901d499e-c092-4327-89e1-257879f0ffca", "comment": "Malware payload (RedLineStealer)", "value": "d2ac4db811f66761b74ca3ee21683086dcbe8d63ad717a1796f0a2845d18179c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591629, "uuid": "d5889af6-62c2-4d2f-8962-07abc73244f0", "comment": "Malware payload (RedLineStealer)", "value": "b69aaf76a379fe05ecda7a908a89e91b08e6cb03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591629, "uuid": "d8ad6700-4e23-400b-b385-9c444071a1a5", "comment": "Malware payload (RedLineStealer)", "value": "b48c411f5d8970738c7c1128648ca6a247cebe0869d350f101d035ffbca9430bd3710cf2e0191453b02029b2fee5fd8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591629, "uuid": "4a525dee-1ec3-49f2-acd5-5c67a44b471d", "value": "7EC42E2825BFC509C4A7EFB12DDC98BBD9A995A3640E713301B9633B4B51794DE0F0B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591629, "uuid": "da283b9f-653f-40d1-aa74-e632846a2f20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591629, "uuid": "901638d4-a35b-4316-8979-be9ea635203e", "value": "12288:DSo73XmcalveiT25Zbc9fSW0JJBuCnKzZjH2wXLYIwbVC:+T0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623591629, "uuid": "64f1a33a-0395-4077-91a0-3c76cd6ebe33", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623591629, "uuid": "19f5215a-8c23-421f-a683-0799d3340117", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591629, "uuid": "c27feeae-f2f8-49d6-8771-f7e4c23c1bba", "value": "03fe0ba790854b4dcb41cec688bf96e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf6a605-cc9d-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623626445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623626445, "uuid": "c4e5c845-fadc-4f9a-aa97-dbed8563ea47", "comment": "Malware payload (AZORult)", "value": "123f146fabe662ad3c9bb4124465380a", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623626445, "uuid": "23e419b9-6795-4b79-bf58-ef8b31d42e38", "comment": "Malware payload (AZORult)", "value": "d43a9c39eb83b58fabc2a3d58ad0b47dc3f6642b3aa68dd4922905a66a4c4cb5", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623626445, "uuid": "c6813eb3-7d9b-4bd8-b23b-28d50023e3f1", "comment": "Malware payload (AZORult)", "value": "a63a3dbaea9163c7468c6c4e16407aada3b56fb1", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623626445, "uuid": "cb0255b6-7580-4783-a021-7e90b89fbde0", "comment": "Malware payload (AZORult)", "value": "06a1dd75def1edc4e76611178a38ae28acc2e5b48356593f2e67a7ef762049c36a4c8df259f2f3fdb924e44f60f42d7f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623626445, "uuid": "584372f6-90ec-46aa-9678-fbab2859b8c1", "value": "CFD3ADACD2B8FCDBD41680F99C76F6E5191FEA189468096A386A711314733533CB6C2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623626445, "uuid": "170b0dea-9ff5-436d-b305-7425f8698424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623626445, "uuid": "59569632-ad2c-450a-b217-6b3264385376", "value": "1536:vgCx0QIcVlD0ZCAz15fv2kDM7bOjaH4ZinJ0iOrvHyu2:QZ+D0gOxQOrvHyu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623626445, "uuid": "29a5f578-9009-48ca-8f80-2ce16b223917", "value": 139144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623626445, "uuid": "6efaa1c7-b29e-4290-8a30-522e5589d15d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623626445, "uuid": "68ba3ae2-3d61-4473-82ea-5dc5f01c5445", "value": "INV14062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaa8804-cc78-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623610345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623610345, "uuid": "cb590ce8-a9a8-48e7-8945-c5a14c386b7b", "comment": "Malware payload", "value": "fcfe1b8c81f617b566ef62f57862307a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623610345, "uuid": "69ff0d67-cbc3-4d7e-8afb-a9a94181735a", "comment": "Malware payload", "value": "d52a546ff7266c7357725076685dd54b11d1616423cd80fffd71d519df0811f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623610345, "uuid": "1a3d8564-75be-4760-8917-403e38bddb38", "comment": "Malware payload", "value": "90d9ad3d508d4381c353289f6078bb8b8213b965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623610345, "uuid": "6fcac9aa-3f62-4011-89e7-a2c25998384a", "comment": "Malware payload", "value": "ce13d93d3a08a93223b689307b4698d36c7a334509a275bfc305d6c471e194ef17307dda742e15fe27019a09988faf53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623610345, "uuid": "9225d406-e74d-43e7-aead-8a9f6eadc017", "value": "8125BE2523C8AF99F13E877951181408A7F6BC27E326CA49FEB610DE9571F41CAE1B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623610345, "uuid": "fef39013-4524-4938-8574-6ecdde084677", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623610345, "uuid": "699acb4f-fa76-47bb-bc22-212263556a10", "value": "24576:QcK+KDjI1SSHzDRODaulQn25TSGpDNeBUdt:++eaLzlOGulr5TNwBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623610345, "uuid": "85ad162e-4a5c-4787-a95d-4b9f687e58a8", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623610345, "uuid": "43f52627-fa90-4742-a2c8-913849390aab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623610345, "uuid": "d255e119-988c-4b1c-aaa9-4d9c3791ab5a", "value": "NEW shipment 5 x 40'HC Mundra to Yantian china.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cba5a6b-cc4b-11eb-875b-42010a9c0053", "comment": "Malware payload (BlackNET)", "timestamp": 1623591042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591042, "uuid": "2b565fc8-fbb6-41bf-a0ed-2e20b808f6ed", "comment": "Malware payload (BlackNET)", "value": "a94970a63494de9eecb666dd6a91b43d", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591042, "uuid": "2119e243-e873-4be4-8795-876051d28ea8", "comment": "Malware payload (BlackNET)", "value": "d76ec16d5684b8193aed6680a5d2b77f813e4267624dd79008544a44c405b4af", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591042, "uuid": "06aafb5c-d5d0-48ec-a0cf-6c237994ccd7", "comment": "Malware payload (BlackNET)", "value": "f4abbba641c235bacd47ccfb71fe52d3153791ca", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591042, "uuid": "e05b9c79-3bbb-4e26-a0be-326253aa5ec9", "comment": "Malware payload (BlackNET)", "value": "60321c0e1914d7963249468e65293a8358c97af3727998c28cfb960564490d9081bbd9459b908d8d31bb704fbc64b0ff", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591042, "uuid": "5a0d6ee7-f312-47c7-82f0-598d9473a5fa", "value": "B8F2191273F88236D2BD5BF94C3596014675FA07A826DF9D5EC480AE1B73B804E91BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591042, "uuid": "c458a9bc-808e-4447-b70d-ea068ddf30ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591042, "uuid": "b1c6f803-9d0f-4651-bfb6-3f6650e36e23", "value": "384:Hz7YVXRNV2KFkq7PYG1vWV9fkPiRNqsM0FnhRnbOrKbGLu9f7Xxx2BTGQO7pp/kz:HKFhzXWlnhFOGbSud7/v/5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623591042, "uuid": "fda8d2f6-641f-4349-a0de-6ffa90b38a2f", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623591042, "uuid": "98d8d762-a62c-4118-a809-924cc05e34c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591042, "uuid": "76f845f2-4787-4192-a2bb-8bf6fead344c", "value": "A94970A63494DE9EECB666DD6A91B43D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf498eb9-cc36-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623582134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623582134, "uuid": "04dee0ba-2f05-4bab-9e1f-3dc85d192796", "comment": "Malware payload", "value": "5e39fb1bb2d4914043276c91cfe85c16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623582134, "uuid": "5b7f65ee-0843-4005-8cce-5c967b97fa56", "comment": "Malware payload", "value": "db30e7a45705a8bf2071bd51b70157cace17faaf34aef2bcbd3266fa0ecce874", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623582134, "uuid": "f36d66fa-8fb8-4827-8219-9295347d6dcb", "comment": "Malware payload", "value": "30a87b3bb44a2cc19ebc9c2b21a2e8109145f209", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623582134, "uuid": "e3fcc94c-6b51-4727-80d5-abfb723b4dbb", "comment": "Malware payload", "value": "c8b0a9d62c574356fa09d72f6b2cf365401adf170f3563fc36edb996a712cf4f73b724709c0ecb4334b54b9938c73781", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623582134, "uuid": "afc541e4-b5a4-40fd-9149-f7c515e1a2e5", "value": "FBE33933AB504092CB4D1AFDD0A44F97AE547F38AF90F2CC6645F1E5A8B5B8D78B4212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623582134, "uuid": "3f067e9b-9396-4157-a015-3286cf59c446", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623582134, "uuid": "a5855cf7-860f-4759-ab2a-1ea839b06070", "value": "3072:7HjwCvkMTJ65vzv/PhqBdi9hQrWeYoYiMY:7H/v3TJWz/gCyYoYiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623582134, "uuid": "fd912787-0316-4eea-99a9-0a3db21dec53", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623582134, "uuid": "da3fe0c3-b35a-45dd-bc6c-19c46ced7820", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623582134, "uuid": "03b00916-5400-4bfa-af41-ceddea0968a4", "value": "5e39fb1bb2d4914043276c91cfe85c16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecd7e1c-cc60-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623599957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599957, "uuid": "96b8fc1e-0c21-436b-aec6-203c2c17ce38", "comment": "Malware payload (Mirai)", "value": "a040f2b16c36972a4152b735d2617a7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599957, "uuid": "d2cdf152-d161-4c37-9d1a-ce23a91bc8f2", "comment": "Malware payload (Mirai)", "value": "dbbc5d95f7d5c2496f65a5a6f935de8fc4296198f84ccacd7cda200780eaa71b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599957, "uuid": "8caac8f1-6836-4094-be3a-f04e98fa358e", "comment": "Malware payload (Mirai)", "value": "ae8a11b030db7d41c762d4e8ce4ece3dab98fa16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599957, "uuid": "61d2651b-2fb0-4285-a7a0-a3f5285a5b3b", "comment": "Malware payload (Mirai)", "value": "c8b03cfe757c3ad24de83ca7d0a273f91c832e435502c8aa4889f4a6e0e11fb92c67d0e27548659e5b982ce8ce4c5ac2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599957, "uuid": "d46582b6-3071-4be5-b19a-ca7d3fbdcbf2", "value": "2DF2E0214327D532CD74CABB993282E41A5B47F4F5BF30682790C59D98D2B07D4FE146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599957, "uuid": "397da3d4-97df-4cff-9437-cd3a053e8b4f", "value": "768:VYVgAxkU1RHz5poClGL1aMnXha7WBNoWhSxHjTcq9q3UELCj:VYyAxdRH9zILLBBrodjoLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599957, "uuid": "55acfbab-6487-4166-8163-ce9adc8d06c8", "value": 34484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599957, "uuid": "43d602f5-8481-4602-8125-9d95ed122ffd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599957, "uuid": "49827a57-f3ff-4034-b2ff-c31c14d82b4f", "value": "a040f2b16c36972a4152b735d2617a7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af73c4af-cc03-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623560176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560176, "uuid": "1d740d30-440e-4461-a76e-3484e000f8ab", "comment": "Malware payload (Mirai)", "value": "b05af3c117bd978bdb6a6c5894189955", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560176, "uuid": "5348760e-955a-4af4-b46d-eca67829878a", "comment": "Malware payload (Mirai)", "value": "dbd937915a99bf99bd156d95c94c5e864cfbacf612a7c9324449207129f14613", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560176, "uuid": "1525881a-3a1f-4c93-8f85-3e22424b905c", "comment": "Malware payload (Mirai)", "value": "91cf6954d1c4a38ed962cd1640c789a0270d4f50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623560176, "uuid": "ee748d54-a709-491f-b5bd-18fe4af131ed", "comment": "Malware payload (Mirai)", "value": "46406ac49b5f563a9aa05deb780908702492b68e3d314ba2fe416e9d7ec0e06158a5fe0b370b9c5247f56734fb44f40d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560176, "uuid": "33009e5b-bbe0-4748-94b9-3b66b2b1c11f", "value": "6D732A827C81AA2AC7D017BBEAAF108E3350ABE9D1DB7217CC140B5577D640F0DA7B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560176, "uuid": "af085958-63cf-46be-a69c-49d386e1787d", "value": "1536:q1ZbIhbGEPHfV3VEalK+RhHyFI/weU82gYoRz8JY30iS4N1x9YceZWB5N/WM:iZbIh6Eft3XlKg0ILxmcwaNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623560176, "uuid": "b94aa399-3b27-4074-869d-846e4993d6f4", "value": 74968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623560176, "uuid": "81349a45-12e9-4638-b62f-8fe146b63d22", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623560176, "uuid": "99aff189-d8bc-470d-8987-f3e058106d06", "value": "b05af3c117bd978bdb6a6c5894189955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef905b7-cc3a-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623583824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623583824, "uuid": "fc9a8dfa-c90d-4bb6-8989-f7caa4811450", "comment": "Malware payload (NanoCore)", "value": "563fa9e0a156d223b362bd9047a9c520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623583824, "uuid": "3ca9a7bb-dd8b-46e2-8eb2-e55ae2e22ef5", "comment": "Malware payload (NanoCore)", "value": "dbfeebf4abb857a3a340b2a9ec6bb8b5b041dc5cc1ca32d89ae64283200ad2bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623583824, "uuid": "7b627c69-3646-4d59-8e75-56c417e18864", "comment": "Malware payload (NanoCore)", "value": "f28c83415b89dfc7839ba640198d6296fd1e0866", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623583824, "uuid": "c1dfe9ff-de65-4996-97b3-934d29f9a266", "comment": "Malware payload (NanoCore)", "value": "e0618fecaabb14c8565f50c0071b32dabd1cf775bbc67464f3ef5416b4125649b4e5d779b9c000ed2197ed20b48c96fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623583824, "uuid": "616c31c4-2fe6-4aa7-94db-c67a641d3a1b", "value": "DE822A20F3C14E13E83A787960F55B156B73A2D1AE0AE62E2F8CC1D29D037C35A5D66D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623583824, "uuid": "7dbcc11e-84b9-4027-a575-d83d6857a9ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623583824, "uuid": "93bc87bb-686a-45d7-a8be-8ae1c933e8f7", "value": "192:Vy8VNjhltpRY1Bzx7UzyTjUYEBza7tIs+fNWSdO6u4SyhScWD5UeoWY59uUByBZZ:ookxUKwvza7mZWSd3+mEO9Yhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623583824, "uuid": "ba0de918-3bb0-445d-8982-eb0e9d86ad11", "value": 18680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623583824, "uuid": "4a10e0a8-cc3f-4023-8229-e8d7577d9588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623583824, "uuid": "ecd25197-dd52-4c81-9f47-489577a45daa", "value": "563FA9E0A156D223B362BD9047A9C520.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf393cf-cc72-11eb-875b-42010a9c0053", "comment": "Malware payload (Athena)", "timestamp": 1623607737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623607737, "uuid": "3b192ed2-4849-4bce-a544-7e2bc008ccf6", "comment": "Malware payload (Athena)", "value": "584ce19705c3c4036039570ff18def4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Athena", "colour": "#0CA5C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623607737, "uuid": "6f18df2c-1933-4541-85fc-7e102ca72890", "comment": "Malware payload (Athena)", "value": "dd4a00fe56aabe5a7363d46a01c6197d9c8a860c4ba3bffb6ad9bf9f40874187", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Athena", "colour": "#0CA5C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623607737, "uuid": "1e35e98b-13f2-411c-93db-cf04cbf9d2d5", "comment": "Malware payload (Athena)", "value": "b6a2ea93e9a89ac68bc6ff739f0722b88e0f39b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Athena", "colour": "#0CA5C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623607737, "uuid": "c39d88a5-ac28-4c06-8e6b-88933c2c9933", "comment": "Malware payload (Athena)", "value": "87069bfe3de860e318966947b9b2a2fdd1714288ac55cdee763c2b2589990d84189720497c7b13a25c5ea3f7ab26142f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Athena", "colour": "#0CA5C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623607737, "uuid": "230fabe8-e9b5-4f91-a63c-0f43833d7476", "value": "0714550D2AC493975813F5F68613F5271AD340096D56CAFF8C2EDEBA96E1B78043D88B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623607737, "uuid": "0a147631-103e-4eac-b103-ba76384b1cda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623607737, "uuid": "799cbb3a-af72-4dd5-bddb-15e46a25ae39", "value": "3072:eiQDkuJjwWhYSjaCICE8XnNa3RTXpArN4i4yrKPmSrqhD/ZZjgx8URjBDfu8llh4:exDkuJMWOGICE8XnNa3RTXpArN4i4yrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623607737, "uuid": "0f141b44-30eb-405e-9066-a8f0ce9c20e4", "value": 193872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623607737, "uuid": "1c4c1285-38e3-456b-aa95-129b8eb4211d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623607737, "uuid": "e793a9a8-f83d-4a4e-9d3c-bb452c81db40", "value": "584ce19705c3c4036039570ff18def4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b26c7b-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623549050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549050, "uuid": "149ee6da-59bb-4478-9257-468790dc867c", "comment": "Malware payload (Mirai)", "value": "f32a0e7ca5282487d32e8484d5b32ec0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549050, "uuid": "28018791-8b3f-4188-a61b-8459f916b1fc", "comment": "Malware payload (Mirai)", "value": "e1176af9232a5bfff7face8d3482382034682d043ad2a24f91b74396e77c4a0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549050, "uuid": "1c163937-8bb4-440b-9e93-5241fad43ae6", "comment": "Malware payload (Mirai)", "value": "8ec3d384323915a9816cb783228f7d2c09560f7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549050, "uuid": "bc57c35c-eb9f-4965-b5b9-ad44a9c12017", "comment": "Malware payload (Mirai)", "value": "ed68e3994492a2c5a7c0a3a37e076324c13bc8f12d56375bba6ce0c7ff33f44a8e075ded94f43797b75f20130642a06e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549050, "uuid": "02029d20-47a3-4898-bcf0-5f5845b70125", "value": "1A73F8467C829A6BC5D023BBEA6E108D332163F8D2DF7117CD111F24768A92F1E63B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549050, "uuid": "c7cb5bb4-7c47-4edf-bc9d-b8fbade3a6f8", "value": "1536:CmOL2SDOTpJfCDYU+BpOIORO0CKK7wQ4R3cD7SFBFiJwgCBaKpNwSGUd42+1aV3:zOL2SDOTWDvLFQqwOCJwgC4KpFGU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623549050, "uuid": "d21aeab8-7864-447b-b0e3-226b720eea89", "value": 75064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623549050, "uuid": "a1d4b6ce-ac0f-448a-81b0-9848942f1d26", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549050, "uuid": "399e2827-2a77-4262-9ffa-81bbb5744c02", "value": "f32a0e7ca5282487d32e8484d5b32ec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147c7a62-cc1f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623571942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571942, "uuid": "8a902bea-d3bc-4024-9978-c28c101ac3ea", "comment": "Malware payload (Formbook)", "value": "bd3d6ce769e0c74653a1b534533ad31d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571942, "uuid": "d060dda2-3aa8-4a2e-b10b-15081a7970c1", "comment": "Malware payload (Formbook)", "value": "e1556b66ceb9d2f4d30e944a1e2f0abbb6bc112783d1ba6573c4d75713e61970", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571942, "uuid": "3b84a7d2-ee50-4cef-b0c8-6caf937d2cf8", "comment": "Malware payload (Formbook)", "value": "4295cbd801b61faaac298374603d0a84702f2141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623571942, "uuid": "45800423-ad57-4647-b90d-dc4f93b5a9f3", "comment": "Malware payload (Formbook)", "value": "23123066ebd0c80c54018699d7daefc9ee1fdee117928572603ab459fec82083d7f1ea838f8d695a5c7e04f42d96a4cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571942, "uuid": "7cc20203-2b78-4baf-b45c-46db7f249369", "value": "25157AF5A5A107C3D39EDDF187CAB3848B6F46A235328212E95C22FC26DD28D25CE547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571942, "uuid": "9e5a453e-087c-40c5-b1ab-63a7fab33a1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571942, "uuid": "e1edb314-318f-46c3-8691-5e8240694d46", "value": "12288:8oRnu86FK5kc5M+OhYJT93ZWbhyX+h0rkLYCx1vc7+Gd8ZM4e/ZUdtb:8OHGqYI93ZJX+KYUa1E7+GaNeBUdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623571942, "uuid": "1f96bd84-0557-418b-bc28-396112d2363d", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623571942, "uuid": "ccdd153b-fafe-44ac-8987-85ed5172fbd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623571942, "uuid": "36e61176-1580-4fca-96a8-4707e8b9a059", "value": "OFFER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3e5fc3-cbe9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623549057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549057, "uuid": "0f913540-0d44-4dcf-9347-21391c18c186", "comment": "Malware payload (Mirai)", "value": "2f6c5a27292aa0cb7bb5d6ffa49e1836", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549057, "uuid": "c8b0da0f-e7dd-4eae-9f80-f30dfd41d4a0", "comment": "Malware payload (Mirai)", "value": "e338f0e1845cc9ffab1079c5ceed99218b9020b77a40531f1aa04a859d463a52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549057, "uuid": "77509382-eb1a-4d3f-8f7a-beaae6155d1d", "comment": "Malware payload (Mirai)", "value": "26a1650b16d8e330ee05ea62c12846d3542ea16c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623549057, "uuid": "8569fdfc-f1e7-45ce-ab2c-f7e2c539b8d1", "comment": "Malware payload (Mirai)", "value": "fb72c9285ce50f7e4122ff3bb793ad3b977aa6bf45f8f5ab3464a490cff934cd7a52151e150d9487e86aacc8dac20a27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549057, "uuid": "2efec307-b560-4214-82b5-f4c4bb481308", "value": "55B3831ABF611FFBECABDC378AA8170528CC651921A97B717934C418F24B25F55E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549057, "uuid": "0326aa82-30dc-4402-b974-90cdac2f0787", "value": "1536:m5MokubAs2ItbLB3Ooc9WCeuPROf2dNtXSRFuZwNEgLd42+Ga13aNzq:m55kubAs2ItbL5Kh1PUFu2IMN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623549057, "uuid": "57ae5c70-9f10-4ae7-8e92-0ca5b67b8ac2", "value": 109368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623549057, "uuid": "f0aae1ed-157f-4117-8cfe-cb641a1e0bb9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623549057, "uuid": "d70df089-5974-4133-a489-4115a93e8a08", "value": "2f6c5a27292aa0cb7bb5d6ffa49e1836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58615f95-cc32-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623580216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623580216, "uuid": "a44dfc73-3d37-4797-b442-d13f25eb4863", "comment": "Malware payload (RedLineStealer)", "value": "10755117709617abab237a30c22f9a23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623580216, "uuid": "83933967-5e2c-48a8-ab09-675c41e5878f", "comment": "Malware payload (RedLineStealer)", "value": "e369896169a902d744d28516d616803767a39db167ccc2ebac8a44c0bac049a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623580216, "uuid": "d17963cd-68cd-467e-b541-81645d5f066d", "comment": "Malware payload (RedLineStealer)", "value": "c5bb6e4e67025a9731f758a0d3c244c4f34b77ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623580216, "uuid": "8d94b749-5014-4e01-8bab-62356b1c0c8b", "comment": "Malware payload (RedLineStealer)", "value": "30497121308a418f498b0a0beac10467640b0a5acd303cb4d2098f92654f19fdbc7cb8b399f4d04ae426b3a13e260788", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623580216, "uuid": "f37525bf-3f9a-4441-881f-6084778218c6", "value": "8D144A29B35C8915D3BE4938AD70163943F1EDCB9812EB874EE07C9E2D76BC22A045F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623580216, "uuid": "c31b6acf-968b-4cac-b148-3d5df6b00181", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623580216, "uuid": "5c42695a-d947-4f45-9df2-f40ef5078adf", "value": "6144:eknIgmOOOOOOOOOOOOOOOOOOOOOOJOWWpymTPGr:e8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623580216, "uuid": "122b9455-2531-4621-99a6-bf6dbdd50715", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623580216, "uuid": "c703fd8f-550c-4746-8a38-21e398275110", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623580216, "uuid": "d5ceb732-bebb-49bc-bed7-36c05f7cdc3c", "value": "10755117709617ABAB237A30C22F9A23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d1d2d2-cc60-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623600242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623600242, "uuid": "6ce3038e-925e-4e96-bbce-82b01d264959", "comment": "Malware payload (Mirai)", "value": "d8114d1542065c0573885aff028383db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623600242, "uuid": "74a6fd56-89bc-40e8-b481-a85787d53de4", "comment": "Malware payload (Mirai)", "value": "e5d1d3d0328d8b4fd658887a8532ec333d428140d752a70d65f542ed64b632dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623600242, "uuid": "92275eac-dfc6-4b44-b017-d0948e70b496", "comment": "Malware payload (Mirai)", "value": "3d25a284eef13e5bbc52073e8e72e41189503400", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623600242, "uuid": "1418600b-fcb6-4cf4-a9f7-c8d7c97f1e2a", "comment": "Malware payload (Mirai)", "value": "60690f52c6049cc588f64da2dfea3fd3ed725ae68c1381603ade554c2dd6ee83e956960b254cb8c2640c890cdfdbc533", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623600242, "uuid": "b83ab7f6-2ba2-4dc4-9a8a-ae8d68c40473", "value": "97D2D1AC63041369CAAE90FD176A07A43CB94F7590D3EE6E62C0F9C1ED404F479939D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623600242, "uuid": "0f182b73-7f60-4778-a5b3-a1f6a0ec7003", "value": "768:myvYLznDEB2iC+sDqC6NtxsfzxPnNsGbmNuXmJgGlzDpbuR1J9:BYnnDEBI+smATfSVJuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623600242, "uuid": "b18cef74-c03e-4eb9-9338-a5c27c7dc471", "value": 30840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623600242, "uuid": "57e6775a-dfe9-4c78-a837-4d598ccb0168", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623600242, "uuid": "9ae3e3e5-00cf-43e4-bc1d-bef4c137f097", "value": "d8114d1542065c0573885aff028383db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1041b6-cc5d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623598909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623598909, "uuid": "c00dbf1e-88f9-4e26-b7c4-42b228ac57b6", "comment": "Malware payload", "value": "171f87e916215ec4a0683cd7566033b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623598909, "uuid": "c944731a-12e1-4325-bafe-8cf02ddca2c3", "comment": "Malware payload", "value": "e8178770be826de7e8e192c6300db0c8ab50d42677462afa0ab4b58be6ae14c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623598909, "uuid": "8f3ccd1f-a576-4d53-a558-4d4b5d45607b", "comment": "Malware payload", "value": "9ab3724768cb83cb9a47940e573cbe1b4ab8f435", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623598909, "uuid": "6fb04369-26ad-46b2-a18b-90c0ffe92df0", "comment": "Malware payload", "value": "d9e82eac554ea9a4aa58c4fa372cd3cbb680365a07ec588975d75ac1ccce5db90e189c22fb8b35d77df84de3b839c2a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623598909, "uuid": "fb944102-e3fd-42a4-8e90-e6746a174a29", "value": "6A14F16691CBE779CE466A330FED82139B34C3C7B11B995768CC034A874365A87B1B9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623598909, "uuid": "b3462870-b481-4ce3-8ecf-da0038127f76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623598909, "uuid": "df86fec5-9e49-4ab3-af8e-15a5105c500e", "value": "3072:tWrXzKz9+6UuVn5iAhGadBKfY50/FtGcOBv++WCiCBOVJbIpmrNMwfHg/Can:tWvW+6UM5D88KfY50/CMQVB0JhHgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623598909, "uuid": "beaa8b65-7fbd-4a4a-85a6-3e279fd7d709", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623598909, "uuid": "fbff425b-fbb3-4516-948e-c30d7c46f3e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623598909, "uuid": "46ab2641-8594-4b23-9740-9fe5bce509e4", "value": "171f87e916215ec4a0683cd7566033b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd5e81e-cc21-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623572867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572867, "uuid": "4872645d-d446-4cad-926a-63e59d4bdbaa", "comment": "Malware payload (Formbook)", "value": "28de2fd9e1b43b6f22082a3c3e58103f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572867, "uuid": "51406dfc-4bfb-42c5-a027-e34bad105800", "comment": "Malware payload (Formbook)", "value": "eb3f64ec577c51957dfd0c55a431209e947c281c3a2a1f2d8514666530a0e608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572867, "uuid": "0cfe8ea0-f519-4268-a25e-2419dfb072f8", "comment": "Malware payload (Formbook)", "value": "96ec5e1cc1aec75159f58b1676b54e289fedea52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572867, "uuid": "7f7f9761-f662-48f9-b68d-73ae7c226f5f", "comment": "Malware payload (Formbook)", "value": "3033e728b39a778c3d71a6d1ff3c74f9f1bd9c46ab2f6d888b9b323f28234098b39f23f08c67b6a93979c8d865a6449e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572867, "uuid": "7b42a3a2-b8de-4b33-86d5-fee9344ba7c3", "value": "043412AD3AC215BAC48D063455B7DDB9C3FA96511312234BAF719FEE7A602C3910B8C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572867, "uuid": "c180484d-295a-49b7-aed5-5ee864531d22", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572867, "uuid": "05864e48-e0ad-4432-bc1f-065331bb5573", "value": "6144:Ds9ffK0UxuowUJzbwVoL+wIcvNNUjKdvbpb1NLopsklGs06Fk9A:yfpUx9wUJzSoL3ZNUjKdvbpzopskYs0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623572867, "uuid": "cb910851-191d-4fe8-a804-3057dd01dd5c", "value": 245660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623572867, "uuid": "c51f2b31-7ce6-4df4-954b-bd2ef87c0af1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572867, "uuid": "dd43e525-f441-410d-b2b7-04e70929eef6", "value": "4567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905f4708-cc1c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623570861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570861, "uuid": "1e0c6559-66bc-47e2-af3a-73d1b1d25a52", "comment": "Malware payload", "value": "04dc7b9876d3e23780df952ebd3c2e46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570861, "uuid": "c33f658a-afc2-449e-b5da-29081edc97cc", "comment": "Malware payload", "value": "ebfd8ee6075a687bfe40c156d61d89a2e724505a617fb077b543a11b9c4e6b43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570861, "uuid": "c1317896-e4fb-4a5f-a32b-42a87118a583", "comment": "Malware payload", "value": "cf7bcd0c89381804067bdd5c61c7b4a7a36e02cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570861, "uuid": "b1a2fc39-50cc-40f6-82ac-4e927d273d84", "comment": "Malware payload", "value": "c131e2e35ac6c3eaebe99a1f6c1877649b45547330dcc8cb4e6d5d5918ae0b7c1d3e887672e4e49c3c7c79fb17342ae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570861, "uuid": "b17ad605-4817-4701-a6f0-85a1e94d5259", "value": "5DA4E1C2F35485B2E85B1370583FDD220666BE55ADF0811E265E7B293FF72D20467A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570861, "uuid": "f8b03399-6c5f-4077-a3b7-da51e54ce7aa", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570861, "uuid": "a4b6f344-8e0e-4adc-85b6-2ac80d803ba6", "value": "6144:Ms6pJko839Qmc3rsdjk/umS0w7W6xbdYAxI+DBqUMg8mDmlo7y:ANmcIxQumS0w7/YMDgUx3DQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623570861, "uuid": "f69af52a-48ed-49a4-aeda-706184b3a872", "value": 486282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623570861, "uuid": "31b0ad50-1345-47c2-bf5e-0030e270cd7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570861, "uuid": "66d9841b-435f-42af-bc25-38cf50ca4a2e", "value": "Order_C3350191107102300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cb4831-cca0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623627514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623627514, "uuid": "8eccdc7c-653a-4883-8fde-fce1f1d5d0d5", "comment": "Malware payload", "value": "41303695b21747a5b88c6ee651c8b118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623627514, "uuid": "d8d5df1e-66e3-4967-bd62-db8e7f7709a2", "comment": "Malware payload", "value": "ece5426f929eaa80defe2e50bf462830fdf601d1997b8a0c7464ae2945d6d672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623627514, "uuid": "40c12cf0-e5ac-4d8e-b2db-de4d8a9f7909", "comment": "Malware payload", "value": "a76e1cdaf4e7977244a6ab38c4599a8420941cee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623627514, "uuid": "9f1f3fc8-12ab-4a7b-a44c-75b4789525c3", "comment": "Malware payload", "value": "e3e5611966b808456fa75dcc50266d7a51ac980b88b6ee4faf250443dd979d3f419a3811bfb60f0ec67957adcf9146c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623627514, "uuid": "e79c3cdf-7650-4ddb-ad8f-c9ebbc6e0958", "value": "DB05F1AD325076DEC86BC172CAA81C64EA643CBB431B5207942734AD5E7E987DF244F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623627514, "uuid": "eb49a917-cfc0-4e05-aa25-e874c5b9fc4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623627514, "uuid": "6c1b6646-a484-4031-b194-5da18f4e4874", "value": "24576:hNeBUdtx0UADfWh+k6QVzriYbG0pgPAF2:hwBUifM+k6ozOYCdPO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623627514, "uuid": "f0b37d3b-3da9-46f3-8356-bafe68ce325f", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623627514, "uuid": "c45ad071-636e-4a83-a31b-3e80d23eb848", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623627514, "uuid": "7c4dca28-7853-45a9-9537-adf556e05bc2", "value": "SecuriteInfo.com.Trojan.YakbeexMSIL.ZZ4.3348.17130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfd48ad-cc1b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623570562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570562, "uuid": "2a6dc4b5-df6a-468a-ac3c-b6b98a108cf6", "comment": "Malware payload", "value": "2afdffa596e5c20d18f7e00dc6e73493", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570562, "uuid": "522ab334-2a2f-4fe5-8c73-b17b6b7f24c0", "comment": "Malware payload", "value": "eed29bcc7839a20dbdfb496d946de1f47404b693dff72cabfbd4d21f26d8ecd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570562, "uuid": "1cb832f3-0dcc-486f-a5e4-ed7d8f9a879f", "comment": "Malware payload", "value": "98cb583b78f035378f787ec80221de537a3973f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623570562, "uuid": "ca63c908-a204-4ae7-89aa-a82c778ea377", "comment": "Malware payload", "value": "afea3b711c1a135bf6df2f8753ab0618086aee7aa71d588503e14e35b1ab774b98589f1cbcf2ac0d65d9a0e98ee31abf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570562, "uuid": "42cd564a-5220-4467-98c7-a01ed33b2f11", "value": "E2F402E033851ABFC1A9157CD034A983C2FCD063662AFB497D9611DE2ED37974B025EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570562, "uuid": "ecaf9976-e2da-4440-b07a-84deba508980", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570562, "uuid": "ee3fb747-41b3-4394-959e-8f575e8eba1f", "value": "12288:LygZM4e/ZUdtbf1ustL+4Vz+pDxK/S8RG52G3Jm/aWFLOnYIOO8xCiugPoxh:XNeBUdtrIstbVz+pFKq85G3JlwqYbiiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623570562, "uuid": "cbe180bf-f457-4160-8808-0b3ea22338d4", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623570562, "uuid": "32de7242-253d-4420-b697-c3549050b090", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623570562, "uuid": "54f55855-6a33-4e6e-a588-b0892a191ddb", "value": "FhlQFvt04ypkH23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106ba7e1-cc5f-11eb-875b-42010a9c0053", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1623599423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599423, "uuid": "63f4ea76-7e6d-4fcb-99d8-2888045f7730", "comment": "Malware payload (RevCodeRAT)", "value": "c34157e025416d3ddf0a8610fa2e8b98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599423, "uuid": "ac203a0c-36ab-4595-95b3-152c003d5c52", "comment": "Malware payload (RevCodeRAT)", "value": "f285822ef8c947a87e556858a8332ed26edda052e597c67a7831753c376e01b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599423, "uuid": "371629d9-0a9e-47ac-b185-8af56b078ce1", "comment": "Malware payload (RevCodeRAT)", "value": "03005c0c1469b7dbe9eff095bfd3ecbc3a713811", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599423, "uuid": "d7bba09e-d7fb-4b7f-858f-451648053a06", "comment": "Malware payload (RevCodeRAT)", "value": "bbbaee78d5ed68b51b8d789894a24223361a28007389a11025b2a0c9afd0e52c5372b04a449912332e140abed5044d96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599423, "uuid": "105334e5-9010-4c9e-bdd4-ff75158b6ebb", "value": "9AB4F11E77A442F1F9029E701D9552A073BEFC76661A460FE741BAE83AF3B80C491637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599423, "uuid": "363adb1a-d0d4-4461-ac6a-3052bedd08c4", "value": "6930eddef69ab61e6824340dff912310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599423, "uuid": "669a1738-7c38-4e75-8dd2-74a404f857ab", "value": "12288:F3QbugX6FgNAgKHDDn6KGxQLfgdVUUyAHE:dJfmNlKHiKGM4dVUUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599423, "uuid": "0d3d596e-2279-490d-ba99-899015ba26d4", "value": 527760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599423, "uuid": "3bd5c591-5301-452b-9e87-7a06506eebf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599423, "uuid": "2320d424-e4cb-49f6-adef-e56791a7d2bd", "value": "c34157e025416d3ddf0a8610fa2e8b98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295d0c90-cc20-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623572406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572406, "uuid": "4e53c736-8cd7-4741-9d6f-692e28aaa19c", "comment": "Malware payload", "value": "1322ed83ed7483200f5a624ca5ed7cec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572406, "uuid": "a3f9d25a-71fe-4d62-9f51-afe6bf0f217b", "comment": "Malware payload", "value": "f3f624101db477f2173e38bee32d8afe938cd16f6e2842304da810913b129c55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572406, "uuid": "2355f964-1999-4b95-b76d-9365a71fe492", "comment": "Malware payload", "value": "439677982208f0891267dccb2769ad6107fc9789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623572406, "uuid": "995a9bc4-0771-4356-9a95-f6ae80c1c7f3", "comment": "Malware payload", "value": "4a9a1d4420765135786eb6588a9e64151237212f9a1a3a0cdc3cd01660f0953f4e9bbbdc3f9c1cf823190db2cc28d7ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572406, "uuid": "6c0c87a2-9a18-483c-928f-0b72a730b54d", "value": "2D65492439FA501AB173FFA55BE474DADA2FBB733B06A45D10A103864723A82DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572406, "uuid": "8e6cf9ae-7006-4655-b60f-d5aa52fece58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572406, "uuid": "85db3ada-63cd-478e-8d77-d83aa07217b3", "value": "24576:ekXHqdr6l4/5lBHD+LzKyrON+LFvyjDvecz1NI:lYr6UlBj6WKjyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623572406, "uuid": "70b79cde-b15c-4e38-b009-71f555b19fd0", "value": 1476608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623572406, "uuid": "92c108d2-d484-4776-a9ff-5207d3a79d8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623572406, "uuid": "8cdd03f1-6ae2-4bf4-8929-80e402e30ed4", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fea967d-cc3b-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623584121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623584121, "uuid": "e6cf46f0-2ece-4075-9c37-0a01c317e07b", "comment": "Malware payload (AsyncRAT)", "value": "322d034176851fd5335cabad6b791979", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623584121, "uuid": "1006c3c2-ed08-45a5-88b9-a8f0b3ee7920", "comment": "Malware payload (AsyncRAT)", "value": "f8e8d8f8fbec84239a9038d01864eb258ddaede9a96f04a153876784cb6e418f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623584121, "uuid": "ea6a01a5-235f-491e-a4cc-3b97c1d887d6", "comment": "Malware payload (AsyncRAT)", "value": "4b6fef101fab3410372e23d907aee56f6302dae8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623584121, "uuid": "d31ce40e-9f4d-4648-a2e8-73b7036d893a", "comment": "Malware payload (AsyncRAT)", "value": "e8628f465d57cf75ee55942e585145c64fa134868e97c44fb98ba70b64753375ca83eeaa2218ab50564986a7c90a6ef0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623584121, "uuid": "a5c27861-a5e9-43d2-bd2e-05df10a9c0d4", "value": "47B44B8123FC851BE1AE57BDE8B148216BF4F407A6A7EB4F4940B1E92C567429E407F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623584121, "uuid": "da4ff94f-4545-46f6-96e0-7f46efbe4b08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623584121, "uuid": "4b9d6ee4-52ab-43c0-9db9-b67700507b66", "value": "12288:YTEgdfY5bgqPIkKD4tywNqp9wLYAMeuOmcdF:NUwNgvSywNqp9ZzcdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623584121, "uuid": "7851bd30-86ba-4bfa-92ff-df096fdbcec8", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623584121, "uuid": "40a2d4a2-9105-49a0-89fe-5eb5941e4b31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623584121, "uuid": "63f6885d-c248-4be7-a064-b89255e3e638", "value": "322D034176851FD5335CABAD6B791979.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a09c1fc-cc5f-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623599439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599439, "uuid": "40cc071f-23a1-4661-b03d-d40d249c004b", "comment": "Malware payload (AsyncRAT)", "value": "b3dba69bba89f7d4d0e37c56b6628a2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599439, "uuid": "84dd0452-9024-4d5d-b087-bb97894bf7f9", "comment": "Malware payload (AsyncRAT)", "value": "fa34352f3aec8d28f7e9ebc21a01c3a32e98620790ca91e29ad385919c0e213d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599439, "uuid": "575c3e93-2463-4f16-ba05-8f12e2f90fbe", "comment": "Malware payload (AsyncRAT)", "value": "47e321631b87c5e65a9baee2509ab919ff237523", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599439, "uuid": "4d0d9c8a-5a2a-4269-a942-b1faaf237577", "comment": "Malware payload (AsyncRAT)", "value": "806be6fbc9cd8e7ce03cdaa8a362fd133112657f3cdcb1a95245c58c85143f56d021a4049be6b85c4f5d980d64e68196", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599439, "uuid": "50438209-d2b7-4329-94bc-a6af2ef60b68", "value": "43C3BF2E61975A75CC0667328BE90402877393C7B133DA0A75DD138A4F937DE06B27AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599439, "uuid": "faf7a0fa-ff85-475a-aeb4-2dc8876b38bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599439, "uuid": "d2bd8285-43ed-48da-887b-987ebe7fa289", "value": "3072:y2MapXVJbIpmrNMwfHg/CaoN9NPTlaGXbpMuBgX:y2MyJhHgKrBTlPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599439, "uuid": "7adbcbc3-440c-43aa-9965-bf3dc75e1d10", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599439, "uuid": "a27f79f5-5c34-4cb3-92fd-a4daecd4c9ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599439, "uuid": "f6393d72-e29e-41b9-b99b-0650cf1750a9", "value": "b3dba69bba89f7d4d0e37c56b6628a2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45eeb84-cc5f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623599698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599698, "uuid": "0545696e-dba0-4d3f-9ecc-9130aba0ec00", "comment": "Malware payload (RedLineStealer)", "value": "f154baeeb55ceb13aae9c4069b57bbcb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599698, "uuid": "8d2983b7-64f4-44e8-95c6-3d4265cb19f6", "comment": "Malware payload (RedLineStealer)", "value": "fc373226d2da88b09fb9edcd310f58096dfe8f20fee42feec9849921b551f48c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599698, "uuid": "b85fa8bf-c0fc-4bdf-bedc-8bcd17354c0a", "comment": "Malware payload (RedLineStealer)", "value": "fb3fb8dcf10191cc1fc2fffbcb379751ec6efe19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623599698, "uuid": "4b959f0c-1585-478c-8ad7-e6d24a6ebee4", "comment": "Malware payload (RedLineStealer)", "value": "b38f135121f030d1c912d5486fb7d61679e12d3646319e556c21ddd5fad145aab596b0b198372a42edf05e7a586f60b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599698, "uuid": "1f57ea3b-ca34-415e-8190-0d86c7d07b4e", "value": "5BF34C05B76AC900E66D8731E5F5011883F2D2C71623EB0F7EC921A80E43BDEDD1A6DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599698, "uuid": "c41c3b10-232d-4bdd-97aa-238616c86848", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599698, "uuid": "c6561695-c69f-4657-b66a-51ac04eb688a", "value": "3072:iOVwtXSOA/PzEFxgJKXVyYvbV8krl5AK6KIgI85585dyXdV341Ix:uXSnnzEFK8XVTbV8kh5r/gDyXdOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623599698, "uuid": "011f190a-5b85-4163-ac19-1828eed50d7d", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623599698, "uuid": "d273a712-a1ac-471f-bc9d-29639ef70e6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623599698, "uuid": "a17768e8-25f9-4663-8e21-d154b33c61dd", "value": "f154baeeb55ceb13aae9c4069b57bbcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f38599-cc4c-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623591626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591626, "uuid": "968c9a54-a429-4aba-a96e-a72c9a96dba9", "comment": "Malware payload (AsyncRAT)", "value": "c2aa11eaf8c10999cab913a2fb800c76", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591626, "uuid": "b33d795c-5687-4cd8-abc4-afd5fa981ed2", "comment": "Malware payload (AsyncRAT)", "value": "fd5d1314146dfa6436f8c3d5650f459abaed7fad51699c1772d6a2996e42b4bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591626, "uuid": "fa0fd3b4-b85c-4983-9049-e29d5cf465ca", "comment": "Malware payload (AsyncRAT)", "value": "a638f46e0fecb965ceec7da6f28b4edf5419a607", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623591626, "uuid": "bbe38097-3944-4889-8d72-0bd590374896", "comment": "Malware payload (AsyncRAT)", "value": "5896b53786b6f6f2ae3ed44dbc3d31ba2753ff1a5a889d415bbd47a54725a574d72800e2f49909937ec6c76e08661a5b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591626, "uuid": "ce289609-7b4f-4c8b-8bb1-2d4478c34ae9", "value": "8854A94BE016C6E9EBA28CF8252F4987E2465EC12461375FECD1F5050B3259F8B92F8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591626, "uuid": "e2feb671-9816-45eb-b646-7495c1c0a15a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591626, "uuid": "d36789fe-c563-454b-8952-e1399fe33faa", "value": "3072:33dSo8Hl9k6h4YUooxk+7hoJ4xRLrSYXf7f4qSg+GE:HJW415kEhoyHPSaUqYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623591626, "uuid": "a1e71f53-25e8-47d6-ad94-d0e8f73fe9c6", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623591626, "uuid": "1445d2e8-8f7c-4858-b9cd-946244ee1bdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623591626, "uuid": "3cad8780-2668-4e80-9ac9-dc3f0b1aa770", "value": "C2AA11EAF8C10999CAB913A2FB800C76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f2eb47-cc27-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623575456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623575456, "uuid": "21b6ea5f-e2a0-4cd7-a05b-67d322255ea0", "comment": "Malware payload", "value": "3c38d368fcfc9290a50c3883dd602e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623575456, "uuid": "4ffefde8-cbd7-43d5-a255-34d904587048", "comment": "Malware payload", "value": "ffdbe4a151dc79655d82564b28027aa566f1a5b940d31fb88139c281d61500fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623575456, "uuid": "f811456d-a2cb-406d-9996-01baa9e81714", "comment": "Malware payload", "value": "87f213428ee2245845d1a1fd776b2b245c9ac694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623575456, "uuid": "bae141b7-5829-4217-9daf-1792069c253f", "comment": "Malware payload", "value": "88c407aef939a652b53cbac735be3da69e87d10063174405350984ecf2c3a6386f8b900d0122a35e6add6beef4eee0d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623575456, "uuid": "472ced4f-e3ff-455f-9c00-4db114d5b186", "value": "8705CF2263552FAAF57DE3399014450097F4E51BE326CACEFDA691CE1936F80C7A2B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623575456, "uuid": "ccf2a7b0-158d-4624-ad1d-5512f742d4fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623575456, "uuid": "d56630c2-28cf-4ad6-ace1-f813f5c86b2b", "value": "24576:qJxAltPr4rNeBUdtp6EN4BOPcoWqwUbC:qJxAl9rSwBU8E2QPhwWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623575456, "uuid": "2ca2cd28-6f4b-4f2a-926b-e04f0b661597", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623575456, "uuid": "e3acdd47-2f64-4090-88e9-1076459b4f11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623575456, "uuid": "530f9307-dcbd-4fd0-a326-dcf4ff785ccd", "value": "Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }