{ "Event": { "published": true, "date": "2022-01-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-01-10", "timestamp": 1641859381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "5024119f-2c86-4114-b6d7-812ba39df7ff", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013b1650-7200-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641810488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810488, "uuid": "b7cb1226-6d0d-4529-bc40-2e6d42c54506", "comment": "Malware payload (Mirai)", "value": "c24cf88ce63e5e2c093a230323d418f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810488, "uuid": "344d99dc-beda-4ad3-abb0-106777b5ba16", "comment": "Malware payload (Mirai)", "value": "01381bbc0838968a2f989cca02ca5d2bbc8a00edffe9d728407e4e3f0dab0ea8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810488, "uuid": "730b8a0f-8101-4b30-8ab7-bb68fd359182", "comment": "Malware payload (Mirai)", "value": "e05011829ea8041dfbb926dd9ac64c4e4f9ee29f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810488, "uuid": "c5eb7641-e706-495d-981f-e191345d2d2f", "comment": "Malware payload (Mirai)", "value": "a75db344373974f8d8d0ac1a7447688a7a7ed77392c8383b78ee8b108edd094f05353e1885b959ce19e5780852d9c23b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810488, "uuid": "8d20239c-0780-4d68-8354-01ca34275743", "value": "T112E2E0BCE1A0B8B0CDAC4C7AE0CF43A3AD413481B08B0F642B314D45D7D6A5BB9CA178", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810488, "uuid": "babf0507-2991-4989-9130-a2b50cfefff5", "value": "768:bcKUaiXguCCDb+XSBnQbPCEKPH8DY5kW0:bc+RuCCX0MQb4PH8Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641810488, "uuid": "61d4e9e4-e53e-4c8b-909e-328f45ea14e9", "value": 31672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641810488, "uuid": "06a653a9-d1d8-48ba-b935-f1346a6930ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810488, "uuid": "23409fd1-e5d4-4b8b-a48e-ced9d382f131", "value": "c24cf88ce63e5e2c093a230323d418f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc59f56-725c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641850023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641850023, "uuid": "0c1be1df-eaf2-4faa-b037-d724fac49d7d", "comment": "Malware payload", "value": "aa75a4472fcce42a3d276f38617a0842", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641850023, "uuid": "5e523c81-f5dc-40f8-a1f0-7c77394349ff", "comment": "Malware payload", "value": "020462377d5a2500c2c8c34d0a77c620aa6daed8744d89d197aa138fa50c24c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641850023, "uuid": "f8d27641-7abe-4c7d-a0f2-4f9bd3849fc1", "comment": "Malware payload", "value": "058b8e2fff664c56d12a5d5b064fcbe61bd45540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641850023, "uuid": "864d5b4d-9988-4e0b-b839-148b78c0c879", "comment": "Malware payload", "value": "621914a50621ebc51ef5ad9d8365eda199e2cd03f8aa01f0f621ff4c130b5e11a5c1906115c9e2e3708b5a2ce17314d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641850023, "uuid": "871e697c-ba81-49f3-a653-71d19d08383d", "value": "T1D8363339BAFD61D6FC26F5BB12BF544F820B1B13D6F50053932552898696B802DCF2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641850023, "uuid": "c41094cc-234f-4932-a635-1042828f43d7", "value": "b8ba55866bfe7b49b97c43084c1885db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641850023, "uuid": "e2241574-3032-4caf-bb43-3efbdba5b301", "value": "98304:Ikod1T/SitNldDIUwkMgLefo6pBa2TOfAzzH1QClJztvRfeOkO6OpAG5SqnWv67s:81TSitnSEefTBauouLtLkONqG5Ni6/d2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641850023, "uuid": "7a656c8f-9d1e-40da-b8b4-92278310ef23", "value": 5199872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641850023, "uuid": "f11680b3-ce07-4a62-951b-cfc7a263d43f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641850023, "uuid": "bd3697b5-2668-41bd-aaaf-0bf761e019d2", "value": "aa75a4472fcce42a3d276f38617a0842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f356046e-7203-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1641812183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812183, "uuid": "6ec06580-626e-44a4-843e-54d854cab317", "comment": "Malware payload (Loki)", "value": "8ca74c3dc1c1b67daff642c7bd424553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812183, "uuid": "8af1e113-4425-404f-bba8-6e72f261c113", "comment": "Malware payload (Loki)", "value": "040cd65e51c5a7de2a9098d4989399ddbbffe7b4c2b5a2f9fe2243d17b2ebe72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812183, "uuid": "9be2776c-7379-4dfd-9c46-728e2b166677", "comment": "Malware payload (Loki)", "value": "2c10de7a226f5cbb911c114b00bb9bd24d56496c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812183, "uuid": "a43db965-0cd3-4908-a247-d25f6f8b9a88", "comment": "Malware payload (Loki)", "value": "d8875c9ddfbbe09aeb574748fff4d259c3cd824f88ac5b8038ec1fd8df46f0ad0fb29b3c379291b54888ded5c4dd4561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812183, "uuid": "1f671494-97b2-4044-909b-7209e36e082c", "value": "T1E464CF3075ACF872C46702B14824CBA55E3EBCB3A66D85473B64172E5E30E9C4AE735E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812183, "uuid": "14586d32-8c07-4a1b-8cd5-ed2552652b8b", "value": "e087163b8fb7bb3f17281a379e5aec9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812183, "uuid": "90b54078-61d8-4330-b2fb-9fc0e02a7352", "value": "6144:QiLu8LaY370dZ7Md05k4j83suzbgwuJG:nmY370dE0yZ8unnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641812183, "uuid": "14d49511-8397-4d0f-b382-71354f23c364", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641812183, "uuid": "fd110fb6-1753-409f-9abb-64137cc0bdfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812183, "uuid": "aa3c2153-4286-4b68-b249-6fddb4b9864f", "value": "8ca74c3dc1c1b67daff642c7bd424553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ceb507f-720a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1641815018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815018, "uuid": "0c430160-9df0-4066-9d8b-587c5d21d299", "comment": "Malware payload (Loki)", "value": "0f23b87813a5334decf2f11636db675d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815018, "uuid": "3a0a964f-159d-4261-b0a9-38186cbc982d", "comment": "Malware payload (Loki)", "value": "06dd39ea9ea0386acad12b00b5b8c1c9ba953e0ed546b86cd4b64c45bbb7f3fe", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815018, "uuid": "15fb2158-537c-40c4-9a3d-778f25c51732", "comment": "Malware payload (Loki)", "value": "f212862dc87fea0d91a6df5ae8fa522e544660fd", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815018, "uuid": "c4893dce-a72c-41a5-a206-5272d96525c7", "comment": "Malware payload (Loki)", "value": "dd0354f13fb18496b053725b79ba46ddfeff83690754f471c82202051e3a5aa27f35baf3b5dfa5faa49604d803f1a4aa", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641815018, "uuid": "19b8ccb5-188a-4a2e-bde2-e0b131d7129f", "value": "T1A3B2757EF19B0E489E97C668165ABBA5064DF11D738440E237BCDB383A4D9178B22D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641815018, "uuid": "f041b3e5-1f02-40f2-8340-e554e098e9f8", "value": "384:fM9r7r9+GX1uWjgP7ejJIK5hFhoN2ndHPgJUBANnWLBa6+7:U9r39N1uWMP7ejJIK5hFPdH1BN+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641815018, "uuid": "7f21a764-14d9-4011-a612-b9faf381c999", "value": 24655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641815018, "uuid": "06c26aef-7f5e-4a4d-a18f-4edab6ad048f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641815018, "uuid": "9791ee54-d0f7-43ab-88cf-6ccda0931c99", "value": "0f23b87813a5334decf2f11636db675d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6561d3-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641805915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805915, "uuid": "e5fa6076-d33c-4ae2-a0fe-b8093cb09407", "comment": "Malware payload (Mirai)", "value": "a6bc0fc72d0b072789a7733e99e104da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805915, "uuid": "649dcfa2-e9a7-4989-b61f-ecc67257d519", "comment": "Malware payload (Mirai)", "value": "07ac6bea72bce67a2be6b5639531c6b27cd8b8bc2e883a1453005b0746f09d52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805915, "uuid": "3889fbc7-b00b-4fbd-a6a9-3fe2b78f70d2", "comment": "Malware payload (Mirai)", "value": "239a3e9634bc388f5dab0c4e28e1937b1a3c5512", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805915, "uuid": "1698c64f-eaa3-400b-9ef4-96ed997f11d9", "comment": "Malware payload (Mirai)", "value": "487d08755f6431a65d46b42408994c9dfab262f43ccead2ebdb95416c7d8545f681fd46a3d70a0f61f3d58ceb349e029", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805915, "uuid": "05177dfe-f9c3-454d-afa9-10085edc8558", "value": "T181830B9AB4014E2CFDCBD9F965214F19AD20225155834B17B2ABFEE37F631A98C03DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805915, "uuid": "d38c0c9d-2ab7-4bcd-acb4-e0e6eca41384", "value": "1536:rKwvmMQGzLy/UBRTjTfQ70Qeg1pgH3N8OAL4v0k/3dRCVZ8lW:rsGzIUB7QHpG60lRskW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641805915, "uuid": "fd97044d-8b74-4d35-b2b3-6b2be5987d71", "value": 83728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641805915, "uuid": "57cc1cc7-cef9-4f9d-9951-d0cf3be519a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805915, "uuid": "4ddb5f84-6bf8-425d-aca1-50b9df9416ec", "value": "a6bc0fc72d0b072789a7733e99e104da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c51825-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641797262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797262, "uuid": "1e9e103f-d91e-4d81-864a-bd4d18888bfe", "comment": "Malware payload (Formbook)", "value": "cfe607172762768ef0d28bd9d46459bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797262, "uuid": "8b3d1c00-3996-4a17-9ef5-15fb5b2034b5", "comment": "Malware payload (Formbook)", "value": "08d17b9c0d3ab4eb79a38b0a500655f9f47bc3468718ae5b61d59d0b2b687e53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797262, "uuid": "c4c10fb4-eb8d-47b2-876a-9c26200e2149", "comment": "Malware payload (Formbook)", "value": "09c2fcae04979ac5eaa9a30efef0e59aa5bf034d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797262, "uuid": "c75caf3f-9f6b-4272-a05f-617b1236e502", "comment": "Malware payload (Formbook)", "value": "81d3f3b5bcc749f81fc134e53be08bb9ddd2fed3dcba02d2859667620fc1f1c53527b3376d3ef4a6fd747c4897f268b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797262, "uuid": "87430e60-d466-4663-82ce-f4be74eb3ad8", "value": "T193C4BF41B7BCE9B6E2A352320D44D9304C65F87A1E3FAA87B7C26E0EC53C9901539797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797262, "uuid": "fd3be393-9c3f-427d-bdb6-2c6887e005b5", "value": "cf6a6d4cfbd4eaf85b2795df0626b1d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797262, "uuid": "25453c00-9c88-49bb-8b50-52081e40cc0f", "value": "12288:hIlLNX+OnUoEIf9SBB4GgW+0PY0oInE8cZCcNTRA:OlLNX+OnUoeBB4G/3P3oInERCEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797262, "uuid": "e0269e29-430c-4371-aebb-93b61b4ed47f", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797262, "uuid": "6e6049fa-f879-4a1e-8c27-b3483da01099", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797262, "uuid": "215763f7-f68b-4b7a-b14e-1c0490754f21", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efc45e0-71fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641809223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809223, "uuid": "f37b912a-35aa-4107-9028-2a85e7f33312", "comment": "Malware payload (Mirai)", "value": "45fefbd4aca8d3ff46a8a9a044f79d75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809223, "uuid": "3edbcea8-ea9b-456b-8ac5-0e5ed8d32e30", "comment": "Malware payload (Mirai)", "value": "0ac4a4ca5ee97cdc927086007928e5bba125513e38c135f5ea45dced08029658", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809223, "uuid": "0911e332-0768-446e-9c7e-816ec6429715", "comment": "Malware payload (Mirai)", "value": "9e69b45fefbb549b448e866b69f17c1df8728a1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809223, "uuid": "bec9b1ad-bc07-470e-8469-875fae012cc5", "comment": "Malware payload (Mirai)", "value": "c5e992442b12d5bd11598daa28790ce385b9bd1dbc1fb591cc54f718d45ecf64f1a1198b5aa42b5ae30947bbf0fc2888", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809223, "uuid": "06deed31-493f-4d4f-9884-706d963e50c5", "value": "T10AD32A46FC819A21C5C6137AFA2E018E331627B8E3DE7216DD245F213BCA91F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809223, "uuid": "afb5aafa-c96a-4d29-9cdc-4ed44dd2f210", "value": "3072:rwaj8oioY950jDMYRxXlZFNaXequ/Fab5W/S8jZv:rwajtioY950joiJ/3aXNgF28j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641809223, "uuid": "27def97d-2928-48a5-a8cf-1a5d57e1a818", "value": 133020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641809223, "uuid": "528c2ea4-c084-4945-b5ce-6701f63b3d41", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809223, "uuid": "da865fff-d3ff-4140-a622-6502da8585af", "value": "45fefbd4aca8d3ff46a8a9a044f79d75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60882e4c-722e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641830405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830405, "uuid": "0ba6b5d3-7553-4b6a-a6a6-0ddbcefbf1f9", "comment": "Malware payload", "value": "8dbad2d8e6ff2ceb0c11e788eef5a3a8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830405, "uuid": "533e0237-0460-4224-b252-e8fc4f399bce", "comment": "Malware payload", "value": "0b00e9f929ab4970729c3d429852deaf85f52a5d19203da31d991e6371c5d7aa", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830405, "uuid": "fdc82462-01db-43ba-8ad9-cf93172b145d", "comment": "Malware payload", "value": "3c5fb590c74d4d0874f0f5ca22eade24cf3bfb62", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830405, "uuid": "a9d7586b-631b-4a16-945c-dcdf299e2252", "comment": "Malware payload", "value": "b34c2f1e12c25a62ee6dec83cfdf631883259a5227dfbb427ef121e4f4879fb63b87976d370b62e7936b393bdb1ecf69", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830405, "uuid": "1f1b08b6-7c47-4b18-b07a-4621e931c809", "value": "T17D06330C23AEF8FDE4594A3C3B2285A0C9E512F5D88225F3967815540C3F67E5BDEE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830405, "uuid": "4b09f9ca-6be8-4840-b45a-53773889cfed", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKA:0XSxVJG2fLAqFOfT9sMYNM29A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641830405, "uuid": "639e6fb5-6e80-4a81-8f6e-bbd8924d345e", "value": 3727360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641830405, "uuid": "15d3bb93-87a4-4b50-9568-956032e1edc1", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830405, "uuid": "effd6306-600f-4ae7-9ee9-27110891a96b", "value": "0b00e9f929ab4970729c3d429852deaf85f52a5d19203da31d991e6371c5d7aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb7f561-71f8-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1641807152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807152, "uuid": "262f96c0-833f-4dad-a3d1-aef7d00653fa", "comment": "Malware payload (CryptBot)", "value": "ed56b96ba7248e74fdf1ded506d26d5d", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807152, "uuid": "0487a1c1-40e0-40cc-ad47-138c3de1cc22", "comment": "Malware payload (CryptBot)", "value": "0b1e6c22216f23b8d4f81abb82333dd65ed64929e14cec83985d11a4d84cea9c", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807152, "uuid": "03eb9c25-1942-4d43-874a-1a9f1e3a77ea", "comment": "Malware payload (CryptBot)", "value": "7724847f44b97aa80e91abffa364f9883dbd5053", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807152, "uuid": "9f3d82a5-ba7d-4ac2-95cd-a4ee3768ed8a", "comment": "Malware payload (CryptBot)", "value": "a92bd5937ecf0e6db51a100a0586bd405c1a47ad67076b7e1a0c6ddd0bd6ce888786cc67bbeeefaf30c93321f22c228c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807152, "uuid": "04662bfd-6fc6-41ff-b889-14c7ea6f86fb", "value": "T12FD533BD45312C4BCB45B7721A35EE7AC068C92626A011F0701FAFB7A4909BED70D5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807152, "uuid": "c11b32bc-e62f-4011-8d44-d2b79b62504c", "value": "076fd3bc44050b5480459bd4d8e1a2d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807152, "uuid": "6801c52c-b92f-407e-afee-33a198989169", "value": "49152:ziUyX4AzXRSyFmiVu0p90MVX7KMIqwfbNmpkmnwcVJUJCbzdAqtwfmhqLbL:zmX4WRRMiVHPN7KxfYp3Nx1tDAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641807152, "uuid": "c5de7b7b-ed80-41a4-bba8-03922075c0dd", "value": 2844672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641807152, "uuid": "ff4769bb-93c0-46e4-8b98-c8fcd245cd40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807152, "uuid": "be645d7d-0ce4-459c-86b2-d2df9586400a", "value": "ed56b96ba7248e74fdf1ded506d26d5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6f67c4-7202-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1641811765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641811765, "uuid": "5c130c49-da2f-49aa-9442-7c093bc4ff37", "comment": "Malware payload (Loki)", "value": "d1a3b07e4d8ee2b121fd4174956ad239", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641811765, "uuid": "8d21bf12-5fb4-427c-bf97-880fb345fcdc", "comment": "Malware payload (Loki)", "value": "0cfb52cfd8822de212124339882bc5d6cbbb3ceb53a1b9a54458768afbf4f072", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641811765, "uuid": "f01d8b91-7455-4d7c-a4aa-97d896f130a5", "comment": "Malware payload (Loki)", "value": "6ebcff1fd86062f3d6db0a40129cbabb92a5fe48", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641811765, "uuid": "c442c3fe-2c33-49f8-9228-7e4e615dd336", "comment": "Malware payload (Loki)", "value": "c953d3a7c2d584500de14e6646e3ffb74bfba59b972f0bfd2acc65198b8bff36af8a8823eec89f1a81149edc66a60186", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641811765, "uuid": "efb5062d-2af9-4532-9ddd-6c2e85390e79", "value": "T141641344324ADD6AE4CEDB3C6031A344489EDD9706C2285FF74AB4D10FB5797EA3E622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641811765, "uuid": "82f94f41-033e-4080-975d-e2bec0a80c91", "value": "6144:gFxSrehyUnvozpcDyR6OiT32JL8qB18BspmRaGZBnlIqZMIyCe:2Sreob5R6oJL8/t8Gn0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641811765, "uuid": "cd9e062e-d004-4ace-a329-31c780e465f7", "value": 317448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641811765, "uuid": "e4d0e824-3c83-4c39-9fe2-cb51063cc393", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641811765, "uuid": "e96cda99-1fc4-4960-837f-c05990782e95", "value": "PI1013PI1014.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a7890c-725c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641850003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641850003, "uuid": "1dbafe86-3e93-40d0-934c-1164dca9fe13", "comment": "Malware payload", "value": "c2741ffe5112396d902a59f3373d0bd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641850003, "uuid": "a3d14a25-c5ea-458f-abc6-b6d89c223384", "comment": "Malware payload", "value": "0d2010a9a6f2c5066afea6b63d881d17684a8f129c1410ff65020f00729bb3bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641850003, "uuid": "db981479-c4ed-4377-a064-225a873beb28", "comment": "Malware payload", "value": "8407992e4af905f51024a533e1edfd55c5598c5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641850003, "uuid": "910f3cf7-41aa-4734-9d44-9d264505ef92", "comment": "Malware payload", "value": "3b04a9dc8e25b72471b9d9ff8a46a2e407d5efaee4d8ad135f02987805407b427b87782744f2721307f2f3bdd89184a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641850003, "uuid": "4fedf0d9-5eee-4ccf-93e4-444275fe9f30", "value": "T1FE764A43F99150E8D1EEC2308766D662BB3174D8073067D72B60DBB22F26BD46E79368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641850003, "uuid": "19f5eb90-fe18-4a0b-a32a-bae5cebf7632", "value": "e6efb84c997b145566619aa9dc9a7eef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641850003, "uuid": "ba881d54-b349-4fdb-8142-8e98f4845258", "value": "98304:ZL+sevdF8QQjsD7Uiw5tFKryGEkV/LHWSq:kse6sozmyjA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641850003, "uuid": "be1ad658-ecdd-41b3-9428-07a38d4c0247", "value": 7506432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641850003, "uuid": "b8481c76-4cf9-4299-adf8-c466312cb37d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641850003, "uuid": "b43d2d5c-3ced-4186-8c5d-67356c36ba38", "value": "c2741ffe5112396d902a59f3373d0bd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4870285-71eb-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1641801797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801797, "uuid": "b4d1683d-6842-4698-9302-8f742a2ba3ea", "comment": "Malware payload (OskiStealer)", "value": "f874f1615ac7b6910b37f82e9ff901da", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801797, "uuid": "f36c1d02-5b5b-4cc8-a749-d32aa9b022f3", "comment": "Malware payload (OskiStealer)", "value": "0e4f3dabe2b20f4d4d22e1e8f8f7548383d6f5cbaf0073d91f2aae44655a31c1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801797, "uuid": "22bd6643-1549-4f7e-bad6-b6dd5210b0d8", "comment": "Malware payload (OskiStealer)", "value": "577033d813986df279de939ebbcaac94d1fdcb03", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801797, "uuid": "2e478dce-0298-40b1-93ea-e918c34e8417", "comment": "Malware payload (OskiStealer)", "value": "7ce9c802cc21a6b9b30ba2c2eaade933d14da423988c07964122c447d07b75c02344dc808341c5f02c53215fec04ded8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801797, "uuid": "75033b56-9f44-42d7-8485-e204c7329afd", "value": "T17282F7ACC5875AD88F8A6BB86B1B6F85008D7A2DF3869433727CA73517D1D3A411287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801797, "uuid": "8735437b-ad07-47a3-8767-dabdc370b1af", "value": "384:6d0crnXWvIbrHp6of4x2Ub7pIT4LrMT2zAuAsu:6K4nGQbr4of4x2Ub7mYrDAau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801797, "uuid": "2fa1516d-558f-483e-8c41-b6a82779f309", "value": 18018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801797, "uuid": "c925b1e7-fdcf-4fb9-a2fb-c5b0a097d18b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801797, "uuid": "f639ba7f-81de-4c60-b4d2-d4c380162f1d", "value": "NewOrder1012022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fcf3c1-723f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641837603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641837603, "uuid": "a39016bd-8430-44c1-9242-278c0f8d4dc5", "comment": "Malware payload", "value": "a860c81fbe94bd76699ca7fc0f06cbf9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641837603, "uuid": "9dd715c3-f3af-4a17-b510-0b207d25f58e", "comment": "Malware payload", "value": "0ede29b6f8df4b922dd8652c105e7f01ac0f59d0d23184ca8c97671825baaa31", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641837603, "uuid": "ce27e0a6-9129-4560-9dfe-946af698252e", "comment": "Malware payload", "value": "b52428b09baa9fb7a921843b084d71189333c820", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641837603, "uuid": "5b80ed46-2c8c-48c6-b110-4e201cafed1d", "comment": "Malware payload", "value": "3b2526bf7eb224db1870e66cdb97686f072e17f677b50f35ccad963a2c98bc9a0729b64928233a918eb7a82316b66bb7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641837603, "uuid": "3412ec9d-56cc-4c26-997d-289f2c490659", "value": "T14733E77AD220B4BFC94B87CCE91691243E6E8CEEF6C1C260917CCF6E16A1ED1DC49645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641837603, "uuid": "68015248-0350-4446-8df5-cd39191c9826", "value": "1536:6cGmzik/n4daA6IHOpcDdJAa5YoQkwL7k3OEkzadkLnQh5:edaU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641837603, "uuid": "e5fb5e70-44c8-4274-8571-ea4161b19425", "value": 54764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641837603, "uuid": "46f1627f-5231-4d7b-8a12-eb7dbacc86c5", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641837603, "uuid": "d66e3ffb-527f-4f9d-87d0-17380876246b", "value": "0ede29b6f8df4b922dd8652c105e7f01ac0f59d0d23184ca8c97671825baaa31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b58b9d-71fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641809957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809957, "uuid": "b736c5ea-183f-4dc3-b5ae-ddc0b9ab48ac", "comment": "Malware payload (Formbook)", "value": "0440561de63026284deabd9c6fc953fa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809957, "uuid": "2a13ca1b-10c4-4a20-bb95-31a63d34d386", "comment": "Malware payload (Formbook)", "value": "0f8d6bf916460763c58738e53fbdbc4f64eb98e794093bf008502a77207c06b2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809957, "uuid": "d650c673-ef47-4bf7-a8f1-43ef8088f724", "comment": "Malware payload (Formbook)", "value": "ab1698275aff88930dfd5b3341bb387c7ae8bd5e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809957, "uuid": "799f6616-ba84-4634-b29f-b2e664e188bb", "comment": "Malware payload (Formbook)", "value": "d2fe9117bbe7c18dfa58e7997b6eae6e802a332453d6c0b3cfba54a0c05745f3191bf72ed79c5c7c0d28f745a77342fd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809957, "uuid": "18676eca-da17-4289-bd15-68a2bf7f827b", "value": "T1EE6422917103FA43CF73893386A18702271BDD5E9B7168C295563364BEF0B72E85CAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809957, "uuid": "bc24192f-5591-41c7-87b5-e7f02f999e4e", "value": "6144:pmTdOrmxcz0V11zVf3id+h8Q1MBAxfAhCOAAF+WlQt39UYMjI0O0MtHH2:KOmx7Od88Q1Me99OAAF+WO30O0Mtn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641809957, "uuid": "10d67460-4de3-4e11-9fc3-0b45f1a6a79c", "value": 317832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641809957, "uuid": "fe29e8a3-f81e-40d6-8f70-dfa700afc0c6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809957, "uuid": "a4e9c367-67df-4ce6-b21a-44d6afc3a9f6", "value": "Quote.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01bb9c3-7224-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641826324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826324, "uuid": "10ee0cc4-b6d9-4778-879d-97a08d123526", "comment": "Malware payload", "value": "c057bacdcf7d419decea924258d3229e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826324, "uuid": "63ba0d8f-2f20-4f56-9ca4-d4982834ad22", "comment": "Malware payload", "value": "10427d9a84ed88f643928edc0faaa165ecd5dca5e5834eff4693f1e4a978d79e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826324, "uuid": "92d9acab-50ab-4342-b9aa-a8839c1c9d6c", "comment": "Malware payload", "value": "16e1d51eda4b3b187f91437f8c33daa292e6eee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826324, "uuid": "c1fa400a-a1e0-4c6b-a692-b3853ac1c5ed", "comment": "Malware payload", "value": "4de4d867099665b3ff97ffdaa7f0e3aaf0d6c2f9d671d6878f58a67e13ce586530a75986fac857bedf4161cf316a2f01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826324, "uuid": "61a29271-80a7-406b-b49c-fc5c3d5c8ffb", "value": "T158F1D526A7F88776E9374F3158A352105B79E252DD13DB2ED486100B9EA331206E2FB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826324, "uuid": "58518dc7-71d7-4c65-a70f-984e4ede0caa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826324, "uuid": "492a9d22-fff3-446a-8d23-e6b363cbe3b5", "value": "192:N/NCDSp8LaYL3V5pzxkLSLrLYdaUifILEvOz:xImp8LNLDpzxkLSLrL2aPfILEvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641826324, "uuid": "e23a829c-b5ac-4ee4-82fc-3060f717c285", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641826324, "uuid": "3e7e82d5-ff91-4eff-bb2d-d4d3496cc279", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826324, "uuid": "024bd293-53d3-45de-a135-e37aeca52abc", "value": "SecuriteInfo.com.Trojan.DownLoader44.30936.2298.23771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cee8bbc-721d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641823205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823205, "uuid": "cc1612b6-2f27-4284-aced-3b590c857e6a", "comment": "Malware payload", "value": "1b484996e67bc3ffa1c464f2ff400df8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823205, "uuid": "b6ea3a16-3461-4df5-8f27-84bbfe58779a", "comment": "Malware payload", "value": "11a78c80ad4cb55a0f617c87e254625a585b1f4e4eafb7ff5f98678dd4b58855", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823205, "uuid": "9c898cf4-48ea-4149-aa03-1a11861765b1", "comment": "Malware payload", "value": "2b8256dd2ae48c1dc43d86d6e33c89d7982c077d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823205, "uuid": "a157eb7a-11d7-442c-bb9a-24c184ddb6ae", "comment": "Malware payload", "value": "139f3323198d48ea25f7e22f2cf85e774d22503e28acd7eafcce4aa32551619c32177bb33143782c55edc00d5f70f264", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823205, "uuid": "2979bc88-b828-4f7f-a732-59ffb0453f8a", "value": "T18D06330C13AEF8FDE899493C3B6285B0C5E512F5D88225F2DA7815540C3F67E4BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823205, "uuid": "296adad1-3d07-43b9-b4b3-8c5edb731c6e", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKy:0XSxVJG2fLAqFOfT9sMYNM29y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641823205, "uuid": "f7e5ac03-ce70-4bb7-983c-5584a3c80ba3", "value": 3710976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641823205, "uuid": "9d610314-6c7d-40d4-a269-d2e5a8cfa73d", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823205, "uuid": "4d9689e2-4db1-49fb-8109-d824551320d5", "value": "11a78c80ad4cb55a0f617c87e254625a585b1f4e4eafb7ff5f98678dd4b58855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e6dfd3-720b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641815403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815403, "uuid": "b84c493b-2ee4-4cfe-b68e-94ace735a30a", "comment": "Malware payload (Mirai)", "value": "b1b01332637c25a18ca72491cbfef92e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815403, "uuid": "2def341e-0f3b-45f6-a4aa-e17869895b78", "comment": "Malware payload (Mirai)", "value": "11d1d2ac9faf663c47594cc251626add4d6ee1c460bb0ee37fabe1afe8ccee8f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815403, "uuid": "f66d40f2-7ac0-4fdc-b072-4c91f53b9a77", "comment": "Malware payload (Mirai)", "value": "b3be1196e0c5bb73169306cf871aef2d3e7356e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815403, "uuid": "c86ed07c-fbbb-4a5a-891e-ef9d49c8e02c", "comment": "Malware payload (Mirai)", "value": "e14ac5c42070e420e57479e4fa2accb0e1ad82d744f00593a8160684cf0a07065726efb5f5c63c583d0915abd2408138", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641815403, "uuid": "90895528-a188-4d22-8fab-4e08299c6ff7", "value": "T13C33F1B4D41AFAF6F9F55839E81A42C3F131B278A39D60670594066C39F34688AF4B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641815403, "uuid": "0ef121a3-a4be-46c0-9e1f-88d23502e98c", "value": "1536:uAtyezlJKZLqsrc2tgZytKXfxgsyyI3fNe:HZJ6LTrcCgZyIPryxfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641815403, "uuid": "c70a87d2-fe71-4857-b374-f64aa1836cfc", "value": 50624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641815403, "uuid": "aaa7c3d9-46b8-4b29-a178-1735c14af377", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641815403, "uuid": "71956aec-f4aa-47f3-a7d0-05174d1432c9", "value": "yakuza.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa50757a-7261-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641852567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641852567, "uuid": "83f12e0e-02cb-40c8-9c43-50057fd403ca", "comment": "Malware payload (Mirai)", "value": "1a384b92062d8716daf1cbaf55f3b4df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641852567, "uuid": "9b377d01-0723-417a-8d6f-39557790d0f8", "comment": "Malware payload (Mirai)", "value": "1307206f1f872180d288b33ec027f1302f5b90b22e5eae4dbe7bd086559de579", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641852567, "uuid": "64712b5f-1298-440f-9de6-4799616cf6e8", "comment": "Malware payload (Mirai)", "value": "04bdf2797fd317f18cc7440510b0d507e8fc0100", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641852567, "uuid": "61f560af-9e20-4483-a7a5-7437246d1b27", "comment": "Malware payload (Mirai)", "value": "5e8511a6cee77c3379eade5e1892da7c9947928f36d23753b24bba84486ca3a7c35c2002b4ce47b01971b04c39cf3f21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641852567, "uuid": "bdee8780-214a-4ca0-960c-01b70ec13d8f", "value": "T111F2E11436DA49778DD08970C82A990763A422F9A8F2785726174B9C3FC3DC785AFBC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641852567, "uuid": "9cd1748e-4326-4ae5-9013-23d16fd85ab8", "value": "768:ybj9RlYu/nWYRpmiV5LvBq63XaWknhZIKxK7EpPQwY+q3UirYUt:ybjdYuVjmcLZhaWk3IKxuqQwYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641852567, "uuid": "d182e386-aa11-4a3f-8340-d6df45a425c9", "value": 36544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641852567, "uuid": "3be6e7c2-157c-473e-b2a8-0987f3fd9a65", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641852567, "uuid": "69c7a9c8-f227-43ef-8911-9d56f9f08001", "value": "1a384b92062d8716daf1cbaf55f3b4df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99316bd-71b2-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1641777404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641777404, "uuid": "d0910710-9990-4807-bbd0-2d4ac43231c6", "comment": "Malware payload (CoinMiner)", "value": "aab76315f72ef75a0009a491285e7281", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641777404, "uuid": "2f971ae0-fe27-4808-bd10-d51dba3dfea0", "comment": "Malware payload (CoinMiner)", "value": "14cb7790f76528aeaaa36a1e35271b25002d592e1e3129e4caa5e8e14141b319", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641777404, "uuid": "7c8c32ac-ea57-408a-92fc-8c1d76569c88", "comment": "Malware payload (CoinMiner)", "value": "afb54cbeb7700ffdb74bdf1301a9cba18d248808", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641777404, "uuid": "0e1f266b-3a67-4369-a627-f66c07c96c0b", "comment": "Malware payload (CoinMiner)", "value": "34d0bce49f6f58704a959527cf7e96834710f878fe67af8c2360ec5e41fb2d698ac9dbc547fee8bde37f3180cc5bf185", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641777404, "uuid": "8fb6e47f-8b52-429f-bf44-6551a24d13fa", "value": "T1CD36332E39DF10A3DD03F4BF387F68E7939B8A03EBF9450322686356674D599285B109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641777404, "uuid": "e5c0c946-168f-43da-a5a5-100da718229f", "value": "b8ba55866bfe7b49b97c43084c1885db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641777404, "uuid": "38185bc9-0e50-404d-9d6d-c9c63696db0d", "value": "98304:SM7YlXVHkhXwVN1clH9NPpJg3DG1Wujx2IblmvRubLNRvGYTt4AVaYoJc:SM7uHsgVNGj9Wjudblm4ROktVVajJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641777404, "uuid": "2a574e8a-57ae-4410-8700-93622200b2fe", "value": 5192704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641777404, "uuid": "0a77078c-afe2-4833-8494-068c86d9edac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641777404, "uuid": "172f8e69-f127-4e4f-897c-5837996bdae7", "value": "aab76315f72ef75a0009a491285e7281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e70b783-71f8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641807101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807101, "uuid": "9c74e676-c8d5-4f95-a96a-5e5d57183207", "comment": "Malware payload", "value": "96e7819c803efb4391de95e14e8a669a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807101, "uuid": "2190025e-7bad-465e-a6ce-66b29da4b4a5", "comment": "Malware payload", "value": "15b360015394fe68abc56bd2511bf31d56ddf045ae5c7b93a1159517df5df696", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807101, "uuid": "88cfeb99-5736-45af-a985-158227698473", "comment": "Malware payload", "value": "7307052bf4b856b344340391704bed04f2393eb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807101, "uuid": "8bad6cd8-4bc4-453e-8d80-efaa82df2f32", "comment": "Malware payload", "value": "943d5d82c9d9da593221033b09115f2dcab4b0815340f308ed012b04e9da257076bd2bb9fbc7b65d3f100912752b1d35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807101, "uuid": "cff9fad8-dcb6-434e-b07b-a1cb25bbf485", "value": "T165A38D2135D0C432C99724758828DBF5AFBF543222B9958B5B352A759F303E0A33A35F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807101, "uuid": "380f5320-094d-4fe2-9fb6-02aaa7c2f80c", "value": "1536:S55aCHc6SDkhR5ELVd0tC/v2CWQMM88iyFTMK/:S746RGL5/9WHv+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641807101, "uuid": "0a31f862-526b-4ed3-a1ae-89c03df6c137", "value": 101552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641807101, "uuid": "7dc14dde-e3a7-441e-a29b-db35576fe233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807101, "uuid": "250c9a0b-c85f-4d49-bb16-07cb83eb42af", "value": "96e7819c803efb4391de95e14e8a669a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab211361-726b-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1641856729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856729, "uuid": "ab0142a8-5504-456d-9dab-7d8e3f9eed89", "comment": "Malware payload (CoinMiner)", "value": "7c1c61ac99109c6641513386f483fcab", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856729, "uuid": "80377f8a-e95f-4050-adc4-ffb1a6f4d0da", "comment": "Malware payload (CoinMiner)", "value": "1628e9f1c562749fea097ededf5bf4ee276cde809b966fc865dbd65771c8e96f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856729, "uuid": "c54cf43a-5fe5-4bec-87c7-619649616405", "comment": "Malware payload (CoinMiner)", "value": "dbc78da849839e14559488a98496d0b15f61fb98", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856729, "uuid": "ef175ce9-5fb1-4281-93a0-dc5de494d6fb", "comment": "Malware payload (CoinMiner)", "value": "d1cb1ce739f05ed6951c14e03e4a446d1c40a622477353d97a5f39b231e6200970e2a080a97e893f6d8f29d30be6bc62", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856729, "uuid": "a8ecca03-c1f5-46f1-ad45-5a95e94cd285", "value": "T1056623AE2198335CC45EC4349033FD49B2B6152F5AD69AFE71CF7BC033AA420E945B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856729, "uuid": "7c0faf9d-5d43-4ce1-bb7f-20d379789ae7", "value": "889336afd01a952ba79d1e90fb751739", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856729, "uuid": "5bca577c-c3e6-4a38-8e4b-7dadf419066a", "value": "196608:ijOdfad3L5IBuLZyLtsIupI+EkTRHQjNWeSOF7:iOfiGBu2r/YRwEeSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641856729, "uuid": "1810c9a3-b9a6-4434-9dda-1ac45c2e521f", "value": 7012352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641856729, "uuid": "795c5206-f944-4179-be68-7375637d3925", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856729, "uuid": "bf34a35c-2b23-4b7a-9bb0-8a7a73f138fb", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e5005c-71fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641809241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809241, "uuid": "48477249-e754-4928-98ad-c89eb25ada38", "comment": "Malware payload (Mirai)", "value": "eeeea4c924cbbb229646d137238af633", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809241, "uuid": "ff4aea1c-a2cf-4fec-bbb1-42c9ecbf8416", "comment": "Malware payload (Mirai)", "value": "1ae1497c3f4fe5098911412b5c7d1d2784a6084d368545c6f982d377da7b9c12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809241, "uuid": "8e321256-bb78-4955-8d38-5158a434261a", "comment": "Malware payload (Mirai)", "value": "28e2d4947362bbb1f624e486efa21e64a74c24c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809241, "uuid": "00d45458-2792-47cc-9ce9-77161f29b2f2", "comment": "Malware payload (Mirai)", "value": "6f3ec62876bf484705727ab6e83db127a35e81d92c6a210236120376ac3370f07b8f5d2a6aa6ec4a839cd5efae511540", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809241, "uuid": "47fc8e50-b044-4760-939c-6dc9ffdea1f1", "value": "T178C35C86F647D5F1CD4205B0106BFB3AAA35DC711122DE9BEBE4FE72A871A03940766C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809241, "uuid": "47bd0998-3541-4b81-ae5f-665debeb781e", "value": "1536:U/HEzSd7VwF6hSHgWsLi4FrCgdVHaFuGgtSRai5yUT31M+Z2oJt2WkwjL+rR:05geDLuonARaWuue+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641809241, "uuid": "505b8c25-f271-4d9d-aa24-ffae6b24e925", "value": 120428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641809241, "uuid": "81a05b9b-0f5e-4e33-99e7-aa3d3fb7423d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809241, "uuid": "7a55c6fd-572b-4588-847d-fb68ac58b5ef", "value": "eeeea4c924cbbb229646d137238af633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db991523-71ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641810425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810425, "uuid": "4158edf2-df4e-4740-9157-d79673f4f6fd", "comment": "Malware payload (Mirai)", "value": "acd5da3970025e1501780af8d6206b54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810425, "uuid": "cf7d917b-45f3-4390-b842-1fc18c511478", "comment": "Malware payload (Mirai)", "value": "1c9d20623e99b092aaa4b340e2441975b4eb3d269550903f99c024b5dccb6c73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810425, "uuid": "bb77cd08-70b9-4ca4-87a9-5c577be4bc17", "comment": "Malware payload (Mirai)", "value": "1f3d14cfbabc54e79f378f1f534f496dbaba8009", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810425, "uuid": "ef6b4bd1-bf4f-4820-9c9d-431d298a2fff", "comment": "Malware payload (Mirai)", "value": "63e49e6edacfa135dcc9e810e4796e488b1625933da9f27222ec656df8e4fb99cd1a6b210682d1fe4ba1f154c5c10d52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810425, "uuid": "50bb2999-2319-4769-93b0-3ddd2f03b062", "value": "T1B6D2D13C4A0500C9C873D43C3E6947A13E7A4694A4C3DC2755BBA6AB29CD1762755F7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810425, "uuid": "cbcd49b5-c2a1-4739-9f23-adaf153a5489", "value": "768:VfnjrFBwx1x7tOdiyY7ICl0lVSk1pGJgGlzDpbuR1JwF:VfHFExICelD1MVJuqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641810425, "uuid": "5a114bdc-5f4b-4f6c-b91a-f9181954be0e", "value": 30660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641810425, "uuid": "b6add3c6-afa9-4ebf-894b-63c8b6988718", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810425, "uuid": "00e5375b-5bc4-4c0a-b421-32607eaa3c2b", "value": "acd5da3970025e1501780af8d6206b54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369e2a0d-721c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641822604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822604, "uuid": "51c289a7-e97d-4807-8705-724c1023553c", "comment": "Malware payload (Mirai)", "value": "84ed73309031b204e2ca00654cadd22e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822604, "uuid": "fcba9c1e-7926-44d1-afab-64bc2c4f077e", "comment": "Malware payload (Mirai)", "value": "1d8a39a1a2a61486896abc32e99093ecdd13e3da1d2d19563ef02586be5990af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822604, "uuid": "f7a4dab0-bc9b-41ab-8f95-618f62e80697", "comment": "Malware payload (Mirai)", "value": "0b8cdaa00494857018c20b35713c8ab67cb5e532", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822604, "uuid": "bdb236b1-a693-4a11-9fb1-44de20ebdfd8", "comment": "Malware payload (Mirai)", "value": "89e8b4101b4cd8b1741c3ff5809643c0cc54d1176d6cc0b7c7267f299e066a8a3ba7d66a76ee312c03340373c4972689", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822604, "uuid": "38e8a20f-3496-4e70-b701-8727bd8fc117", "value": "T11AE2F15BCCB25344E9FB18F0C8AD3D0D04A8EA6D4D586150B7B8ADB2DA7A37C19744B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822604, "uuid": "a3c8aba5-569b-4cf8-b446-fc5f0f1306e2", "value": "768://8KEvEJHtoApd6TtXAdeHutHgLvUjtUAWcWzR967T7nbcuyD7UHQRji:38ncdmnOyuHgLv1kdnouy8HyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641822604, "uuid": "eb1930e6-f4b8-4027-8de7-3c0bf265c122", "value": 34000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641822604, "uuid": "e270dcd9-9878-4fc8-83f9-dda5506cef83", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822604, "uuid": "9e423a8c-9dae-4873-ad69-b35a7d1d9ef5", "value": "x86-20220110-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e0aced-722d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641830137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830137, "uuid": "f07eba1c-693b-44b9-be9e-6d50764f92fc", "comment": "Malware payload (AgentTesla)", "value": "c07daf3ae2f7ba8acc07b54f34a900e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830137, "uuid": "5ccdbff4-61c8-4224-9b76-d0e58bd7bfab", "comment": "Malware payload (AgentTesla)", "value": "1e4ef20cf1e89bb608d1ace96727cad4f443f60a3b41f2cfbbd9a62c262f4c3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830137, "uuid": "2907c705-94de-4d28-92da-0909dce9f05c", "comment": "Malware payload (AgentTesla)", "value": "4871b8143180d24ac4d5a677e5ed9cbaf7fd434f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830137, "uuid": "fe2fc76b-c0b8-4be1-84c3-a03f430682db", "comment": "Malware payload (AgentTesla)", "value": "dba396c2635ba04e39f8bcaf97cfd938bd19cfeeabdd9fec722d62cb549ae6ae78f5c236b08d8070b043629a6056733d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830137, "uuid": "4fd53c31-0d42-45d0-b38b-2164c1ca4aa5", "value": "T1F473C2A6F27B4005C4EAC97FFBF58180ED11797C481DCA92D1486F9E1AAE15205F1EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830137, "uuid": "0dd7ef56-7443-4930-be7c-195387b7c99b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830137, "uuid": "cf1a44c5-d100-49d7-8a83-029df7fe6d8a", "value": "1536:MSbbzhlvI5OVvvdY7b31lZgEem93R5LSrGh+c/:MSbbzhOOVvVGb31f31R5YE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641830137, "uuid": "f4ceff3f-77c0-4f51-8b0f-5f713f9a9c05", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641830137, "uuid": "cebcd407-2bd7-4c0e-aa94-4a3545e6118a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830137, "uuid": "025d51df-9757-4df8-8009-d920b9c3621d", "value": "c07daf3ae2f7ba8acc07b54f34a900e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1b12d2-7213-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641818746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818746, "uuid": "0d2f454d-9f9a-4663-affe-83d7dd2d881f", "comment": "Malware payload (Mirai)", "value": "63adf7b61d549eef94de930214529d35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818746, "uuid": "e67e1cd3-94f3-4074-b504-3abaf9d2bd87", "comment": "Malware payload (Mirai)", "value": "1ec5f4007c8a7320dbd8601611112f6d412b6d40c81846bf2bd805071da124e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818746, "uuid": "d02d589d-6d32-42bc-a4c9-73b3257f065c", "comment": "Malware payload (Mirai)", "value": "c17d099075f0fa36bca7c9de8e9d23c6668e113b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818746, "uuid": "21f00664-b315-450b-94c1-335be94da7f2", "comment": "Malware payload (Mirai)", "value": "cd178abbbfa1e1a2de839cba9520f9c72e8c7f6c0741b4d36565d8260908e372d101d6195ed4d286c344ebc67a4daf75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818746, "uuid": "d8b2a8e6-a3d6-45c5-a703-52bd3e38ef67", "value": "T1CBA2D0B03455AD92C5B08D7FD0E6880262BF56B8CBCB31E1D6155BB8BBD212225FD21B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818746, "uuid": "af031f0d-b1d9-40a7-8f5a-e635bb6870ea", "value": "384:qVmpV6Bk2/Wm40HBqL6sq8Q3esa7P2n3vodmOW4xJJmdGU5E/T:qE6k242Lo374D4xJJ3UcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641818746, "uuid": "5e4770aa-0a62-499a-b19e-b733f4b79236", "value": 21648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641818746, "uuid": "a402f897-5cff-4493-a008-c1c5e1ead598", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818746, "uuid": "bc333fc6-ef43-47c0-9bdf-3462818da7f4", "value": "63adf7b61d549eef94de930214529d35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fe74da-7246-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641840692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840692, "uuid": "3cb07ca3-42a4-470c-8cae-5724d65db887", "comment": "Malware payload", "value": "efba2197f49c4bf9da4ed801b7bb3de9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840692, "uuid": "0e6b9bce-cb4d-4361-8b2c-10b206d65381", "comment": "Malware payload", "value": "1f7974619c3ed0f077446418709c7e2e06b936af07cc653c97dc1e0700281b1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840692, "uuid": "a5c792aa-ac33-4c48-8c19-5204c207fa60", "comment": "Malware payload", "value": "278ae00d391d039de8511b29254575effbb2cdf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840692, "uuid": "aa9db822-6258-45a3-bc3e-2b478e052345", "comment": "Malware payload", "value": "9cd2b11fdb04512283a28790e6c6004198eda90c8c95f1523b46ff0efd9ca9a6ea6ebdd4529742197b177002195d8f0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840692, "uuid": "1145120f-c5f9-49ef-9593-3021ccb3c260", "value": "T100B4D0322388AB11E93DE7B94411915053FAFC56E361DA6F3DAD70D90D32FC68B3260A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840692, "uuid": "52fc1381-df47-4e3c-85a9-f76bd1367ab9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840692, "uuid": "b2c0d491-a8b8-4641-b417-976f8b229b09", "value": "12288:1w5nCg8tVdXgSzpa45Ngux0bogW2zESksuCI:m5n0VdX9zpaCgNbg+ESks0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641840692, "uuid": "e98f79b9-9aab-43bc-9a25-071fcf14602f", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641840692, "uuid": "7da148b0-835d-4aef-8009-7d4b6a4a71f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840692, "uuid": "9db790de-1dac-4baa-b1e1-87ee66f52af7", "value": "0rder_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820a8819-724e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641844205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641844205, "uuid": "1d442d9e-de7b-4757-b689-22bf7a96bcbe", "comment": "Malware payload (Mirai)", "value": "71f3b621123eed614d17eeafd5ad2ddd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641844205, "uuid": "044c82e7-daaa-4aed-b319-47845dfa17b0", "comment": "Malware payload (Mirai)", "value": "1f988b3bfa60bcb4ec89e2392785e025168c20045f303cc23668f4599aa14591", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641844205, "uuid": "71d1375d-466a-42db-a1c0-a1bdadc24787", "comment": "Malware payload (Mirai)", "value": "b73fc7d3828e213359ce9215dd1155b9fee90071", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641844205, "uuid": "a58a3947-8329-492a-869a-efda68de9b50", "comment": "Malware payload (Mirai)", "value": "e16ff7f21cac23f168e463e1372506e0ae2a4950f0c2b825779359e38e546c7fe24427f3591703adc0cf56b91f060314", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641844205, "uuid": "3edb2556-11bb-492f-9dd7-0d9786c11871", "value": "T144E2F17E187491D4E81B80FB27D60BD00E92C695B2448C6DBC4696D3D79F52AB8BBC8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641844205, "uuid": "d97d71db-1734-42c4-ba93-9bd082f790cf", "value": "768:5IjQKcxlfZ/NshAHkosSUfXCXGydInhvxJgGlzDpuWul:5RKc71NsyHkosSUfSXVdIhvDVEWul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641844205, "uuid": "de66deae-5171-4ca5-adce-5665db959a30", "value": 33140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641844205, "uuid": "43d0dea7-cfd1-4ba3-81a3-9f6fc5422b6a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641844205, "uuid": "793e12d6-4786-42ad-8055-d7fede73019c", "value": "gmips-20220110-1950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fb8d19-71ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641810468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810468, "uuid": "752fe9a8-e862-4cc5-a28e-271ca8163c50", "comment": "Malware payload (Mirai)", "value": "0281bfb8bfa4f92c1c8af8dcee47ba56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810468, "uuid": "6d6a49e3-0e2b-4b50-bf17-4a444fce9edb", "comment": "Malware payload (Mirai)", "value": "1ff6be4ec7b2698bb65dc8621f4c90bf6a17a46490a026470d8b5aa2f135267e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810468, "uuid": "2f679b7e-cf29-4017-9b20-368982cb326f", "comment": "Malware payload (Mirai)", "value": "848267148ae2187c69b1306633d2370a209d9760", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810468, "uuid": "ab9de0b8-5ce6-40b8-ab8b-dfb97a633785", "comment": "Malware payload (Mirai)", "value": "14365227d826c04bf87fbd17f56585be2d29674523122d6db92d21f208890b51be5271137bd80f0b8889f6b689b0884d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810468, "uuid": "bb018668-5a66-40e2-ab6f-8714220c297d", "value": "T16A535A11FD7A2E13C0D4A53A22F38725B1E6234E35B8862D7DA60F8DFF116906A571B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810468, "uuid": "b12f69eb-e503-4384-a057-c7ddeeab5aef", "value": "768:8dsof7rUv5WKvq9404PniOTp+cas3hA+K/KewZpMF10RqwO+a8AzFz8Xm5vhS:8+KrUv5WIS404Pnik+u3hA2RqaKze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641810468, "uuid": "0cb18998-4158-4798-8acf-d27d04aaf0c0", "value": 66568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641810468, "uuid": "17391825-edb6-463a-83b4-0ed564bc1994", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810468, "uuid": "a343c1ef-c23d-4818-82bb-a40afa4688f6", "value": "0281bfb8bfa4f92c1c8af8dcee47ba56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea00d84-71ea-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1641801464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801464, "uuid": "767be352-3f1c-47ed-894e-a6d509c7fafc", "comment": "Malware payload (DanaBot)", "value": "3b2e2b369895d2fd94a07ef3c66978c5", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801464, "uuid": "38457b32-8c6f-4c88-9f3d-9c1270ea4caf", "comment": "Malware payload (DanaBot)", "value": "220952caf42db06de1b1b80c1f95884419ebd90a667a07fa8da6792db1404316", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801464, "uuid": "9fb28368-f300-443c-a752-863dd506323f", "comment": "Malware payload (DanaBot)", "value": "91a09480fad625eae27f4df3e6de3e7e2cfec949", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801464, "uuid": "6f3d3e4f-9e1c-4a55-9f61-a6bd804b03ad", "comment": "Malware payload (DanaBot)", "value": "da3b4a5c22d4a8ec59dc4f15360c056c3a3bb12223c8786a9235c8db6f552e38087305acd950822667603bf0f0d9278c", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801464, "uuid": "6d9a512f-6057-4c43-a842-ddbf752c97a5", "value": "T1A3452338798DC477D95B0B3498608A954B2DBDB622688D8F2729135F1FB0ADC09FD34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801464, "uuid": "0f93f10b-da72-44a0-bbc1-def97db50853", "value": "5c93c9e73a5c1d80cd92ccce20897712", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801464, "uuid": "a3b47740-c85c-4724-b5f4-32bb35a2ec31", "value": "24576:rm/x7GFw7tS5VHifApuxPEkVaf5pshGsdcMYANwwb:rix7GF35hgqD0c3Aag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801464, "uuid": "e15e5877-7da7-4fb3-9ea4-d57ee67a3ae1", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801464, "uuid": "605a9106-488e-4cda-8e41-d2fc4d0426fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801464, "uuid": "24df9996-0080-467a-b3fd-b163642469c0", "value": "3b2e2b369895d2fd94a07ef3c66978c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be46ae4-7225-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1641826505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826505, "uuid": "30902b02-ee95-468d-8097-6b93fc88c13e", "comment": "Malware payload (Heodo)", "value": "854ce297ef9119fed311f1fe7f46e5fb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826505, "uuid": "724003b0-2a62-42ca-a518-a80e4ed5d660", "comment": "Malware payload (Heodo)", "value": "2310c1d0f6de26811169b28e899ad2c3157dd7f58ede7baf7aa5775fe1e523e7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826505, "uuid": "e7befc92-d204-47a9-bac6-c606dc89a513", "comment": "Malware payload (Heodo)", "value": "009c324b781f2a369d786534af295f5b6c45ea70", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826505, "uuid": "fe48778b-ab7d-41d9-b853-360299ede819", "comment": "Malware payload (Heodo)", "value": "c2986f94a0e0239934c06a585a2780d75b0a5ea633c5940221044a7744d2514b9cbe9037629228867dc2ff1d6214e311", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826505, "uuid": "b234699c-a2b2-433d-af37-1e5f3b6db37c", "value": "T147C48C0B7AF2C277C1A2D5318E9BEB98A3F5ED204D76464337801B0D2DB65C69326366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826505, "uuid": "6b3b1b63-7d15-44a8-95a0-780d60c942d4", "value": "4ea0587e4cc44535d4b6ae0865d33c1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826505, "uuid": "af228b93-5526-42a9-b037-2bbc12bc12c2", "value": "12288:IqcEDY6wH0R0zcvRmGKwo7FftPLZVEqeFVEk:G6wU2zcObFfP+1rEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641826505, "uuid": "d1a902aa-42fc-45e0-be2c-9dc62a7f777d", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641826505, "uuid": "f44654a3-1f9e-47c4-8f43-60b8c8fe4742", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826505, "uuid": "8a1ca04f-1e15-4e6a-8a98-691eb33cf641", "value": "2310c1d0f6de26811169b28e899ad2c3157dd7f58ede7baf7aa5775fe1e523e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bd6d85-71ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Phorpiex)", "timestamp": 1641802579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641802579, "uuid": "d97e0792-7a74-4250-92a4-b1bf2e7f598a", "comment": "Malware payload (Phorpiex)", "value": "9a848116c1c4588d9d0843cff1dee1f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641802579, "uuid": "68fe4b59-a82c-407d-b8b1-9f77b3382ef8", "comment": "Malware payload (Phorpiex)", "value": "2480a9b260108a5cd8630419c5d76fc359d926970cb4a71926924ce56ccad98b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641802579, "uuid": "f4e73723-a660-4e75-8278-19c8d433754e", "comment": "Malware payload (Phorpiex)", "value": "b3970c29a17c2bb7b6ca44432f6e29708f2d57a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641802579, "uuid": "4a7fe42e-4bd6-4897-819d-32cd11f0e7c5", "comment": "Malware payload (Phorpiex)", "value": "a361ca2d5a71fcb58b59bdb300ab283aa37b3d7553cab486d148504f38f14ff5b4b6f92fd6dddf90195b1a456e57a66e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641802579, "uuid": "535cd5dd-0a25-473f-93ec-6812b0e7b34b", "value": "T1B992D60A9954536EE8751434A3733E3EB039B937630D88DFDA8406B855A8ED1FB3334A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641802579, "uuid": "a4a61b32-d935-455d-bfb3-9ff473641116", "value": "eb9ecade5150c0b948e3fb49490e42b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641802579, "uuid": "cf8465ad-a1fb-4e91-afa9-4ff37066f2c5", "value": "384:vDHKG3A1eaVd0ZQLc01PpDeFibYTJ4JVB0+A3A1jxb5+kFjp1o25V:vzL4v5PpDVYA036jx3FjpnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641802579, "uuid": "2951dd4b-6ff6-499a-955f-a2b5cb01d730", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641802579, "uuid": "2249bebf-d4e5-4747-8179-a792e6131585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641802579, "uuid": "3c3e06ea-e0b3-4d1a-8af4-e5449bc5b062", "value": "9a848116c1c4588d9d0843cff1dee1f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea9a033-7225-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641826805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826805, "uuid": "4919fe67-7bf8-47b0-b55e-d6be1e44eb4c", "comment": "Malware payload", "value": "67583793112dad69ab54caa6ffed9205", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826805, "uuid": "b8236ec7-debb-42c9-8a81-e9485d7b98a3", "comment": "Malware payload", "value": "2565c9fdf16c1f78fd524c73f484c893bccf164ef70e5b6a12be08e023608ce7", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826805, "uuid": "daacb443-e8a4-4663-9590-8db1ee2037db", "comment": "Malware payload", "value": "1b0e4a4c845436b535de809739e725bc0ec5b51b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826805, "uuid": "f31d117d-f75b-4b7a-8ad5-6389d878f55e", "comment": "Malware payload", "value": "bc62422e3bcc309fb577697e9b7b669180509d74dad2c459daba667900d054267555f094b66ee05f71d5f40566b6caec", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826805, "uuid": "9b3da43d-e47e-4a5f-832d-8937f318f49c", "value": "T1CE06330C13AEF8FDE4594A3C3B2289A0C9E512F5D88225F3967815940C3F67D5BDEE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826805, "uuid": "7d36167f-ff1e-4a74-b650-460982aab5ee", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKh:0XSxVJG2fLAqFOfT9sMYNM29h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641826805, "uuid": "9930225d-1b88-4963-8cce-403d430f6885", "value": 3735552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641826805, "uuid": "1c877a5c-a173-4cf6-baa7-3d6141ce78bf", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826805, "uuid": "0203893f-fe81-4b73-8644-14addeae9d7a", "value": "2565c9fdf16c1f78fd524c73f484c893bccf164ef70e5b6a12be08e023608ce7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2134b92-7224-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641826327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826327, "uuid": "b499cd76-a8f6-4573-9cac-40599afd989b", "comment": "Malware payload", "value": "2a009f6f4233d40a5d1f6383e82144ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826327, "uuid": "332335ba-95c4-4ade-a77a-6d923bb5f8b1", "comment": "Malware payload", "value": "2575952994cc4f5d5756198ee4da5d6df8b7691f0d5a8a6566567ec1f54445ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826327, "uuid": "fc900b9a-53ab-4998-a45c-897885c907ac", "comment": "Malware payload", "value": "6b55faed728cd175c65da4a1e3d80b13d87c1bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826327, "uuid": "2efbc4dd-8803-4cfd-a6c5-931ebd756bed", "comment": "Malware payload", "value": "19548ce0da5735f446c4b84736143c8c97e4095ca4cfcbe2f861b9efdc1637027179a8338d03a8ee4355e4e9e168a147", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826327, "uuid": "c8659709-c231-4f4f-a53e-e9f59fb762e7", "value": "T132322A14ABD945BADEBF8B7408F252229270C9857426DF4FAD88049D9F27B508DC3FA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826327, "uuid": "5ccc1154-a64d-4520-8637-11a85281ddc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826327, "uuid": "b7753917-11d0-4051-83a9-21e61d2db224", "value": "192:mmOr6PJ7++2hZNxykOUVPaKX/0QUe4em27+eOwBWjUND0i+Xg3PWf:mfrs7++An08PRXcre4eVPSUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641826327, "uuid": "89d04cbd-04ce-482b-8226-efda3770f70b", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641826327, "uuid": "f7539083-f81d-473e-96d5-c96d59c29f0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826327, "uuid": "4c0947be-46b4-4514-ba16-0b7cb22be906", "value": "SecuriteInfo.com.Trojan.PWS.RedLine.20.1082.7853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ea3bc9-7246-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641840606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840606, "uuid": "7b235194-fc8e-4ad4-ba28-9dce863a8cbe", "comment": "Malware payload (Mirai)", "value": "f721b2068a06f9d6eb397a5c6b475151", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840606, "uuid": "9316b53d-ccc3-469b-b3d7-bc77a31dc866", "comment": "Malware payload (Mirai)", "value": "26f0daf1d6bba28d2000afaceb4393f7d866ae194cc7d2db0e87c12bb4a5c7e7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840606, "uuid": "b0c0a6d4-4c5a-4776-a807-0e0b68b97a44", "comment": "Malware payload (Mirai)", "value": "dc35e640c79d95d68122a0742a5f18785ae5a04a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840606, "uuid": "f519d879-5e58-4429-a25d-4bb8d5018224", "comment": "Malware payload (Mirai)", "value": "5268038767955e9acdd77b0ad698fed652f293f7fffc5f12616a1c18e17dd4bb68ed494b53c986667ec0bab906fe0a6a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840606, "uuid": "8593f021-ae06-495f-a73e-b56f8c3d68b7", "value": "T12A33E891B8C25A1AC6E423BAB6AE41CE332173E8D1DF3257CC205B147BD595F0DA3B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840606, "uuid": "f4bc24d2-2a07-4bb8-8ed2-f89e7c6804b9", "value": "1536:pHZFLK8l5G2y1iZL5V8rC9FV2NWhKdCWmAL:pHZcglS6V2AhKtm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641840606, "uuid": "b31ff131-848f-4cef-99c3-5c1f18ba3214", "value": 51476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641840606, "uuid": "1748ae5b-55b1-45d4-8cdb-c49ebbf3db5c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840606, "uuid": "1c6cb123-c716-4d83-bdc9-ea9657e2cc27", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0590c7d2-71f8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641807060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807060, "uuid": "0be98363-092c-453f-87d8-8a34529a1589", "comment": "Malware payload", "value": "d571792f7b14e1575ed714177dc60a79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807060, "uuid": "9077bea1-78dc-43c9-822b-7b23d1c2814a", "comment": "Malware payload", "value": "2735e4e4d7b0664a8e65e1767111bef660c0e321feaebdd54c3ff93b5e4ad126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807060, "uuid": "5028ffe8-e740-469f-8e62-518266ad12e7", "comment": "Malware payload", "value": "17766eeed5ac2e0f229ef1f54b220094c519c97b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807060, "uuid": "f0d014d3-4d9c-4619-8061-43029e688edb", "comment": "Malware payload", "value": "fba7069fc3b4f4298cdc4570423c1518e0f164dca94c7a4a786d98e84da238c0592724032a8abaab7d27fd3ba1fac9bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807060, "uuid": "6e9f4d8e-1dd3-494d-9b80-d413152af5cf", "value": "T1E0528211EBA45D75CA7E063118A363434FF4A2A17C72EAEEACCE108BDF372064752657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807060, "uuid": "834ae5b1-7634-4cfa-b236-675f8cc6fc14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807060, "uuid": "4b0a8731-03f7-400f-9ebb-a8e616adcec4", "value": "96:emjyktc6MV8Nzw5h9uLpglYnEdr+d6Pdb4ALyL5SdavtbIN5A0S0pwY333qLLLXO:VjZtcKbLpginSm6lMALyL52Ad4zjAy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641807060, "uuid": "d340cb39-43b0-448b-870c-7d2aa2c4386e", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641807060, "uuid": "860cf9db-9783-4875-8654-71b0db0ee354", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807060, "uuid": "c5180468-05cc-4c1d-a66c-0a3e811517f5", "value": "BOLETA DE CITACION FISCALIA No 0091-09753-120543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1279b54c-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641797203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797203, "uuid": "60321695-53b6-4eeb-afa4-27edbdcc6d3b", "comment": "Malware payload (Mirai)", "value": "585e9fd47e3b34a8cbbb0db6d10a9c1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797203, "uuid": "9b747bea-a78b-4f0b-8a3b-a0335a0eec3b", "comment": "Malware payload (Mirai)", "value": "28c960749d0fd25ccbfa483f978f4c0861e98740fe769b1d297519ab33f42c05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797203, "uuid": "cae6665f-ec63-4ec1-83f4-129040aec919", "comment": "Malware payload (Mirai)", "value": "70dc48264b9bdd141d7dd37cfd7096f0b559dc4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797203, "uuid": "23aca8c9-1657-4a7c-9c78-a70ef453b811", "comment": "Malware payload (Mirai)", "value": "bf92a1fafd87b66fa3cce86233b04aad45fff4a4f4c848460c2fd44c68b522f569c5d8902b90fb22de40ff1567a6a107", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797203, "uuid": "e895bf95-6833-460b-8327-c34bb9326a32", "value": "T1BDC2D12053CE2E90D3215C38BFB8E3D367528FD972A3386175104959AA4999307FEBCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797203, "uuid": "3b9b2420-a373-4041-89fe-c0c34cd87235", "value": "768:Ta8AIv+IEdm/WrpdQBWBm9C8tQw6CwZQCMes3UozMs:2aZ/Wgum9jQw6CGDMDzMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797203, "uuid": "c431aac2-d5be-4c47-bd9a-a0a45c68b2a1", "value": 28100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797203, "uuid": "7dbc0a22-6972-41ad-9e86-9e86ab774ddc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797203, "uuid": "fd625b8e-7d05-4a24-9bc8-96b43a5e4a12", "value": "585e9fd47e3b34a8cbbb0db6d10a9c1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02120583-71fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641809201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809201, "uuid": "e3fa9d7b-a568-4d77-99ee-db86bd15cdb5", "comment": "Malware payload (Mirai)", "value": "65292fde4370d9512b833685fafcc6e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809201, "uuid": "2ee5c677-eca7-4212-a8df-1e44c3a09e32", "comment": "Malware payload (Mirai)", "value": "29fe0dae7b7d81081bad894f908a02df01f88476dbff399e88c9101d811b82c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809201, "uuid": "de794736-7b8e-4a16-87b1-7522cc11c1ae", "comment": "Malware payload (Mirai)", "value": "ec8c6f472f65d855471437fde95223b2c5f89899", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809201, "uuid": "883ab631-0b81-4bd5-8a0a-3e1b30922a22", "comment": "Malware payload (Mirai)", "value": "c12eef12b7ba890c861d8f230af9e4ef486eaddd35bce83c1e2841381ba501ec4a6bf2bd320cdce688cdb7780a828e05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809201, "uuid": "2c5d17a9-f5d5-4756-868c-65cb015ce5b8", "value": "T103F3C70E7E219F7DF7A9823447B78E26935833D626E1D581D2ACD6021E7024E741FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809201, "uuid": "f63e59dc-18fa-4ed8-a00e-8b9143285e44", "value": "3072:4hKYDp/1taAIGSsh6mPQgOMkxii/uxqS6KEc4FLLIYo:qKYDFCLuIeQgOFwi/0jt6L0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641809201, "uuid": "b5315053-c1cd-4139-9554-73ee22a3ef18", "value": 160296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641809201, "uuid": "d2759a92-5114-45cd-83be-c1d6e366043e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809201, "uuid": "2842ca15-f85c-4307-a138-8e41724ae46d", "value": "65292fde4370d9512b833685fafcc6e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e07dfa-7246-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641840675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840675, "uuid": "1e52266d-b34d-442f-a58d-bda2d83f87bf", "comment": "Malware payload", "value": "5085ab3ce7f0d5ca635b28f4d87be217", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840675, "uuid": "98d87f52-e758-4a69-a252-1d8eca07176a", "comment": "Malware payload", "value": "2a17e11bb4c12101f6e524e7ba117178f8ba85777282863feee91690c24643b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840675, "uuid": "1f99f93a-435d-4ca7-b3c5-7aae392b2a1e", "comment": "Malware payload", "value": "2a3e480a12694368f9e8e077d250833357936070", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840675, "uuid": "e767ee3d-59b2-47c4-ae14-49e05537ff44", "comment": "Malware payload", "value": "753104410179066f50c65fac2d374bab5de65e02575694d689478a8e0c42ed42466f3a6c05f37c0334acfea62b994449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840675, "uuid": "f78b03bc-3a8b-4351-a923-fb6321d3bbe7", "value": "T13AE4F15857A8D926C17D03B9D1B9C1F04BB46F89E602E30B8ED17CF73EB27909D48686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840675, "uuid": "5c230ce1-bba4-449b-8feb-1360dce0bed6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840675, "uuid": "53e74bfb-7f02-40f7-828f-49d5f2b54a9b", "value": "12288:l6M8rWmFwtDTmilHq1Q3U9t/S1QYXQlZDdifKal2lh0QSkBY5ul9wrEzxa4HE:l6imCtDTmitq1Q3ENM9X8DreY0QSk0uB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641840675, "uuid": "4407d272-239e-4a88-90dd-0213132f073e", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641840675, "uuid": "da43a907-f2a8-4d54-8b37-687549ac9dc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840675, "uuid": "23ce5da9-1fd4-4622-92fa-4773b0089360", "value": "\u0e04\u0e33\u0e41\u0e19\u0e30\u0e19\u0e33\u0e01\u0e32\u0e23\u0e0a\u0e33\u0e23\u0e30\u0e40\u0e07\u0e34\u0e19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69402f02-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641805938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805938, "uuid": "8ec6e4ed-99c2-4d0b-89e8-f74c862ec508", "comment": "Malware payload (Formbook)", "value": "c703e8a50f73de479af3bcd295e05d1f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805938, "uuid": "7289679b-f3b2-423e-98c0-812583997372", "comment": "Malware payload (Formbook)", "value": "2a465661f3f941cf5cbcc0ec47b793489e61a4e67e9398e661a873a5d2f0a2c0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805938, "uuid": "a9efa2ac-0f13-4d50-9a80-12166992ae09", "comment": "Malware payload (Formbook)", "value": "83b847bad92a5d095c5ac6b37275a73576b8bd28", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805938, "uuid": "720ac192-3c80-4183-b095-92a3b93a27d5", "comment": "Malware payload (Formbook)", "value": "20169ae3a88ad27f94f6a92246310cd624bf635da74675c0e3f62632cbee4bf681589047840ca567a49224c77a17618a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805938, "uuid": "a16ddf47-d81f-4193-bad9-4a1be1274bf6", "value": "T15474121AFDA8AB07D1530C3A49AED53BF5A9ECCE178E0A2524DE315F29372048D70237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805938, "uuid": "80f5b80a-04c0-4be0-9275-5d02bd32473f", "value": "6144:v2b78zGeypynf96h7XEKnmYw4fEAiRbWmhltznH014zMlVXM8IxHZUXEwx1s:+b7JeypyF6qUuAwDDD7z98qZUUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641805938, "uuid": "39b514e4-615c-4a24-8452-b3baf0f8a892", "value": 358504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641805938, "uuid": "40429f99-696f-403f-8dd5-fb606dd8eea5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805938, "uuid": "14f75a62-9ee9-4654-b524-b782fb970769", "value": "New Quotation Order .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e970dd1-7213-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641818752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818752, "uuid": "cfb65684-e40b-4181-b774-030c758cb379", "comment": "Malware payload (Mirai)", "value": "6400e14983698f795fa31ce70d870613", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818752, "uuid": "571f7041-5174-402a-9a7f-bf747df3b683", "comment": "Malware payload (Mirai)", "value": "2a61734126904d5323cc0d228b1d840703e4ef66ad105691c6af3398a3b921ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818752, "uuid": "47f40bc0-2784-4606-ac25-1b3e22fd0dd8", "comment": "Malware payload (Mirai)", "value": "33f3e3c073b449126c996a99bf4b2c37cea9272f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818752, "uuid": "f3e3902b-6926-4a21-8d49-7403916be5e5", "comment": "Malware payload (Mirai)", "value": "d3db1615c8caa92c1806d4a75262d489a2676290927ad423d9ce343a44d63fb2f3a5e72e89639bc375a38fd03ebacfbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818752, "uuid": "fb56044f-8fa4-438c-91e2-3803e7fbd59c", "value": "T102337D73D42E6D68C1588674B0648A341B23F018A6572FFA5D57C272A447EBCF2A83F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818752, "uuid": "cf8a343d-bd7f-423d-b420-d570c2f82743", "value": "768:+aHQjcebqUesezeLecKSYRIqZodx8iotHCRRfolGeX0UCN5xW1:+aHYca1xiyqTI7y1HKwlP0UCN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641818752, "uuid": "5ab6eabb-6694-4045-882a-61a9092ccc50", "value": 55116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641818752, "uuid": "0e37b4e2-9853-4378-91b6-ec8df42ef53e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818752, "uuid": "1389bbc4-3476-4512-8b28-762819be5b6b", "value": "6400e14983698f795fa31ce70d870613", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9db0cdc-7227-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641827522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827522, "uuid": "40f3a5b0-3b7e-4838-b89a-321ee34625aa", "comment": "Malware payload", "value": "3c2ee1471c778deda189d613dc5c21f4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827522, "uuid": "5ebbbcb3-b5fb-4e38-8782-649d69212f12", "comment": "Malware payload", "value": "2c9dec17910b40344fee2b69f093585c3d9a31c420d778aed92223f4df0ea0ef", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827522, "uuid": "ec21f252-e487-4ebf-98e0-f0cf832457e3", "comment": "Malware payload", "value": "d3824f9252e9a360b4f35977cd9b27e1cf6d7482", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827522, "uuid": "6c54103c-bd10-4e43-b0d0-57b8b07aa43a", "comment": "Malware payload", "value": "a98d33459e3a51f7a3a5a313ebc4bbf70633ab89e2c99abe3daeff9ec55f32fdceba599199219c5a64a79f90ccb8b833", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827522, "uuid": "45e35f3c-f461-42f0-b4e9-9e680392005c", "value": "T11E92314A7ED1F9E813931B3B662F70CDE5AA0CCC3884040BC119F9D1797A617DAE1A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827522, "uuid": "6aa8313a-c4c9-46bf-869a-dc9be8db3957", "value": "384:wdARyBdE6H5H3zYiTm/V5ndE+JCJaqzzgx5DFi5djRywiJaDx8Yu9v/5GNmw5wcv:wdAwBdJH5H3zYiTm/V5ndE+JCJaqzzge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827522, "uuid": "205abce1-1ca3-4e09-9604-a110416edf51", "value": 20791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827522, "uuid": "edfe3774-26c3-4854-a678-3669475ac380", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827522, "uuid": "bc0b8735-2756-4a52-a604-031a56863c0b", "value": "Bank Payment Report.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdcc9f2-71ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641810481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810481, "uuid": "2e294fe9-2901-4a6d-b0bb-de2437c5801b", "comment": "Malware payload (Mirai)", "value": "5559ddff5e4df7b59dae415a4c6619f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810481, "uuid": "fced92f1-be9a-474d-94d8-88a939af61d1", "comment": "Malware payload (Mirai)", "value": "2f555817edbf463d42612b4800b9c3375c76a1c9dfd2c3a6c948b958b7e9074a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810481, "uuid": "a54680de-4719-44ee-a70e-cde5c71491bc", "comment": "Malware payload (Mirai)", "value": "df62d2f9213481cbdedc86445a34fa8c37b18231", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810481, "uuid": "af75a27e-4581-4fb4-b062-dd09be0af832", "comment": "Malware payload (Mirai)", "value": "84ff948e55eb53ddebfa309c699b3307abdcf05ae182d992967b581988e97239f20ee64ca0e1bf0b1217aa1986af64a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810481, "uuid": "e152b5f8-396c-45fc-ad10-ac11b2bc81c8", "value": "T141C2D034F2D56530DBFDDBE0295DC7DE62D19A2DBB8AEEE028809E4145651283A37DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810481, "uuid": "64597f9d-817f-4005-bee3-2390baaa609d", "value": "768:K6z6tmp6D6fDiYAx8ySehZ2A4uVcqgw0zp:Ka6ILAceiA4u+qgw0zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641810481, "uuid": "89a1d07d-4aa9-4c35-8b4d-b9d7ce4104d2", "value": 28128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641810481, "uuid": "d65feb5d-0e7c-4f49-8e9d-4c16ef04924e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810481, "uuid": "fe8f17ba-3b2b-45dd-a43d-d8b09da703d1", "value": "5559ddff5e4df7b59dae415a4c6619f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758a4e9f-7214-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641819273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819273, "uuid": "b31ce887-d781-4168-9708-d59588f890cc", "comment": "Malware payload (RedLineStealer)", "value": "1e0c51ff73e2aed3b7f81be4ca254926", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819273, "uuid": "32dfc7ca-7b05-4a79-989b-487a4bee78d5", "comment": "Malware payload (RedLineStealer)", "value": "2fb74ba5141ba422f44dd2b5d5992996ae30841aa63060aab7882a99931cdecd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819273, "uuid": "93d71d6f-4b12-4808-842d-6a8199e94998", "comment": "Malware payload (RedLineStealer)", "value": "118d3e633d2ec8904dbef94df74f5ac1acabc97a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819273, "uuid": "d3a67037-26bf-4a8d-bf19-e56af84863cd", "comment": "Malware payload (RedLineStealer)", "value": "88c67885a9d4dc6ca72fda533c5d2153841bbea3f2b7e4657826a467a589aae3f6e5f9fed0b639f35b342249d5ec3438", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819273, "uuid": "1f02686a-2134-445a-822c-5500143dbfe3", "value": "T160251ADE51C15849CFEF07F00DFBE62E857292C613474BEA731E85F0AB6209EA56D4A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819273, "uuid": "6224e6fc-cb9c-4aac-be34-f54d0c286516", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819273, "uuid": "72c07272-86f2-4fd8-bbb6-f2d5abb5b0c1", "value": "12288:NSl/GP8cV46OlgJuo6jF3EHgNbAHG9zx51r7/YTQ6IZyRoa0:Yl5cxubEABX1bNYMDZyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641819273, "uuid": "24d5e1ba-88f3-4ffc-a192-c81a54b08161", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641819273, "uuid": "c1b60020-c284-4cd2-901d-55742b6186fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819273, "uuid": "050a64c9-6ab8-4dfe-b212-b423c193bcae", "value": "1e0c51ff73e2aed3b7f81be4ca254926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ccdeb4-7226-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641827214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827214, "uuid": "9ed93c09-0dd5-4d54-8239-9502322dcbaa", "comment": "Malware payload (Formbook)", "value": "95cbc1f3891ed39e56fa3196a060f94e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827214, "uuid": "9642e447-89a6-4d33-880b-c31217733146", "comment": "Malware payload (Formbook)", "value": "2fe50cd698c141231db5d547de06e846312bbddaa3d5e8be0e012cc61de114ed", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827214, "uuid": "7ca4c79f-1766-4f44-bb22-9c69e2aeb7ab", "comment": "Malware payload (Formbook)", "value": "ca003b9444c4eebeb468985bf53db7f7db52a4a8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827214, "uuid": "e1c237b1-9e12-4e7a-9f8f-cbaf13eecf9d", "comment": "Malware payload (Formbook)", "value": "40e7ece04f4ebeb14c779715c37fd203a1224f7706f5da139537ba7168af1af4bade6ae3bf41f7714a8717988638e295", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827214, "uuid": "21901cce-9dd8-4c34-af92-817b5ddd65d7", "value": "T14364122E766CD30AC572E7F51D598064120EDFDA7F90F2E08815B78E987F9C89F250A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827214, "uuid": "671c96df-533f-4096-9a81-e9b7b30b373a", "value": "6144:1sY5bI0OIMZ1IcvEMc7SS21nTjK3MRBkfuiyKIrW0GO2:1sgXeocv+SpKcIfuYIS0GO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827214, "uuid": "2553b39f-aa14-4e7c-85b6-b0cf4b80e854", "value": 317528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827214, "uuid": "ebb67e53-9738-4aca-b1ba-b36f753eea48", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827214, "uuid": "797761a8-3a05-47f4-85d8-b5ee231c793c", "value": "QUOTATION REQUEST DTD311221 - Mopcoms TurkeyPDF.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b2aa9d-721b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641822277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822277, "uuid": "d7cffff2-8670-44be-85bf-9e1fba61e36c", "comment": "Malware payload (Formbook)", "value": "80764ca0b93848c21c2b6afe75ab4329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822277, "uuid": "28129770-3fcf-4cda-afc5-82beb42f2b54", "comment": "Malware payload (Formbook)", "value": "2ff07642867f534743f26a3783850d83f59d74bf6860831577ccf26d52ae88ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822277, "uuid": "bb839d80-4801-401e-8fa5-19277d598a93", "comment": "Malware payload (Formbook)", "value": "ba49730f90414720603a1bed0811443b3459a47b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822277, "uuid": "495f21ad-cd0e-4125-bed8-1d8ab029fe22", "comment": "Malware payload (Formbook)", "value": "8369ca1d77af6548f242628da41b08343cfa5ffed8a1374660900a38f0cf1e5d5ba5865ca7be3a974f7189834239cf24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822277, "uuid": "58f995cf-4071-42a6-b331-134724d419bd", "value": "T193F4C0067A4AD902E2690973C5DBC2B447F47E44A553D32B79E53E3F3D723A1BC0868A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822277, "uuid": "c08cab3c-efe0-4721-a120-d8294f643c3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822277, "uuid": "1dc38d5c-9ab0-41ea-b312-c27ffb9992ec", "value": "12288:Y0xGOg5d1WNwtDTmilHq1QR6uDQVGaXAbApUXvMe4KZgeXLU9t:YUg1WatDTmitq1QR60OGQkGUXvMe5ZXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641822277, "uuid": "cbd53aab-7794-42c9-9841-2a5b8e43e6df", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641822277, "uuid": "98bb9193-1133-4614-971f-075867c64b77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822277, "uuid": "e8b91614-579e-4519-a8de-5dd9dc155ede", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b31fcde-71f0-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1641803767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803767, "uuid": "91ac74a6-4ff9-45a1-8636-1f809727b667", "comment": "Malware payload (DCRat)", "value": "caa7bce6eecb9257f60f559b27fee677", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803767, "uuid": "981e075f-52a1-4a79-86e8-bee1a204c2bc", "comment": "Malware payload (DCRat)", "value": "304edff857fa25804412b30701ed763a0bb2588b9301e8253951328338a12158", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803767, "uuid": "5e23fad3-b514-4471-a209-99b4ea75ca43", "comment": "Malware payload (DCRat)", "value": "a374e62d52031661f4debcde48667b546d63935f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803767, "uuid": "932b816c-bbd3-4722-a241-54627b2dcbe6", "comment": "Malware payload (DCRat)", "value": "28902f876c536945eb0c0e9fe080b36a7bf1b510ccfb2d54d0fe47615a47e83a2dec23509cb8aad93c05176e84ba7e90", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803767, "uuid": "1f54c1e8-4cc8-407c-97ce-49f4c6846567", "value": "T14A4548027A48D911D0291637C9EF922447BDBE027A23CB1A7FAF336D65513A35D0E6CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803767, "uuid": "3dd6bf00-8e57-4ef7-8724-7a643759e383", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803767, "uuid": "e3844410-2b06-43d2-9897-7426291f3b68", "value": "12288:URZ+IoG/n9IQxW3OBseUUT+tcYbSJyB+7G7dElKMv28/H4xKlYgCFSjGymWR1JWV:u2G/nvxW3WieCcrT1U+WD4ub8k+4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641803767, "uuid": "24b84646-191d-4644-90da-647933fd6a8b", "value": 1270515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641803767, "uuid": "4868c4f9-a3ce-492e-bd33-ed495d12e95c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803767, "uuid": "2b114351-853d-44ef-b252-fb9d260ff6d3", "value": "caa7bce6eecb9257f60f559b27fee677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be0b343-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1641805970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805970, "uuid": "6d86db10-31ca-4924-be4f-1dace290b486", "comment": "Malware payload (Loki)", "value": "e62dfea1c689bccd586f8020eb48ad6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805970, "uuid": "18bed55e-bef2-4a9a-a0c1-e57634bf9d3a", "comment": "Malware payload (Loki)", "value": "313671adf6e5d1d339c426853b83b9a6198278777a6aa693de5ae517fc6e236f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805970, "uuid": "22d5c20e-9030-449b-9690-268a658189cc", "comment": "Malware payload (Loki)", "value": "a6632d76510db46311481d447272ddb99fdcd5f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805970, "uuid": "526393f6-4085-47a6-9754-eb95323e6c49", "comment": "Malware payload (Loki)", "value": "c6791256df161126587975a4b5c3978cdf92d8b1dcfc03b33d4a0ca3bb227e9c24e9005e6a8994c8c074b98203fc7fe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805970, "uuid": "0ccc9559-13e3-4e45-83a1-b32d2980e77b", "value": "T1EA8423A7A192AD7EFDD98F345AD7E7BCC7FA8B100072A05F17821C662E715028B055CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805970, "uuid": "2a22544f-ec86-4f6a-b781-306ca21e9e1b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805970, "uuid": "57b877f0-1f52-4ef8-8a4a-edbaa9044b49", "value": "6144:yybLOe0o0TMQ0vNcs+WvM580nl8NpS6QXKQwjEK1PDW+xxmGxtTw3lfq2+h6p1KS:PbLbH0oQYNP+WE9N6CKZN1dRJw1q2+hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641805970, "uuid": "8b378a89-0d7c-46e1-ae2f-95c5f8de49e1", "value": 376346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641805970, "uuid": "dd96e53f-9285-45f0-8a90-47257ebdc89a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805970, "uuid": "5afe2615-99bf-4293-99a8-65cfb27d2a18", "value": "FILE NO. INS-21113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58bba38-7203-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641812160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812160, "uuid": "29b4136f-20eb-4196-b21e-e64201902329", "comment": "Malware payload", "value": "3a67690693b41201e871b3c1c9864fba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812160, "uuid": "6d255a9c-ecfd-440e-868c-2bed7094d4b4", "comment": "Malware payload", "value": "315ed6f81f3a9c997648cc1885825e60e61e9201cb000ea5f05311ba82fcf75c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812160, "uuid": "e9fac929-95f0-439e-9eb0-91ba782e4b28", "comment": "Malware payload", "value": "73ee8cf5a82197ccbc7b3ea549bba5fad56ae4b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812160, "uuid": "54860ea1-49fa-41cc-b1e5-70abd023947f", "comment": "Malware payload", "value": "eed88e41971ca0929001c824170099957b8bb8907f0bd50d11316104db26c2b28bf5a8ea2f8377410369e557c52d26eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812160, "uuid": "27c92436-3370-4355-bc32-2ef824464f73", "value": "T1B0B15203FB859F62D4EF133884A74328A671E441F3038B23364C6B153E627EDAB02389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812160, "uuid": "407df09f-2d90-43a5-a8a4-9758f8203c73", "value": "96:B56VcXRvm2/ojzoask0q2AOxtW4w4XM2F:B5mcXtQzoa4AOxtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641812160, "uuid": "caaeb4e1-142a-44a8-983f-a214359aea07", "value": 5532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641812160, "uuid": "1519f06f-c624-44d9-b84b-3521f14884d5", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812160, "uuid": "09ed9513-ae25-4f8a-b477-f16413f9ec96", "value": "SecuriteInfo.com.Suspicious.Linux.Save.a.2055.10236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52704d7-71ea-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1641801314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801314, "uuid": "f8a8a2fe-ebe3-4a37-9bfb-e52241ef985d", "comment": "Malware payload (NanoCore)", "value": "3084566c91221ca5d8db7ea723dba528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801314, "uuid": "5b38e76f-112a-44d9-b1bd-fffcc0fffab0", "comment": "Malware payload (NanoCore)", "value": "326f992e7f7899519e4f46bfca7ca0e1da3483eb5e48c5ca03be1b3fb3adcbc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801314, "uuid": "8bebe37d-603c-462e-8ea9-bad5ee878701", "comment": "Malware payload (NanoCore)", "value": "2ba17a8d6dd299618927de183c2dc9300441f9d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801314, "uuid": "79613094-7cd2-4af0-8f27-060d972d4381", "comment": "Malware payload (NanoCore)", "value": "9965fb64af3699daa98760753e39270f2c3cdfceb5374b14f287ec3932bdcd807fc41a65a4889925358405ac29df4a86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801314, "uuid": "fd9da269-7beb-4aa7-993e-e406a61f6b9c", "value": "T118056CC3B0C024CDFCDEC2FB69A64A2395E16C9A494254006A7D3F40BFEDED6578C969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801314, "uuid": "f89ecabc-64cc-47b4-9615-f14b3f0c6360", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801314, "uuid": "0b920995-936a-4695-b32c-fb5a7ab51162", "value": "12288:9wo776gDlxUhr+OHeMVmdV2QdmgKrXaXhhapC:SM/wVqndmgSaxIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801314, "uuid": "ed87a36b-6bf1-4f01-a6c6-0e7f4364032d", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801314, "uuid": "e97b8be2-b0cf-44d2-b1ed-09d0afe1abfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801314, "uuid": "eb6672a6-70cc-4912-930f-3782c984e4fe", "value": "Signed contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7325ea4-71f8-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641807358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807358, "uuid": "92ae9cb5-8e17-4b14-86a3-1cc40fdefbc6", "comment": "Malware payload (RedLineStealer)", "value": "cb503f8a61c6dff69017c5d09257f27e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807358, "uuid": "82dcfe80-21b0-44de-aa77-0d90856f2984", "comment": "Malware payload (RedLineStealer)", "value": "34b44b19cc0b150990327a43a612fa1d17a218811c920bad6dfe8c278b1297d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807358, "uuid": "5553956d-0b40-4733-8139-283c50e45243", "comment": "Malware payload (RedLineStealer)", "value": "a17016645bb10f37c8d03162f11192c6149f103c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807358, "uuid": "e3a068eb-232d-463f-ac15-fcf99326b84f", "comment": "Malware payload (RedLineStealer)", "value": "bcd8373bc14e0bd8863e420934de9fac5a42d8799141f348bee537f20789e9046d75e798cc3287d45c5056521d9417ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807358, "uuid": "e6a141a8-5c93-44f1-af5d-f76fb07cc9ef", "value": "T1151519DD52D15849CFAF07F00DFBE22E857296C213474BEA732E91F06B620CEA56D4A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807358, "uuid": "1efc54df-84a8-403f-a7a4-9e038d34868f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807358, "uuid": "566267a1-64a1-40b7-a2ef-d3c75ac7ed17", "value": "12288:vopIOSuidVyaqcC4/HdJvFCR5hQ8UK9vUqtJHHQmD:Q2uaAcLHzFP1AnQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641807358, "uuid": "e47ba81d-4960-40e4-9d9c-693848ec51d7", "value": 935424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641807358, "uuid": "7eddf15d-723d-424f-bd78-f91b88905d70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807358, "uuid": "51ff56e0-b147-4c60-a94a-307720aac3b1", "value": "cb503f8a61c6dff69017c5d09257f27e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe0d18f-7262-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641852979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641852979, "uuid": "4b3be7ee-e277-4532-99c7-b458c9fa8625", "comment": "Malware payload", "value": "6af5eea28bf38b6848e6e3ec41110438", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641852979, "uuid": "248d336d-57d8-4d87-8db6-3d901285ebab", "comment": "Malware payload", "value": "357c7ddc33964c2a4c26abce03a5877ae1c3cf19816477fdddc2d71255095c7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641852979, "uuid": "c3e2d374-3526-4e0b-b9ba-f28e3cb29e7a", "comment": "Malware payload", "value": "c8e73395464477cd8ee5f91ea02f06692a7c539d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641852979, "uuid": "1eb0738d-719f-42f6-9c4d-e4b9f69492c7", "comment": "Malware payload", "value": "a126ec920b3835ce3b1b757f3da7e308a7c80ee90e2fe2ab3b6ed47efe8f88c858d9920ac2269b36f02d5ae62b729036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641852979, "uuid": "a41696cd-7606-4c7e-a88f-029c120ace4b", "value": "T1832509DD51C15849CFAF07F00DFBE22E857296C613474BEA732E91F0AB660CEA56D4A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641852979, "uuid": "14a04607-4632-4464-b38d-7aa2f7b14842", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641852979, "uuid": "460df9d1-6d24-43af-91aa-bf7765978c8d", "value": "12288:WCgWdzgG6OEUnnJ7sYndWh1rljB1+Q9JhTo0Gij7D:7JEUnZUzBYQ9J+nib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641852979, "uuid": "c3e19ac5-ce74-4068-967c-01dec8d4a82e", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641852979, "uuid": "2f63bd72-b8c2-4642-8837-dfeff03fe802", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641852979, "uuid": "13e9c543-406f-4a41-8dda-2397de8cb661", "value": "AimbotFortnite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ccb7d5-71c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641786224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786224, "uuid": "cec181eb-83ca-4dba-9da4-b7445724cbf6", "comment": "Malware payload (Mirai)", "value": "f7bf2fb264d6bf8033e8710ca3f8ad22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786224, "uuid": "3c7086c5-ad94-4782-9aa7-a06d4751bd20", "comment": "Malware payload (Mirai)", "value": "3690e720038f354e17233ceab10624fe77ca4bdf7c0b0b4430b5839c690771e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786224, "uuid": "20850218-bc3e-41f2-8d6b-2605b2549936", "comment": "Malware payload (Mirai)", "value": "a9aea4d9044b213e2f1aaae247bb135a375bb51c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786224, "uuid": "a6093bc6-00c7-4d43-8513-e4f830e26560", "comment": "Malware payload (Mirai)", "value": "d7b2b856997c7763b1bf7beecbaa829347d58192fabd652eca0d71dce823cb7cca4a107db1daf28f2d921816d8114686", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786224, "uuid": "6b3816cf-874b-49fe-8c94-c45e531d2d89", "value": "T1CE533B02F3284957E5931EB5293F2BD153AFEE8020F5F5847A4FEA0D8171E726646E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786224, "uuid": "1005dad5-b1e4-4eda-8fae-094d447412cc", "value": "768:9ivBu58DV6RI5j9hwAXN1o84wbCYphyIKj6mCGnBsFKoXFiLNlo6Wx:Yg8DEy7xN1o+pEXjJboXMh/Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641786224, "uuid": "d2de1ecd-5126-4fbd-931f-5c4585ef0bc6", "value": 64576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641786224, "uuid": "bdd52e19-c133-4831-b75e-41c4e7f968c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786224, "uuid": "d02813f5-a732-4227-af1c-b0ef5978fe63", "value": "f7bf2fb264d6bf8033e8710ca3f8ad22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3829cc57-721c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641822606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822606, "uuid": "2b265f8c-be90-41fe-b8d9-7c70745c87bf", "comment": "Malware payload (Mirai)", "value": "8ad83dd1593b053c1c8aeffe92cc727a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822606, "uuid": "ecaae8a4-3268-4cf2-9816-2904e32159e0", "comment": "Malware payload (Mirai)", "value": "3c6ac7d21b5783335da67ffbe9a84cf99e0330d33114a6f204a8a546bcbafd82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822606, "uuid": "12116c33-073a-4bd9-8c98-a32d8c4eb870", "comment": "Malware payload (Mirai)", "value": "58e4ed4201504cce6f92a712f1d35c37077b4787", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822606, "uuid": "f667f4de-a366-41c5-b492-d6ff3bd643e5", "comment": "Malware payload (Mirai)", "value": "27c3c256e49691e7da742583535c5db90091be12a93b816e3889063d3f05d01fe4d924a2f445c7000b43462d903f1dd2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822606, "uuid": "09795631-b110-43f0-afa0-12b10375574b", "value": "T127F2F16826CE5F60C279893CFD7D8944A37B05B4606F7428CE802CFD5A7AE19627F491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822606, "uuid": "81cfc289-11a5-4771-bce0-a5be0e3c0395", "value": "768:bro1jvHPTMXUWW1d4bfbX6JW8bRNt0Ps3Uozw:Xo1j3Or6qfLyJHzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641822606, "uuid": "136de2d0-257d-405e-9c50-184946579df6", "value": 37008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641822606, "uuid": "f586086d-626d-4ca1-b759-aa4b7fe615ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822606, "uuid": "488af610-1909-404f-848f-46b3c6a42a50", "value": "arm-20220110-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1e8780-7220-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641824363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641824363, "uuid": "930dab40-5d6f-493b-8b76-fc0c1bf9208a", "comment": "Malware payload (Formbook)", "value": "523cc9d41948c75931c2c280576635af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641824363, "uuid": "74c86d3f-1584-4c4d-ab6e-9723ce410484", "comment": "Malware payload (Formbook)", "value": "3dceeaa794d1b8b67ba67c57820ba13f8078801c589747426b0562b5ebf411ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641824363, "uuid": "bc3bdaff-a184-4560-a2e0-db542b3762dd", "comment": "Malware payload (Formbook)", "value": "55dc2cc4f50345f8826e0a5e7ffa54304800f1b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641824363, "uuid": "b38adfac-ab05-431d-9044-6d2def3f3de2", "comment": "Malware payload (Formbook)", "value": "467d418008e0227fb8e48da3c8b1d0872d3cc757fd71e0ae587c1f5b08bc7724f71e1b12a87a09a7461f7c3dc69f71d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641824363, "uuid": "e60ade17-940d-4e57-adea-0e7850fbfc99", "value": "T184F4D0063E59C802D2690673C5DFD2B407B46E88A543E3277AE93F6F3D723617C0969A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641824363, "uuid": "e722cb3d-c97c-491f-b846-e79ae7406e42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641824363, "uuid": "61108674-d889-4cbb-9799-40cfab8022c8", "value": "12288:4yY7AqKIWwtDTmilHq1Qr5mXOt48KB3G6r9UYKTrg15/Bpe5Tefw9pU9thtGG:45l7tDTmitq1QlJaSYKT2/u5a8pEpGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641824363, "uuid": "aeb759a9-b681-45bc-b963-1dd8b8947c6b", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641824363, "uuid": "481bc2a9-77d8-4639-a1e6-d02c627afefd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641824363, "uuid": "de75b87f-e148-4125-81a8-95626b09edcf", "value": "aguerozx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2b48ea-721d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641823209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823209, "uuid": "6d1a07b9-e625-4c98-8531-88ed98a57a74", "comment": "Malware payload", "value": "a74236517022d0c82f44864f6170940d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823209, "uuid": "1d1c8e43-afff-46dc-9f28-53ec7e74653f", "comment": "Malware payload", "value": "3e0bfe3ee8aeaa8c8f80763c9d50805c114feda85d822a6e72575e9c60c244b0", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823209, "uuid": "2d8cd5a7-51e5-4f6c-a5c0-6624ab7f7875", "comment": "Malware payload", "value": "229ffe2d839ea530aac61baa24d3a6b84696aad6", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823209, "uuid": "2b468f28-1eb8-4542-a5fd-7db6c86d5f6c", "comment": "Malware payload", "value": "4dc2baa9f669f550011553c20f555475f93493471dd58f92bd0acb4046697aa86319c0e555f46a90cdd06ba85384c0b8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823209, "uuid": "e8c1a0bb-2e77-4a65-bdd2-744d6c021625", "value": "T11906330C23AEF4FDF899057C3B2689A0C9E452F5D88225F3963815940C3F67D5BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823209, "uuid": "c782486c-16ea-49f3-9921-84691240f00b", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKt:0XSxVJG2fLAqFOfT9sMYNM29t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641823209, "uuid": "f7378bd1-1cf8-44e0-ba5e-e26fc76b3743", "value": 3756032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641823209, "uuid": "1d6cb183-71b4-45eb-87cd-bb4f37036176", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823209, "uuid": "8cc6ea73-1698-4abd-9160-da6111ab6e16", "value": "3e0bfe3ee8aeaa8c8f80763c9d50805c114feda85d822a6e72575e9c60c244b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f19414-721d-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1641823171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823171, "uuid": "b4f398bb-e89f-405f-82a9-89f2be9afc0a", "comment": "Malware payload (NanoCore)", "value": "186b4c0b2553f2f6c89a207532f3b01c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823171, "uuid": "068586ba-79ad-419a-9296-f002b63d92eb", "comment": "Malware payload (NanoCore)", "value": "3e3134b1a5a7f25052eeb1c64451228f5c0051f22160097f644502f9d060559f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823171, "uuid": "a740c980-7704-455a-a844-36203db0d5fc", "comment": "Malware payload (NanoCore)", "value": "bd1df01d9345307ab57c07f67042f4803c0a0984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823171, "uuid": "bb82cc2e-d6e2-482d-9927-41b4084da2f4", "comment": "Malware payload (NanoCore)", "value": "1828a4cb0291abb2d0c2974cbbac8ece526976c8a4e82aafc1ec9793244e83843b4120ebd061ce0fff6c5424e8647b49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823171, "uuid": "6d1624f3-18f6-4682-bb9e-a8b8f6a50366", "value": "T117C4DF1533186A07C26D34F48061A140A3759DA665A6CBED6CF270DD1AFABD3EE023DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823171, "uuid": "65639bd5-8fca-4e0f-91c6-799c14586249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823171, "uuid": "13b85306-bc6b-4621-bc0c-6ef4f546c6c4", "value": "12288:I6jCQD9Pp8BKzIwpQxjIhuI5jAA/wcr8GjSIhnTsp4AJf:1jf9bs/IoI5j9DzOzJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641823171, "uuid": "39740344-2e2f-4cb3-806a-72f20e7c1b65", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641823171, "uuid": "ecf5d876-c81d-452d-94d3-122807842ca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823171, "uuid": "69608f0b-9e04-4cde-ae9d-a0485cf14a11", "value": "RJN54QhMPbbTJxo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62548980-722e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641830408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830408, "uuid": "56c18847-4069-4cfa-b0ce-0751b50d1dc2", "comment": "Malware payload", "value": "f8785708b3bbb1b8a2793ff9908d9a74", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830408, "uuid": "f5596dd4-c1f9-458a-91e3-284905588c9e", "comment": "Malware payload", "value": "3f40cb22e5ca536ef01c49e1fd8983d4361a66f27196373dc8ba64fc363cd639", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830408, "uuid": "6bfa3b05-fcca-4bd1-9eb0-14ef4af1b64c", "comment": "Malware payload", "value": "e53d5776206d82e57bc429f703ca80185a0d25d0", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830408, "uuid": "de55bf33-b4aa-4d08-b8b4-aaafeafe71d0", "comment": "Malware payload", "value": "4d6e5255db9bb2e52ea90db6ef80e6cc224d760000940f4a5748cbe9f51ee931cd5ed93b2f8f9f85d2aef215d8843f24", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830408, "uuid": "6ec15e86-1944-48b6-9604-4282c79e2858", "value": "T16606330C23AEF8FDE4994A3C3B6285A0C9E512F5D88225F3967815540C3F67D4BDEE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830408, "uuid": "3ff98303-2a1f-49d4-b443-cfc2e6728cb8", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKO:0XSxVJG2fLAqFOfT9sMYNM29O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641830408, "uuid": "a58e9e97-fa3d-43c2-bb68-31db73d4cef9", "value": 3723264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641830408, "uuid": "13c3a1bf-9678-452a-9415-602ed809e753", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830408, "uuid": "0f9c5e18-e208-4b95-948d-aa5df7ce33e3", "value": "3f40cb22e5ca536ef01c49e1fd8983d4361a66f27196373dc8ba64fc363cd639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa38e09-725b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641849669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849669, "uuid": "49aed026-61ba-42bd-91c7-b9d7b550c901", "comment": "Malware payload", "value": "cbd37689009123e636aa66cfdbb2c221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849669, "uuid": "5adaba3d-187c-42de-8fc4-293ac105656d", "comment": "Malware payload", "value": "4063b840b7529eab714323d205aa1aad13bde2b527884e46048df4a2409594cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849669, "uuid": "b0893081-aca3-40be-a8e4-54678ad75976", "comment": "Malware payload", "value": "d5e7453365142c893dfef2f44ae4b4ba1c19bcc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849669, "uuid": "c20add41-7541-4039-99e3-d84f4ca4c48e", "comment": "Malware payload", "value": "8207d4cef3be5c648549083d1b7deebbc1370121c15492db996a0a499845807f0b7c8f959fc3f2321386ee9a57a953d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849669, "uuid": "83d89647-f692-46ce-b4b6-a155b06a1a2a", "value": "T1316623E96254332CC41FC4749433BD09B1B5914E1AFBE6BD75DBB6C07BAB820DA42B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849669, "uuid": "f3112df5-2941-40ac-b868-11a2845b21ef", "value": "889336afd01a952ba79d1e90fb751739", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849669, "uuid": "0cb98621-ec65-4af7-b923-0390fd8f1f45", "value": "98304:VMUmOo1CZMAho2l/dzlXVeJjmZbBK1d04eaRj72CVtJu1upPa1uxwRQWkKinY1hn:VM7Oo1FYoOdlVMj4x4ecj7tGeEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641849669, "uuid": "337c1bea-25aa-4704-905f-663006ae8403", "value": 7000576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641849669, "uuid": "f242df1d-a1ae-46ce-a52d-d015b8504462", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849669, "uuid": "4fa08a1f-53da-4a4c-a0ce-0c820f06b7df", "value": "cbd37689009123e636aa66cfdbb2c221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3532a758-71ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641801127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801127, "uuid": "2a5faa20-4539-4a19-a58d-bf506b86f53a", "comment": "Malware payload (Formbook)", "value": "a4039fcf77b45aacf5030d812bce0d1a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801127, "uuid": "c1773891-04f6-4cbc-840e-cdef5ad24386", "comment": "Malware payload (Formbook)", "value": "40dbca0dc293feaf8428c8511e5ea96c9a5794520f96b7f9b718b34b2b640374", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801127, "uuid": "091ee864-8295-47ef-8e33-42342ab3ff74", "comment": "Malware payload (Formbook)", "value": "e631061177df9131590d8bf06d833f8ba5619422", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801127, "uuid": "3ac8b60b-aedc-41e7-b005-d4609d38781d", "comment": "Malware payload (Formbook)", "value": "9d67cc9fbee07b1a22174fa11cc166de5ad7ae99a05922a137226a3b04dcc3681714f13bfb69695db9682c88dd1a38af", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801127, "uuid": "b22250b2-f6a4-44ec-b328-d317a4cc7d94", "value": "T1F6C4238A7D084A7781CB36D8728FC1345D8438AFF91261ADBDD5A8F75943A4C83A8333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801127, "uuid": "d02d4641-c944-4399-94a1-cdb959d7bc4f", "value": "12288:GhIeKj7ulVz3hZdY/+CIcztm+vHzglQcTNq2pHDQQRz+:3eh1q/pmETQNbQQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801127, "uuid": "cc63656a-7a96-47f5-b8b3-551b538c77cc", "value": 552079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801127, "uuid": "3ff16bd0-fc0b-4a5b-a1aa-9f709d8a0010", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801127, "uuid": "cb8a3b2e-e116-456c-b956-b836a153bd76", "value": "quotation New Order I5117.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068298e6-725c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641850011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641850011, "uuid": "b187827d-afec-4c31-b413-317d5e7f16f5", "comment": "Malware payload", "value": "58b08c09716a39ff71371eae8f1571bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641850011, "uuid": "04df58ad-825d-4353-8f5e-02b1a4df4195", "comment": "Malware payload", "value": "41dd73f6c48fc19020f97608c923cb59f66a7659144f03f4d9825bf1f7c8cef6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641850011, "uuid": "b58d8d23-25be-4a80-875e-848913e1efe6", "comment": "Malware payload", "value": "e4f92fb5563f6dd96f440954ccb499a8ff294439", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641850011, "uuid": "8c975ff6-2045-43db-8ab3-827f1ed00d48", "comment": "Malware payload", "value": "99a9fc9124773195a64a8cb7623d45ba9431a22587779963a2d129c7a0134a2e2b62bd0db328f76d35053f15fced43d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641850011, "uuid": "1524c69a-c917-4b42-b1a2-e7803e6235fe", "value": "T17AA45C2437EC5A26F2BFAB79C4F2245587797553BB6BD70F08C1118A0A22701ED81B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641850011, "uuid": "6bcf33a2-0aab-4959-a5be-1ef0973013aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641850011, "uuid": "529a7710-e141-4de6-825d-c6299d69fd2a", "value": "12288:AqnO0F9xPaDj/VbW04eBH92wiR73JWoQ:A+O0F9xPaDj/Vi2nK94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641850011, "uuid": "d0fc6363-cef4-4d13-88d4-f2ee98b3b03f", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641850011, "uuid": "ecebab8e-d5df-4cd3-b27c-5f0b981b361d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641850011, "uuid": "0a61ae2d-a5a6-4738-9e4f-208745534010", "value": "58b08c09716a39ff71371eae8f1571bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1345383c-71fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641808371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808371, "uuid": "cb78be07-d146-4561-8ae7-609336de5d0e", "comment": "Malware payload (Mirai)", "value": "1d49900ec58a4bd8f001fcdcdacf1fb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808371, "uuid": "fef0ca13-5047-449a-8749-8d2759aa0f59", "comment": "Malware payload (Mirai)", "value": "423fcea3204f988b08cd8df77379ea124b0c0c04ccaddac9fdc0e514c8e6e49c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808371, "uuid": "e03229cc-7893-4462-b15f-9a05d860dbf8", "comment": "Malware payload (Mirai)", "value": "96664fee79d495583c8f6e53e151aab094323c49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808371, "uuid": "95a8d164-4cdf-451e-b81d-e5260012126b", "comment": "Malware payload (Mirai)", "value": "44c3964acf7f3a07b0f2b30c13ff29c55dab1462d9f312894aaee41c28e346b78bfdedd49a1d008a8aabb3ac43375d8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808371, "uuid": "ecab65a3-7ba6-402f-91f9-648892350ba9", "value": "T14DF3D709BF610FFBECABCD3745E91702199C656622A93F717A34C918F64B24B25E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808371, "uuid": "b4c323ff-be24-4550-b7f4-0f403ef434be", "value": "3072:Dl/qlClGMAhNu/qKmB209fp/msQZa0tHDV:Dl/qlClgh+q/209fp/WAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641808371, "uuid": "00eb70c2-7504-4f84-9589-8f8432dc6a93", "value": 161992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641808371, "uuid": "f052ecca-9715-48b8-ab30-75fa46d6da85", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808371, "uuid": "e0e087d9-e8ab-4154-b9c5-6ffeef0ae9f5", "value": "1d49900ec58a4bd8f001fcdcdacf1fb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8935005a-71f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641805133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805133, "uuid": "212484f9-ac06-458e-8676-2f22c3c0d2c9", "comment": "Malware payload (Mirai)", "value": "dd0a2b55ee42ee1e15316e8d44edc501", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805133, "uuid": "120b3c13-99c2-442a-8b48-c017bc41dc5a", "comment": "Malware payload (Mirai)", "value": "42f84db9de1f3190c904089af7e0d1b6ee82ed2c5496ec463c6f661bba3e83da", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805133, "uuid": "f279bde9-a3f2-486e-b373-de9724b4e18d", "comment": "Malware payload (Mirai)", "value": "8b464b874b2465b8fe2d35702235d1a5dc3ab6d1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805133, "uuid": "de750fcb-5b0e-412d-be7f-b78e293de23b", "comment": "Malware payload (Mirai)", "value": "7fb1e101256d3bcfd565d9fda490b141b40c4b76562a43154e352aff34035e4267a4c5fea090f38773e1217d868b49bb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805133, "uuid": "7a1c844a-6e61-4d34-b7b8-d082ea2febf8", "value": "T109732BC8A582E5F5D80648766066EF71DEB7E27976B8ED8EC7E41633AC42302C10375E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805133, "uuid": "7aa5fcba-ef08-4267-a37e-3f2fbd133173", "value": "1536:JHhMBcm2+IT9QfM2UpNAfDRHl0vleA38KgeSW3/aEGITm3bO/z2:Jhwcv+IT9QfM2UjAvqkA38KgeSW3/172", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641805133, "uuid": "3f008983-cf5c-4580-8412-fa0a3d347df8", "value": 80176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641805133, "uuid": "25d7e017-cef6-4fff-a991-efee9e8bc466", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805133, "uuid": "c47d2650-4be3-4c14-876a-091ad507434e", "value": "jerusalem.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ea7e38-7228-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641827782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827782, "uuid": "9b4db26e-5a8a-4c22-837b-5d04ab2ec4cb", "comment": "Malware payload", "value": "dde5ccfb94dad6fed3edaec8018f6534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827782, "uuid": "e00a75c3-ec48-43fc-97aa-70fed805d23d", "comment": "Malware payload", "value": "442cbfac3dd887a59e6b815a5bab60d49f313294fa93335e8b301022ec2c30e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827782, "uuid": "0637f8cd-3674-43af-8b75-420b09d7b58a", "comment": "Malware payload", "value": "c3abe1e8509d60f5c42a91a4f04a9f6444ff2479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827782, "uuid": "0edd4e38-1653-49d6-9a38-8a067270ec8b", "comment": "Malware payload", "value": "de73832d7c094767f3cf8637ceea54fd4bf7d6df7591b996630f6b6e60a09e92a62c06b806baf21c315b59d07e2cfb9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827782, "uuid": "5ce8531d-8ed8-4932-b0ed-61cb0775b1ce", "value": "T14FA52342BDC654F2C6321D790179AA2566347D210F289FFB63E02A4EEA750D0F724BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827782, "uuid": "c09f391f-9a3e-4d21-801a-17cf9b9ac170", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827782, "uuid": "2a5a553f-4da8-4475-a985-8c2cfd2c0094", "value": "49152:784NLGO35gQrXU1ksnpETm6KV/cG8ocMPuDFM9:7DJlk1ksnpUm6O1cMWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827782, "uuid": "e641b8a7-5ffe-4d13-ac4c-114981750616", "value": 2225592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827782, "uuid": "6bc475b0-111a-4b48-8167-44fd60900d60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827782, "uuid": "eaef130b-9636-4389-85b0-22763b6f4e53", "value": "dde5ccfb94dad6fed3edaec8018f6534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa931fe-722c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641829679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641829679, "uuid": "c1bde28a-b2a9-401b-b503-593a344e2fe0", "comment": "Malware payload (Formbook)", "value": "97ccf6ebd6abe7786677f0e6e6b8aef0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641829679, "uuid": "67dbba65-2f7e-4f8d-9683-215163d0f2b0", "comment": "Malware payload (Formbook)", "value": "44ed69358c6ef98ffc0e4da5aee0692f74fd03b8a7ea7c5c3b08f427f32a45e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641829679, "uuid": "571cae07-1c19-4f5e-91ab-18a8eea61e6b", "comment": "Malware payload (Formbook)", "value": "be06f330c04450b80848d8c5ed680dd8fce61c21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641829679, "uuid": "f3c7f567-7146-43f1-a7a5-69b079b087a2", "comment": "Malware payload (Formbook)", "value": "68517e11d56aab5a0dae4bc68abca98697d46a3fce25e7b318c43a177cedea48547a6eceacffaad768accffa2d7ca388", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641829679, "uuid": "3707ab91-2fad-44dd-91d3-8b0bfc0bc9a8", "value": "T105156C8A16E5940BD12905B5D98AEBF00770EDB8BA52C3167DC0FDDF7E323E164122E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641829679, "uuid": "b12f7ce9-7e5b-4076-8fbe-8c4b5c34aabf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641829679, "uuid": "3e15bfeb-1bda-4987-accf-f0c1d58c87da", "value": "24576:AWvuytDTmitq1QOIFXvm4PAT95scVREMZ:1uytOitq1QtV9PAT95NhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641829679, "uuid": "5220e043-2e80-4f7d-8c9c-aafd1dcc6037", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641829679, "uuid": "02d2fa30-ca49-43c5-ab48-5590e4a89142", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641829679, "uuid": "e4c6b68b-a6ab-4082-a1e5-3c510a328a2e", "value": "97ccf6ebd6abe7786677f0e6e6b8aef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3852be1-71ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641810412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810412, "uuid": "08f960f4-8182-4e34-8078-fc85200c5ae8", "comment": "Malware payload (Mirai)", "value": "af8262a84aeed05414b8bf3da61a6291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810412, "uuid": "8fc39e62-e0f7-464a-a0bd-28f2775c77a6", "comment": "Malware payload (Mirai)", "value": "45df0e9f5b8290e9424706449dbf84d73751687a358a34356f3eaec298e108c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810412, "uuid": "b328a972-586b-4514-a59d-09bcbdb2b0f9", "comment": "Malware payload (Mirai)", "value": "058a0e20495633009881f63746a4d72594d6a9cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810412, "uuid": "ec4ee70f-fe24-4f90-b7aa-a3fe126171fb", "comment": "Malware payload (Mirai)", "value": "2f70012db439c8aa6c426e18c82ed935a8b0ee56555829481d30371484035f796c40701e131803a13b6931e91634c311", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810412, "uuid": "aeae6068-c912-4aa6-89b3-c782b0925124", "value": "T171D2E179F93A49BEE47283378C047DE719F2A111C9FDB27BA605C612612704A78637F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810412, "uuid": "d6de50d6-70fc-44c3-942e-6633aae8af1d", "value": "768:gtWHKBuJKXAztdGvFfMMEzd8yvAg5Fkmw2ESPknLlzAMjLoLy:SButpn9z2QkmnxP69AMjLoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641810412, "uuid": "b92b7fda-c5b5-4e02-ace7-e0b6fb92bb1d", "value": 28520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641810412, "uuid": "444d4ac9-d5f7-4a66-bbc4-eec777124558", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810412, "uuid": "c492e7ec-2f6a-47c1-8019-70ac56db5ddf", "value": "af8262a84aeed05414b8bf3da61a6291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f97b94-7214-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641819279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819279, "uuid": "ca78912b-509b-4f56-8a74-7f9030695145", "comment": "Malware payload (Mirai)", "value": "c2fa61e94507435fb7506a0569e80952", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819279, "uuid": "9f59fe80-7ab1-4292-b870-9442d9e49e5b", "comment": "Malware payload (Mirai)", "value": "45e31c499f275fccd29e72a56888316c1e6a6ac9dbd6284deaed38ed5dba46b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819279, "uuid": "dca63dfb-a2a8-4051-9f8f-b5820814b766", "comment": "Malware payload (Mirai)", "value": "ee9f5f62d85fcccdae557490b95491e6b933c9d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819279, "uuid": "e6a5b5c6-b300-463a-9d9e-ff81a2b1f8a1", "comment": "Malware payload (Mirai)", "value": "c0dc4b07c888e57e87bf074c0063ecbd70da5b93f4ba6fd452940b6c75e7095493e1aaf85dafc50c0a00a89d3b409f7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819279, "uuid": "4a8ea701-6191-4984-a4fd-fef5a5bb0864", "value": "T189C2D03803016BB9ED258436018F0F916E318B97B7325D05B795E563CA05A9D7CAF7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819279, "uuid": "6502860e-912c-4d38-972d-16505a29fedf", "value": "768:Lp8MQOtbqBy7YZMupejD6YY1b3WdVQ/kD+AJgGlzDpUYs2:+MQ+mI7YLejDFY1b3gVQ/m9VqYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641819279, "uuid": "fa531ddc-4aa3-458d-87e1-de665590fc36", "value": 28192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641819279, "uuid": "0747b892-a930-4539-9830-746355afb1e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819279, "uuid": "4768b5d4-b941-46b9-a216-fe1c4bb4654f", "value": "c2fa61e94507435fb7506a0569e80952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6930c3d9-726e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641857907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641857907, "uuid": "0514148f-555d-4eff-a37f-00ed28e4c1b4", "comment": "Malware payload", "value": "911dd6e4e76bd413bd62a3de696f6982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641857907, "uuid": "523ac7b7-0c0e-48da-a3c1-341417726c95", "comment": "Malware payload", "value": "4724b55ca938b0bbdc393ddfecec9ccad30b911490e9fc1922546596526cdb04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641857907, "uuid": "45bb5a5a-e590-44fc-a849-405cfd14d6f2", "comment": "Malware payload", "value": "ad9ad231d5a86565f5ab719dd4a0e3eab42cfc5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641857907, "uuid": "d0b3f1cc-0de7-4501-a6fe-acdbdb9e2af4", "comment": "Malware payload", "value": "e58befdbf0f2ecdc9c2c6c2f5af30c4efdb1bb33aa774356ac5867e7dd6d5002d371acdf4db05c4ee71865fbf176c41e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641857907, "uuid": "c907cc22-0e1d-4299-8c34-b73cca6cb019", "value": "T1FF45334433E958B1EED5CEB75B9C8224C1F4A442FAB360CE3598E1769C523D2D3E6CA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641857907, "uuid": "13117d93-433a-46e4-84af-b78e7901b2bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641857907, "uuid": "4fad7b70-fd6a-4e86-9c51-7adaf6307643", "value": "12288:IVYjbfhGFFoiD7ll2Zlzs7na6DNYxljepMte2R+YP2VH:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641857907, "uuid": "8ea48651-0fe6-45b4-a939-0d0e1b78df03", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641857907, "uuid": "24df9df1-f107-400f-b318-db47948c4829", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641857907, "uuid": "ea15964c-2af1-4660-b938-15b1764d4b87", "value": "IMG-022013758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db8f002-725a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641849271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849271, "uuid": "84c7e373-c74b-4500-84af-3b826eef3dce", "comment": "Malware payload", "value": "bedd97c5e2a37245285f9b93f0267b4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849271, "uuid": "a43b9553-b999-4bd8-bec0-942f50e887fe", "comment": "Malware payload", "value": "4b332a95a994b8a47e433316f8c24a8091dab197960af4c461a5ddbf44e68698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849271, "uuid": "a20e8a98-5421-41d5-a7b9-27c7c61792a5", "comment": "Malware payload", "value": "f05b58b0c05990264e1d98e3a8ad359aa1336d98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849271, "uuid": "13f59e4f-7312-4c15-8ae3-3ac9c316b1cc", "comment": "Malware payload", "value": "3400c2cc447bced695868d28ef8ee106540d447c05999a0946e88927e8c152301e8b9b0f2ff06242838e4242b0143c01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849271, "uuid": "6c3c228f-b1b9-4692-8e7c-25a21e50c329", "value": "T193363359A09E68E3FF06F17F6AFDC09EE7362617C7FA904343A013598BD9940468F492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849271, "uuid": "314de2fd-5882-4555-9352-b8c50dbf5704", "value": "b8ba55866bfe7b49b97c43084c1885db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849271, "uuid": "0c9605a8-b51c-45b4-a567-c3342b7541fb", "value": "98304:2SyaNdNWgrhfmLfKq6O1Fq+eZ0CUBfGbQZcyDeTBu4H:24Nzvr9mLfj6AM0CU5GbQZcVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641849271, "uuid": "a60e20c9-9205-4d3b-949c-5f19f2da78d6", "value": 5185536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641849271, "uuid": "19450d40-b996-431f-8965-c16b06961588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849271, "uuid": "3bf4f941-0d8e-4975-9707-1fd11001fb23", "value": "bedd97c5e2a37245285f9b93f0267b4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baff255d-722d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641830127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830127, "uuid": "25c08d56-1246-41b4-879a-499d4d0b039d", "comment": "Malware payload (RedLineStealer)", "value": "8d5156fdabb28dc8146237b8b8e34758", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830127, "uuid": "6f89e907-b549-4a02-995a-a79afb40a0f7", "comment": "Malware payload (RedLineStealer)", "value": "4b879bc589e17a5e6f70b1aa7b757435eaca9d96fd0e4123c92e5b072df2276e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830127, "uuid": "fde191f9-9181-40c9-9398-be1bc0d7355f", "comment": "Malware payload (RedLineStealer)", "value": "029e58f616c8a51c060458de32a302bb2bf59b57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830127, "uuid": "1b0741e0-2f24-4419-b8a2-ee0c8b4cfc8e", "comment": "Malware payload (RedLineStealer)", "value": "24a301b2145893de548aa09779c548034d98b1b105ccfff5217110d39d0e9e667933ccf7355655af19913698b998e5af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830127, "uuid": "746560a0-f47c-49eb-9413-16aeee65ac57", "value": "T132251BDD51C15849CFEF03F00DFBE62E857296C613474BEA732E81F06B6209EA56D4A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830127, "uuid": "7c83eb35-d7ea-44b7-972d-16c58868ba89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830127, "uuid": "5d630f2f-8f8f-4ab7-aabf-8cf88b210a44", "value": "12288:WwspTk05ZjoqRCJPUnyQbIkW79mQ3Cezr7aQq/O6j:PZStPCJPijtGmeznhaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641830127, "uuid": "722e12a9-f718-402f-ba2a-df432dac3d09", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641830127, "uuid": "0bb43fcb-7320-42c2-802e-e05f9886e801", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830127, "uuid": "927b1064-3167-4193-bfb0-b99f07b59a73", "value": "8d5156fdabb28dc8146237b8b8e34758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d383024-721b-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1641822105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822105, "uuid": "a141d2be-c6f3-4872-be07-6c30e44b5852", "comment": "Malware payload (DCRat)", "value": "7d13dd4bc9a9449af7e9713f0ecedc64", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822105, "uuid": "fe2eec01-a674-46da-adc2-4fd66b359e6b", "comment": "Malware payload (DCRat)", "value": "4bd98120ab1d719ca47ef39b4223c5e7da3a70207a7587168b0dbb6be20750e9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822105, "uuid": "fd3fbfd4-82c7-4442-9d55-c320b3dbeafc", "comment": "Malware payload (DCRat)", "value": "a66c7239a88ab397e793db289243d3940a4101c4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822105, "uuid": "2049597b-7bc3-4fad-afe3-5f64ed1ad321", "comment": "Malware payload (DCRat)", "value": "8b198de3defc8b64df5d1bb90caf9e1b8d7b55a626ee414368a9b67319d11a69cf38061ab0e5deaa1e0e1374f960b807", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822105, "uuid": "f34108f0-07dc-4ed8-8caf-8dd7def086b7", "value": "T12D7533B3F6312334DC8B50BA50B0BC57F76A1D0954B50A931B81AF8979FF6B29D48329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822105, "uuid": "1aea8506-a4c2-4c04-8b00-1f07d8ec6da8", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822105, "uuid": "58d489c8-dd33-4de1-95fd-d5a53881e3c1", "value": "49152:Tm8ifjTs6OacS5lA/NKVdP9NaQuUe7T8g:gfMaJlfzXpu//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641822105, "uuid": "0babecdc-ffac-4a9c-b7a4-ec0afa15366f", "value": 1615872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641822105, "uuid": "e6f7eedb-a8a3-419e-8b7f-18e5eada6bfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822105, "uuid": "10b21ade-2e1c-4bc1-8eaa-fb226d60e8b1", "value": "7d13dd4bc9a9449af7e9713f0ecedc64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124d44bf-71fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641809228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809228, "uuid": "74797cf0-0a77-4a2c-a555-41b3a58736af", "comment": "Malware payload (Mirai)", "value": "abf71be16d177def592b54f1bf51517f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809228, "uuid": "f513ebc3-4d13-4856-829d-f2d0f79a8569", "comment": "Malware payload (Mirai)", "value": "4cd3c158b6a06fbff223d0c4eaceef3f04b1799cedaf11d7fbfaad55aafd5ef4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809228, "uuid": "7c0e19e9-4125-47c8-a35b-f6c8e5cd7272", "comment": "Malware payload (Mirai)", "value": "c4fc0f17828d0f1801480ce9d25bb5fa8cb58fa9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809228, "uuid": "1cb4fdd6-3aeb-415b-b7c1-3d731606a4c2", "comment": "Malware payload (Mirai)", "value": "4121bb1a42b2d44a04f1bbb1d90abbb12a55851017a9a031cfe510f52771d85a6e69a4448284bd1312bf573d3800e461", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809228, "uuid": "ea53aa71-9e1a-4206-bb86-9bcd34002074", "value": "T125835A56BC929A2AC5D0137ABA6E56CD332173E4C3CF711BCC241B657ACA50F0E67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809228, "uuid": "6ce18ff4-1255-4fc3-b0d0-77301695a1d0", "value": "1536:5+R2zr5kXZIP1qbNtnWJEo2FXukysv3RBFTL3uRkEQJtBIja10:5+Rir5aZIP1qRtnWJR7KnFTLk9cPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641809228, "uuid": "b9416b53-61ee-4d08-a5fe-8473f6181e88", "value": 88772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641809228, "uuid": "61dcf16e-37f9-4378-998b-537c8f114312", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809228, "uuid": "47fe06a6-0b16-404c-9796-40cb99de2b2f", "value": "abf71be16d177def592b54f1bf51517f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788df276-7215-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1641819708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819708, "uuid": "d24bb366-15de-48dc-9fa3-6d09c92a81de", "comment": "Malware payload (Loki)", "value": "eb9601823180e93e7c162ff9ed197991", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819708, "uuid": "e04ae06a-33c0-4cf2-b18b-5f2df7c67fa9", "comment": "Malware payload (Loki)", "value": "4cdc0066a8c9c9af29fd83fc781198924e5b7fa7de206392b69440675979ae39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819708, "uuid": "a8136d0a-730c-4927-886b-bab879a38d34", "comment": "Malware payload (Loki)", "value": "272a84e6fc6089aef0cf1f23748d47903f717e47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819708, "uuid": "facef729-ca24-4baa-b438-29f1dc9dc37b", "comment": "Malware payload (Loki)", "value": "8fa0d3628c8dac0eb29704f660f5d79a5d3ab2987814375c4179aae8d49770829009afdde58a0ef4234aa13c339fdab6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819708, "uuid": "e5851c0d-8230-4a01-8022-5083b361aef8", "value": "T119548D10BBE0C439E5B711F85A7693ADB53E7EB15B2451CB13E42AEA16346E0EC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819708, "uuid": "bb6b8fe1-143a-4c70-95e6-3fad27d31f80", "value": "33ffa739444fb60570737a513136cebf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819708, "uuid": "a5fe343c-b349-4a5b-b01c-81fc0c842ff4", "value": "6144:khSieu4FFAS++k2DwuUtXnZX4NW3F8hG8Ofm4M:ESHkzuUtXnJ4W6haf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641819708, "uuid": "43841c13-18f1-497e-beac-6b330ece4edb", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641819708, "uuid": "815c686e-ef59-4d54-b1d5-6f2be783ae61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819708, "uuid": "6c4fd555-596a-41ea-be31-fe84cfe09748", "value": "eb9601823180e93e7c162ff9ed197991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2243c32-7203-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641812154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812154, "uuid": "877346f5-aee3-4740-bc89-9c9459b0a232", "comment": "Malware payload", "value": "5392723051c6250e1b3921710c0a6c0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812154, "uuid": "581bff4a-aee4-419a-b3b5-395da639fd99", "comment": "Malware payload", "value": "4d4d4395d496771dad11f658b94852b68f6974fe5cecdaf6dff49cffc69a976a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812154, "uuid": "8885ea6c-2177-4ed8-9880-3489d1293c41", "comment": "Malware payload", "value": "ca2ac3404f8c09b3fdfffd7b7de91e4b96d164c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812154, "uuid": "b31c14c3-803f-4ace-a8be-791e5835f274", "comment": "Malware payload", "value": "57e84ad63e0072056d65d7558983a50f05f29a8cccba5c0e3a4fff71ad370c5a356f8cff35f4a3064e578b5431958ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812154, "uuid": "fc5bab61-db64-4de7-ad8d-f7d56c702014", "value": "T19F621A05DAF40077FFB204F6877D0A9A98FDAC5407996CEB12C0B9DA1B748C2E53653A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812154, "uuid": "5cce4e76-f30b-4b6d-93d0-0abfc4f8d646", "value": "4adcdccdf5a743e8c4d401544f951bb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812154, "uuid": "d4320a1a-8627-4e8b-ae0e-d4a84f4b80b6", "value": "384:kZaleW+Dg8vO8/Eww8qxKZ3vHw4+Mlcj:kZaleW+DgIZQgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641812154, "uuid": "98040938-e303-4c58-9bff-fdb44db54a95", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641812154, "uuid": "8c744d74-85ff-46a8-b2a1-d5eda50b869e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812154, "uuid": "34f5252f-1b42-46ee-bd00-3baa0101eaa8", "value": "SecuriteInfo.com.Trojan.Siggen16.30156.4374.31302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236f1e79-71ef-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1641803244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803244, "uuid": "26a58919-9a14-4d90-b293-de4cb3e4bd29", "comment": "Malware payload (CoinMiner)", "value": "136860e019115c0eefd8cf669dd8963e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803244, "uuid": "efc868f6-b18e-499c-bafb-8da6a79de54d", "comment": "Malware payload (CoinMiner)", "value": "4da864854d368ab640245f8174d247e0b9947045712d2d7449e25e7074b8587c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803244, "uuid": "6dd7e0ba-67c1-4711-9827-328460528a58", "comment": "Malware payload (CoinMiner)", "value": "fa99887f95f5e0fe48e37c2d464eb56ef1619031", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803244, "uuid": "0d9a6a55-da5a-4018-9ce9-de5100686218", "comment": "Malware payload (CoinMiner)", "value": "20c2a3de5014533f1b3f0d8258d41c4c9f2f5aa87df186694b212b052b28c92bcb93ddef0bd65c56f8a393a5a9b8b4fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803244, "uuid": "4dd94439-cdcd-41b8-a39b-85914e55d432", "value": "T19C741251F6E582F3E6E1047201A2B16E9B36A3349720E5D7C78C3D41AB53AE293793DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803244, "uuid": "1091e23c-2e51-43d9-8b79-3f94dbf2385a", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803244, "uuid": "823c8e8b-ea19-465b-ab32-2dbb32a3e4ae", "value": "6144:b5aWbksiNTBtZrhUJctzVtAWL9wCt7ZWfTUYcDy7D9ghpsodi2V/llT2R:b5atNTXZlUMAWLRt0YYo+uC0bFT2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641803244, "uuid": "b3909ad1-7381-47af-b434-49a1d8f4e6a0", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641803244, "uuid": "3c41b28d-9da5-49b9-a09a-e872753b1a16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803244, "uuid": "18b6518a-fd6f-4693-8bc6-f2c3e4d87e9f", "value": "136860e019115c0eefd8cf669dd8963e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcca471-7247-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641841111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841111, "uuid": "ac1db301-8749-48f9-85d1-8d87f8ecf5e2", "comment": "Malware payload (Mirai)", "value": "81d8022569bc109d05dc33dc9f871b76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841111, "uuid": "efb38361-58cb-4760-b881-10494a24df60", "comment": "Malware payload (Mirai)", "value": "4df5a09facaaf72e74040f56ec3e6add20416e2ce73b35607d8f492e7116d9a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841111, "uuid": "5c521657-6464-47c3-a7f4-3e454e9bbc7f", "comment": "Malware payload (Mirai)", "value": "08aa917cf373c7990f21ee703545ae8169df7510", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841111, "uuid": "453ba87e-cf81-4823-a1d0-4b27aa6a9280", "comment": "Malware payload (Mirai)", "value": "51a35c85d5b60142864f594742c13b3e260c607e31324d428dc2b7cccce762eaa4afd119a5c1178e1f60d493a88c4313", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841111, "uuid": "e32695d7-7e5e-462f-a6cc-19d94ccc4def", "value": "T1C473C509BF651FF7ECABCD374AA9270224CC651A21A93B357A30C858F64B65F15E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841111, "uuid": "d3702616-c588-4189-9916-4e6e0fb65b3a", "value": "1536:3YKnzTwssqZAp3H2nVfCgHwPPqZwWrxXG:3YKnoeZAVH9PPqvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641841111, "uuid": "e5d15883-79b6-4ce6-9fc9-83522d4f9145", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641841111, "uuid": "ec43a78f-f8f3-41e6-a628-ddfc1d5e3af6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841111, "uuid": "6b97097b-211b-4925-accf-6048884a2409", "value": "81d8022569bc109d05dc33dc9f871b76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9472717f-723e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641837364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641837364, "uuid": "8ea8564f-6688-4ca4-884f-66d2f4a407b4", "comment": "Malware payload", "value": "529fb026f6b804fd24f0743275e826c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641837364, "uuid": "51c56888-c840-4645-85c6-f8a4a2ed7c6d", "comment": "Malware payload", "value": "4fc6b4e42650b9f85ebfe2d2fa8925956049f5e2e1e9c5a74d806cf759479113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641837364, "uuid": "18945a8c-7efc-4e8f-a85c-92baaa1d1a7f", "comment": "Malware payload", "value": "fccb85c0cbc44e5f846868bc4c1cc285dbe91916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641837364, "uuid": "c7830e14-305c-46d7-84cf-49840e088687", "comment": "Malware payload", "value": "2bc08bc3d7d815b4870e3e33aadc8db6bc100d3a757bedb7e4a9ebe7faeb331c3dbf907c3766a5fe149fa132ca28afe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641837364, "uuid": "12062fa5-8e3e-483d-969c-d8310126446c", "value": "T1CCD21C0ADA90C859D8F214FCD2B713DEAEBFBFB2274020E702E09196B6645D1B739517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641837364, "uuid": "8c3d838d-361d-400e-8f24-bb8fad6d4ddf", "value": "8d700780804547eb3df79efd3ff33b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641837364, "uuid": "7587c506-4609-4bd0-ba17-1001825e7877", "value": "768:kyBzxh2C3eOnY9lKOhWhJ96x4F3jsOkCscznnjubX:ks1ErhqJwR0znnje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641837364, "uuid": "ed6a0dd1-a9d4-4a1e-b853-948301a623ee", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641837364, "uuid": "5bbaa5f9-4901-48c4-921c-758b6d99c087", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641837364, "uuid": "4fb325bc-f646-4f62-bc02-73fe18eb0559", "value": "posgrabber.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544b0c3c-7247-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641841122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841122, "uuid": "d5d7dd11-21ce-4f4b-8957-2cdd1bfd58ac", "comment": "Malware payload (Mirai)", "value": "86d844034cd6462eae13f2a0511140c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841122, "uuid": "9e44d44b-8402-4afa-ab34-150b7e3b9886", "comment": "Malware payload (Mirai)", "value": "50281296157fd117ef1478ef6dbc1778780c78506ac2d71f4988676ac724475b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841122, "uuid": "b30c5886-7c59-4a0b-8921-bcd39151f899", "comment": "Malware payload (Mirai)", "value": "d54e7800703acafaba6faf17fa8ab8d85c15f304", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841122, "uuid": "07498e90-21ee-4836-9c66-270a5ecf9ee3", "comment": "Malware payload (Mirai)", "value": "523cf2f251406c4b0d31cf104d4989dbcaf016e8adc9645f444af3632f6f3fa7c6f0c481034bb73855c428b28c6a9fca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841122, "uuid": "9cab08cb-6c97-4f14-a9af-1b73c95a851a", "value": "T19A432BD6F8029D3CF94FE6BE9466090DF631335051930B2B67A7FD936D322A85E12D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841122, "uuid": "e5e0dbc1-d194-4e8d-b346-751fd108c621", "value": "768:8BaevHFmIwQSZA8NxfArAg21gWPvFlypuT8WhXUCC9qntWm6/1W91XX:8QMHFmNZA8HfA0/5yIT8WhHC9qkm6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641841122, "uuid": "5a23cd08-d0d3-4a07-922e-6fc9ae0c974d", "value": 57324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641841122, "uuid": "6dd3b045-c39c-4748-a71c-d2693aec3261", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841122, "uuid": "2af22091-1375-4c46-97d6-9d1b4820a3f1", "value": "86d844034cd6462eae13f2a0511140c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c737111a-7263-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641853341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641853341, "uuid": "7b88aaf1-3e87-44b1-9604-ea44ae9c777a", "comment": "Malware payload", "value": "9910ef4bfc84dc844d507b1404a844e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641853341, "uuid": "6c5a90c3-50de-4ff4-abee-6da330ae55d0", "comment": "Malware payload", "value": "513e10c9e085481effe52e8323e1c085499ffd14f842f0e738d8cc8cfc96f76c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641853341, "uuid": "f1b0d0bc-bf97-4e7e-92ed-1f7a4beebf98", "comment": "Malware payload", "value": "2989c2215d6fb85bdfc282d7fd7ef623c05049a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641853341, "uuid": "df154d02-bb94-49cd-8955-2b970d8c433d", "comment": "Malware payload", "value": "e1ca0961d25fd4e01ab3a84763a5623ff44c17fd522e1dec2f166dbba9142d7368c7896f475080e9dad904f8ce2203f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641853341, "uuid": "161f1e4b-3032-4a9d-994c-a12fa5f4acf2", "value": "T129F5338995236B82D79F127EF4C83E05ADCBF462EA6CFA02D131449B0E11C61D7D8DB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641853341, "uuid": "e9d3e488-b90f-4810-bfaf-bdae193955f1", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641853341, "uuid": "514e6c4c-77c7-48e5-bee5-c85c271ae653", "value": "98304:62AETWthQ2XoUXgV3ZH17x2RIrZqCwOyrBQQEjJD:mETWtBDXgV3h1djrZq5OyrBBmJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641853341, "uuid": "d54558a3-95e4-4ca7-9a25-217d8a9995fa", "value": 3540480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641853341, "uuid": "24514299-015b-47f6-a712-0816a8b96e9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641853341, "uuid": "bb93b9f4-3966-4a6a-b0eb-ebaaf28b3d79", "value": "NEW FORTNITE CHEAT V2.2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0099b54e-7226-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641826808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826808, "uuid": "ee1e4b4c-c17e-4764-8eec-a60f9d0dd28f", "comment": "Malware payload", "value": "072c26ec6fba7c39aa23d3730335b5af", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826808, "uuid": "128783f1-f0fa-4523-a09a-6d3a7a44c138", "comment": "Malware payload", "value": "525c83547037163d4c151cba65304f8eb4e6ccc7f7cba09069b3d8616782eafa", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826808, "uuid": "ed9cafbc-f68c-4aa2-bb31-898c1b8d0415", "comment": "Malware payload", "value": "2e545e986f9e861450c0ff9ff50b41215c9eb023", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826808, "uuid": "db0f2e48-1ce4-45bc-94ca-82ceecdcb90f", "comment": "Malware payload", "value": "f2604cec365707cd4c024390c2756f34e75ba9fda3829a2af78c73c5967d325dc467cfe8243cec8614faec871a3342f5", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826808, "uuid": "a90ca5e3-cb18-4117-bca1-69f43f0fcb7e", "value": "T14C06330C239EF4FDA49A496C3B27C9A0C9E452F5DC4225F3963815940C3F67D4BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826808, "uuid": "85ff96d3-0c0e-4adf-89b5-9292225f1ea5", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKZ:0XSxVJG2fLAqFOfT9sMYNM29Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641826808, "uuid": "8498735c-df1a-4958-8aa6-7042e29ffea0", "value": 3788800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641826808, "uuid": "5bd19b3e-c4e9-46b0-b051-c9ef23dd4d90", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826808, "uuid": "8f398ff4-9077-457f-b58a-1ecaca8f424a", "value": "525c83547037163d4c151cba65304f8eb4e6ccc7f7cba09069b3d8616782eafa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07c962a-721d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641823211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823211, "uuid": "f52ea5f2-fbc1-49f3-966c-c422f0ebd8c6", "comment": "Malware payload", "value": "f4676bcc453f08f37ef5806408deb042", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823211, "uuid": "49476036-cbc2-434d-94f3-b9770d4587d5", "comment": "Malware payload", "value": "530ef048f6697633f5d9c7beaabbc9765d89b82ee093cfd397ddda5e959e84c2", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823211, "uuid": "8d0337a1-1003-41d0-b8c5-320c5d387625", "comment": "Malware payload", "value": "bf93aaf80cb2362ac1981eb4e1dcdc85344e68e8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823211, "uuid": "ba4e317b-199c-4999-ad43-6b64bc837bea", "comment": "Malware payload", "value": "1727f2a668cf8a27c585d12d3ba5d85d9c1c7cd375587475fe33ecc472a33b499abcbd3b0a7f4bbf22cdbf97a85ec275", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823211, "uuid": "40ddf663-b7ab-44ee-8fdf-9682438ba8ee", "value": "T13806330C13AEF8FDE899492C3B6385A1C9E512F5D88225F2DA7814540C3F67D4BDEE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823211, "uuid": "24170aea-c31d-48d3-ab50-765dea775533", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKY:0XSxVJG2fLAqFOfT9sMYNM29Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641823211, "uuid": "dc847274-4095-4c8a-87ac-9658c80c8c23", "value": 3702784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641823211, "uuid": "578e43f3-3273-433b-b7a7-5fbba4bb7745", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823211, "uuid": "76a9156f-dc93-4230-866e-0f6e8193393e", "value": "530ef048f6697633f5d9c7beaabbc9765d89b82ee093cfd397ddda5e959e84c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6451e3b1-722e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641830411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830411, "uuid": "77a8385c-cc3b-41e2-ac5d-8994b2579836", "comment": "Malware payload", "value": "022e76e78330efbdac343654580d77db", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830411, "uuid": "78b16d96-0676-4de3-9945-c37ae73d8a25", "comment": "Malware payload", "value": "544c0729e89955d5aa41436628b48d81e98fb2371d06eda2743d9c629da7b82d", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830411, "uuid": "0d2f4ba7-d006-4f92-b641-d64c1e03ffea", "comment": "Malware payload", "value": "a1dc6f3042f4a515a297bbc2967a6f7c7621cbf2", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830411, "uuid": "5dd9cdc9-9833-45bb-8b71-45aeb256ca26", "comment": "Malware payload", "value": "78f3790ab6a6788ee40ea5e14cb2e55cbf8c8c9c78621178b5ae61fbac4e9abece25cb57ee1776b3e4065a91f09e4f25", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830411, "uuid": "88a47821-027e-495a-8160-6ac965326ca8", "value": "T1CF06330C239EF8FDB8990A2C3B2689B0C9E452F5DC4225F396381594093F57D5BDFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830411, "uuid": "3eafcc40-19a3-47eb-b893-0a18276b1a1a", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSl:0XSxVJG2fLAqFOfT9sMYNM29Sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641830411, "uuid": "ee807d2f-c8b0-4ed8-83a8-e59c38f91c87", "value": 3829760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641830411, "uuid": "d623cfe1-2230-4c61-b574-5b7c1ef6bf39", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830411, "uuid": "5418a937-1988-44d0-998f-ce8c9782791c", "value": "544c0729e89955d5aa41436628b48d81e98fb2371d06eda2743d9c629da7b82d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1875d552-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641797213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797213, "uuid": "95ad823e-3076-4cb2-91a9-c8b2368d93dc", "comment": "Malware payload (Mirai)", "value": "14145b986650dd7f4b19c950de6a93c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797213, "uuid": "c0e4dcdc-9768-45cc-a25a-7cd38b65f039", "comment": "Malware payload (Mirai)", "value": "546741b56cb6b178931cad5e18cc57c445e0ec472bb1835754f6ab08a2b72997", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797213, "uuid": "d0149833-e00a-4f83-8fd9-8ca7897fc8a7", "comment": "Malware payload (Mirai)", "value": "c474abf5d883dc4b72bb65bfd5732a79e8fed287", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797213, "uuid": "104ef7e0-480a-4674-b961-9e2f0b951610", "comment": "Malware payload (Mirai)", "value": "7135fb89a6a2dcbb0cca9cd9775d6170bfb06aef52a2ab4ad6f127980ba87a5abc656bd6d26870424847fac7faae1b1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797213, "uuid": "924b9901-a76f-44bf-b94f-ba5807934ec5", "value": "T1D3D2D036049005FEDC5B88FDCEB20F951EB15F60BC976D53460CEBD22A6A071BA43AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797213, "uuid": "c4d9f7ac-7016-4f81-94ee-b423dff832e1", "value": "768:Bwy2TWYKgbXk9kc7bM/uQcqlNdGmjfKMMqy3JgGlzDpbuR1Jy:Bwy2TXOVbMGQlNdJnMqWVJug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797213, "uuid": "72fd04f6-0d91-42c8-bf7f-6f01f07f386a", "value": 30800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797213, "uuid": "e96137d6-04ca-4468-b8fd-65d801c1c18f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797213, "uuid": "382b79d1-3f84-433f-ba0c-d455468b5df3", "value": "14145b986650dd7f4b19c950de6a93c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcdd7db-7246-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641840604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840604, "uuid": "0e7b8cd7-c118-4ac2-8ab9-0a9f8e52e94c", "comment": "Malware payload (Mirai)", "value": "64795df91e3ffa35a727a580e5e072b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840604, "uuid": "876c4678-0f94-45d2-9a72-0b2e3c3793be", "comment": "Malware payload (Mirai)", "value": "564b91fd1e149453d2e6587354c861e0444a38e3fcbe12c221c8bce9fb7813e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840604, "uuid": "6361293a-5e9d-4c3e-b401-32d86b2a679d", "comment": "Malware payload (Mirai)", "value": "e2c96802bf72e340ca004070847e5adebd9418de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840604, "uuid": "fedc7656-6796-4379-9158-64667ad1914e", "comment": "Malware payload (Mirai)", "value": "790ffc8a4d63b1c01942c242cad4c699403b5c9ed5a115171d6d8ebbddd2c74e98846888a4525021be7a7d53ada56aa8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840604, "uuid": "084ed8a5-aae6-4573-8da5-869101891ac8", "value": "T112D34C46EA808E13C4D5177ABAEF42493322E754D3DB730699186FB43F86B6F0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840604, "uuid": "ee9df86a-bfba-4e11-b0cb-721261211c81", "value": "3072:LB92gvRAhsRpJdvaSF290t4mOk/04UFwvrKf3l2M/971mgn+:V92g5AhsRpLSxk4mOk/BULf3kM/9pmi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641840604, "uuid": "ec921309-f6ad-4685-a6fa-24973f2892d2", "value": 132659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641840604, "uuid": "04359554-4ce8-43b9-8d7c-43c537e17571", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840604, "uuid": "0ec82a2c-4cc9-451c-af25-4dbd4592c558", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb98c66-71e2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641797811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797811, "uuid": "8336c9d5-ca28-49d1-8ede-f08e848dcb9a", "comment": "Malware payload (Mirai)", "value": "288bf9fcba0f17cc8be7033d9e37bbb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797811, "uuid": "071bb1d5-bfbb-4295-afe8-fa55c5470205", "comment": "Malware payload (Mirai)", "value": "566cc331d0b99610193ee357c1fe73181fb2700c5ee4922c6e93105a8200ada0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797811, "uuid": "12590bda-a56c-47eb-82f9-9a65575dd8f8", "comment": "Malware payload (Mirai)", "value": "a0c8f7079c023d23ab3a5c428bebfc74622bc118", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797811, "uuid": "24bf5035-5cb6-4164-9a2a-df5e35d606b9", "comment": "Malware payload (Mirai)", "value": "1cf7fc7fc1db1168e1649be0550c836a63964627042234d70dfab6dd39f398b48520095250520086a6728c8d3413eb22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797811, "uuid": "c1058549-8764-4e7e-aace-e627d02da1f5", "value": "T163A34A322B391A27C0E5A53940F7C736B3F65B452A71910B7E641E9C6F1ABE031933B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797811, "uuid": "1ffca6a8-b817-4efc-87ed-960785b8c1ad", "value": "1536:uUPZ0oqZkGiZGS2rmg7G18rFW+JSEUsCqgot7PCZrkqkzzEDw9FAKxmtJX:5mxrX7a5+Aqg+GZuzYdKxCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797811, "uuid": "4938f180-71f3-452f-b6d9-3e3a78d0d704", "value": 103628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797811, "uuid": "7ef1856e-a1cb-40a0-af6a-188f62197bf0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797811, "uuid": "6931eeb0-7767-44b4-97ca-fca9876cfdae", "value": "288bf9fcba0f17cc8be7033d9e37bbb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8ecd5f-720f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641817002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641817002, "uuid": "7a3da61c-b3c5-40db-b855-5ccf0dfa598f", "comment": "Malware payload (Formbook)", "value": "6046b2f34b67e06c817f4375c6d26a54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641817002, "uuid": "7e89323d-b647-4bd5-b07d-1a3949cb9cf6", "comment": "Malware payload (Formbook)", "value": "56d2b2837e2856b61ad276a3b52151851a79e366c22c03652caf2ad2b50623db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641817002, "uuid": "8ebc0113-4eab-4cc7-8d45-3972ded3ae64", "comment": "Malware payload (Formbook)", "value": "2230944a4216a07fde067866af7e81e1a52e8535", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641817002, "uuid": "e607021d-1b91-4981-a1b7-4ba067f8f3a6", "comment": "Malware payload (Formbook)", "value": "8f4ed2c4ae858ba717062d9f5d19688cc70e405a02039ef11a0f239c911d9c7b6d535c22d96d3ccc073631f68a839479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641817002, "uuid": "4c04191e-1e44-4010-b5c2-557e48d81657", "value": "T13084230A5099543BE5D37A3608BFE7AEE6FAC3A21D090857CFD02F8257772425B994C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641817002, "uuid": "ab28e519-1430-4c74-a1e4-a7cafe41bc2e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641817002, "uuid": "6e11060f-5727-4166-a7a7-270883d7b67f", "value": "6144:yybLOIDTA+ZoCRGELNxy9vMKTlFhJXRqSbiOjorqCjTStWAYtpqEvpq7tWODV:PbL/DTJZogq9EKTX7XYSbjorqrtG857p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641817002, "uuid": "c5e79567-0c13-45ee-a276-f53b98da003d", "value": 382826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641817002, "uuid": "ad1cc7c9-1455-48eb-a50f-d3893794aece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641817002, "uuid": "6e3b03b5-8f08-4937-bfd0-f58f0a888f13", "value": "DEC SOA_09012022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d7cff9d-7269-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641855740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641855740, "uuid": "68674ce8-7120-4bb3-8b63-374a55416e6e", "comment": "Malware payload", "value": "9b2c29759763112389493e287276cfdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641855740, "uuid": "5a80fdec-69b7-4247-a626-99857736661a", "comment": "Malware payload", "value": "57862b957494cfc6f181abfe86ffeae9e89f3f5ea85fee8e5224423bc6023ae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641855740, "uuid": "14f79687-11b9-42c3-9180-239391aa6f3c", "comment": "Malware payload", "value": "fc96ce5754e6212e256ce78c02fe222e08993931", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641855740, "uuid": "87aef761-9d07-42b5-a4de-4ca7c3857741", "comment": "Malware payload", "value": "3d27a25fe075df5c70d8f0c250724adf2e6babe0224bbf5072e18657fe2decb3bb58d35949adbfd666f933fef8d01c05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641855740, "uuid": "5983f4af-4886-490e-9db0-2193c75349e1", "value": "T1225633F08AF6B9A5D10831F134A1F47D17D79E5AEC309826C74BFB0924926C241F6E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641855740, "uuid": "a1a1cc32-51e6-4993-8d57-c13f070442dd", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641855740, "uuid": "fb299970-9058-4fe9-bd79-8d74cfa3cbe7", "value": "98304:T5V7+/fCZM99g3M9amB0tpDbKDkQVKNHTg5q0ttvzEA4Lb268bRzzv4DBh/BjezW:T5E/fCZa9Z9ammpbKDkQVDtdzsfp8onn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641855740, "uuid": "6367b2f9-e865-4132-8917-0fb7fcbff99c", "value": 6054643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641855740, "uuid": "191390ef-ac31-4502-8b45-aaee96ea1ff3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641855740, "uuid": "3b048f67-febe-4661-8d06-f482ef8591ce", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4de868-7224-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1641826341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826341, "uuid": "1081f482-b949-45c0-ae67-bf53a471728a", "comment": "Malware payload (CoinMiner)", "value": "a4b9ea388b68ccccdc4d7f8a403ecee3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826341, "uuid": "b6d38ee5-4c68-42ea-a2b1-90a05e135e12", "comment": "Malware payload (CoinMiner)", "value": "57d14382f6de16b585d9983b959c15a293ff8aecb8f42cf9075652767a627246", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826341, "uuid": "91a5e02c-69a8-43eb-8c4f-97ac140148d7", "comment": "Malware payload (CoinMiner)", "value": "99694ba0cbedb52fed4f40be3d41b0d87215551e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826341, "uuid": "eaac88e3-f131-4888-972d-7ef6568f2973", "comment": "Malware payload (CoinMiner)", "value": "8c74a24160203a56a1dad29ff746fafff035f6e9bdfceadc163263a86a99811aed52ca4b6c1f18921ad5922f1ccc074e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826341, "uuid": "7ded51ef-01f0-4897-aa75-ba287823110b", "value": "T1F6E5330B7FCB3FFAC692C0B7A6659131470326055EF664D8935A43AC35C32261F896EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826341, "uuid": "3412e4d9-68ee-4f23-b838-4d535382d35e", "value": "45c3eee06bcd5ef7518bc946e1677c4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826341, "uuid": "5d4157a0-1269-41e1-8809-a19a3dfa11db", "value": "98304:vLxRFJWh35eOjU2YCPoLwVyrsWCwnQ0o4DTeoYS+0wdw:vHFSo2YCPzHeQ0lDHYtdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641826341, "uuid": "577ce747-fd4b-4c35-a579-b56a4c927754", "value": 3256832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641826341, "uuid": "5c8c0e55-73e6-4791-b391-b4914751ea93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826341, "uuid": "f2741fd8-b8f5-4509-911a-d35377f2d0c0", "value": "SecuriteInfo.com.Trojan.DownLoader44.29141.32641.10659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b9740b-7213-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1641818762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818762, "uuid": "fbf740fe-ece6-4bdf-9634-c308b37373b8", "comment": "Malware payload (CoinMiner)", "value": "6e36f2949030dc1dfc452656c453bce9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818762, "uuid": "e54c7f04-c81e-4f11-b3c8-3db79b50d268", "comment": "Malware payload (CoinMiner)", "value": "58eb4a506ed5299ddde9ed4a720796849b1de79fe939cd75feff353557d03b03", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818762, "uuid": "29457ce8-d2b1-4102-91ed-8f50abb8d128", "comment": "Malware payload (CoinMiner)", "value": "2889981168c1b3537cd00c98d49b2b7fc48f8075", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818762, "uuid": "b7f18bf2-628e-4e62-9826-f2362c328b85", "comment": "Malware payload (CoinMiner)", "value": "67ece6881361bfaa2b4ea1577f9b38e3ef29b21fce1c88528f1db32dafa2d82f13fd140b220d4f5ad5f7b90de41249f6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818762, "uuid": "287f0391-0f96-4103-a631-880687633db6", "value": "T137B5234037F82316F57B9B30E9B213622A32FD206E35EA0E54C676BA94756032D1B777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818762, "uuid": "147c629d-9087-4b2c-a167-fe7bea663935", "value": "6c3ffa6e177b891d1e38eaf4e34bc9b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818762, "uuid": "8d757587-2c15-47ef-89fc-45ec89191f29", "value": "49152:YaSKx1fdD3cQ2bsl8MsIaL+tBvrLFqvqlFHbrZjRcgp4+yRhZi:YaSKx1VD34sPsitJrRqmFH7ca/yvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641818762, "uuid": "3b4bb56a-f3a8-49e2-a660-83ece405bc0f", "value": 2416280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641818762, "uuid": "857536fa-d38b-4aa0-9976-b53308f55745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818762, "uuid": "b697c45e-a3b9-49db-a79b-44b585a64a67", "value": "6e36f2949030dc1dfc452656c453bce9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea665a8-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641806001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806001, "uuid": "3d1d3f89-30c8-4e97-9c38-56cff1f1fb1e", "comment": "Malware payload (Formbook)", "value": "7b78a1970378f1df159763698324f363", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806001, "uuid": "563066c1-cb90-41ed-8b2a-b32a558710bd", "comment": "Malware payload (Formbook)", "value": "59318860e75372174a61cd094d0ea8789da87217190c48f23c6d9447dc99c709", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806001, "uuid": "03b73dde-c877-4553-a655-5f1ec44e0ce8", "comment": "Malware payload (Formbook)", "value": "7c14c6fc31d2986f450345f6be356e49c4516901", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806001, "uuid": "f875b53a-6a48-4b5e-9789-9ab780aee4e1", "comment": "Malware payload (Formbook)", "value": "22001c1febe26044156a54120fd07d6c70a706342d396a54a88a339969b2f988ed6a2d494e2b1f2037f3820e4fefe677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806001, "uuid": "614d977e-f03a-41ad-a5b0-225473d2c978", "value": "T13EC4E181328904F1DC7AD7339726E153CE1E6FE46BF0941E22C23B9A7376589C6CB256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806001, "uuid": "f93b1ff0-5ff6-4873-8c0d-49495c6fca4f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806001, "uuid": "3eff4c19-03e9-4a25-aeb1-9bdc79a843f3", "value": "12288:CbLLxPgUrXaJt/P5/5V45mD358AQMFJhG+yQ9AglD:Cd5aJt/RhVtD3DQMHhf3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641806001, "uuid": "0c0ebb8a-2be3-4262-a9b5-02bece0d047a", "value": 580574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641806001, "uuid": "7bc20ac3-b374-4a4c-98ed-ec8b850d3b48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806001, "uuid": "332e08ec-59be-4c97-90a5-133d58b722dc", "value": "PO - TAD8820-SDS33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0a55e1-71e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641801004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801004, "uuid": "6413d3d4-7c64-4712-8c15-2e2032026ff2", "comment": "Malware payload (Mirai)", "value": "503cef73b59a9646846dc262bd78be1d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801004, "uuid": "58dcb3a9-0f5d-4811-90f1-f323a1ac26c2", "comment": "Malware payload (Mirai)", "value": "5934c777199c120858381cf6f55fbca8a1e7abd08e8df8b8465df6ad512e44d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801004, "uuid": "073884a6-bf80-46cb-bf10-53c37798f939", "comment": "Malware payload (Mirai)", "value": "8df2600a0404222076bd5569454d9a46848bf5ee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801004, "uuid": "97cbc7e7-953a-48e4-ae96-4ab91552dca9", "comment": "Malware payload (Mirai)", "value": "9fe7298a872c13f6d10eb0fb008736ac93167d01b0e7680d5882354728342f48f99f75fb4981b2f9dedb524546c9fca3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801004, "uuid": "7400c7a4-7473-4a8c-8b2e-cabc92989146", "value": "T15D5329C8A593F8F5DC140978307ABB66AEB3F13F7035E99BC3D82927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801004, "uuid": "045a2910-b665-4d31-a95e-9d778e83ddcf", "value": "1536:IIG9170vwHbQXZ5+qXDEuXU9aBSW7V/DjObeFt6PuQ4Zy:I917iwHbQXZ5+qXAT9eSWZ/XObeb6GZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801004, "uuid": "1df2e400-b3b3-45c7-9031-3133730e1b32", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801004, "uuid": "1e526658-79fa-438d-84f7-6a9a8ab0656a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801004, "uuid": "73a764f6-7bb6-4200-8b87-1535eb677912", "value": "loligang.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02db440e-7226-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641826812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826812, "uuid": "af433518-e439-4888-8740-1847aa8f3997", "comment": "Malware payload", "value": "809e6bac28f1daf270362cfac41106be", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826812, "uuid": "6b16c0d8-64f6-42d4-8823-c439975de725", "comment": "Malware payload", "value": "5ab076edce7d26f77d54b3b2728bb8f456fe1ecdedccdf1301aa508a3960d540", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826812, "uuid": "b396afda-9956-401c-9ad9-4fb7763205b9", "comment": "Malware payload", "value": "2db97b8bc1684d288e6143d2f3006e537effedde", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826812, "uuid": "61cff663-bf19-466f-9f77-599c62953fef", "comment": "Malware payload", "value": "75135a450c9c45bcc1393e55732042612606caf7ac9f4a4093a58860b691cc06ad8749f919b61a955f2c17c18adb4031", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826812, "uuid": "43b7d0f6-de94-4813-b346-4b90b15f4a8f", "value": "T14606330C23AEF8FDF859453C3B2689A0C9E412F5D88225F3963815940C3F67D5BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826812, "uuid": "270c715b-e192-4096-a62f-c15a77789985", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKQ:0XSxVJG2fLAqFOfT9sMYNM29Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641826812, "uuid": "666be813-6211-4989-a3fe-a3ed802a1648", "value": 3751936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641826812, "uuid": "de51f62b-d17c-4a57-98d1-a6af55c8d41e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826812, "uuid": "0bb29299-0f76-4c20-becb-b0481e27b625", "value": "5ab076edce7d26f77d54b3b2728bb8f456fe1ecdedccdf1301aa508a3960d540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9ed9d7-7226-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641827204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827204, "uuid": "a997780e-fc58-4d50-bd66-25ec6498c775", "comment": "Malware payload (AgentTesla)", "value": "38522b7590b030796c17c6d44e07f9ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827204, "uuid": "5e5bb78d-f66e-453f-8a32-80e60045f6a3", "comment": "Malware payload (AgentTesla)", "value": "5b2fdd9685a4d59ad54ad4b72afcf6b605108d946bb18cfef8a88c69246d36a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827204, "uuid": "00bfd260-26db-4728-bdce-705184bcd278", "comment": "Malware payload (AgentTesla)", "value": "dc4cda6103ace23d3d9e75816be648bd29f2f339", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827204, "uuid": "234c11ed-2ae4-49e1-a588-a5822344ac0d", "comment": "Malware payload (AgentTesla)", "value": "6aaa68f2b6b9684c4cfee57c52e8d2ad531e9ca9dd8e7653d5f81b83275b19fed69c851a90e45fbe2cf78285cd494e6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827204, "uuid": "5177cdfd-d769-47c2-b571-c04ee1c83339", "value": "T1C7541221BFA82F43D457463A80543AB70BE5DC88254E1C4D2ED27AACB031615DDBE7EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827204, "uuid": "dd5fb5a8-16c6-4236-9c1a-290bbe04e080", "value": "6144:DmKNkfYO5PSeZCgkN5qKe9K0dMXrl0oHdWx+Zf5o83lqx6:DYgOz2uJK+s0oHoxmRo8Vq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827204, "uuid": "4ed0397d-69d6-4ef9-9d17-200a5d7da671", "value": 303976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827204, "uuid": "2d9a9484-0077-4175-a2f5-35d07adb07f2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827204, "uuid": "d70a6d61-e2b2-4b54-8b00-3a6e76563685", "value": "POR22-013018.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eac241a-7212-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641818269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818269, "uuid": "ca42ed11-fb30-41b5-88b7-688a2ded3003", "comment": "Malware payload (RedLineStealer)", "value": "e8ff0c71d5824846836541dab93f9275", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818269, "uuid": "faaab0e7-8275-414a-bcdf-66669909cfd7", "comment": "Malware payload (RedLineStealer)", "value": "5bba34d947a4f9c559601f4fee0c1538804eab1b4b4cdf49d26a93eefb68702c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818269, "uuid": "1ce9580f-a78e-426d-b18d-fe9753259d63", "comment": "Malware payload (RedLineStealer)", "value": "21a4d5beae522e30e548194e98c0fd80d27710dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818269, "uuid": "b01827c4-e375-456a-8858-428b8637754a", "comment": "Malware payload (RedLineStealer)", "value": "8697862bb753244e6ec35f85c19947a0f652799ec7617b4cca0d4cf229835bfc2d3b003af7a1fd89ce812d16387fd8c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818269, "uuid": "01f3f7fd-e49a-4c5a-8731-cac5fd50727c", "value": "T193352DCD51C15849CFEF03F00DFBE62E857296CA13475BEA731E95F0AB2208EA56D4A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818269, "uuid": "823d043e-c144-430b-8d17-3cd6873447c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818269, "uuid": "5d91a4dc-e3a9-4b72-b6e2-96493aa1f87c", "value": "12288:T7G+sphYzDQqIYkKjasVIImleT2/GIxRunSvb6hJ0:2jpgIYbaysGy2hJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641818269, "uuid": "997f1944-841f-42f5-bd08-8a13732c69b2", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641818269, "uuid": "dcbf0cd1-e073-4856-b6d7-3b1eed54387c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818269, "uuid": "daa91b12-7843-4bbf-8b86-454f1372df64", "value": "e8ff0c71d5824846836541dab93f9275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3b0e49-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641797219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797219, "uuid": "cd437c29-0b72-42d4-bf4f-73adf203583b", "comment": "Malware payload (Mirai)", "value": "b2492ec9de9fc37b03b3ce28d51ad32e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797219, "uuid": "930e499e-fe6f-4d0e-bd0a-408838c6d208", "comment": "Malware payload (Mirai)", "value": "5d433f0e742825247138697c94a634f228f603bc8af7fecd2ff13a37723c77cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797219, "uuid": "547816ef-b811-4e8c-9f2b-dc40b07755b2", "comment": "Malware payload (Mirai)", "value": "38548a9d59821f87c0f1aae6fa7cb3ae84a3d147", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797219, "uuid": "30a9ab32-d967-4dce-8642-a51607cb42ce", "comment": "Malware payload (Mirai)", "value": "f2b3c0365b15d7cc9147177ee75e39d71b83d965cc6dde735d99b1af104ca62bf6fac31fe88e137fd2856ec17c72ae86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797219, "uuid": "fac6cdb9-3f40-4281-9aa6-837c24a9a77c", "value": "T1D4A2D0D2BBE5EC7BDCBBB232A9B9FD5708C85AB4A96C5E631169480723034045A24DD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797219, "uuid": "4f152fa6-65fa-424d-a9dc-c7a65655f298", "value": "384:MAljs7s5xVwq4k46QV+7TJuagiSAVn2I7m+/apByz0156x4mmYr2Nyq:xxVHG6Q47rkAVn2Om1QfmYLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797219, "uuid": "9112151e-26b9-4134-8ac5-8d5464061e97", "value": 22672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797219, "uuid": "5ca4efef-ab69-481c-9eb8-aee23ae1acaa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797219, "uuid": "459c8463-5356-47b2-901c-439d90b672a6", "value": "b2492ec9de9fc37b03b3ce28d51ad32e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8105aa56-724e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641844203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641844203, "uuid": "a2aaf361-db03-44d0-bf8c-89784bf02e42", "comment": "Malware payload (Mirai)", "value": "90d56bbeb86b53394481ebcfb3128abd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641844203, "uuid": "e727cef6-5f69-4e25-8e50-771991c078a5", "comment": "Malware payload (Mirai)", "value": "5e4aab10bffda69e586a95db44d5974c7425676d45ac3706555f2651022b50db", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641844203, "uuid": "482b32f5-0e4a-48ab-a439-80ca375e91a9", "comment": "Malware payload (Mirai)", "value": "cb49f19298697d0377693a1fd06ba07545c0f51c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641844203, "uuid": "7da44878-116c-437a-9056-a4c9634ba06f", "comment": "Malware payload (Mirai)", "value": "efd54f8f36700d4ec1bc1d74307d1b938c3b1ee5197961db2f6a896088544ec187ce677a9487f18d0f042cee2d53bebf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641844203, "uuid": "1d4ef688-e91c-4f7d-a067-046c235c41fd", "value": "T1EFF2E04E8CD45EDDDFEF0E3A46292181AE06A6D4A21D569F1342DD80C3BB86FD09C134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641844203, "uuid": "9d25c428-330d-4050-905c-edf5973af4f4", "value": "768:jHEghcdW9zLOm4N7RW9ileKm3tQEZWTNH6:jHnhjZp5ileKmdDMNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641844203, "uuid": "67911fd9-0357-47a9-89e3-c6918dbdf010", "value": 34256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641844203, "uuid": "32eddd74-2f98-4ddf-abaf-146cacfb029a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641844203, "uuid": "888f5d55-32e7-4d43-9a24-864a289daa54", "value": "gmpsl-20220110-1950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865a7232-7226-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1641827033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827033, "uuid": "7e448b99-f618-45bc-82b5-f1f9a9c810c9", "comment": "Malware payload (SnakeKeylogger)", "value": "2962d793c473764878c307178dc3c3ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827033, "uuid": "153c68cf-3b48-4875-ab51-fbfcd7020c80", "comment": "Malware payload (SnakeKeylogger)", "value": "5f35bf963ee8d88066521747a37fa0449536d65d9ff767e37dcd4b5fe5241b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827033, "uuid": "500d071c-8c85-4fee-b9f7-a0a9784f9961", "comment": "Malware payload (SnakeKeylogger)", "value": "eeafb84be3f64a2c21ffeced1e6968933e39c170", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827033, "uuid": "c3094e69-5528-496d-8c9c-53227b408caa", "comment": "Malware payload (SnakeKeylogger)", "value": "f61e2f974743cb753bf7155cdde6c50ad71c24e5dfc6f5cce7724824550990f28dfacb919baa8c163a68b7ab62df5811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827033, "uuid": "75416b01-bb28-47cb-bd24-92e32c9ffaeb", "value": "T138160D02663CE8D3F98C6D7258CD8B2D2EE02C1D4536145EFA97B6E9D53F043E9212E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827033, "uuid": "bf6513ab-d304-4dce-9486-bb827a1b4938", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827033, "uuid": "450d9b72-7c1d-4703-a08f-4c4b3a26762b", "value": "24576:RkoCU9uiQFQqlBxb7mYge5QokAJYAxvD:RkrquiQFlvge5QokAJYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827033, "uuid": "3ea590b3-0d48-4dc6-88bc-42daeeb95984", "value": 4300800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827033, "uuid": "6ab24768-5ee1-4e13-8a0b-500a743caf97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827033, "uuid": "f26a2a6f-34d1-4afd-a47b-abf0ddbb21bb", "value": "File-04070111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa4a2ab-7226-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641827201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827201, "uuid": "5ffd120c-ee64-427e-a15f-b3f5faf44dab", "comment": "Malware payload (Formbook)", "value": "a3d4cdc8a20ab70adb1e9cb60a4b5a17", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827201, "uuid": "8a1a79c8-596a-4ba0-98e4-d5d0863f5478", "comment": "Malware payload (Formbook)", "value": "5f68d743559b59681d1bc2b6bac40f5cc4e3155a2c77f11cbbde4337729fbe02", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827201, "uuid": "5f29d4cc-0916-4e0b-aa74-3882b8f7e6f0", "comment": "Malware payload (Formbook)", "value": "b216487eafb1f1e8017a1a4992484a720c6852be", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827201, "uuid": "3e7b7f67-adbf-4983-90ab-2c07cc92ca4c", "comment": "Malware payload (Formbook)", "value": "c280b783ace3270cc158ba74cc700bc38c6fb9093d61a543d61ca9f73c7cbea4652ac455573368b4755390ef0b62dfd0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827201, "uuid": "4a4b6d07-9b81-410a-80e0-93bba0af168b", "value": "T1036412097B8D07F3D5939AF00759CA48BB7BECC09E5AA11BD563B58A17309E0F1C463A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827201, "uuid": "3ce7cfd0-ac70-467d-8700-8c234a8f20b2", "value": "6144:fZVHUy36lHfyRamSx9rZXES0qOOi7lTg6f2Zukjze6k7ZlI7bTIo7:xxU86VfyMdx9dXEIOllTg6fsuk/Iq3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827201, "uuid": "c896d5bf-8b7e-4d46-af69-ba104baa8ffa", "value": 317688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827201, "uuid": "16335b35-0304-484c-aaa5-9cff90912cae", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827201, "uuid": "20865d06-8945-46c7-8348-5515693a2e82", "value": "MTC_Bank-swift-009883945 (1).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a141fd-722e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641830415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830415, "uuid": "8a6e9491-5edf-4390-baa2-e56214a3c3a5", "comment": "Malware payload", "value": "44ae86745588e3a599b3691bbc760cb2", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830415, "uuid": "c88a7441-97ce-4dbc-8a07-f778a4e7d563", "comment": "Malware payload", "value": "5fd40131a6647fd1e6277877f96a164f38609f06df69c13ee5ace879000ba080", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830415, "uuid": "6796ca80-e7e2-4163-b8ec-32df6e36a6a8", "comment": "Malware payload", "value": "902fcc8a9a1998e2758ab5811b258cb4d0c4b31d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830415, "uuid": "8f8a22f6-7ab7-479f-be7a-be45f46d1bf2", "comment": "Malware payload", "value": "c0c7165e4f2c0adc323e16c005101d896a4aafa853932915f10fb44220095246d2d490d0f213aa13f1dc48a9b9f61da4", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830415, "uuid": "0f76022b-0344-4199-81d5-631bbe3dc0cf", "value": "T15706330C23AEF8FDE499492C3B6385A1C5E412F5D88225F2D7781458083F67E5BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830415, "uuid": "30f562f7-2969-4ff7-ba8e-fda6acfd5b62", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qX:0XSxVJG2fLAqFOfT9sMYNM2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641830415, "uuid": "a2b7a844-12fd-4518-8473-0fdb1b925866", "value": 3678208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641830415, "uuid": "f85b711e-8c61-4474-b415-bead52871ba9", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830415, "uuid": "3a3d3e1f-1fa6-4312-9b12-701704276950", "value": "5fd40131a6647fd1e6277877f96a164f38609f06df69c13ee5ace879000ba080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df8288f-71f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641806268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806268, "uuid": "4af1ef4f-a60b-4d69-9c15-71da9485f22c", "comment": "Malware payload (Mirai)", "value": "3ab5ae5d137a33d59df3aa7344209006", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806268, "uuid": "46aba478-5fb9-4b9d-b1f9-4c54eb625309", "comment": "Malware payload (Mirai)", "value": "5ff58c313219d6056adde7c72ab37731ce68aff2dbaf80990cc0b69b7cddcb78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806268, "uuid": "d8d001a9-b805-477b-8040-fa938c261c7b", "comment": "Malware payload (Mirai)", "value": "d1d353de36da9eb0d3442e646fbb2127a943639e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806268, "uuid": "227c1e77-57d5-4b0d-8a30-93696b69b6fb", "comment": "Malware payload (Mirai)", "value": "1e23ad765bc0dcacbee6cc771ca7696b89e838feee92f67b3935b73036233127e1f99ddc9ace455b4193d7f717ac3321", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806268, "uuid": "71d1c442-b811-4798-aec4-2677fd1a78b4", "value": "T18EA3F742F8919A10C2D502B7FE5F014E331697ACE2EFB3A29C355B2076CE85F0E67956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806268, "uuid": "37a6a1e4-ba80-491e-bbe5-36d900ba2d0f", "value": "3072:OEq4UeDMrRN9yRSv4d+TfJvWa8dCAnhbOhL+5RQw2V/b:OEq4UeDMrRN9yRSv4d+TfJvH8dCAnhSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641806268, "uuid": "450af649-0b07-49a3-9c9e-21c952597d6c", "value": 99628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641806268, "uuid": "b0b6a912-2e92-4650-89b2-de589deb56e4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806268, "uuid": "14721f49-d304-4b5e-b5d5-9d9d38a689ca", "value": "3ab5ae5d137a33d59df3aa7344209006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86a0db8-71ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641810420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810420, "uuid": "b06994d6-3972-453f-8e56-f0c6ae454992", "comment": "Malware payload (Mirai)", "value": "e59ca645d1ed821b6a6f24f36f5c7233", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810420, "uuid": "2cd2aaf6-60f3-4960-806c-7764731376e0", "comment": "Malware payload (Mirai)", "value": "618c71e1c4dc5ebd004fc491d37a1011b6cc492c24efc6295d3b74d5e0c1def3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810420, "uuid": "23abd3ee-4e6a-4ecd-8df4-74ac4447f2f2", "comment": "Malware payload (Mirai)", "value": "f634fdd00a36d5cb58a1500ea24504ecdf4550a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810420, "uuid": "5a51cbad-eb89-4d35-81d8-e52bd713f798", "comment": "Malware payload (Mirai)", "value": "16e8ce2f4f9458415ff42bba189066b943762774d6bf5655102688d6a4f019fb5b1f1afc29b21ae0885317daef0e8423", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810420, "uuid": "7665486a-d492-4bfa-bbad-46a35441006b", "value": "T10C533C96B4019E7CF84BE7BA8662490AFB20721049A30F27B767FD876C330959D1BD4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810420, "uuid": "2b2fc290-ed26-4758-a3a8-8879b9a78b64", "value": "1536:rdOAQjFcMQVpy6ao93LZg2mQpVLBiJYT8ZBo:rdhVRao97ZfpNiiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641810420, "uuid": "8ae9e5b3-d34e-4bad-96a2-fc4ba6b5e7af", "value": 63740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641810420, "uuid": "bdc265ce-ebc4-4d8c-ae28-297cff82d2ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810420, "uuid": "e20a391a-403c-449a-af36-08dbdfddf508", "value": "e59ca645d1ed821b6a6f24f36f5c7233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5d062e-71ce-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1641789405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789405, "uuid": "d55af071-b33b-4a12-a355-e37888c30fd8", "comment": "Malware payload (njrat)", "value": "fd0d3e25d88b5c318f4dc543a7770f22", "object_relation": "md5", "Tag": [ { "name": "aptc36", "colour": "#E07664", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789405, "uuid": "a4d715cf-02be-41b7-a72e-e4437b668ed5", "comment": "Malware payload (njrat)", "value": "623027463a2ef70f60ff6a0991019847a3fb24da3b633b52da4a99a77c99f92b", "object_relation": "sha256", "Tag": [ { "name": "aptc36", "colour": "#E07664", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789405, "uuid": "8133f2d9-1cec-4b7d-9e97-e80f5a630ea8", "comment": "Malware payload (njrat)", "value": "94572d313222700a565f2ff161223bb28464636c", "object_relation": "sha1", "Tag": [ { "name": "aptc36", "colour": "#E07664", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789405, "uuid": "f0e00264-a3f2-400d-8603-67b771d92467", "comment": "Malware payload (njrat)", "value": "bea9a5497fd07a9d25c6bac0b44b6f340e002a64aff6b7bfcf08d48c60dbbd8f6fdc42d55dda70b14482b6750859dc36", "object_relation": "sha3-384", "Tag": [ { "name": "aptc36", "colour": "#E07664", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789405, "uuid": "dce4a9e4-c5de-40c7-bc74-59879fb4a51b", "value": "T1EB92E11DE8D72352E1BDC9B737BD0416CCEC50312BD58D4A2675B3E10A6C2E32A859B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789405, "uuid": "d66829a5-5cb0-496d-8bbd-f65c80e3c131", "value": "384:dXPu8euJxUHlrN7Xvsl5PfgmMzGe1w3UhS:VPJeu8HlrRkPfgmree3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641789405, "uuid": "b192ada8-d7cb-4516-ab70-c2bba879b214", "value": 21096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641789405, "uuid": "43102a45-e2ac-4f01-a5fa-06aa1df34ad7", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789405, "uuid": "e3977071-badb-475e-a377-7914f772a6af", "value": "ComprovanteXdeXreserva.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227a6e63-7212-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1641818275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818275, "uuid": "ab053faa-8591-4637-9e5d-98cbf2ac2623", "comment": "Malware payload (CoinMiner)", "value": "0b239f6cee96421feeeec8b442bcdc66", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818275, "uuid": "6f337eb2-6dd1-47b4-9582-16297aafe623", "comment": "Malware payload (CoinMiner)", "value": "626e1458922127b621d2f25c7fea6aae5a6db80ce562be768f23386fcd8c0b00", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818275, "uuid": "ae3694f5-2713-4681-a5fc-07513279c48d", "comment": "Malware payload (CoinMiner)", "value": "6eecc3d25496c49738c5aeb744baa3d9248d4126", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818275, "uuid": "564531be-292a-47c2-8899-38c2eeff53b9", "comment": "Malware payload (CoinMiner)", "value": "9d9837cf5682c76e4fef7cf05a24a894b9819673e82936587735fb040a4d22c9ce0a3e851f6220b01228df665fba74f8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818275, "uuid": "4c766061-6e21-4ee4-8d5a-2366a9386196", "value": "T190363369A69EBCEBFC11F5BB567F949EC9279703D1B1448383AC6329479D9802C8F103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818275, "uuid": "56744bdb-a059-4b31-a9b4-929d1be47646", "value": "b8ba55866bfe7b49b97c43084c1885db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818275, "uuid": "64f3efa6-65ef-4116-a70e-455487a878b2", "value": "98304:Vrq7WMMXCg4ub1nsKWPxWVMwopWMHm1MiQTDmpd1wPhaEDH4rEUTGI8/J6XWHZJ8:s6XZ39szxWmwoEMHm6PTipIPh3DEE5JW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641818275, "uuid": "b24b4402-b3ec-4213-adcb-59a36ea5f4ff", "value": 5266944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641818275, "uuid": "db236387-e8ab-4f2d-81fb-814903f15053", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818275, "uuid": "65e63ae4-cfd2-46fa-8699-e9580960089e", "value": "0b239f6cee96421feeeec8b442bcdc66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c13749c-71ef-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641803259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803259, "uuid": "83207c8a-8e14-4ff3-900b-2046b3d8db1b", "comment": "Malware payload", "value": "0cb3eabbab3294d2860807ba9be055f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803259, "uuid": "6b8052d2-4069-4dac-b437-6ae82b991def", "comment": "Malware payload", "value": "62cc6e9a440b5cacc6ba124f71407528da312577b595350d258a983cdd32119a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803259, "uuid": "c5a2f83a-01b3-498b-a606-30ef53a9ced7", "comment": "Malware payload", "value": "4322f67752d117da87a52f76eb23157955e0c350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803259, "uuid": "e2af6e36-2c9c-48ad-9cb8-8fe9bab58541", "comment": "Malware payload", "value": "b6ec996fdacef01c8f69334c949a595bd8293cf9a5b1458e82c435957e667d0fe4b1fa8c3f9fd727c6878cd05c07fa65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803259, "uuid": "b644b2b4-f6b1-41ff-b8c1-ff9be2cdf881", "value": "T111B4D0C197E68A2AF8F74F31B8790D550261BC28E9B8FB5D02C4352F78762825D47B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803259, "uuid": "bc78ad84-4de1-4d8a-a3b9-d84ab28e9397", "value": "afd8169c4a337ec37e09db5512dd74fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803259, "uuid": "41dff67c-b40a-4e14-b930-9922c16ecf75", "value": "12288:CUrh7jqguXy2+28dkqqO3cA4bA0XuY9WM6oUlrAUjiY:jBqgqy2+2V1uobAwuFM6oUlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641803259, "uuid": "8b889939-1927-4a32-a783-773bca5cd774", "value": 535232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641803259, "uuid": "23b6c34b-ddaf-42d1-9090-c81f29f4dc1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803259, "uuid": "ce9b917a-864a-4f1f-bf93-28073ecce814", "value": "0cb3eabbab3294d2860807ba9be055f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3c480c-726e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641858105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641858105, "uuid": "4adecedf-6861-411b-b8d7-18b85f660b7f", "comment": "Malware payload", "value": "9e987306149a90a0a8896d779b4c729c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641858105, "uuid": "e2aefa84-8040-4528-910f-da63a23520f8", "comment": "Malware payload", "value": "6310861ca6435c2515cf9009761d948991877bc1c8d092459b98b211523f4f0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641858105, "uuid": "bdf4f9d0-ee54-4496-994d-597ce44ee3e6", "comment": "Malware payload", "value": "d2b74b0500033eae3489a673dfc238e755c24f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641858105, "uuid": "480ef760-2a51-42c0-be8c-38094acdcced", "comment": "Malware payload", "value": "dcf4400472940ae549ac6a76ddd77f713218da92e43b4820b4a4a21ba1f35f3faee52f455cdad6e280ea9b30f8cf571b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641858105, "uuid": "7dabc6c5-320e-4161-a4b0-eb14f9f5bb54", "value": "T1E193312429FF502DF3B3EE755FE474AF8E6EF6732A0A6569208103464722D41DD8273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641858105, "uuid": "b9246b62-0810-4c59-b636-d4ae65599632", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641858105, "uuid": "2a5f513a-3faa-4814-91eb-9fe82302f863", "value": "1536:s3kIhPHX6r9S2TFZ2p9tiCnBF5y/WD5HRY/RPZWkA4C:s3kwX6r9S2vUUaxY/p9A4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641858105, "uuid": "98e3e270-d9d4-44d1-9182-0fcf13e48062", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641858105, "uuid": "5d27457e-79d8-46ff-905a-87b3c5f50bb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641858105, "uuid": "b64e9419-5797-4acc-b7e1-64d7458dfa10", "value": "choas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b618e544-7226-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641827113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827113, "uuid": "5ee2c8f9-326b-4ac1-ad6c-191201d5812d", "comment": "Malware payload (Formbook)", "value": "8d123b34099b4b9bed19882bebf0b255", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827113, "uuid": "ce67e143-e295-4389-800f-833bc887bcee", "comment": "Malware payload (Formbook)", "value": "6316ba2656af7efb6fa93a9ea2787bc05886c86f3ace73ddad605d6a80bb6c56", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827113, "uuid": "5b8b274c-2cde-49a5-a124-8c2cb99332f7", "comment": "Malware payload (Formbook)", "value": "d1fdd14e9114471710bc6c06afa64d08181aa433", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827113, "uuid": "3a27fb12-467b-47e9-9a60-274e971b6701", "comment": "Malware payload (Formbook)", "value": "3536c50896682b535419c6ca53ef7e0d8a00d98e329c79b43ba980f18157d118fbb478c7d6204f404c09d54b772b5def", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827113, "uuid": "43f86aa8-8db3-4322-96e3-aa0d1837af50", "value": "T145A2B4BCC0970A9C8F86A7F8670B2F45048C765EF79895733278A7756BD2C7A412287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827113, "uuid": "b9ccca69-9b24-42e3-a65b-20c483020881", "value": "384:WbsK5ATtck5UFkTSNETXHPxsQXRUiEWEIg+i+0AJqiE1Yl3N7yQ4:xTF5UqSGTXvxxRnEWDg8PwihlNOQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827113, "uuid": "30a11ae2-3a05-4fa4-8f5b-070549baf246", "value": 22919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827113, "uuid": "28d21d6c-5fc4-4d47-be3d-890c1a7a7caf", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827113, "uuid": "5d27716f-a19f-4584-ab61-9e91412c4e66", "value": "202201.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886f58ed-71c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641786234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786234, "uuid": "6bf204c5-0cd1-4beb-a058-356127eea518", "comment": "Malware payload (Mirai)", "value": "e0f362bd6dd50b12ebdf7605bb402d0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786234, "uuid": "547e2ec5-7682-403d-864b-93214e52adbc", "comment": "Malware payload (Mirai)", "value": "653e4bea84787e7cc88fbe305892e50cb1f4a3177678f88c388602ebcb397206", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786234, "uuid": "5821e75e-2738-4e96-b517-eb4fe862e1de", "comment": "Malware payload (Mirai)", "value": "bd16b23d9e63f91100d721bcc71a6258b4ba1052", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786234, "uuid": "2a972603-0233-4cde-8957-af79d2651714", "comment": "Malware payload (Mirai)", "value": "a11329fe37eda0a57c3d26c4e3a74d287204ccf9c83e9c0adcb1fdedd80a5bcfb4c22c59e7e7aaedc2cd44c0ee8b3167", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786234, "uuid": "cfb2c0b8-2f72-4902-9bab-3042a9234901", "value": "T1EC636D91B400DE7DF85AF6B7911F0D09B63162144FA30F67F673AD6B9FB20986A06C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786234, "uuid": "7d56870c-669b-4911-b323-b09f6039abae", "value": "1536:McockNP8y+9pCEaJZHH69ZYr5yrAtNWjQHk4zGnXSjG8p4WT:Mrc1pCEaJZHH69ZYr5yrAtNKu/eXSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641786234, "uuid": "29db33eb-a774-43de-a0c0-f5dcc662e4e3", "value": 72556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641786234, "uuid": "edc9e90c-9e3e-47a8-8494-ab44fabe687d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786234, "uuid": "4ef41444-1500-4e9f-b186-0575608425f5", "value": "e0f362bd6dd50b12ebdf7605bb402d0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25b0f5b-721d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641823214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823214, "uuid": "ae7b69fc-acbf-459f-a8a7-442397e38da4", "comment": "Malware payload", "value": "53fbf8b7f7d8f37233a83a63d6fe4365", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823214, "uuid": "3144c285-9334-49db-a7b6-1839842208d4", "comment": "Malware payload", "value": "6670a24da6cc047fdfb14e73329fda8a4aeb08f1ddc82949494048651e49ad7f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823214, "uuid": "f0f03f9b-f2f3-4d55-bd6b-7b15923cff1d", "comment": "Malware payload", "value": "84c4ddc5ac7478db671605182c65adb96ee8f4b0", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823214, "uuid": "aef580d8-6d4b-4777-9835-04b332391d9a", "comment": "Malware payload", "value": "8610c0f7b73f18b191b2efd25507ab2f134efd59048bcf223de1b3ea0dbd7e95ffb45edbb7acf2057cc44e035d05e6d7", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823214, "uuid": "477982ae-8776-4462-9235-2419d00edfa2", "value": "T1D206330C239EF4FDB49A096C3B26C9A0C9E452F1DC8225F3963815940C3F67D4BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823214, "uuid": "3b83f353-dad6-4d9d-902e-0ffcf9a3b62b", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qK2:0XSxVJG2fLAqFOfT9sMYNM292", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641823214, "uuid": "d5ff3dbd-9982-498a-b5ad-2d8ccf24ccaf", "value": 3784704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641823214, "uuid": "a62cca64-a41e-4ef3-ae80-403da04e0aa1", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823214, "uuid": "35425481-7bed-464c-bb43-7531ca12f397", "value": "6670a24da6cc047fdfb14e73329fda8a4aeb08f1ddc82949494048651e49ad7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6d33c8-7238-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641834904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641834904, "uuid": "f2bef93e-d35d-4fe0-abe6-609c23345ead", "comment": "Malware payload", "value": "1ffa7d5e3a236cf0d6981d07e1b90406", "object_relation": "md5", "Tag": [ { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641834904, "uuid": "976f71ed-afa8-4646-bc33-1666787341fc", "comment": "Malware payload", "value": "69f4dcd1de05fc553781e737e85bdae5f0e79e7f34ded1899d60630e54d43fe4", "object_relation": "sha256", "Tag": [ { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641834904, "uuid": "37e32557-660d-4199-aefd-0f85569ccaa7", "comment": "Malware payload", "value": "9bdae03e2410b108144841c466d1e769fea3a9ce", "object_relation": "sha1", "Tag": [ { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641834904, "uuid": "d9173371-5eba-4f68-9301-39c2ad6d6e9c", "comment": "Malware payload", "value": "f938db127f4541562791f73f2b8679ee5611bc2d4c31dc8d1fd0fac08369bcae955834d526366953a8d033fe48b9ce3c", "object_relation": "sha3-384", "Tag": [ { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641834904, "uuid": "ed4fb844-13fc-4d79-8c16-7fef685ace8f", "value": "T10D512FE9046E180EC1DF99305B5DE9885BB29ED332D7C711F85CE72581CEAB4A8E391C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641834904, "uuid": "d95047ab-e5ab-4b52-ad33-bf0de3af8692", "value": "48:SEzg5oMEl63gGESbucjEPlP6P3PcPGEvktKRYEoxQAZEYhgwpENCPrc8HEqz2Ap8:SEzg5oMEl63gGESbucjEPlP6P3PcPGEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641834904, "uuid": "e7916b79-8bf1-4ec0-a043-2ce05d66b1ea", "value": 2954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641834904, "uuid": "b83fcd82-f2cc-4b38-a216-78221dc2abe8", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641834904, "uuid": "7ff0ab7d-47f5-459c-99dc-e10eac096538", "value": "retard.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37744aee-721c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641822605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822605, "uuid": "c83762cb-3411-4238-ab96-61d91ea60e0b", "comment": "Malware payload (Mirai)", "value": "12d8c72c11086c541d174bf1ac6801ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822605, "uuid": "c7ce1692-639e-4739-bd32-991bff47ac47", "comment": "Malware payload (Mirai)", "value": "6a4b08bf293fc5cee2d1d2d803312f4406668242287979d47265d6e564b9d5f9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822605, "uuid": "43b47be0-1af4-4750-9c21-5b77e4a1ac68", "comment": "Malware payload (Mirai)", "value": "e15cab9d76c815792aad13555930215fe5677d5c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822605, "uuid": "169679e5-1ff7-4859-910c-f797c5bd9039", "comment": "Malware payload (Mirai)", "value": "4c3d4d285c1f03ce68daab8b747fdbb89e3c36cda95a99f6ff276c10de33e304515240f7451ea40ad40b9889c49fd813", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822605, "uuid": "84e44237-530c-43d4-b11d-0d84ed179463", "value": "T1425302A1B3BBB9FECBB434B5425680023D625FF795B921BB3158C7509FE380A9359807", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822605, "uuid": "f0ecb42b-fda6-4a2a-b629-f814fb75a302", "value": "1536:WX+UwzvJbH2cbngvsMRIWKCW6jrJTOLF1Ch/3EXrVn3mE0i:C+UwzvZWagvsAhjr9OLnicXrkJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641822605, "uuid": "63b5abff-e1b0-4312-a571-62d9eec37e87", "value": 63704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641822605, "uuid": "3b77b727-e257-47a0-ba52-37b60e85f14b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822605, "uuid": "6905cea6-ddec-4c27-9cae-64b5646c6caa", "value": "arm7-20220110-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8d8e49-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641806021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806021, "uuid": "79818907-1b16-47a7-ac5f-5d899f28c0f3", "comment": "Malware payload (Formbook)", "value": "a4d14dafb1a66af90a4fe76a2a78206c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806021, "uuid": "1b81cb50-571c-4a9d-be8e-94f5070f9c2e", "comment": "Malware payload (Formbook)", "value": "6ad1733c8b7f2d689659dac3231330133c262b9448d609fd47cca16ddc255e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806021, "uuid": "3ea29502-1fa8-49af-ae53-348f6d28f511", "comment": "Malware payload (Formbook)", "value": "865fa1923893f38cfff81f2ac0bbbd6e9148f458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806021, "uuid": "fcbdcaa8-3672-408c-b6df-04aef57c9ff8", "comment": "Malware payload (Formbook)", "value": "4e2e8a268d80ceb8291f05d3ed9f1f3dbe8e2f98ad0a38cde1585d19322fac1859a3e339344e8b4f22a439489de46923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806021, "uuid": "a1b21d4f-6a30-4763-9267-6ef2b9512d0b", "value": "T14D841241598090FDDEA08BB905672F7AD6879E2384BD26074F427FC3ADB73335529A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806021, "uuid": "194a247c-b48a-4c6d-b0fa-8c4eeaf308c9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806021, "uuid": "60029f48-f171-4772-94ad-76694a5ed68e", "value": "12288:UbLcjkkkkkZDgNGJnRKXthhc44rLpukvNcw882:U2NG1K/h6v7P4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641806021, "uuid": "4a9db525-993d-4433-b742-8aac39ed6168", "value": 396853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641806021, "uuid": "c85a2b4a-91aa-489c-ac49-bba123f497de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806021, "uuid": "71687a1b-78f3-4600-bef7-af978f58787d", "value": "Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6f3813-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641797404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797404, "uuid": "c4f27591-89f0-4c88-8300-6444d9965f6a", "comment": "Malware payload (Mirai)", "value": "3d7b317b8e2e462ef93c99e151c7f0ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797404, "uuid": "70a8398f-fd6b-4d3e-9560-52a02e36b41d", "comment": "Malware payload (Mirai)", "value": "6b21b831fe6e52ee249bd6866d6f5b7cfd5475a70e1f5ac25d652c994b1653c0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797404, "uuid": "f4a199f3-6b53-411a-b8ae-d0db82f41eb3", "comment": "Malware payload (Mirai)", "value": "b1d7ab29ad9eb543fc7d50ac52c5babfb82f2fec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797404, "uuid": "3267e095-df4d-4651-84bf-9c0344b8890f", "comment": "Malware payload (Mirai)", "value": "b743d85bc44f7d22cd4c00e4db6628279227fd943e83e79ac6d9e2200344bd29062fc4d37817b7eba77232d8b525ede7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797404, "uuid": "f8f7606c-95d9-4969-bf91-11ecb805492d", "value": "T133D31946EB408B03C4D62779BA9F424533239B64D3EB73069928BBF43F8679D4E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797404, "uuid": "f8ea15b7-cb60-41a7-b4ad-ec7a38e01348", "value": "3072:kpEkTLQVOabvG0TZ6Ke5fk4FbvTu9JjSM/9TupCmmhwL3Yo:kpfqOabvG0T8Ke5jbTu/2M/9iImmhwL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797404, "uuid": "9cb523a8-d344-476e-833b-c58bd1ec2b0d", "value": 136872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797404, "uuid": "877fdac2-a446-4ae4-b9f2-a3d07d2c5404", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797404, "uuid": "d5a97c3d-e7cc-42de-b621-9edb474c5987", "value": "pop.arm7-20220110-0650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56d27da-71b0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641776404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641776404, "uuid": "af257e1e-1ef1-4b6b-a9b6-5476e167bd6b", "comment": "Malware payload", "value": "202e06e416f50fcf12fab3f96590c999", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641776404, "uuid": "9e92f35d-8d22-4e11-af46-f31569f4422a", "comment": "Malware payload", "value": "6b8f912511084e2083eda474f8954dabe73f125acc1101b64154cd6f9dc6c538", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641776404, "uuid": "cfda9779-4a54-49c6-91ea-f453ca042260", "comment": "Malware payload", "value": "b4877086a613501b8866e342ade99b810387a6a0", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641776404, "uuid": "849fb318-1f46-4ce5-b30e-7cf7ce559f26", "comment": "Malware payload", "value": "28effedba90b065d033bdf638efbda25af8c6884cfaf26a81ec13a8f469738c566e1c3cb466177d6581b965695b64f37", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641776404, "uuid": "296a4b3f-3bbf-4724-9d0b-a35dd94c9633", "value": "T18F26337DF0F92DFF8398697193EBEF2070661A8DB0A1974298B7D58B041633194FB918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641776404, "uuid": "fe370440-e5e9-40ae-85ed-f0111b2141da", "value": "98304:tos909Qg6ecEZHyEexmLaI9MY7bxTE8SSvEgP3N2v+Kr:td69Qg/JFeQ5x7bhE8SSdP8v+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641776404, "uuid": "c26aa400-6edf-406e-8f02-8c9c994e65a6", "value": 4685824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641776404, "uuid": "48152e7d-2e2c-4822-8a18-4291157fe1e7", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641776404, "uuid": "84c847d2-6d17-419c-a17b-66affd30b931", "value": "6b8f912511084e2083eda474f8954dabe73f125acc1101b64154cd6f9dc6c538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c509722e-7249-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641842170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641842170, "uuid": "72253f8b-0d8c-497e-abab-a6b38ba339ee", "comment": "Malware payload (Mirai)", "value": "782d4c3d38964ca84e01d47f3da4fc33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641842170, "uuid": "00a5be40-a3cc-482a-91e4-4cbdddee9017", "comment": "Malware payload (Mirai)", "value": "6ccfb1a88e05b3dd1c9958b61977e3f8afb01b14647c10c82d0a6da6569fbda7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641842170, "uuid": "5794930f-d3ae-4da1-a2e5-ae974867bfd9", "comment": "Malware payload (Mirai)", "value": "bd446fdac6e94d0aea498c8e12432d5ab5e94fac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641842170, "uuid": "64554bbf-7658-4f56-9539-6a9cd028f2af", "comment": "Malware payload (Mirai)", "value": "8fb0df212aa0c4470bd631d8bb98155633c1ecd490bb1c9e94bcb1d1651c571756cf696d649b3ec7f8d2a63d54315adb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641842170, "uuid": "55bee044-b0a2-422c-97a6-629858bfbe6c", "value": "T171436B26AD7A2E17C4D4B4BA52F78324B2E1635E25E8C61E7D330E4FFF20650A0531B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641842170, "uuid": "a699b045-910b-4763-8162-0fab0d6b6938", "value": "768:+uoWnAtqAimRU+fECeJ6Nq9aBwXe8weW0GuoZgkuO+1YKQxh:+u9AtgmRU6ECeJ6NSaBye8weicWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641842170, "uuid": "95983bfb-3826-4248-a3d3-1c779fd4d7e6", "value": 59960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641842170, "uuid": "55ee0524-e12b-4209-9a62-bdbf656a3b52", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641842170, "uuid": "e935e674-fd9f-4aa7-8444-627269a01103", "value": "782d4c3d38964ca84e01d47f3da4fc33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f06e25-7233-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641832810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641832810, "uuid": "3d51c436-c687-4996-9405-dcb85a55b7e9", "comment": "Malware payload", "value": "88dbfd9f0a880da09c6914901900012d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641832810, "uuid": "d8996092-21ad-425a-a088-9925b1da78b0", "comment": "Malware payload", "value": "6d8b1837b28f33d77d09fdef2a5454614ff4c0d7e9389e39a356ecf7ccbaaec9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641832810, "uuid": "0dce42c7-b778-4b07-a17f-c390ed2dada8", "comment": "Malware payload", "value": "cd903f01e585ad5271314cc27b634bd58f0d42ae", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641832810, "uuid": "2564f1e5-9f62-4bf9-98d4-11b910877298", "comment": "Malware payload", "value": "ddc4b1de04b1029781363fa71ee9fd82757f0e9047e59bbf5dcafc995f7d7249c4b69cc287878e9ea4d5f33c1103b7f4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641832810, "uuid": "8fb2bb2e-ce1c-4f2a-869a-da5263cbe526", "value": "T16413E155E5A6A617D290DD78C5141182D728000AEB4C9A2B2D0ABBCC5FF2B0F1BDF7DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641832810, "uuid": "02723cef-9a13-4eb6-b153-c347f37491aa", "value": "768:eqfV1sbdoYCLLKQq41qHmjMZbcJlcH7156aayew2ykjH9fs:xtmdWjqcEUUHprayew2hBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641832810, "uuid": "c8641325-6f42-4a79-8d9e-468baf5be9e2", "value": 44400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641832810, "uuid": "074fd8e1-3f6f-499c-b05a-e1791a746b1f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641832810, "uuid": "9dcdb2ce-8bd4-42b2-bde9-4a4c527f05f7", "value": "aaron_resume.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320c6652-720f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641817013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641817013, "uuid": "451adaba-1fb9-4df4-834a-a35089d63218", "comment": "Malware payload (AgentTesla)", "value": "3ffae01ef7c1d5c01d7b1ef1773c7bed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641817013, "uuid": "38bf0cac-0696-4e26-bfbb-e8fe824d1043", "comment": "Malware payload (AgentTesla)", "value": "6e8eaa2ced1eeec93d3e850ae0ef3491ca2fde6b9ab3d5292a39fefcb7e169ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641817013, "uuid": "ea480d09-8029-4826-ba97-b39e4c745305", "comment": "Malware payload (AgentTesla)", "value": "9ece6a254dfd5c40ebe53f34a52a7ebd0db53c47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641817013, "uuid": "0f77cf3a-3294-41a5-bacf-4be2baf09275", "comment": "Malware payload (AgentTesla)", "value": "588aded3ec1539c8fa0c51971c8e04cc6e9290ad50bfe41ac7a19350318c6c3a411ae1aeebf9c28b118588d2a9416a2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641817013, "uuid": "c504b166-d70c-489c-b653-60e2b72e8af2", "value": "T1AA05E0067A45C905D2650AB3C5DBC2B447F47E44E553E31B79E93E2F3E327A2780C68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641817013, "uuid": "642ba532-2c8c-497b-ac2e-99ac91855e80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641817013, "uuid": "12c0b93f-3349-48e3-a325-e91773b63e54", "value": "24576:fosBlctDTmitq1Ql+rV4p/tfkuCn/EsE:gsvctOitq1Qkmp/tkRnMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641817013, "uuid": "0bd71000-3e8e-470e-a7a5-ec7de623c84b", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641817013, "uuid": "087e9a33-8a69-471a-8c6b-f90e76399964", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641817013, "uuid": "a8bb93d5-36a8-41f8-bec7-609be067ff4f", "value": "Alinti yapmak.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a74590-71f2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641804645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641804645, "uuid": "61d4bc57-cc4c-464f-b95d-61ce4e15b5c4", "comment": "Malware payload (RedLineStealer)", "value": "cced2314b659cadabff1c79a158444d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641804645, "uuid": "4ed193cd-e8a1-4fbb-82dc-4ac3adb12910", "comment": "Malware payload (RedLineStealer)", "value": "6f4cc8876fbf0a34d567c12950b086a62cd6cc6e872b459209db3234915ef621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641804645, "uuid": "b22eafba-c417-4707-9a44-b8ba109d2ee8", "comment": "Malware payload (RedLineStealer)", "value": "7128e74a88679992f5077632387f03419baaed0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641804645, "uuid": "a2486662-6a51-4e42-945f-c2fe977ee54a", "comment": "Malware payload (RedLineStealer)", "value": "5c84739141837b1ad0c874e629b57c6d80a862051a1fddbbe887bfcd02c69944aae89289fc26106af9081771b63e0a87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641804645, "uuid": "84e6e56a-e2ea-4ae8-97f7-edc171a7ad50", "value": "T14725E8DDD9C55849CFAF23F41DBBA84C8DB094D71B6743EAA31895F0AB422C2254DEE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641804645, "uuid": "1085ac86-6faf-4fd4-bd42-ee0863c4b8e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641804645, "uuid": "4e404c50-ab8a-4b02-a024-af0404767e3a", "value": "12288:p8LUc6nV2kMqga/rhLTtx14zEzbRPuni5LzBdfY:SeMqga/rhTombRjNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641804645, "uuid": "4cae697b-a92b-43be-a294-499ae6ae4625", "value": 1013640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641804645, "uuid": "afdf6357-fa2f-471b-bc9a-f1f8fa32592f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641804645, "uuid": "ad53d75c-fafa-40bf-b532-7d05b06abc16", "value": "cced2314b659cadabff1c79a158444d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14f0a30-71ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641789363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789363, "uuid": "307d1334-b2bc-47a1-bf1c-fb7f8f24d544", "comment": "Malware payload (Mirai)", "value": "4ede66123793c068521c4f4ac5b0b4aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789363, "uuid": "047c2334-d5e6-4495-86ff-7e0c3a7c6211", "comment": "Malware payload (Mirai)", "value": "6f9c0a8a4dba6cd2b4135dc0f20e52aa37278257453762d3b757d4a22906486d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789363, "uuid": "3085a3e4-cc2b-4478-9e28-5c38609bd601", "comment": "Malware payload (Mirai)", "value": "754c326da06399c9c72750217d44d015cf4df509", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789363, "uuid": "35559a8e-fbd6-4448-bd70-0213b5341045", "comment": "Malware payload (Mirai)", "value": "f598e62f9fdc5b15b15e6c0739b78a8dc8d908ac4438195eef162557207db187e3d46d9411145072afc22cff8b983216", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789363, "uuid": "bd2cda0e-83df-4205-adb0-8a28f859c709", "value": "T1CB93A30ABF615FBBE86FCD3705A9170514CC951B22A93B75B930D828F74A24F1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789363, "uuid": "bb7d7be5-5b1f-434f-98b0-07da33fbe79b", "value": "1536:EKt7Jqch9CtX2b4Uo92nkvTLnv1Zdz7c9tWOOq2:EKt7JJhItX2d0v1Km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641789363, "uuid": "9ed65fe2-2e92-4594-8ddb-8c6b0e5e14da", "value": 88896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641789363, "uuid": "785ace98-93f0-4522-8932-7db2f3790067", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789363, "uuid": "ba127557-3155-45d5-b079-ab08b43d2be7", "value": "4ede66123793c068521c4f4ac5b0b4aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5443922a-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641805903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805903, "uuid": "119109a8-f2d4-4220-bee5-5815f2e385a5", "comment": "Malware payload (Mirai)", "value": "20b4fdcfb5195f385acc9f85b641acb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805903, "uuid": "1e9811b3-c48a-4250-89a6-b0dabf82023d", "comment": "Malware payload (Mirai)", "value": "708f174576ea76e4dca351bcbcaf26f9b40b05376042ba2a28026f1b0c284e78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805903, "uuid": "0d596835-2d63-4e30-b6f2-d5bc7cedf61f", "comment": "Malware payload (Mirai)", "value": "e6d946d3b6411a099fff8c83952617b0e73fc38f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805903, "uuid": "99fb590a-4674-4f22-89c0-c19479ad1fa7", "comment": "Malware payload (Mirai)", "value": "3b7075aff8bff3094cbe7c608807ea17cd3948117fa2f8d815b9f38e916da4e475e057315466711b44fa5bdb98067d06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805903, "uuid": "ba87ed44-94e9-4d3a-9506-6aa8d3ca6135", "value": "T157B3740E7E214F7EFBAC823C87B74E25D98833C627E1D585D16CE9021DB434A245BBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805903, "uuid": "3bbd9a25-390f-4c99-bedb-77e8e7142c28", "value": "3072:/JihRVw8uWooVCoSne0l+r0YF026OPkS+y20k9j2rlM:/JihRVw8uWooVCoSne000sTkS+y20k9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641805903, "uuid": "e87ca9d4-d217-41ef-8119-be0f5b62a042", "value": 112728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641805903, "uuid": "cdce1f43-61ef-47d0-8f29-fbd03b3a7be0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805903, "uuid": "f471fb28-5bcd-4a0d-8b5b-5908dc565873", "value": "20b4fdcfb5195f385acc9f85b641acb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a429c1-71fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641808778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808778, "uuid": "f8868623-a4af-4f5f-9074-70572ecada2f", "comment": "Malware payload (Mirai)", "value": "5eabaaf3fd3dce52cc4c144093bd9f65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808778, "uuid": "c270d2b9-4f89-4008-9d4a-883982b6ad46", "comment": "Malware payload (Mirai)", "value": "72bfb1391f45db5b9b0da838d370b9264fb5cbd44bc26112927c480eef65a203", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808778, "uuid": "37b56bba-2116-40e5-aba7-25525d8ea8fd", "comment": "Malware payload (Mirai)", "value": "0c0ac2d0aa63d0b65fac33434808527a89b501eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808778, "uuid": "b9f238a4-5103-4cb9-840d-cf4bea0aa324", "comment": "Malware payload (Mirai)", "value": "4b310350f379625f8b551012e8847fedae2497f10b63b917108654ca9360aa4b2c92e40f98a38f189f09ba48e9281f90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808778, "uuid": "30c80f6c-361a-44c0-9e83-f571b00e84ea", "value": "T101D36CCAF800EE3DF84BDA7944674E0AB530939166D30A27735BFC63BD321956907E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808778, "uuid": "2bfee8f9-f7ff-4ae6-8062-9d21d8648bde", "value": "3072:xQ/6GqInWUc9FFMifSx4mddtBSsUjhWyeqpB4OW:W/6GEtz3mddrSeyeglW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641808778, "uuid": "8a6b7949-ce83-4cfd-857f-cd00edc626db", "value": 132944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641808778, "uuid": "ecc54e7c-f387-4241-b15f-ec952c89952a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808778, "uuid": "4f169606-10a6-49b9-baef-2d7d9b67f931", "value": "5eabaaf3fd3dce52cc4c144093bd9f65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894a867a-7248-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641841640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841640, "uuid": "7a6dddbd-c7f4-46dc-8942-5ef9e49faf2a", "comment": "Malware payload (Mirai)", "value": "44a4e6b462c28b0994a2a998e5f73724", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841640, "uuid": "e46c8828-9673-4333-a635-38520e8300f4", "comment": "Malware payload (Mirai)", "value": "7300cbe4def5847b8cea7dabbe9dde3d3cf484a875afa27f93aec35538f9c745", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841640, "uuid": "e6981c44-4a08-473e-93c3-a5d4cd9bfdb1", "comment": "Malware payload (Mirai)", "value": "16a44756e0bd3a63d034cdb7e90cb8d17b398dea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841640, "uuid": "4d7ea173-a003-4f37-8912-6342b004982e", "comment": "Malware payload (Mirai)", "value": "f40c1f1c33b7db39ee532b0bf2da1992b065742009f75ff372eb26da8f6edacc5a6a2ba51b24be1f824a8c668ae10a4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841640, "uuid": "0ab179b1-d588-4cae-9ebf-31d83032cdc4", "value": "T1A973C91A2E25DFBCFBAD823447B7DE259648338A36E1C144D15CEA011EB024E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841640, "uuid": "5c62d685-0e9f-4f83-8fd5-5f6f53e17c54", "value": "1536:swhV7DJq46HbLM2OFoM9tgsPJIJG6VTIAa4tsPkE24Eq:swhZJqpLJdM7gsPWJlTIAa4tsPkEtEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641841640, "uuid": "87f093b9-3651-41aa-8937-1492e8bfc9e8", "value": 76064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641841640, "uuid": "4cbbca93-a7a5-406a-8544-7c8f9916e04e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841640, "uuid": "afcbb2ca-fff9-4764-901d-2fa8411ed7b2", "value": "44a4e6b462c28b0994a2a998e5f73724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15768022-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641797208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797208, "uuid": "7c183d3a-1dd0-4602-abe1-fa5b5d7ef143", "comment": "Malware payload (Mirai)", "value": "fd0fd08046911f7dde222b350b73ed65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797208, "uuid": "df9c5740-df24-4f1d-a097-77575679618d", "comment": "Malware payload (Mirai)", "value": "74218a9271b133d479a025070fca05057742ff97895e4fbfd29d103ef4883bd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797208, "uuid": "fdb64927-f112-4b9c-b72e-3828dcce3bee", "comment": "Malware payload (Mirai)", "value": "df6b62ce9eb6e839d7faed6bc3a912d7e6bceab2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797208, "uuid": "1bb977c0-ceb7-4b93-a0ee-2bb4153743be", "comment": "Malware payload (Mirai)", "value": "b8735f6a3083548fac4c8b4e55d6fdc11c005b6abf4d7265fc0abd70b019f4b454b7110b93ad0e7851104b4a44fa347b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797208, "uuid": "1471a9e0-6b82-46a1-a4c7-e0760c5d95c3", "value": "T1C0D2E132EDF2BCB1D591D439D8ED80C539172738D67F293A4465A66E58C3C863AF5007", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797208, "uuid": "842560fc-3548-4dbd-99e8-42e5ecba10a6", "value": "768:phLAqFpeYuEWWikc65azszGJItwZidb9q3UELC:pKqhuEWWAQajZDLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797208, "uuid": "399130ec-e2f2-4da3-8a8b-7d8825ce0b71", "value": 30300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797208, "uuid": "7c5c3a21-02e7-4cd6-99ce-83099e2e61fe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797208, "uuid": "efc72017-d8df-4999-ba00-bc6fe41c1452", "value": "fd0fd08046911f7dde222b350b73ed65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98782f97-721a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641821909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641821909, "uuid": "12fab6fb-2665-4eaa-b230-5ac79ff78668", "comment": "Malware payload (Formbook)", "value": "393137b332c768bcbee9fbab51b59466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641821909, "uuid": "f2b2b93d-0941-46d5-a115-eebcedcc8c7b", "comment": "Malware payload (Formbook)", "value": "778fb400067e1de625dfa7e62e7091cc28e75fc44673562dc193f4b486fdcef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641821909, "uuid": "65cb3dff-d19f-41cd-a161-03fa8d501696", "comment": "Malware payload (Formbook)", "value": "ad236281f846b31c4912d77d905f4df87852ebf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641821909, "uuid": "b5da45df-13fb-477c-ab92-e3773cb9d0c8", "comment": "Malware payload (Formbook)", "value": "0f9f0c737a5bf7c26005274b58f346cd3c57ed42345943088b0308ce34ab5733c26eb528df39989021176b108ef0700d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641821909, "uuid": "40e09ab7-3b19-4387-90b3-636f17bd441a", "value": "T14DF4AE27B3D0C537D3670734FC0BA2B869163ED17A1898473FE86D5C5F39682B82946A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641821909, "uuid": "63227b75-2e57-4f63-90ed-937726c56816", "value": "49170fcdfee353b1aac6ddc5a1ee7657", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641821909, "uuid": "075961fa-cb1e-46f2-a23d-a34925d71403", "value": "12288:4IKaDZ7PYlbnRG5Xb0NIskZUDHMI3Os8eJ/M9/Tu7dK+/3yjc4uBd8QWOlsfF8h:VLD5YlbnRSb5sGUImXU9/J+fyAB5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641821909, "uuid": "cf500891-c969-43d9-884c-756628b93710", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641821909, "uuid": "9faa0f71-6cf1-4fb6-8aeb-53e2bc15a2b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641821909, "uuid": "3057ca48-af12-44f4-9c41-a29d77be68a8", "value": "csrss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdd823f-71ea-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1641801300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801300, "uuid": "2c9221f4-eb68-44b2-ab92-eb0574a1435b", "comment": "Malware payload (AveMariaRAT)", "value": "14c38699f354c43d41598113561cc104", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801300, "uuid": "f3f38fef-d174-4e0d-ae9b-ae0cc4d03627", "comment": "Malware payload (AveMariaRAT)", "value": "78a6203d938c1509afa28e37ef7a14e27da4346f3238097485621ffd180b2f99", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801300, "uuid": "3a4f90fc-41d4-4aa2-8c14-8a921402f9f5", "comment": "Malware payload (AveMariaRAT)", "value": "960b5bf90f96afe26f4b6970b7022e410b65079b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801300, "uuid": "dff55858-67ff-4a4b-be61-a3fa09aa5b26", "comment": "Malware payload (AveMariaRAT)", "value": "615e7ca2e5c9231589aa999503862f88fc39674b827b31ad1cee8314b057298311377b72171380e818eaf03e796c9395", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801300, "uuid": "5e8379f5-2fc3-4155-84db-3ecb0531a62c", "value": "T1BF259E8975C070CECCE7CAF44975DC339A617CB68626C00A6C8F395A767EE968E0C572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801300, "uuid": "ee23d307-57bd-4545-81b8-57e88701c4ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801300, "uuid": "8c2cb8b9-7aa6-448b-a4a4-3eaa60784885", "value": "24576:GY1+B5BT9cCuIr3PyVNn2H/Jq91iuf3RndPpnQP:GYi5d9cDIr/gNnYJosuZnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801300, "uuid": "a3f6f920-4b7b-4072-b5c2-d10c6668a6b0", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801300, "uuid": "01f0c403-53af-43d6-ac4c-d6ce0a9a4544", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801300, "uuid": "a294db72-667e-4d24-9e9a-e7206036073f", "value": "OCHASUS33XXX1030317110006FC.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb747f8-7239-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641834992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641834992, "uuid": "d2a13ff2-8887-47a1-8ad8-f2e32280045f", "comment": "Malware payload", "value": "7b712342df63598442753537618a440b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641834992, "uuid": "7aae7334-9eea-4f86-a234-1363d6aebcc9", "comment": "Malware payload", "value": "793745e4bfd94b8f8ffc26d0d26b72563768947ee2eb988c9c1da1183698204a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641834992, "uuid": "a2aebda1-1c08-4b68-b676-f64b386678f0", "comment": "Malware payload", "value": "975bcad1b4a0874bb0718a06a1c2dafd7526e200", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641834992, "uuid": "424f7b8d-acce-4697-ad9d-664ae4354707", "comment": "Malware payload", "value": "81d874e1f295ab9d07561b0db0552b7341e0680c0b0b29f191a2fc80362a23b020287adca132a507b679b404c62be143", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641834992, "uuid": "e59dd12f-0ac5-442e-a7d2-28e959211755", "value": "T1EB75332D220A9075E6C1B93472810BB7B97190A9618F195B2F8F50F52B7DC27F532ACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641834992, "uuid": "61f28abb-6a52-4301-8c5b-5b4d0df88891", "value": "1ae9f1d4c13c68c0fea04f0c906c2597", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641834992, "uuid": "40dbaa79-ab46-47d4-a3d3-e4a43494df7a", "value": "49152:9uoKluKZBrLJ1kjvT/LuL+QZkYCBGaXy+J4W:9u9DZ9LoveiekYUVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641834992, "uuid": "c8afec99-a710-4b40-b20d-bf4bdbf8e69c", "value": 1636864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641834992, "uuid": "d59aa5d0-14dd-4d39-a36e-9d49f98181b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641834992, "uuid": "ad32926a-fc63-422b-8101-1fcaf73fe1b8", "value": "ckoikaw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35aae004-7256-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641847513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641847513, "uuid": "66ed3446-295c-4901-bb0e-ab81624b01f1", "comment": "Malware payload", "value": "84465f99c3e0335d1465aa49ab60da64", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641847513, "uuid": "a7e7bccd-e71a-469c-a134-bc3b6babb833", "comment": "Malware payload", "value": "7af49572ee23aced70e99bf7ab1923ac9d58f9ba5dd0dcf5ddbdf95d795b40b6", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641847513, "uuid": "ebcced9a-b0e4-49f4-b0fc-bc4044707116", "comment": "Malware payload", "value": "dbd782cfd66704e7b2bdea3fb2c94a9147511c88", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641847513, "uuid": "e0f75de1-25a0-4893-aafe-b9ec1a3472ba", "comment": "Malware payload", "value": "d121ca5b2d332ad9167bba64f3d7aa954e919b27b482cb99fd25421e862d51b28e77bf3def53f141b89046973f542995", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641847513, "uuid": "4521f17b-ae8b-439d-b410-ad4521670876", "value": "T16C1259E31AF4B9D4A2AE6203D6F4376843351C73B7A9BE5735C2E94608239C19CC25F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641847513, "uuid": "cc077618-aece-47db-9d17-983d4cc2ef04", "value": "192:IqZOtPPRdkWHegBvCdMBoylC4T+AO6F+OXVRGzpu:IqCPJd0gzPTTx3ZXqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641847513, "uuid": "7408f1fc-7518-40b5-88d3-93ae782368f1", "value": 9401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641847513, "uuid": "d9f2ad97-36c4-40d8-8684-c3216ecad004", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641847513, "uuid": "0e0ac4b7-e4bb-474e-a507-424307ece7e6", "value": "swift.factura.pago.01.03.2022.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7f77a1-725b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641849994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849994, "uuid": "630b630e-ba4b-4e9f-9fee-163830325cb8", "comment": "Malware payload", "value": "e33c387bf187aacef0f2257fe6a61ea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849994, "uuid": "5eef4db6-976a-4232-8565-6064a1b5f5a6", "comment": "Malware payload", "value": "7bb8d00e98c432d123ca538aa4af62a24d927d4cf73aa8ec4bf4798d6f94fe25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849994, "uuid": "229cb27f-f81f-4fbd-b030-8aed26dcaeed", "comment": "Malware payload", "value": "104ff1b8ff61e3ed3fe85565184bd6541dcd4d9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849994, "uuid": "09732c9f-01fc-476a-8d22-ae25eab065a6", "comment": "Malware payload", "value": "f049d453e0d231b93597635540f4b0b175f2b3e56bcba4e8b75c0fcd909c8749be89960035edd65a790d2a8169fc2921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849994, "uuid": "bad22423-b1dd-4255-8368-72d31ea3a4f1", "value": "T1F1363306255E64F3F897F67F097E506B86735263E7F818B34B28338D039C993589B286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849994, "uuid": "2e3d5bbe-9525-4da0-a83d-2086c8c43240", "value": "b8ba55866bfe7b49b97c43084c1885db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849994, "uuid": "9cb400ad-423c-4b43-89b4-46f941216a1e", "value": "98304:07NzepdYAq9sfSveduDP/+vnV5A1xDFNIBfKyywAxGGHklgV20HRkyX/:SNS3Q9sfPgwV50hMfdywQndg4pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641849994, "uuid": "50661a7f-bddf-4724-975a-52db5760c87e", "value": 5255680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641849994, "uuid": "ba0988b6-2740-4358-9b8f-5a0fe97d8267", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849994, "uuid": "6d5f38dc-a8c3-4092-885b-0c1dee7a3580", "value": "e33c387bf187aacef0f2257fe6a61ea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816e5941-7248-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641841627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841627, "uuid": "6261a6e0-a8da-4be3-a3bb-632a2597bf5c", "comment": "Malware payload", "value": "05143be184ef5c7304b5ea7e5b81c73b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841627, "uuid": "35eb332e-b75f-47f9-a143-15a17c5cf488", "comment": "Malware payload", "value": "7c509612702a20c66fc6df9218f88496e096e5cc13e6fdd138f9c75e265387a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841627, "uuid": "905be89f-014f-49b4-9848-47c117a2518f", "comment": "Malware payload", "value": "c561a1a09776d0ec35af90e192bf2ec59839ace4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841627, "uuid": "206d6d93-71cf-441f-aa20-4035df007ebc", "comment": "Malware payload", "value": "0ff03685e91f02d697b092e3899013047373f447d3e767825a4f8889fbdd1c4184ff65417fc0c27c4c210971d8fe32f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841627, "uuid": "88184ae0-9430-43a2-bb17-41cdc7880131", "value": "T164E52306B99F3FF5E562C0B3D224E436C64325106EEB085507249B7D3ACB6631B8E9E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841627, "uuid": "801614ea-fd9f-447e-9e66-295c65047bbf", "value": "45c3eee06bcd5ef7518bc946e1677c4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841627, "uuid": "a98f4e25-b72f-4a8b-aac0-482b991e0917", "value": "98304:FZn4XKbupaE07DYiBI8r1QbC8QNv4/rvUeX8SIm:86buAEkDYerC2bg/TDX8SI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641841627, "uuid": "6a833903-2513-4c34-9b09-274ac79e4369", "value": 3304960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641841627, "uuid": "29fc9d48-8ca1-428f-b642-be07d8b7099d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841627, "uuid": "fb23ac85-7ad3-4f03-a059-714dc71c4a03", "value": "05143be184ef5c7304b5ea7e5b81c73b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fd9c6f-722c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641829689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641829689, "uuid": "f2f8f053-5b10-4726-b5c9-c50fb15df1af", "comment": "Malware payload (Formbook)", "value": "f32ff36c15687c954844f1ac08736b8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641829689, "uuid": "deb5fa18-9d6b-41a8-a860-824efa4d7e04", "comment": "Malware payload (Formbook)", "value": "7cb0a06f7d34e3e89e90112768ff4a8c66897ea5a10a880c9aface1d544c3b2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641829689, "uuid": "926683ca-b1ed-42c5-aa79-2a0539da60bc", "comment": "Malware payload (Formbook)", "value": "4402306d329dc7f8606fc31d29e771f7ab4cf14f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641829689, "uuid": "6bbb9e5b-c451-45be-809c-2b4e902dbb98", "comment": "Malware payload (Formbook)", "value": "915879871afaf582b0cbcc389cac28224b0f80fa0b2e6df756a88e60208e0f3e128287550244e4724187977f2f90b522", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641829689, "uuid": "61d8bee4-542b-4c12-9899-5df1950c0159", "value": "T1CAF4DF067B4AC902D6790673C58FC2B447B46E44B553E32B69E93E6F3D223A178086DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641829689, "uuid": "95ba322f-f7a8-4aa6-b996-f10e8384bf2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641829689, "uuid": "c748348f-4d55-4dfb-a189-90792d66a2d3", "value": "12288:+E/lKd2SiBwtDTmilHq1QjlCImcuSOiRL6HWriYDRJTyUiU9tutGG:J4dKutDTmitq1QJRmAOs+HWRRpJiEgGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641829689, "uuid": "3bb8c4a7-b51e-4481-bc58-d1e199eb382f", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641829689, "uuid": "6c0fbdeb-61b3-4690-8607-9df98129cd15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641829689, "uuid": "761c13b8-f103-4419-8061-94083ea0fa5c", "value": "f32ff36c15687c954844f1ac08736b8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16cf20a0-71f8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641807089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807089, "uuid": "48827a63-6ea4-4109-98d1-fe8e33a7a322", "comment": "Malware payload", "value": "e825565216f6397a04fde97547b5f106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807089, "uuid": "ed231dd8-a914-4fc9-898f-64fb5dcfff69", "comment": "Malware payload", "value": "7e0039e89e08c86ef23875cc3abb955184c389bd51f491218da2fce7b824bdcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807089, "uuid": "6cbbeda7-6665-4a31-b9a1-2040b60fa29f", "comment": "Malware payload", "value": "c7d3eac92ba99c9b2787ed4245e633d708b3603d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807089, "uuid": "29b0b4cb-bc4f-4c81-8299-c761b5063089", "comment": "Malware payload", "value": "03b876d2638078f6008d29787b2d9aeeed9d860fcd70a3bae67924946242b0cc6303656358f54f3ca84e35f0d9ec3f48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807089, "uuid": "a9fb5c04-d2f9-4cf6-9bb1-fd5c76713a30", "value": "T1E0B2CD96F5E4509DE189627806A2437A68257C3D5848E84FFF45BF5F2CB42C2B4F0B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807089, "uuid": "48ee1689-3b78-42a0-b4ab-333417721266", "value": "0bf9136bb9c49b909aa5e2a7af9a8048", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807089, "uuid": "bbbe4498-a3c2-4eaa-ab4a-a86f6f7c63f7", "value": "192:/TakmpXXpTTpNHmpNp6T1nfqV7iU4aaR9nsqV7iU4a7RPLeI:/TahbnA7iU9Un77iU9BeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641807089, "uuid": "7dedf3ea-0708-47b7-ad4f-821064b0ab6a", "value": 24582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641807089, "uuid": "51644155-8464-4831-a3d7-3798b335ab16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807089, "uuid": "7de7ae3d-7f66-4794-9a27-a05b0568af0b", "value": "e825565216f6397a04fde97547b5f106.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6bb829-71fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641809734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809734, "uuid": "23d7dd6a-f599-4aa6-9d5c-822d8bf8fea9", "comment": "Malware payload (Mirai)", "value": "85d12a0e0526b1457a77509729334b0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809734, "uuid": "caaf3b7a-dd7d-4a2c-99a7-c138220015a0", "comment": "Malware payload (Mirai)", "value": "7e2b0061035b4427f0365d28aacfe903b6c57f91d084c7f313bc8cd8fb0c7d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809734, "uuid": "1297485f-ab2d-4740-bba2-4352500ab168", "comment": "Malware payload (Mirai)", "value": "71782637b9b2d857eaf16992e53fb8f26a6005e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809734, "uuid": "44dbed88-47f6-417c-b0a6-d22d795ebeed", "comment": "Malware payload (Mirai)", "value": "c0acb2eb07c2e8ad67804a85d354bb721e6f703bdbb6f8e4740619a973ca99419f0038fb87df6b8fcb4f5e9a8d0b875b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809734, "uuid": "baf50bde-076e-4481-9c00-bc864dedfd81", "value": "T11E33F166008792D0C335A8FD97361D91B7AEFB2DE4D5A51813D6443CA0E33CDA69EDC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809734, "uuid": "b79c6d96-9d93-41bc-b3d6-33298174a81c", "value": "1536:DCS0ygh/q7yV9EyLKUbPHmH4qdL6U7MevHCHU:wJquoyLKU7HmrdL6U7MUHC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641809734, "uuid": "ce92efe8-023b-4a31-96bd-725287f51639", "value": 53556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641809734, "uuid": "7c6cd08d-3fc4-45a3-b6ae-6191d84f1504", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809734, "uuid": "be65a6d9-9968-4ae9-8e47-39fc2948edd5", "value": "85d12a0e0526b1457a77509729334b0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138ba210-71fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641808801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808801, "uuid": "9024d1ff-ccb0-49f1-aeee-ae5efb76da37", "comment": "Malware payload (Mirai)", "value": "41e9257b418b90f1db5dfe8f881e8ab6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808801, "uuid": "3c1831bb-1f55-48df-94c0-5e5dd779d404", "comment": "Malware payload (Mirai)", "value": "8088c679efe9f2ebb6eb7c8e6056a62e9c425603fb77a0d5138c60226e933785", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808801, "uuid": "c444d232-0f2b-4325-8fbf-d5913b3d55a9", "comment": "Malware payload (Mirai)", "value": "85ebd075b2be1a320e94e4ed263ed276b2cbcf3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808801, "uuid": "9daeb321-bd9a-45a1-adbb-c3327ba94574", "comment": "Malware payload (Mirai)", "value": "ff18c2e80ac4a5f7673f5ce305ef1eb828c9ab002c76f2e45d9c93e0a544f154d82c6a56c13c76ab9760ed317aacc409", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808801, "uuid": "3567b481-ab27-42f4-8394-15e65b742722", "value": "T14DC36C22B93A2E17C0E064BA21F34322F5F657CD25F8C61E7EB10E4EBF24550255BAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808801, "uuid": "699c3323-830f-48a8-bf68-f1bfe9e3a64c", "value": "1536:mWrx2WD2Hn5lbFLuD3Ph0nnkHyytSOZGFeVdKjPjORNBkipu+Q3T5+VgxtWtrMMG:9r88D42yb4ps3NiRM1wa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641808801, "uuid": "7092a04e-9073-46a9-87b6-57f217d99d49", "value": 127188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641808801, "uuid": "98addec9-f786-4a00-97dd-b1136517fb98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808801, "uuid": "fa5e33c2-5c97-42f3-9b18-b2c1f1e690b2", "value": "41e9257b418b90f1db5dfe8f881e8ab6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ea64f4-71ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641810474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810474, "uuid": "7d73d6e9-618a-4da1-a130-988a6cffc6db", "comment": "Malware payload (Mirai)", "value": "7648bf4741bcd427f0c9027061ac0056", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810474, "uuid": "ae78c19a-8c39-44e7-99f1-0e052cf463a9", "comment": "Malware payload (Mirai)", "value": "8130eb537e89289f125166f278446dea62bebc058694845841e0bb362c4b7fa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810474, "uuid": "611906a8-df25-4455-b900-5c5043bec280", "comment": "Malware payload (Mirai)", "value": "5a947207abefe1d07a6c995f66c09bc2bc767529", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810474, "uuid": "1115ca3b-82f1-43b7-9840-b91eebf86be1", "comment": "Malware payload (Mirai)", "value": "46d16027b49073803d77d387ff55fed8331d61e48f0f457a5de85b58c69ec3c55818e861209a18429ceece7b3c974cd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810474, "uuid": "e80daa02-0510-4a8e-ad04-0488e3788ef3", "value": "T16DB2D0E1F5DB820AE67C7376C65E36BF1D4A30252BED974C81680C43C3630A69B657D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810474, "uuid": "92731e00-231b-4768-9b72-2eed5988665a", "value": "384:MWZh7zrGuPdr9CfMDMCVEGQ0VLiNPTyhHslmgASaUw4GAeqQH/YeQqzjjO9v1RQO:5ZVPdr9C03mGrxiYhH6mgDxw4DEAijoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641810474, "uuid": "bce30433-fbc2-4c20-b22b-a638d9f2d021", "value": 24024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641810474, "uuid": "8cc1dac2-cd2d-496c-b162-c50a0c78918e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810474, "uuid": "7570cdb7-80a6-4b22-85bf-4ba73bc45873", "value": "7648bf4741bcd427f0c9027061ac0056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a048c6-721d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641823216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823216, "uuid": "89ff09af-bf6e-4616-add3-ef9d6eeece17", "comment": "Malware payload", "value": "71b519a93416b7bb061e4bc72cf4a3a4", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823216, "uuid": "0c225331-38e6-4a34-8f00-9955def9a09f", "comment": "Malware payload", "value": "820e35d22171cc0216234b2a360423a4855fd5c136fcfc9423d8d791d022a310", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823216, "uuid": "95248669-a497-4369-9652-69f4c77c1d0d", "comment": "Malware payload", "value": "b76c91ee07dbc2eb5c3347f17005021673195cd4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823216, "uuid": "c4dc89c7-cc41-44dd-98bd-05d462f3ac3d", "comment": "Malware payload", "value": "532aedccd001ce86b45fcfc07b84e0ff6e3ed771105a05f0468ea35b0b2bf49e5af5a50a012720d64fd1b81be980d0b0", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823216, "uuid": "d4429f82-dd5f-4e6e-ad8c-9b61623c3ee7", "value": "T1B206330C23AEF8FDE489492C3B6385B1C5E412F5D88225F2D6781594083F67E5BDEE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823216, "uuid": "2c76bb7b-9a4e-4541-827d-f249bdec06a5", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qM:0XSxVJG2fLAqFOfT9sMYNM2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641823216, "uuid": "412cd320-a66d-471b-abf9-2891c730ac8e", "value": 3682304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641823216, "uuid": "2732662e-4cc6-40c1-810c-f7bbdc793a01", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823216, "uuid": "39a2e171-50d0-47fd-8ce0-1eabc9309b36", "value": "820e35d22171cc0216234b2a360423a4855fd5c136fcfc9423d8d791d022a310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f60c24-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641797232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797232, "uuid": "ce26d96f-97d1-481f-8acf-6ad469016836", "comment": "Malware payload (Mirai)", "value": "505712de496b8d9ea0dfe869a72bc321", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797232, "uuid": "770723b0-95fc-49bf-8ca3-464b5a40ab8d", "comment": "Malware payload (Mirai)", "value": "82123e2a4ad50e4e68f8bd1b31af1c358c2f7122e7be11bdeba127db8015a677", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797232, "uuid": "82152f82-aab6-4342-aed6-6eb04f5bdcc7", "comment": "Malware payload (Mirai)", "value": "f060a2156d128aca115a197cb38e4b03ae9d4779", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797232, "uuid": "82f7a106-f725-46aa-9317-4482119f0d02", "comment": "Malware payload (Mirai)", "value": "042b95dbcd7c21027687b4c763652a2b3796afe393e6247f651494af8de2d41f99a9a1903ba813c0a10a4c09fc906460", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797232, "uuid": "234a79d2-3703-48d2-a243-b208840c3d8e", "value": "T105230112B2530EC3B282C4392E5D8D12D1AB8BF517FE36B70762413C66468CF56E5B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797232, "uuid": "90109d19-e1de-409d-9a1c-5872a6ec406b", "value": "768:/CkaJA+NbTVCITztWXe0volVxt9q3UELHGxs0bC1WLFq2QydYarR9cvmROxrNMY:wJxTzI/LlnWLFqi+8mvmoxraY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797232, "uuid": "7cfb200a-e2a1-4ae7-81ba-5f77386f3fc4", "value": 47824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797232, "uuid": "51d6d079-9498-4e82-a2c1-178789bbd70c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797232, "uuid": "f43fe0bb-db9f-4718-9c89-bd7e6c404ade", "value": "505712de496b8d9ea0dfe869a72bc321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ceed719-7212-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641818239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818239, "uuid": "7f2869e0-492e-4caa-b444-3190dc99bf5c", "comment": "Malware payload (Mirai)", "value": "22816a10546be5a1c029f2d9ef2ce30e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818239, "uuid": "634aa419-608e-4fc1-834f-cc488ac0e234", "comment": "Malware payload (Mirai)", "value": "841aecb3078491ed13bfe0d389938c491abd341f6ff56e4549e9e2a5df312621", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818239, "uuid": "8fa2c2d9-de7a-4501-aea5-a2a7eff6785e", "comment": "Malware payload (Mirai)", "value": "ca1a7e0ef85027a50b357630dbfc3aa37182fbc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818239, "uuid": "59ce9fb3-9545-44a1-994d-91c0f52cf1dc", "comment": "Malware payload (Mirai)", "value": "99f1b05718a0a43044b779f718ba995357be183ceb4a04d40bdb0b1f529f602c24db4f27b32edfbe74ec291026e8bb89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818239, "uuid": "c62f1ed2-b748-4c39-99e0-eee2f1057851", "value": "T1E0C2D0B0E3D4FC51F66E9AB56C5492C42FF08DE936B1EAD122106F1CF6821769606CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818239, "uuid": "9a58660a-1d90-4fb5-9e0b-d0e013b65c31", "value": "768:taD3MLQFKKeSNOZD+p1iHNLj2G4uVcqgw0RNWX3:t6q+KKesU+p1iH9jj4u+qgw0bWX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641818239, "uuid": "24985559-0fa7-4976-b96c-c67d93b84020", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641818239, "uuid": "45c49409-87e0-4499-9142-74e0b0f27448", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818239, "uuid": "bce7e062-5b81-4bea-970b-9dc3caea3733", "value": "22816a10546be5a1c029f2d9ef2ce30e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ce08a2-721d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641823220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823220, "uuid": "2356d0aa-5281-4bb4-9571-629b4a61b39c", "comment": "Malware payload", "value": "c434ee19af64bcebadd139103351089c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823220, "uuid": "6e5d54fa-2159-466f-865c-367b25a1d561", "comment": "Malware payload", "value": "8427be32ed02b05eedaee1d3842c39fc67280d4ea4309280e0ccf791227b9dd5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823220, "uuid": "b0ac95a9-1ea1-4226-bd5b-cc559e85f6da", "comment": "Malware payload", "value": "d220a540a9fa1192d5bc01964c0d5679df3ed6a3", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823220, "uuid": "0c579d1c-484c-4238-b9ef-247d7c57dbbf", "comment": "Malware payload", "value": "008e8711185af12a5004a055f49af85279d6ef88a9417744fe05e020a1837349843f62bb7adb07bec9d077f165863e0f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823220, "uuid": "defc8553-193b-46b8-b1a4-7ae55c7ad22c", "value": "T13806330C23AEF8FDE459463C3B6289A0C9E452F5D88225F3963815940C3F67D5BDEE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823220, "uuid": "e5fdd249-3878-498a-8c96-2b7fc06963fe", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKg:0XSxVJG2fLAqFOfT9sMYNM29g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641823220, "uuid": "2fd59027-7c7d-4276-9dde-befa8ff87bd6", "value": 3739648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641823220, "uuid": "5af73746-17d3-4dbf-a323-d36ad5f3a43b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823220, "uuid": "cd432dd4-58a4-40fe-897b-7120db7c8ad0", "value": "8427be32ed02b05eedaee1d3842c39fc67280d4ea4309280e0ccf791227b9dd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a05ae40-71fc-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1641808892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808892, "uuid": "93f035a2-c559-40a5-9f2b-ac8017baa461", "comment": "Malware payload (BitRAT)", "value": "08e0f6fc015b6008f3d0e583c94c8772", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808892, "uuid": "00ed6789-cf6b-41e5-a0fb-7c54620ca4d6", "comment": "Malware payload (BitRAT)", "value": "84e9426e79655328d7e51384cd16697772d5fa8043ef793e4777ec7e3c38c6d0", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808892, "uuid": "18bf74f7-0e9c-4528-a296-6c6d51c5e091", "comment": "Malware payload (BitRAT)", "value": "ea87a156303f0cd82266734f7f9678faecffa18b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808892, "uuid": "72d408a0-b757-4d4e-9e0d-05da6f85eb5e", "comment": "Malware payload (BitRAT)", "value": "63501734f527035b8108827d747f49b755b1294ed66cb9344f88e72d8628f148ecf1aee88e1b9ca3d151af9293b7d33d", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808892, "uuid": "23cc024e-f39f-4053-a42b-0b481fa96546", "value": "T1D135E7E46578D4DFF3A38332FC10B178B566EAC4658690463093EBB82837385256DB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808892, "uuid": "0ae5ce65-6cab-48eb-a4da-96251763f7f5", "value": "73bd01ba16664ef98e493e67bb6c3113", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808892, "uuid": "eb87bf78-75ba-4d38-bb8c-8b366c94f609", "value": "12288:UlNAmkC8ExB0Rnq0BMYztQ/3/nAxcNE+v0NpXAAAAAAAAAAAAAAAJAAFEAAAAAAN:o6mAExmRFMYSPnOcNE+997J+fyAB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641808892, "uuid": "10318e16-fc00-408f-b97b-86cb3012c081", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641808892, "uuid": "eaf80cbe-280a-4edb-84d1-ba94824efb18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808892, "uuid": "e00ca1f8-0046-4203-8c82-1be89f2c4656", "value": "RECEIPTUSD97.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68b2d54-71e7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641800162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641800162, "uuid": "20394fbb-2df4-4b8e-9120-882d263c86a7", "comment": "Malware payload", "value": "936274be0d0b8b9e2679898d54409b31", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641800162, "uuid": "03158fed-7da7-4122-b451-556bc750e499", "comment": "Malware payload", "value": "8542bae8ca5e29462fc1c127103b38d084005e18e843a5ef075c7e331a75bae3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641800162, "uuid": "c59749a4-be95-42e1-a79d-fadd77c2284d", "comment": "Malware payload", "value": "5d0c52449086210ed600a5d4d05aa63260a00c19", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641800162, "uuid": "9a1f27b0-3a8d-4110-aaac-6cec0ee7d57f", "comment": "Malware payload", "value": "48d252d836ff8519a0994b45a917614398fdcd217b47f26f27ca7fd8aa3822a40e60813b8140ec8e26f3e2d86d1269e7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641800162, "uuid": "b752d9da-5924-4cac-afd7-43e0213282cc", "value": "T170427CE941A708AEF38D71F990D431CC832637A5A8178E4932309F244B6F4DA3E4FA49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641800162, "uuid": "c81b1eaa-ff73-414a-825f-7d56118e4d29", "value": "192:RddlSLVxbAi8HaxsC7sCAlxNpwMU7mF3gSOX9vtmfGQTYYLfC:R0LbAgOCICAlDpmaQxXb6XrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641800162, "uuid": "7c837419-9843-4089-8eb2-7c9e2d342f92", "value": 12899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641800162, "uuid": "0316237b-5bd2-4b80-8974-7b5acd68e587", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641800162, "uuid": "1feaf137-94b6-404d-a7b3-6b7ea5d56cce", "value": "Quote.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3e1f3f-71ce-11ec-9275-42010a9c0029", "comment": "Malware payload (SpectreRAT)", "timestamp": 1641789381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789381, "uuid": "04fc479c-95b3-4c53-83c8-ea7d5417da47", "comment": "Malware payload (SpectreRAT)", "value": "6c59169b97872d5c4d49ffb4739fff1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpectreRAT", "colour": "#36A581", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789381, "uuid": "99ec1822-b5b0-4eeb-bde0-f8967b0c9d6f", "comment": "Malware payload (SpectreRAT)", "value": "8737889b676e5b9fc9511cb9f2bb692032e944739d8d77e4cece07395014f16c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpectreRAT", "colour": "#36A581", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789381, "uuid": "8ba15d49-5c79-4004-9b1f-05c2adc16ad8", "comment": "Malware payload (SpectreRAT)", "value": "1d58ddc670cada78ce42a24d53addfac251602cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpectreRAT", "colour": "#36A581", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789381, "uuid": "1d109508-096b-4b14-bf97-fa47dbad8f50", "comment": "Malware payload (SpectreRAT)", "value": "df40c375cb7c86afa4717fe3066e920a28bc52534a26c2222b6e334ec3a30975158f30724cc7a1bbd825e70257f65bd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpectreRAT", "colour": "#36A581", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789381, "uuid": "ebff7646-d2ec-4ca1-8f85-1f83d45e518e", "value": "T10EA4C06076B2C472E83951B44979BE6DBA7DEC2544608F1B37C018B5EF30AD0E6237B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789381, "uuid": "81da1031-32ab-4625-b307-f66087af2362", "value": "1c8e1f115042b1cf856f2c4589f466b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789381, "uuid": "57f1d183-4064-499e-9792-b33c8eede56b", "value": "12288:Ivd4Ub8mGvS6skQ3oQsGEE6K3P5iUPaBzbduEmnle0SyQv/ZS9LM8UDwKtlWLJBQ:kd4IoHuU/Hprf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641789381, "uuid": "3fe92b69-78b4-4bd3-840e-efb889f5c2f6", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641789381, "uuid": "14c1cd8b-0327-4d36-8e43-87daaf30b8e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789381, "uuid": "feab14ae-971b-43a5-a98a-09b055fe6df7", "value": "6c59169b97872d5c4d49ffb4739fff1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ee3d2c-71ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641810439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810439, "uuid": "2c12591d-f5f2-4601-b5ce-f47c159e5308", "comment": "Malware payload (Mirai)", "value": "721caec61ebbe3359d486e2bd210cb7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810439, "uuid": "6d4f16ca-c7c8-4a98-9f19-fe66a328e96a", "comment": "Malware payload (Mirai)", "value": "87a6e21877ca2473c71c7a13923ef80b8a7e5748b0e4a94baff400e2907cac78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810439, "uuid": "ec262da4-dd59-4e94-942d-e4c304b1f92e", "comment": "Malware payload (Mirai)", "value": "96e5ac33ff2efdd3e10b36f9b562cd18453906a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810439, "uuid": "52a56caa-7cc3-4a02-9f7b-9db34794b928", "comment": "Malware payload (Mirai)", "value": "77b139c398849954a5a7bc05e45b7ffe6139c475ad61f5631c21b7689b51f46c3dc67772b435f56a9e187d73ced44706", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810439, "uuid": "6ec5967f-f909-46c5-9928-60db3b47c439", "value": "T1C77319B42A86F27CEDF190B8E44321D528B20A183BACE5E375C7543AEF65B0C7279D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810439, "uuid": "3dbcda2e-c15b-46be-8afc-9c920661e489", "value": "768:mkUnBljgg+p0d3zGi2V5UWF8tKIZw/a9/W4yvWjAOqslp4myzmX2ZvB:3UBljgNYYUWSnZwi9/WbAqslpYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641810439, "uuid": "b6661f0c-6cf9-4e69-9b39-184a5189b96b", "value": 75132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641810439, "uuid": "4eb55a81-ddb9-40d3-983a-e231343b9dcd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810439, "uuid": "d81a1f98-4e89-43ba-a151-b728a1b4ea13", "value": "721caec61ebbe3359d486e2bd210cb7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc9fb66-7240-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641838074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641838074, "uuid": "cb9ad089-a41f-4a3c-90e3-2aed81cde7fa", "comment": "Malware payload", "value": "5b623a4d1adbc236c1c11fe8e9630188", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641838074, "uuid": "6cc91289-4639-49e6-8837-37e7dd84e99d", "comment": "Malware payload", "value": "898046056f632515a0b36b5fd0e5ecb855ed2c4d307f4bf7512f7ea9f0f98f84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641838074, "uuid": "a22af6b9-c200-4add-a53f-f3dd6c9e0753", "comment": "Malware payload", "value": "d1c20b9af0ecead4206041364c1fd94dd618330f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641838074, "uuid": "68c5e795-defb-450d-97d2-35b15d2041cb", "comment": "Malware payload", "value": "b7312de14b4b686e8c5bcd43cd107b601f7ba64f6e69417b926a0e23834472abd10a255a6d2085c782b0f5f30ae7bee0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641838074, "uuid": "afac4cfe-5a33-4580-a4d1-76702302f753", "value": "T15AF35B3A0E3941B5C3DE99FC77E710BABDF48217032A9223C9237D1D8A7A3A4E56D550", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641838074, "uuid": "a2e06cc0-e0af-4765-a3dc-5f7a314447b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641838074, "uuid": "6127895a-9140-4fd5-9b5f-27b7811ebcc8", "value": "3072:O/iGxbSbQnuzQCaooNjoHbZXGjZz4Zgz29Y0z7a36M0SqXtoOLYV:O3bPhrNUHbZXYZz4ZgS9vnQ6ZSqXmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641838074, "uuid": "4190657a-5d27-43f8-84a2-b8e6a457ddad", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641838074, "uuid": "6a1059ef-20eb-4815-bb69-910cab976b53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641838074, "uuid": "48c36756-85f3-4a3f-9b82-d7b330a641e7", "value": "5b623a4d1adbc236c1c11fe8e9630188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f896aa8-71fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641808821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808821, "uuid": "3530c363-af94-4bc2-9e5d-b7f2b14f448d", "comment": "Malware payload (Mirai)", "value": "b62e39d848c9798294518cb8b938f18f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808821, "uuid": "3755a77f-d609-4e6b-bb01-55c95338bfc6", "comment": "Malware payload (Mirai)", "value": "899df535cfd1f87ddb680e3038af31b28d86668a848b038cb4537997a9d54951", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808821, "uuid": "1f5492b8-8ae6-4222-9afe-bb576fa26fec", "comment": "Malware payload (Mirai)", "value": "28faf40131fabe09ce947ba95f03a47d5f77f6fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808821, "uuid": "32cdc7f9-e100-4b89-9514-fd52d98d3ffd", "comment": "Malware payload (Mirai)", "value": "c3717d1485aa510b4edf02321bec496962eaf9a65a4f40c32e9a5cd1e949b65776b5e3af7dae7a50818e7d45bf7e2db4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808821, "uuid": "01dc9249-64f3-42ef-984f-aa0f40ce6209", "value": "T171C34B12B3180B47E0D31EB0293F1BE587AEE9D021F4BA85294FDB4A5572E77154AECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808821, "uuid": "3456760d-f5d5-4d44-88b2-25365fa57cd5", "value": "1536:h2S6YaR5XPLsRolOBmzpQDPP2odl0QkIeZzTS0cQbMqa10CXsN:hhaR1YRolpw2S0QkI6zff0Xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641808821, "uuid": "9727afef-63a1-45ba-b1b4-8db3ea632de6", "value": 122108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641808821, "uuid": "ba1e02ca-430d-431f-8f80-dd8fa59e0c1c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808821, "uuid": "9bb4664a-c657-4b6a-a63f-d4d11d019c77", "value": "b62e39d848c9798294518cb8b938f18f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec93931-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641797250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797250, "uuid": "594ee167-5322-447f-87f7-74e14dec36b7", "comment": "Malware payload (Mirai)", "value": "5491961d3be868255a1dc4cc4d56b55d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797250, "uuid": "a1b5840e-9c3a-47b2-9793-f89f9cd63ade", "comment": "Malware payload (Mirai)", "value": "8a03350a9880058b6a7f497de7bc74525575f1a89b5bb2f1fc81b9e0baeb69b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797250, "uuid": "a2a6cddc-85ca-4010-8509-282a22b1ec8a", "comment": "Malware payload (Mirai)", "value": "de94ec6c8c55d625094a951cbe600d0dbfe75f17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797250, "uuid": "47c26c0b-2b53-43a2-ba1d-35ae9b34b287", "comment": "Malware payload (Mirai)", "value": "7d9b5a4111361e9d9e784cc7abda8e4b81925ecae990dfcf95064e053a1fb9241d172ca0bce7e462a7e341526e8455e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797250, "uuid": "7f2c77d4-a882-4c28-8707-d663a23343c8", "value": "T1D8437C60F6706CB4C80016B4BA68C5B4C393ACA860D22CF1EFDDD9589477E69F0DDBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797250, "uuid": "d1365c9e-ee4e-443a-bb0c-6a8f70bf3b1c", "value": "768:vx0N1fvayjNgNiPJjyPTjP24BdcF3jm0RlHVWulxm7KJuCsABs:dyjNciPJET72eelRlHz8Cl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797250, "uuid": "ded9efe7-1fbc-45e1-8cbb-2b01726d2f36", "value": 58052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797250, "uuid": "9083011a-58bd-4062-83d2-85d632ba08e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797250, "uuid": "88317c72-8ce6-498f-97f2-e2ac7b2a5040", "value": "5491961d3be868255a1dc4cc4d56b55d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708ce728-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641805951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805951, "uuid": "470ee7a1-41e5-4c7b-a076-b8344dbf9db5", "comment": "Malware payload (AgentTesla)", "value": "623168c36d3ded3a5797d7de54f89a36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805951, "uuid": "6a6f510f-3dbd-46b0-bf9d-85b088b5919d", "comment": "Malware payload (AgentTesla)", "value": "8a33dfbb3427f09cff3337e1feda1f1e83713c1cd211869d985d233d2ab70364", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805951, "uuid": "22b4ba54-3149-4d2a-9fac-2cb6c8505dc3", "comment": "Malware payload (AgentTesla)", "value": "dccefe700ca6567dd2781344934616426f46f09f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805951, "uuid": "0fcad38c-0d2c-4a97-8832-e3502a517064", "comment": "Malware payload (AgentTesla)", "value": "0b3648423ac663d8f19c491aabead79c4ec2751ccfadb633dfeb8698c29bc495f974554ee61dedc52680871bca115fd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805951, "uuid": "904d30f3-421b-4b73-b569-e67bcd16da5f", "value": "T1F684EB51912E3C6FF62FE81C1593E1C8386EA57AA4F0056C939EF014DE259EAED8C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805951, "uuid": "5fb3fb1f-e1e2-40a4-b598-8fddb2cad96e", "value": "1536:i/pDDDDDDDDdBhTBE24harDEioGnOoQRtTlXZVOno7hKfedzFz76mAg5eeVhMDwq:ixDDDDDDDD7YbldzFtr5RDAw5wfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641805951, "uuid": "64443d7d-456a-4b82-930c-8a5ad6f2d224", "value": 392926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641805951, "uuid": "eb748c05-9191-4f30-b500-601e060bc71c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805951, "uuid": "0a68b4c4-7857-4af1-b564-3631a43a0039", "value": "RFQ56767.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cc8373-71c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641783604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641783604, "uuid": "722bb368-f115-46fd-a035-f52bfc03ffe8", "comment": "Malware payload (Mirai)", "value": "3e4bc9d2478cc5d593afaec1a3ed7046", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641783604, "uuid": "7ab0fd10-f532-436c-a4f7-225e9cb5c432", "comment": "Malware payload (Mirai)", "value": "8ab0698b79c241f3ac342e8e33df00b1175e1c8444781f72a87536eb79f1c31b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641783604, "uuid": "75bc1223-72a0-4408-8615-21fdaee23422", "comment": "Malware payload (Mirai)", "value": "dda434a845b807c834306d74be448dc291925ce6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641783604, "uuid": "13216df4-45a5-4825-a09e-99c85b6af47b", "comment": "Malware payload (Mirai)", "value": "b57e3372a06f3c8d88bc2d4a68fde61ecc8b8afefd1bad2e850411df6cd2a091e2f70f88ba4706a55b06f4f6ea350928", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641783604, "uuid": "5a829287-72fa-4e5d-8169-89bb5f58b5cb", "value": "T167D35D46EA808F13C4D527BABA9F41493323A754D3DB730689289FB43F86B6E4E37505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641783604, "uuid": "58269b6d-a28b-4a9c-a719-cefc6dcc5e45", "value": "3072:6s7rIVJ/crRDvaYJi7EJbfkBknsO1CKRUExqYtBlwSRKTE0M/9pH1qke2:lPoWdDvaYJi7EZfnCKRUExqqlDKT7M/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641783604, "uuid": "cb745456-53e3-4500-820a-4a7ff15788ae", "value": 141100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641783604, "uuid": "629e99bc-e71c-4355-86f2-98816b2c5713", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641783604, "uuid": "ebabd61c-f67c-431f-afd4-f139d8343824", "value": "DEMONS.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bcb2f6-7212-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641818245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818245, "uuid": "e760cdde-5514-428b-b75a-d1159d0542d9", "comment": "Malware payload (Mirai)", "value": "89fbc7c541d9104bc0bbc67dcb721c3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818245, "uuid": "5961cb9b-a9c0-44fb-b3b1-4125378294e2", "comment": "Malware payload (Mirai)", "value": "8b74d8fb258ece023d9305e2faecb5d223204bc1a7ae888601d5ff7c1fa8a3da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818245, "uuid": "e09f0237-cd42-4efa-a792-92dba7a8082c", "comment": "Malware payload (Mirai)", "value": "da59867c4bb6193febe5d86cafed1a2715831ab4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818245, "uuid": "e3f4e7e6-5945-4f38-978c-261dc6fb06d2", "comment": "Malware payload (Mirai)", "value": "2acb04670b9aaa7973e2673a99e81c471c4cd0b0179e663f474cdeccd028139fd0b7527ae5014c6244a08d147e0e1c21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818245, "uuid": "a9beb7c0-c249-441e-a208-8157ddbc2dc8", "value": "T16DD2E062EB28BD17C5F10F72E6FE060877181C5CAAFE3B6712550A25AC9114BDA9D036", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818245, "uuid": "a207b89d-64ab-4804-a924-4bd8affa3efa", "value": "768:zUhFhsBry9UNzP/2jPejvop1VQC4Dw9/bUYq3UI+V:z48vzGjPejApQCN/of4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641818245, "uuid": "ba202586-3d14-4e3b-bdbb-9e548794ad41", "value": 30204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641818245, "uuid": "47db7380-7d49-4a4d-b768-efb679824195", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818245, "uuid": "b81b5048-1967-4b3f-aff8-5705d5eab6ab", "value": "89fbc7c541d9104bc0bbc67dcb721c3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f919f81b-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641806180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806180, "uuid": "8b3b806b-78be-4955-be73-674c54eacb64", "comment": "Malware payload (Mirai)", "value": "844e491577d646354d68e63239aba6f1", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log5j", "colour": "#3789B9", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806180, "uuid": "aefba4c1-f1cd-4fe2-ac86-c7352322b51b", "comment": "Malware payload (Mirai)", "value": "8d236f3ea9db3a01b65c4e806913eaf8f5c13c4f7f3949a7970fa64bceb05423", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log5j", "colour": "#3789B9", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806180, "uuid": "7786b309-4734-40fb-af3d-4ca6b3be350b", "comment": "Malware payload (Mirai)", "value": "6ec5bcf2573e5973d4d6ab7019e93645a7a64476", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log5j", "colour": "#3789B9", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806180, "uuid": "9523b60f-4eca-4133-b885-6e51567798f9", "comment": "Malware payload (Mirai)", "value": "f442998bd5ce9c64c2418f4fa8a9ae61c2828a06732d4be6705f68c1c4cf7fbdaa63b6d800b9f8590b962664a28c16f9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log5j", "colour": "#3789B9", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806180, "uuid": "6d2faea3-2477-4434-9294-e843c252a595", "value": "T1E9C2F0C184CDFF4BEA8441BD87CD067C598B7124C7FF8352C29D9ED690E2AE865E0248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806180, "uuid": "90b29b5c-3af7-4b3a-98b9-f75285ca5f30", "value": "768:L8SKQvyt98Gj6HyWj6JrW71X0OdedOdTuwtN3r:QaY8Gj6HNAInjdXNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641806180, "uuid": "baf40dae-c09b-4b4d-8afc-d041beb2e5d3", "value": 27672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641806180, "uuid": "330722e0-1a78-4e28-b0db-c29a3a0d9c04", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806180, "uuid": "310e7f89-fcb2-4dcb-8103-60b94747156d", "value": "lshboot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718ff3a5-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1641805952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805952, "uuid": "0ff8d03c-a2b2-4c7f-930d-777101f0c2a6", "comment": "Malware payload (Loki)", "value": "3a25edaab922d04f5e287452191d2dfd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805952, "uuid": "95a525c2-c791-432e-91d2-e410ee2ea602", "comment": "Malware payload (Loki)", "value": "8dac00305d1ec605a6a3c6ef3305a0b7fff955f7862f6d965906ab8d0d3607f5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805952, "uuid": "0e592d64-1a5f-47e0-b007-7ee5905468af", "comment": "Malware payload (Loki)", "value": "7a372534c6260dfc87e0c67d4b8a4604df68b652", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805952, "uuid": "a06889c5-20c4-45a3-a7cd-14f4051aad2b", "comment": "Malware payload (Loki)", "value": "0166964f0ca266e8b8d777ab7352671c6425af1661f04e3b36cacaa962d7b691834b1d648b0f51bc37a2992b53ccf2a3", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805952, "uuid": "3f415b16-4de3-48cf-a65e-e3f09a5f4426", "value": "T1B1641285B299474FECE84C7E9B2324068595EE3926C872DEF3177A81E4B33958B017CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805952, "uuid": "a4a909e0-2d42-48a2-8ebb-3058097410fe", "value": "6144:qypMhKa2Ci12jyRF3Dq4WIYlg7Itm3pbWgD7vWaZBCbiDMVZsF:qEa2lTFpWIYS7Ik7eoBBDYZsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641805952, "uuid": "142426b9-8336-46b8-9978-4f0f7c38a2fc", "value": 317688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641805952, "uuid": "71a3398f-635b-46cd-bd48-46a773b6ffa2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805952, "uuid": "26cfa3ce-6569-4ad0-88fb-0d7b3f803da1", "value": "scanned copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f19e74-7212-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641818234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818234, "uuid": "5045d4fc-e775-47f6-8dd9-8a413a6bd3b0", "comment": "Malware payload (Mirai)", "value": "c41a5b1c53129572bb9bf63755f429ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818234, "uuid": "380e5e78-4cb4-480b-a43f-de8a411584e9", "comment": "Malware payload (Mirai)", "value": "8dee031e40542caf19aa048d4578fadd83b709e0c8d9715fa278f4e064e1c6d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818234, "uuid": "c7153c6d-8fdb-4dac-8d08-fe6c0e9d9f4d", "comment": "Malware payload (Mirai)", "value": "17fb890b1add0bed3069a46980d5ab611ad49970", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818234, "uuid": "56b83846-5baf-4133-9208-308d2df5f999", "comment": "Malware payload (Mirai)", "value": "f06ccdc1de12bf47726a03ca2f56362df9cff1f4c1fd9c63a1a89d4c6d406aebccc67600025bbc6e9a9b6a6382d197f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818234, "uuid": "1e41da0c-04cb-4506-a7bc-d290329ac1e7", "value": "T198D2D0DD64A45C4AC6DD9CBEA5FF0F769844F444A22F874A1712CC829B2940FBD0F0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818234, "uuid": "08523c75-9f6e-4d8c-b00c-92507348ce79", "value": "768:o4ABVJHZ6x/j6HRNcZxOPzZjhuWoVC4WMy:o4WVJK2HRyxgZjhDo0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641818234, "uuid": "7748e56c-cc86-41ce-8f45-f366ad318811", "value": 28880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641818234, "uuid": "08d126c2-0d74-4f48-b335-08d8808c1c5d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818234, "uuid": "0f9e6b23-8359-4b4d-a4cc-129ef122b376", "value": "c41a5b1c53129572bb9bf63755f429ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932486fc-71c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641786252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786252, "uuid": "9bbf5ee0-cb14-49a6-aafd-078ae661d33c", "comment": "Malware payload (Mirai)", "value": "637946914293001079350b0b5328de3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786252, "uuid": "3cbbd05c-98f6-4361-83db-b2f702953247", "comment": "Malware payload (Mirai)", "value": "8e3cb43d6d4caa81b8f13d66f40f71e15e8ccf7c6c0abb19905d65dd8cf9abdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786252, "uuid": "3ed03151-7e83-4cbc-86f7-34f9cab9e8bd", "comment": "Malware payload (Mirai)", "value": "762930793c437e035495788d18177056ae063e59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786252, "uuid": "036a29ac-009f-4ce6-b701-7f75e256e745", "comment": "Malware payload (Mirai)", "value": "6680931c5b79b937ebe21382ba8b67e4d9c284d4b34b05716e8d663271e68a4ab7d1e1957293a4bdb46fa4ef5b9d553f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786252, "uuid": "1de52082-a194-4816-a68c-5d2f80601ea6", "value": "T1FE431945BC92CA2AC7D022FABF2E629C3311A3DCD1DB3247DD241B786ACA51E5E37541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786252, "uuid": "86975dac-f6c4-4357-ad6e-c8eec01c3206", "value": "1536:Q2ZwGOZfBWZqv+h0LueU5BdpKiM0raspY40EgiA5qwEW:Q2eZQGLchEiPpZxbA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641786252, "uuid": "d2296e65-e004-4996-b306-89b73aebb340", "value": 55792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641786252, "uuid": "b18fdba1-7e2a-4cae-b161-3da0d579be07", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786252, "uuid": "237cf3c3-0a63-40f7-9139-245b623cc698", "value": "637946914293001079350b0b5328de3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20195968-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641797226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797226, "uuid": "160caff6-ea3e-4422-bdef-c2b82a4f21f8", "comment": "Malware payload (Mirai)", "value": "e4feb6e22d2d2e4a5219e5f24b061400", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797226, "uuid": "5cba4a69-d3d9-4e0b-b877-28a061d3d3e7", "comment": "Malware payload (Mirai)", "value": "8ea3c198b5a0ac8628c25bcedd1efdc6b7f01680d98196eadb819b8125474619", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797226, "uuid": "24c8d022-5280-4560-9d1a-7300d363f9d6", "comment": "Malware payload (Mirai)", "value": "ceccc9b33cbb20bb04416eb46b1d01386c823c47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797226, "uuid": "3144f26a-5c05-4b45-9387-ccb20ee6502c", "comment": "Malware payload (Mirai)", "value": "d4311937b79340b16d0c629de9979a4f8588dde2f4a638dc5bfbd5174f5af90b3e4d138f3c637c29942408e3020ae7f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797226, "uuid": "73bd2257-ad61-4871-9c14-d4aad0cc9941", "value": "T160C2E11CF5494EE0E9E6DC254EF2F2D5D3F08E4E3A1AC297D1402E85A94F0125F178AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797226, "uuid": "822ee893-cd4a-4861-9d59-f72aae2cdbfe", "value": "768:HcsT/dNbQsxFsrhqemAucx5Wtw4I+CG4uVcqgw091:HdT/YIFomhc2F4u+qgw091", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797226, "uuid": "647683ac-7970-4cc4-b356-8899f265be4e", "value": 27452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797226, "uuid": "e4714783-5599-48eb-9aef-82437afe50e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797226, "uuid": "caa4ba25-1fee-48bb-8dae-03658fbed779", "value": "e4feb6e22d2d2e4a5219e5f24b061400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c152a4-721a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641821716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641821716, "uuid": "acba5d45-a830-4ff5-b7c7-a133d00cc8ea", "comment": "Malware payload (AgentTesla)", "value": "1cfdf6deda21201d6e20a00fb44ad4cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641821716, "uuid": "46937a34-236f-40e6-8170-50a9beff282d", "comment": "Malware payload (AgentTesla)", "value": "8f090fc39eaf8b0da0c40a08f17112763448b86331969affa0500e150320cb1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641821716, "uuid": "a69a6647-cda9-40e5-8938-51296c4037dd", "comment": "Malware payload (AgentTesla)", "value": "752d79d9a8bd39ba1d96d51040cc635a35f1fec6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641821716, "uuid": "1707824a-5244-4458-946d-096017feddcb", "comment": "Malware payload (AgentTesla)", "value": "ce6ac9ed5ccb43bef7f74fdb38d1bb8b786838610cab4ed5e25746474982b22129743360c5e4dfcd513f221c8c114eb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641821716, "uuid": "bf22b27c-d3d1-4f3a-8046-a78363369992", "value": "T1ECC43394425B2007D60161BA5B72164BF609005DADF0A6BB7E5A7FA8AF07CBC4CCF379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641821716, "uuid": "059a7b18-f793-4ce7-aa7d-90f77e93d6c6", "value": "12288:m4zmwNhFG2DnPztDdomN3YfdrcpVsJ9z6SgvV:9XFG2DnPJRoo3Y9eSgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641821716, "uuid": "8b1a3bbd-9454-41cd-beb5-ba586974992d", "value": 559122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641821716, "uuid": "47113a79-4395-4b3e-bebe-41789fa5b93c", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641821716, "uuid": "67faaeac-6412-41eb-95c0-c774ceb3b22f", "value": "Awb_shipping_BL_doc_0000000000000000023.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d6a7b3-71aa-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1641773834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641773834, "uuid": "896ead9c-1e47-46f7-bc6d-e84af1edcb59", "comment": "Malware payload (SnakeKeylogger)", "value": "d7b0fb799a977dcd0a043e1f68878a98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641773834, "uuid": "3aa62f70-5570-4edd-b5e7-9e7ee26898bf", "comment": "Malware payload (SnakeKeylogger)", "value": "915e729068acea1bc8cab8fa41bc5100988fb5c0106923d77518a52dfaa50a16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641773834, "uuid": "dcae1859-d4db-43c5-890e-1c96b4d40aec", "comment": "Malware payload (SnakeKeylogger)", "value": "9bfa0a9f1de35ac457bb20573d7081faa234f9e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641773834, "uuid": "d56c9bb7-af91-4a44-8ebc-6d7abeb060c6", "comment": "Malware payload (SnakeKeylogger)", "value": "05331eb57cbea51ba5be8ff81a72a52291abe768994ba448c92be27e9969849647d99f90afbfce07c3b311ff6b5f53cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641773834, "uuid": "28d762a8-9181-4df1-a88c-2b851c2c6fa2", "value": "T145160E02663CE8D3F98C6C7258CC8B6D2ED02C5D4536145EFA97B6EAD53F043E9212E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641773834, "uuid": "f4c9dbc7-c50b-46cd-8f0a-0e5c47021bd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641773834, "uuid": "5a8eb7dc-7da6-4046-b08f-600d1396760c", "value": "12288:U8xXd/oPgiFpJKFu9yRo7WDvOb2WzuuUrDg/HDskAJYAxvDp:NxdoPgKp8oyRo7WT6zIfcokAJYAxvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641773834, "uuid": "62c5bccd-c9ba-43a8-8dc7-548898d8c90a", "value": 4299264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641773834, "uuid": "39cb8f02-faac-4919-bf4c-c3dc96a688ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641773834, "uuid": "07d6434b-0946-4cb5-90a0-05e7a9c806e5", "value": "File-6012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d9efb7-7226-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641826819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826819, "uuid": "3f01c3dd-134e-40b2-9a90-8ff1f50ce1e5", "comment": "Malware payload", "value": "61e4db021dcfbc0c0e9e7fc28e314ca0", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826819, "uuid": "9da2345b-8c2d-49e8-b563-f27b7128073a", "comment": "Malware payload", "value": "91962f7c6bd2c65b0c6781e4a2798f81609edfb1c46350866f160c7da08baa64", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826819, "uuid": "b1616f16-2688-47c4-8073-301958ee555e", "comment": "Malware payload", "value": "062d15f5e4f1f848d6c5ca05aadcf1af5c221120", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826819, "uuid": "f1191905-f380-4301-b723-552cab151666", "comment": "Malware payload", "value": "b58db51e8964ba369451cacb17fe979179223c5306c8cf5e84bedaf6bcf91660236b18c477b9b7e766a97e714bd1df78", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826819, "uuid": "98b2a809-c338-4570-bff9-147cf27ad7c8", "value": "T1B106330C23AEF8FDE899492C3B6285B0C5E512F5D88225F2DA7814540C3F67D5BDEE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826819, "uuid": "4576738c-6f12-4b8d-9578-6546a8f7aede", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKg:0XSxVJG2fLAqFOfT9sMYNM29g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641826819, "uuid": "858812cd-c3a0-42c0-9224-dfaf6e1de2f2", "value": 3698688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641826819, "uuid": "18c3fd1d-7707-4351-aff8-1d4ab80ec997", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826819, "uuid": "cf7feff2-5213-4ee9-b1a6-952e4870d599", "value": "91962f7c6bd2c65b0c6781e4a2798f81609edfb1c46350866f160c7da08baa64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d8881a-7228-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1641827812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827812, "uuid": "c0a359b2-9013-4eb1-97ff-308019093b92", "comment": "Malware payload (RaccoonStealer)", "value": "bf7fdc94904235a35f69dd0179e95bc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827812, "uuid": "a0ac8bf3-6511-4519-b902-7c44eafadb08", "comment": "Malware payload (RaccoonStealer)", "value": "922a3412b7f44d7fe508a7cc97ac71fde977dd07025fa84a9d849383f44d2353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827812, "uuid": "0735643c-4b23-493b-96ae-19738150330c", "comment": "Malware payload (RaccoonStealer)", "value": "c5ad86c0836e42f84fcec63413aca7a4ea990f58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827812, "uuid": "b361b2dc-8c1a-436f-8ebf-a56af2b8f923", "comment": "Malware payload (RaccoonStealer)", "value": "9036fc3b5c1b4d527a2dd7d93171b30131f211248446d49d2018a361eac1e0d7a33ed96f4d62f341a10b379141e4f326", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827812, "uuid": "63803212-03f3-47b0-8a27-4d3cb49bec75", "value": "T1BD4318DA37F6EE53CA8C9B78A4E617583334D1067E53E7178AA4063E5C623DAEC40913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827812, "uuid": "76ac5993-3dbe-4b80-b25e-f2a145bf9ce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827812, "uuid": "a103bc48-6583-4df3-8a15-b069dbca0721", "value": "1536:7X8++D7Mu/7OocRzT4R+1TRYwn/ZcOZaPXDdNc:r8++D7MSTR+1TxnxcOZaPXDd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827812, "uuid": "cf741abc-19c4-44e9-b68d-90dc20c9ae08", "value": 57824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827812, "uuid": "8eb26637-0e54-4309-9e3c-08650004ef71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827812, "uuid": "499d64d9-aaba-435e-a01a-25de158dbe6d", "value": "bf7fdc94904235a35f69dd0179e95bc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cac32e6-7215-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641819607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819607, "uuid": "f08af10c-c6c5-4a9b-a115-71e306ac060a", "comment": "Malware payload", "value": "68c977df21a9ae15f176e0c7aa61af07", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819607, "uuid": "49ca6244-9cac-49e1-99cf-6d838d16c8fd", "comment": "Malware payload", "value": "92afaa98fc01f9f9c86c736a5c6074128a0a8a0addab7d12ab3b56411202093a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819607, "uuid": "5403a2cb-b298-47dc-9d0b-a2aa5b23342e", "comment": "Malware payload", "value": "bd27773065493b0d0ecc4cebe35ba3b9e62e44a1", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819607, "uuid": "e0371c70-7c22-4221-a051-13e0e4df8e72", "comment": "Malware payload", "value": "852a99bafa92fe0e4f1fd585fa220c7c62e69924c91888ce85880bb93b5c17c64591120ca8cd78055b83d00512c08482", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819607, "uuid": "66334a23-d7ba-4c26-b058-9b99c9ec5d68", "value": "T19006330C23AEF8FDE459462C3B6289B1C9E412F5D88225F3963815940C3F67D5BDEE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819607, "uuid": "913ad409-18b1-4b43-926e-9a591f72b2ff", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKN:0XSxVJG2fLAqFOfT9sMYNM29N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641819607, "uuid": "c7c78318-f72d-44df-8108-4e2c2a1d5e49", "value": 3743744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641819607, "uuid": "e4d95bcf-9184-4a5a-b979-0348771ffbf0", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819607, "uuid": "3cd2a88b-d209-452d-a512-5987b6c0eec6", "value": "92afaa98fc01f9f9c86c736a5c6074128a0a8a0addab7d12ab3b56411202093a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1aa649-71c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641786243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786243, "uuid": "0b7c9455-d710-41b3-834c-476d746f7fa9", "comment": "Malware payload (Mirai)", "value": "416984efb06f88a7929228fb15182860", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786243, "uuid": "fa7fdafb-3a3c-4515-9cd6-3b3a925b2b15", "comment": "Malware payload (Mirai)", "value": "93091155813c561a4e3fb85698acb3d6f14ac4b2bd5b84ef27c59c1ae0390d13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786243, "uuid": "955058c9-d7b1-4899-9da4-246f3888a631", "comment": "Malware payload (Mirai)", "value": "b1eae8442383b24ccc35f32d28acf3a8e12269ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786243, "uuid": "84603755-8a6c-4ace-8589-4b34478976f6", "comment": "Malware payload (Mirai)", "value": "2dcae35ad66ce9b683f341a1c1bee4b5af533fb6dad7787d3fb3513f3bf768e722a4bd1e8d4b5e1608ae6caab5718f62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786243, "uuid": "31f5516d-63e3-45ec-918a-afacafb27062", "value": "T14F731946BC919F15C6D522BABE1E018E3317576CE3DFB2128E245F3467CA86B0E3B445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786243, "uuid": "151c7065-e5a0-42f6-977a-98b606b17303", "value": "1536:FDnXEZqOloMOY7LJtGY4EFCNDvaYJi7ErtLOdwZwPgSih+1uloKEzYImiTKiWG1L:DOccJHlFCNDvaYJi7ExydyqWh+YlCKim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641786243, "uuid": "3ba8e509-5dff-43e3-9bd2-dd02d2c4d12c", "value": 75540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641786243, "uuid": "eb8f494a-5e11-4a83-9415-803af07c4053", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786243, "uuid": "b7a1a240-8eac-46b6-841c-f4ef0c3dd9d9", "value": "416984efb06f88a7929228fb15182860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24a0341-7208-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641814302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641814302, "uuid": "568f1422-e300-48ff-b02f-b21693af1eb1", "comment": "Malware payload (Formbook)", "value": "15da24c2bdfacb69320ffaafaa04064e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641814302, "uuid": "dddd3ab3-baa3-47d5-b817-2040a3ff15a0", "comment": "Malware payload (Formbook)", "value": "93e0d8207b9a57298c1c04e0f00c13f9f4281ec497b48d14c8047743c8addacd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641814302, "uuid": "47542db9-7ba4-4cea-9f90-5e5bafede85b", "comment": "Malware payload (Formbook)", "value": "b6fc5dcd768c69f91ec20b1ef4b8fea8c1482405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641814302, "uuid": "95ced52e-677a-4fad-9ff2-679a6ecc3304", "comment": "Malware payload (Formbook)", "value": "cd0f70492f43821040704d65d47b6b0ccc7c57162585b378bbe630a2f7627573ab979b2cc6af0c42a51eacc889b973bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641814302, "uuid": "d0c111bf-9531-46c9-8da1-cf6391f07351", "value": "T169F4D0067A49C911E2390673C5DBC1B44BB46E48A593D31B79E93E2F7D323A27C0968F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641814302, "uuid": "dff5acee-f907-43ce-811b-57c78c84155c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641814302, "uuid": "87223b50-e4e5-4c6a-adcf-a02eacb2b66f", "value": "12288:qu5au2YTwtDTmilHq1Q6qyFWxcTrxq/YcTwZ6IU9t40:DcdYMtDTmitq1Q1urxU18YIEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641814302, "uuid": "20d89969-bb64-4271-b9da-9a0106a5f677", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641814302, "uuid": "150924a6-ecbe-4b08-af70-d5ae48e8089b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641814302, "uuid": "e8cc59cf-bd36-4a4d-8f8f-69fc5b6bf067", "value": "Purchase Order 5809_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4bc2ab-7246-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641840677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840677, "uuid": "e1494819-44d3-4efb-bb60-3a6120554e96", "comment": "Malware payload", "value": "97d3781b6a477b920c78679f73a55500", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840677, "uuid": "3ce68733-9208-4326-bfad-92c616df461e", "comment": "Malware payload", "value": "95532346215e591b923e7c438a892e8684ef011e5a364b2c8b5601610c8b8e06", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840677, "uuid": "effacdc5-c564-4fd5-896c-c6ad782fe6d2", "comment": "Malware payload", "value": "9a6508c71bb83b929e68400be7a2e47635893867", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840677, "uuid": "c0b37870-5892-41a8-bc8c-0bc5624fbe8d", "comment": "Malware payload", "value": "f80a9e0aa1db7b830dd024eb24a5cf37287dbd6ad8559afdff8dfe2a34c6ac0b7f99f9637bbf80b21f92edfad9c1a2c4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840677, "uuid": "4830f989-570a-43c0-aca6-4d7cdf67cc91", "value": "T1A3E48C2136C79B32D483127155AEA3611A3EEC704B71828772AC779E2FB27C0673579B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840677, "uuid": "d36af95f-7940-431c-8416-d44dd003388a", "value": "12288:IvfDE9Q23Nn7ByIuyBlpOuq+8wAb1+ING:IvAq23Nn7BjlpOu3dAHNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641840677, "uuid": "b62b4b83-b34f-4579-9caf-cf4accb8cc4c", "value": 673252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641840677, "uuid": "9dfdf413-5bfc-4e09-9e29-e5e30b771c63", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840677, "uuid": "68a440b6-1103-44f9-9755-107522b229f6", "value": "labeldelivery.info.jar.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36ecbbc-71b2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641777394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641777394, "uuid": "dd608668-96fe-4206-8967-966180f468b7", "comment": "Malware payload (RedLineStealer)", "value": "f55dad3132a4732fd471867ab54507c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641777394, "uuid": "531cb653-ca20-48e7-aedc-6c73103f129a", "comment": "Malware payload (RedLineStealer)", "value": "95a084460ffe24360be9bab0f0910941f379acb6f0e94310961b1ae4f582e386", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641777394, "uuid": "5f72999b-e90f-4f95-8419-f9fa10214cd9", "comment": "Malware payload (RedLineStealer)", "value": "cfaab5fc14e27fbce6e2218aee312a5eae53f922", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641777394, "uuid": "c34b90f9-5201-4d83-8667-8d517d524847", "comment": "Malware payload (RedLineStealer)", "value": "ce77cec978fa587a79b9621b73370976d4238a705b4f67478a0043a5c52799957f6ef85ed0902fab2b2af7401f7f08fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641777394, "uuid": "56e76614-c4a6-49b6-bb0a-d038bfa67ab8", "value": "T1B8352CCD52C14849DFEF07F00DFBE62E857292CA13475BEA731E85F0AB2509EA56D4A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641777394, "uuid": "a78823c2-14db-40a0-9769-3acc136b5214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641777394, "uuid": "ef527911-b473-4022-ab3a-be68aac7a73e", "value": "12288:oQysVhh+ZhN9oaQjE2ywGsNvofQNjborPR8a1jF:d+zzFp2yw/6e4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641777394, "uuid": "602ccffe-6387-44bc-a961-f8e862989ffb", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641777394, "uuid": "57664ee5-b8b0-420f-b392-84f1c0f6ad1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641777394, "uuid": "9f4126e5-bb5e-4947-a7b7-283ee7aea8dd", "value": "f55dad3132a4732fd471867ab54507c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edc8575-7228-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641827852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827852, "uuid": "4130dfd8-f397-4d13-b10e-b42a6d49ac6f", "comment": "Malware payload", "value": "c118548ee9dfabc8702de396e027ff29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827852, "uuid": "013782cd-0149-4f71-8bfe-b13aa2d5ce17", "comment": "Malware payload", "value": "9686eb8b631d6c2a817f3d3a5acf003cc88846fe137658da5d2e854b6b6ed8c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827852, "uuid": "c0a94567-da46-45e8-9d7d-4b3d71259e04", "comment": "Malware payload", "value": "61184e68f544272d11eec90c00e60c2319dabb68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827852, "uuid": "43b87954-4bd2-4af7-b978-d47457a3d416", "comment": "Malware payload", "value": "56d5330dd4810208d64884e52eb9abb9e35e90ed4535402a470ea8e7fc5c680c2767d70effff5406b2685d2c26d58e18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827852, "uuid": "03865268-489e-414a-8c4e-525758addb60", "value": "T16032F703FAE54D76CB0403B1247B9656C3BA7FA01B9597A3A789E4690B791C4E43780E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827852, "uuid": "bd40bb6c-2426-4669-89bc-f6ac9155902b", "value": "fa8bea08ea15e874f51091ec7d053eab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827852, "uuid": "80112679-6a96-4161-97fa-9d8523eeae66", "value": "192:04SQUcu7QiTnW/D7yeggVjO5+jTZGS4Zr85CE/037E5pz6dbi2Ho:xSQUcuUvb7bgmjs+jTM77M2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827852, "uuid": "66fb2148-1d7f-47e3-92c3-3742855c74dd", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827852, "uuid": "94f3af6b-b818-42f2-b317-5ea9ab930385", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827852, "uuid": "c6f45100-6141-4eae-8e80-547eedbfa4ea", "value": "c118548ee9dfabc8702de396e027ff29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973ec1bd-7226-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641827061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827061, "uuid": "360aa620-afa9-44b7-89f4-cec9e119601b", "comment": "Malware payload", "value": "6f763b69ff2a858a8b22bd507ac94f01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827061, "uuid": "20790609-19b9-49ee-8c08-9d0d2c5da514", "comment": "Malware payload", "value": "9718cae859c4a5d43ef196aa1c7860278152e8a2faeb8863d61ddc7d3ca59076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827061, "uuid": "c01a409e-1b28-4a8d-ab80-fa8f00e5fdfe", "comment": "Malware payload", "value": "6e15373d8913b9587a74d9af94ad6b06e26a1776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827061, "uuid": "cc634400-9301-4e93-8bf2-da7d86cde3a8", "comment": "Malware payload", "value": "775e60b7684236dea2ebc0ffd2a2730da7ffd90cf6537da7c639617796b02f840231f12de9cd6ae153c8b7bb87ce646e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827061, "uuid": "9526ee2d-6c40-4f19-94e7-6f7902bf85a6", "value": "T126C5F105EF285352F4A5D5B295AA0D1ACD5A7D4737422B86A03DFE3C71333D722AE08E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827061, "uuid": "b6a8416e-d3dc-4ba9-b39b-1ef5d510ad9b", "value": "49152:8EQIlrrlRPr9OQKWP6Fdzvx+gWFh2ha/E3dAaeIeU:NPrMLcydzp2ohX3dAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827061, "uuid": "8ad03017-51d5-4c7a-b925-636e933c0dbd", "value": 2582216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827061, "uuid": "d4596448-a798-4ed2-b744-883b18917980", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827061, "uuid": "db8b94c9-f21d-4411-8e39-5ec206970107", "value": "6f763b69ff2a858a8b22bd507ac94f01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49982f11-71ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641801161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801161, "uuid": "b3d267d8-b7c7-49b7-a530-19f8d2218833", "comment": "Malware payload (Formbook)", "value": "2b9199b5854e0931c79ab54ecdbd11ba", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801161, "uuid": "f10010af-a7ee-4c49-8781-8bdcc3971a0a", "comment": "Malware payload (Formbook)", "value": "975da2d066e096b5969f4c9ecd2d2109b747235d881474f7651b1ad0e50ff388", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801161, "uuid": "e56d9cfc-dc92-4cc1-bf37-f6adda3fb1ee", "comment": "Malware payload (Formbook)", "value": "3f00e00046ba99ce1c905dbb1bb72251f08fc68e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801161, "uuid": "fed8785f-069e-41a7-b0ca-b4b866de0175", "comment": "Malware payload (Formbook)", "value": "7874a76a99196f09e7a548d24a3816aa70890b9e2655e2e2429b9d4875483725d6e2f142e2e3cab05376b6fba910c518", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801161, "uuid": "32498cd7-53b6-4870-abcc-b20831e571b9", "value": "T155C4238A7D084A7781CB36D8728FC1345D84396FF91261ADBDD5A8E75943A4C93A8333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801161, "uuid": "99ed6627-1f75-4ac8-8484-31dc51a3a5c8", "value": "12288:ihIeKj7ulVz3hZdY/+CIcztm+vHzglQcTNq2pHDQQRzs:7eh1q/pmETQNbQQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801161, "uuid": "3fdb631f-31c0-436e-af49-cc801f0bb06a", "value": 552075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801161, "uuid": "9d1a1068-4c8d-4817-b95a-b5a1a10ecb8a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801161, "uuid": "2e77e334-2023-42ff-be87-1751f62f0221", "value": "NEW ORDER CHINA 6596261.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed41cc33-71ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641810455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810455, "uuid": "19443af3-2f71-4f65-a806-d8a8d688e12b", "comment": "Malware payload (Mirai)", "value": "ca04400383feaa91bf299c081953899d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810455, "uuid": "a4812d75-bb0e-4d57-9cd9-4573f9461e92", "comment": "Malware payload (Mirai)", "value": "97e16fbac57866629080797cad758858b19603ef4502005c375648871f8d7e64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810455, "uuid": "3250cf7d-0cff-4d2e-8fb8-b55b528c3132", "comment": "Malware payload (Mirai)", "value": "d578c7d4e7ea6d8abb476e78b96c6da8621c9d41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810455, "uuid": "f98b81a0-a080-40c1-a035-0e2dda8efc99", "comment": "Malware payload (Mirai)", "value": "4a4a5cd85aeb19296e285596b36f18cd23f8c02222d0fffd183fafb1094886bc818b9c2dd9996d1a53b2995a6b392303", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810455, "uuid": "757c5b87-5f6d-464c-87ca-a6499122eb80", "value": "T1ACE2F126E5DA1640CA72A877E638C4C279F019A9F1FA71626447211C3EEB6443FF86C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810455, "uuid": "3e885d15-c394-4973-9c65-d569bcbba0aa", "value": "768:B+EbO3QmQuWNQiFN0MvzvhVRSPiX1fwqjfZJlISD6kOmN5FYBykuM9q3UELOx:B+EbYQu+FvzDo0/jfZJCSDvN/YHWLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641810455, "uuid": "1b67773b-f8a2-430f-bbaa-0c15d7c3b837", "value": 34000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641810455, "uuid": "b5b5335f-342f-4885-b99c-dd6757635007", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810455, "uuid": "2cb89e37-8e1a-4723-80bf-e613eb919bf1", "value": "ca04400383feaa91bf299c081953899d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98703537-71c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641786261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786261, "uuid": "a6ea5df1-0d8c-49aa-9271-dd1b4e0c5118", "comment": "Malware payload (Mirai)", "value": "85b4d63600b3c94c90e2500c918cad0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786261, "uuid": "fbf07e35-26c2-4cdb-8cd6-2f0d9ee62339", "comment": "Malware payload (Mirai)", "value": "981e30d26c209ac3c87972902349c5fee4bcd61308149959366bd1390f89c1f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786261, "uuid": "7af897cd-b174-4c16-b89b-78215e9f5e2b", "comment": "Malware payload (Mirai)", "value": "61059426d963912dfaa0b887804db4e1134a97da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786261, "uuid": "7fd33d20-c24f-4f2f-ae4f-58829b6e285b", "comment": "Malware payload (Mirai)", "value": "918ca3053b831857f5153ef1e8ad638ebded5486e77eaeba47adfc4f5ae51442b246daa14fe583b9cfa450faf67c334c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786261, "uuid": "8d54a6c0-6561-42e6-a345-1cf011f4d7dd", "value": "T170539DA9C4E0AC54C1844BF46539CAB94773D918EA532EF696028E799047FDCF20A3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786261, "uuid": "ea82c9b2-1d47-4a21-9e0b-20e1dd7c1393", "value": "1536:nakjQw95L5HOFTDvDhRE18Qk0zyCWsaEW:nNQw95VQLzQk0zyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641786261, "uuid": "7aa43e50-46bc-4d11-b808-c499eb1d9292", "value": 62940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641786261, "uuid": "7caa9e92-922b-4599-8a1e-08ac35002a37", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786261, "uuid": "29cdb830-57d0-401d-82a4-ea313961926d", "value": "85b4d63600b3c94c90e2500c918cad0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ed195b-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641797376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797376, "uuid": "25f3a064-a17a-48ae-a6be-3fb732480524", "comment": "Malware payload (AgentTesla)", "value": "1b496c816ebf7ce443c14decd7f0569f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797376, "uuid": "da814146-0201-4dfa-9521-d1f19814f630", "comment": "Malware payload (AgentTesla)", "value": "9ceb219e4dac398ceef84b05521a1383e0e49ca2611f11e81121daf459c5ac36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797376, "uuid": "7aca69fa-aa49-496a-9a7a-ed4d73bf1ea9", "comment": "Malware payload (AgentTesla)", "value": "f6fffb4626848396febff4975ff2df6fb03c264d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797376, "uuid": "e4def232-73a3-410c-81a9-6ff8ff1d9c09", "comment": "Malware payload (AgentTesla)", "value": "8b520b0834783545acc8f6336509c466d10b53150fb6b8827bb22faa2eef8b0220651ee32db0b61987abe3d62af0f19d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797376, "uuid": "28b1870d-2d0f-4d8e-aee5-f26a229fad73", "value": "T18BB4F162A2FC8553CBB655B4FCA190988BB8BE575051E7ED4CC8F7EA08F27810E11277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797376, "uuid": "f02143d8-2f54-4966-97e6-cc0a07637784", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797376, "uuid": "15d2259a-ec92-4567-8f97-7097586448fb", "value": "12288:1bomXmKsxCPfRFQ6dF5svIPOy4J0yZHVDV4Z3X+gOqUlr:W0mWFQ636vIEhX4ROTTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797376, "uuid": "99a0d38e-402d-4cfc-bc97-bfb0f7c3ed2d", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797376, "uuid": "b71b21be-81dc-4084-91a5-01f0eaf8b3fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797376, "uuid": "f1b5d27a-414a-4a25-afec-c91a7ab90792", "value": "Upadted Quotation sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ea9460-7228-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1641828018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641828018, "uuid": "39156180-47d6-4c45-bd07-65327cd0af1e", "comment": "Malware payload (RaccoonStealer)", "value": "573c1f56ce37faad50534c7ddf3665b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641828018, "uuid": "e4d5e31c-ffb5-4328-9f2c-7683e4ca1dc7", "comment": "Malware payload (RaccoonStealer)", "value": "9dd85db25c80607afc1a3efec5b5d03fe882a59beec4347f0a75b6b256d7c5db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641828018, "uuid": "9636c192-a664-41a3-8e47-43ba580e0e45", "comment": "Malware payload (RaccoonStealer)", "value": "2a5aefb1dbddea9dffe1edb9844dcce897f41829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641828018, "uuid": "3b5b29ba-55d7-4751-bf0f-ddb9295586f5", "comment": "Malware payload (RaccoonStealer)", "value": "c6591f085c177bf997e60a6da2d0b068755edd2561c4e2bc35f26c8ac232a18ab7a9bfee3c49f882298c461cacf82fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641828018, "uuid": "ed0e0590-44f9-4165-8a8c-9347309e6664", "value": "T135432BDA37F6EE53C68D8B79A4E627583335D1057E53E7578AA4063E1C623DAEC00823", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641828018, "uuid": "aea83d6e-460c-4954-8025-f9a51eff120e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641828018, "uuid": "4186d17a-2afa-43a2-ab65-c23e1431439e", "value": "1536:P3QhJCDXiH94ujCLRH0kRc8B6KQezfO8a7QdNc:fQhIDs9qRH0kAKQezfO8a7Qd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641828018, "uuid": "41bdd1e0-318d-45ef-ade7-6b2340d85bec", "value": 57824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641828018, "uuid": "573820ca-39dc-4524-be36-2e3d08ae11b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641828018, "uuid": "00b7c6f7-c233-4a6b-87ec-41543f33f6a8", "value": "573c1f56ce37faad50534c7ddf3665b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b718af3-71ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641801137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801137, "uuid": "032e77d8-863e-4d8c-bc95-db795a5f0d17", "comment": "Malware payload (Formbook)", "value": "a45506feaa8bc01b90ecc3204bc45b6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801137, "uuid": "f08051cd-7383-417f-8442-c13f194a7538", "comment": "Malware payload (Formbook)", "value": "9f5649294d8a9d4cc583e6bbcb11d8287e02f5221d3f7be4109048271f1112c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801137, "uuid": "682b29a5-897c-48c9-8798-127a278d198e", "comment": "Malware payload (Formbook)", "value": "04abf27e6e718aef274dd5cbbc0184334e84469e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801137, "uuid": "1221cb66-1615-4130-b50a-64fe6e0606c0", "comment": "Malware payload (Formbook)", "value": "f04eb66c343975a8703dd3d087b78b0792c14f43c8ce5214cfee0c3028d3f0b839e5ddecbfb5a9e0f20e6edc2d40cd18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801137, "uuid": "f273f294-0ee8-4a9e-bf14-891de840a788", "value": "T1FCF4D0063E49C812E2694673C5DBC2F447B46E48A953D32B79E53E7F3E72391BC0858A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801137, "uuid": "5dc6761e-5d1c-471f-87b8-5e0039f731c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801137, "uuid": "c8832e39-8927-4a57-b947-7d6a7d97f7ac", "value": "12288:El1WpAAYWD4Kh8wtDTmilHq1QD1FeOxVtVykEaBX63TO60x7ZT8U9t:El4pADWD4eFtDTmitq1QpFptV3B/x7ZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801137, "uuid": "893acb17-6020-4f93-8639-12a16cb1d92c", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801137, "uuid": "188fc1a8-0f87-4350-b627-3a1f1d334786", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801137, "uuid": "fca58315-a7a2-4b4d-a878-8c584e5c84ea", "value": "quotation New Order I5117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23694405-71f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641806251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806251, "uuid": "caa002eb-7661-4164-83cc-806d6d69fc1e", "comment": "Malware payload (Mirai)", "value": "9f1629bee29daa2f4bb8ccf715e507a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806251, "uuid": "e30c6ba0-03c6-42ba-b73c-4f24b2bd3ee6", "comment": "Malware payload (Mirai)", "value": "a149cddff3ad57611b86ca0c9ebdae7d825f2866282d445d98eb0f563fda00a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806251, "uuid": "43cb8ba9-ce9a-40fd-bf54-85d9e838e08b", "comment": "Malware payload (Mirai)", "value": "e6f2bb1698ccf7b7371a394a70781b6ae23b4a82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806251, "uuid": "c4ca8752-812f-482b-9303-20b9db8cf972", "comment": "Malware payload (Mirai)", "value": "9bab4e3093206a2f1c10fe16ca88a27e21f7270dabb9ed81e833302a6378eef77581ad191474562b87d236ae49432b19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806251, "uuid": "106eefec-3f1c-425e-8f6e-4e4c48331328", "value": "T1DA736BBDF0795E94C241097878548834AB23B146A7D23DF6EED2825FA9ABDD4F005FB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806251, "uuid": "cf83daa9-5158-43fb-bb74-5140aaff6014", "value": "1536:F/5eOqqea+wt4q2FpWHDyVQ71iNofjfs3nCvpFeBcNsC9J:FRezJRzq2Le71iNmf+CXUcNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641806251, "uuid": "66834b74-adb1-42e2-adf3-519c10daddbd", "value": 78836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641806251, "uuid": "91ff36ac-7258-4026-a6da-87ac666c34a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806251, "uuid": "89141965-6d0d-4cfc-ba90-ace65b581db2", "value": "9f1629bee29daa2f4bb8ccf715e507a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462c1a2d-726b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641856560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856560, "uuid": "7f46d1a5-8979-442e-b692-dbfb56519ae2", "comment": "Malware payload", "value": "39a6683b9b279f662f90e1fa6b651c82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856560, "uuid": "1a882b8b-8cec-4347-bfa5-3a99ac1c2961", "comment": "Malware payload", "value": "a15aa89da9f5f87dad62333dca4d34358a10dc939ba64479d01a46675276bbac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856560, "uuid": "0dd359fb-6029-4779-8a87-1511a4a9887d", "comment": "Malware payload", "value": "6820838b0de135a5f83d817f16d7119176c6f083", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856560, "uuid": "8680eb58-bd3a-46fc-9977-103b1bc296a0", "comment": "Malware payload", "value": "23778b1de5dfa9dab2c425fe735f64c76d4034a8cf133c86d46b988946a0d62e60300845e11be45ea69cecb5a2a7b266", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856560, "uuid": "4e4a66fd-fe64-4b72-a99b-350fc05079b8", "value": "T10B84222B65E598BBE9D840B7013B6B3AC5B58E6210530C4F63D12FB63B39742937A743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856560, "uuid": "523b2c87-cf42-460f-9a75-447c9bde8957", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856560, "uuid": "1d86c6e3-4926-4878-be47-d45c3386fe5b", "value": "6144:yybLO0Ee1x8sp0oILX4ufTaZJHpY2u50bwoYfXHdpUSJQOV8ASk4wq9B2tjlW:PbL7OspzILlfctVlbSXhmASktqzaxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641856560, "uuid": "5648019b-47de-49d5-8ec5-3037d6842c16", "value": 377627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641856560, "uuid": "d80f3276-720a-4556-a3c3-8aa2e1cf0ecb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856560, "uuid": "e50830cd-3f95-438e-847c-65b2d08aa638", "value": "39a6683b9b279f662f90e1fa6b651c82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d31076f-7241-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641838614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641838614, "uuid": "06dd5bb9-0da9-4b7d-aa9e-020b4e5a01ec", "comment": "Malware payload", "value": "8a5351410c0829ebd9f17d00ffbf2134", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641838614, "uuid": "c6bd484a-2a88-41d1-9d9e-08b520596b32", "comment": "Malware payload", "value": "a18705c77fa4e713fb2b05ceade465f15e7310616927643d6a9b54ab1aaa8711", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641838614, "uuid": "91c1f4c7-351d-4b18-9475-851927bc4c16", "comment": "Malware payload", "value": "5b5877e761fb3016890a84b0acecf26ec20bfeca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641838614, "uuid": "bfb6e697-4f0a-458a-82c9-3a6337b3dea7", "comment": "Malware payload", "value": "d6aaca8b0147a2c71e2204d15910d62afd634df9e5b1fc259153633b817af8b544cc40d723bc2956e564c48fb054bd4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641838614, "uuid": "78ef7881-d8d8-461a-be4d-a83e4acb5ad3", "value": "T1C4A4BDCA21DAD1E7EDEAEAFC0DF765834E71A6E09140D58E6E4D204974A1FF8460CC72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641838614, "uuid": "263f7de0-5c09-4637-a481-181942989e17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641838614, "uuid": "f6627a2d-514b-4226-87ae-ae9553d61df2", "value": "6144:wNfcOMXoH1gYmnkVu8AcvFRAJd+OKgBR9rryPoccAzczKsNGG:af9gYmkVuVcv4JBhHiPvRo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641838614, "uuid": "e142bd3d-7d28-459f-8cc7-5f293dfbd28c", "value": 464896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641838614, "uuid": "760b983c-1d1c-4240-a8f4-cc9e6dc9921d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641838614, "uuid": "2cd833e7-0f2c-4109-abcd-6d3c4fef2595", "value": "BL-SHIPPING INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9dbf6f-7212-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1641818262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818262, "uuid": "d4c41275-3995-41b2-b9e4-5516e1509e6c", "comment": "Malware payload (ArkeiStealer)", "value": "aec70ded586cfe6f9bae06560b0fe7a6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818262, "uuid": "649ddae8-aca5-4525-ae20-5cdcf0631da6", "comment": "Malware payload (ArkeiStealer)", "value": "a1d583650ec7dc99e6c0c4009908358518a0be5fbe7cb6e2b3a50889bb5da3a1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818262, "uuid": "807f37f8-946a-4557-9f75-0c934252ae7f", "comment": "Malware payload (ArkeiStealer)", "value": "8da695d69d3e3c3df85767b57c24f46576d1aeef", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818262, "uuid": "09f18f58-3d8b-4c90-85d6-533268ba9083", "comment": "Malware payload (ArkeiStealer)", "value": "b6f745258dcf2a2ba81995aca46d9292b67fcc91872697df76f24fb3c488b3eace6ebba2f98da598220c3517c8fc1ab9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818262, "uuid": "41a9c5df-9823-4f48-a4d1-a0b7d8178e3c", "value": "T1272512D99A03C2A9C5925E3EF53D9148936ABE50A9F2FFCFE61D7370D6B20E06801D14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818262, "uuid": "cde0b25c-76e0-48bf-b9ed-a8e6bfbb504e", "value": "8ce72e3282cfe3876fcd1078f6043be9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818262, "uuid": "a06e092a-2793-48bf-91b7-eb69b8c697d1", "value": "24576:rIl1cSdx7yIM6LCEYjHQQvRclPsSiI51/UOFw:G1f8I1CEYjwQalPsm5COFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641818262, "uuid": "aed34fdb-0bbb-4c70-b824-b17cafe30e16", "value": 1013648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641818262, "uuid": "6c5ed453-53a3-4c31-9747-bf3ff92a80dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818262, "uuid": "28842f6a-eee3-4e64-a90e-feea5d673918", "value": "aec70ded586cfe6f9bae06560b0fe7a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699f2bcb-71dd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641795631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641795631, "uuid": "ac1995de-1dc2-40d2-af8b-04f66e997292", "comment": "Malware payload (AgentTesla)", "value": "9b366d46303db841e7e871e4173ea83c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641795631, "uuid": "b4895012-7060-4485-9604-95fc05dd0287", "comment": "Malware payload (AgentTesla)", "value": "a2338807bc8aa5a75ef1cb05358373dae418753d330dd5dc79246ae6e1264b0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641795631, "uuid": "a237092b-34c3-4d74-962a-2690c269c473", "comment": "Malware payload (AgentTesla)", "value": "b3bf7080a1477dbeea3e2891b33c29df73b9a5d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641795631, "uuid": "ee6e7dae-3760-4596-8363-a300a64a0ea0", "comment": "Malware payload (AgentTesla)", "value": "261532e2881474b3074f85cf59bec26538cb6ab5a35fa0e7d3bf92f9ae4c744f7258d7c84f6c8aacc232bb8f93ab4761", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641795631, "uuid": "e992ed21-f53a-43ae-a220-5e2fba9ed7f1", "value": "T1EB05DF8A21C9DDC6DCFAD6FC19B2E1634AB1ADA0D290C1493DBD744BF4E1FA90D0C961", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641795631, "uuid": "ab82f5eb-d2b0-432a-99ce-844fa30d1d67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641795631, "uuid": "1ad8477f-c1f6-48aa-9a74-bcdeed0aa260", "value": "12288:jXVf8mmpmiWrdmjfI5I7JNm/Y3o5obRw9tGKWf53EM85cAXzhhj1F:jlZmpmisyA5I7MY4tQdEz9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641795631, "uuid": "3049f82a-0ae0-4853-9f18-7f376ce70c89", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641795631, "uuid": "53fad7e0-00f8-46d0-9f92-4140fa4fb81c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641795631, "uuid": "fc28e63b-2e9c-4cc1-b85f-9652203cbc55", "value": "PO_5882022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ac763e-71eb-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1641801634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801634, "uuid": "9285c8bf-f553-4dbc-8d65-f65dd8ffc344", "comment": "Malware payload (RaccoonStealer)", "value": "27f38096e53a91c525b0700700cee4c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801634, "uuid": "bb4637ab-94e7-4bd1-a86e-98f289e33292", "comment": "Malware payload (RaccoonStealer)", "value": "a35a1ff0e7ef9f9dffbde98157e8fdf0ad0d2c1b081284acb5cf29623ac79a4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801634, "uuid": "0d95cffb-b7bb-4350-a732-dac1505fc8ff", "comment": "Malware payload (RaccoonStealer)", "value": "c9d8b68a4e0216a83c44d7208c2d79da873a48a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801634, "uuid": "a50c32aa-957b-4d25-a012-8643ffcd1563", "comment": "Malware payload (RaccoonStealer)", "value": "d4f5573714fbb9eb50f2aeb94abb936176099b0fc3524006aceca5c722e0bbf5ae0462d7093b6c6ba45e75ac44233747", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801634, "uuid": "fa877e11-a662-413c-b899-e8786e9f0c4e", "value": "T1ECC40131B5ACC676C69746B0C475DAD19E3EB8F11958804F326D136E9BE0E8C09E336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801634, "uuid": "2eecd98a-6950-4dbd-b747-9f1bf41aa341", "value": "494d9e5cf9082316783ab2dc17a63b60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801634, "uuid": "f22b0446-66a5-4aa6-9130-03cfff68ff94", "value": "12288:wZ74qPWaSeXqN5GCJzSilgqJg38oOBPBLunnb:ygfG0ztlg938N0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801634, "uuid": "619f2fb1-4367-476c-82d1-3e1aa91f6370", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801634, "uuid": "6a0969bc-6119-424f-a147-e1b340082e83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801634, "uuid": "9ea83a1f-1ee9-4313-97aa-70c25f5467cf", "value": "27f38096e53a91c525b0700700cee4c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e52fa2-720b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641815407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815407, "uuid": "013e06c5-76fa-4b4d-9722-042e678a144b", "comment": "Malware payload (Mirai)", "value": "35669c833810b57aa965e6cd0303f194", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815407, "uuid": "ed738008-e718-4092-ab1e-13511c8a096a", "comment": "Malware payload (Mirai)", "value": "a3d51344a78b9d681f39f1841a25ffd5181c59ba0d454872947c55f322128082", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815407, "uuid": "068b797e-29cd-4d76-81be-4e75c4b80707", "comment": "Malware payload (Mirai)", "value": "7b9857aab05c2bf0fa579d9161310f7054de8304", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815407, "uuid": "41496c4d-78e8-413a-838b-5e19ffec539e", "comment": "Malware payload (Mirai)", "value": "32142ec24d49120417364851a4a7999d859484ec63226b240dcead41d9d81411ff6a408fa52c662f90ae367e09085865", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641815407, "uuid": "dae731ea-f87b-43f8-a0dd-309848cd39d7", "value": "T1ADC2D154438F21B1ECF00836CDE90207336A02B99ACB3013A66D17B9F6B7895557FA7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641815407, "uuid": "cf38b1cd-67d8-403b-abc7-08677a391b3c", "value": "384:Mg/kIyDqj4vEaZUNomXodwLYfATNdXIrRMk4QyAJPVSMzLf99zH2CF7wN9YX90Ky:Mg/kIo2CzmYv2Nd/k4ZQQMzfvIkb3UX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641815407, "uuid": "a22ade7f-50c9-420b-acda-cfa7c1e7f09b", "value": 26028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641815407, "uuid": "26594205-feff-4889-a13c-18e4306cf19c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641815407, "uuid": "45167a0b-168e-4b18-9d3e-2be9bf368cdc", "value": "yakuza.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7298f6-71fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641808786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808786, "uuid": "ccf41280-1b69-417e-98a9-460d89560b30", "comment": "Malware payload (Mirai)", "value": "2c1dc1fb69bcd30eed097cb1c327ad22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808786, "uuid": "c3a10a6d-6f64-49e5-8a6f-625a379d1b50", "comment": "Malware payload (Mirai)", "value": "a490a8db15ffb2a4cec1afa2f89965a68c85fd374f95a27ec53930c9951c041e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808786, "uuid": "239ab308-13fe-4db4-93a9-086ab958edb1", "comment": "Malware payload (Mirai)", "value": "84a297370b964f4d13430baa6cadd621f969bec3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808786, "uuid": "ef8c7f96-8a40-4288-9876-1db2a430b16c", "comment": "Malware payload (Mirai)", "value": "245a66dbc9a949e88121f43b5f551cba9ee53ddbbf44c668d72dd982170f9e1a60f9f7acf2e80f560b6335e8cb112316", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808786, "uuid": "4bbd84b7-fe72-4c9c-9505-e6b1a58743ed", "value": "T1CC245D46EA818E13C0D7277AB69F41493332A7A4D3DB73068D286FB43F8675E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808786, "uuid": "5afad35b-893b-47cb-9273-ea10952a3958", "value": "6144:kwwjoPvqj52rJXxkyEaLOI8S1tiXsHe8EeHLcM/9KmlwlkeWBvv:kwwjCvqjyJlEaLOI8S1tv0g9/Yml8keQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641808786, "uuid": "ad37525c-ab53-4d7a-8f8a-e48492dd3aba", "value": 211585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641808786, "uuid": "14e0350a-8242-490e-8a08-a58b3cba158b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808786, "uuid": "b5fa5be4-cb9b-4372-a457-03568e274753", "value": "2c1dc1fb69bcd30eed097cb1c327ad22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cfc73e-726a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641856148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856148, "uuid": "780278b5-9e24-463b-8083-51c1fcc7f168", "comment": "Malware payload", "value": "f577aa61371cff4661440b3ad1b37818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856148, "uuid": "a3d0b0de-be0f-41df-8d03-c419c4c65348", "comment": "Malware payload", "value": "a4a985cb200e6baabc95ff563b28831b0a609a0787c2e29dceaab1c065b38e2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856148, "uuid": "fadd6ccd-93be-4bce-851c-ef3fdf922dd2", "comment": "Malware payload", "value": "ee9aefe8170dcb53171350f8b025cb355e19a460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856148, "uuid": "81db6bf9-0513-477a-963f-5becf69ca2a3", "comment": "Malware payload", "value": "36d96979b4a66abeb1f4306c0f62cb2ae27abb46a39ecaec7ef8225c512fcf8616e41b518bdedc732030fa356f9751d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856148, "uuid": "116e743f-60d9-4cfb-b60c-57172b20a790", "value": "T1BBF5338AD27CBC11D0AF0476E9F56D357E0DE928772E6C87628BEDDEC488041A719326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856148, "uuid": "8e792e62-061b-4630-ba42-038190895535", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856148, "uuid": "622fa1a4-a267-4bdf-ba1c-44bcc7ddf6af", "value": "98304:wOnUwmO9k6FIFwwzK1ZQrWkBuqmatMvh554SRUI:wL/O9ksIZu1ZqAqmSMp4SRUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641856148, "uuid": "05d790b8-357b-4e25-8fdd-46bbf56caca4", "value": 3644928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641856148, "uuid": "611a4c5e-9c3d-4b68-8b9c-89f6b6162d3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856148, "uuid": "22dedca8-0362-421c-876f-0bb21a69eefd", "value": "EsetNod32Security.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94812ed5-721c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641822761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822761, "uuid": "b6d2f650-31af-4e39-9748-df4dcc6f9921", "comment": "Malware payload (AgentTesla)", "value": "7546ed51da8ca71bbee5ba570e644a8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822761, "uuid": "49efdc85-aa6f-4b7c-b278-e8e60a60d3a6", "comment": "Malware payload (AgentTesla)", "value": "a4f0b9880b460f31b72b20b7f13641f0ac795d4726ccc3f503a64dda34d99dfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822761, "uuid": "bcee50b4-69b8-4726-aacb-e74fc176058d", "comment": "Malware payload (AgentTesla)", "value": "40112c6f324793712067f4d49c80409339d5a025", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822761, "uuid": "26b62e5f-7442-4d0c-8bc8-55a3ccbf22e4", "comment": "Malware payload (AgentTesla)", "value": "e503f5b01c21b10316406aaf00a78c6da08f22e9b1337e2150dfc4a76015bcffd5e919d0aa7f4e8da1bce6e3012a55ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822761, "uuid": "df3e24ce-16d0-4348-b0a9-5c175c7e4f27", "value": "T151D49DCD31C1B1CFC8E7C8F54EA66C13AE60ADB29306D1475D4F2199A56CEE68E1C8B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822761, "uuid": "5ccee790-e2da-4672-9abe-79d4351ee9b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822761, "uuid": "41871a13-3662-4d14-8c5a-9e8b106bffec", "value": "12288:rsuhwHsfmWjIqEMlK4jhXTalqIs1b7Ihh8IpX1qywdjXAO:wu2M3IqEMlX1TQqB1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641822761, "uuid": "3958fb01-6402-4f30-92d2-1ab7faf75fd9", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641822761, "uuid": "40947533-b223-4944-9c12-a6ef404d39f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822761, "uuid": "14eabe93-e9ef-40c2-bd52-ed9fc416a96f", "value": "PKGBKI2200196.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3d1c69-71c4-11ec-9275-42010a9c0029", "comment": "Malware payload (Ransomare.Makop)", "timestamp": 1641784764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641784764, "uuid": "695f1906-793c-4e94-bd4c-18341fa9708b", "comment": "Malware payload (Ransomare.Makop)", "value": "5d8ae8c788d8f89b6bbe4b94f77d0181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Ransomare.Makop", "colour": "#864BDA", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641784764, "uuid": "2529e579-0359-421e-846c-436399d61d7e", "comment": "Malware payload (Ransomare.Makop)", "value": "a617fdbff227afe8c89ba96d34724fb03c0c08857c508c8c80f3fedc916fe2b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Ransomare.Makop", "colour": "#864BDA", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641784764, "uuid": "5a9f1bd2-32c6-4269-856c-add801e7d191", "comment": "Malware payload (Ransomare.Makop)", "value": "efde96d76f372f2f31a017a7f83ea5ed87905614", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Ransomare.Makop", "colour": "#864BDA", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641784764, "uuid": "b71c65d4-dab3-499c-83a0-1bedac534e9a", "comment": "Malware payload (Ransomare.Makop)", "value": "1fd1df26498b499a17ad8b9725f1d97fccf9542be94c5f5f77048ce21a36ae50f78f8cbb8b9d9ac9ce4902fc8edd0746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "makop", "colour": "#0769ED", "exportable": true, "hide_tag": false }, { "name": "Ransomare.Makop", "colour": "#864BDA", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641784764, "uuid": "dca15ee4-ee8d-441c-8923-67d8bdebd620", "value": "T10AE5E0E6E4405945F82F0BB2F8B66DB304471D7B94BC2B8C398A3B5245F7DA5103E98B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641784764, "uuid": "444ec32d-a54b-4459-8fea-e56cecde06c4", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641784764, "uuid": "11149d29-fd16-4a28-9ac0-a0a807d1ac75", "value": "49152:+yrMQjbcDLasp30MinHKQ3TqR9FhvFrcDLasp30MinHKQ3TqR9FhvF5qI:+yrMQjbcPV0FnHKQ3mhv5cPV0FnHKQ3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641784764, "uuid": "6bee9243-6569-475d-a8c4-cee808e3aa0d", "value": 3032820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641784764, "uuid": "54d3b6ad-c6c1-48c2-b102-cd8e9234979d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641784764, "uuid": "d1f81a3a-1298-4a53-9e71-f0ca0e22cc08", "value": "\uc785\uc0ac\uc9c0\uc6d0\uc11c_220109(\uacbd\ub825\uc0ac\ud56d\ub3c4 \uac19\uc774 \uae30\uc7ac\ud558\uc600\uc2b5\ub2c8\ub2e4 \uc798\ubd80\ud0c1\ub4dc\ub9bd\ub2c8\ub2e4).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfc8e82-71e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641801007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801007, "uuid": "305dc8e4-bf70-498a-82bf-876fee022c77", "comment": "Malware payload (Mirai)", "value": "a965396c99a52f3f3b0f47807d6ea680", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801007, "uuid": "e1280872-b805-454a-8215-3a3874c548bc", "comment": "Malware payload (Mirai)", "value": "a668787cd18644fa5e6512fa65238654b1f2c35486eb9a0f65ed4e83d85580da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801007, "uuid": "3aa428d3-4d35-4e57-9605-a77c25b5c152", "comment": "Malware payload (Mirai)", "value": "bbdbee95251fa05db8565137ac7addef0987409e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801007, "uuid": "fee0145f-96d3-4dd6-bdd1-458cf8048228", "comment": "Malware payload (Mirai)", "value": "6ea6e2ac5198c5004a7374a16e063dd68cc64a7f82e019874fb3ce61ba19c9d45d466ca190cf6995e3be23b693f04620", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801007, "uuid": "2dd1152b-753b-4e5a-8d2f-07720965d737", "value": "T12B6319817C80AA26C7D0177BFA6F108E3314ABD8E1DA73478C145F9576DA81F0D6BB4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801007, "uuid": "df174d0f-bd36-4b01-9f7f-30f99f49acc5", "value": "1536:GZQZrx1aWQuTJPcsCmNG59ioO7PW75T5FGHxBpJeZW6rV2M:GZQVx1W5bIrTwPBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801007, "uuid": "50ae1e60-9377-4aad-8cb5-cf19e739270c", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801007, "uuid": "8e879353-0478-4fa8-8eff-6d0980be67d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801007, "uuid": "6963bb34-dfcb-494c-861c-cf0febc420db", "value": "loligang.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c4b023-723a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641835596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641835596, "uuid": "3ee114f5-1126-49dc-8025-f17a5ae27a3f", "comment": "Malware payload", "value": "3dcef524944616411650da39a0d3b830", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641835596, "uuid": "16799d62-4362-491a-95a7-f9028c9c0cff", "comment": "Malware payload", "value": "a67cc47030a67a9f6bad704da80c629cf270eedf3aee309e0cb0a1ef30f7a50b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641835596, "uuid": "6979a88b-12ec-487f-92c8-48fca4013041", "comment": "Malware payload", "value": "a50636be8bc5af7d3389a2da5c4d3fcf8abf4b6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641835596, "uuid": "12703ae1-8fd7-4a4f-b802-c0ce33bf5d4c", "comment": "Malware payload", "value": "6ccecebccac7a70dfc354ff1477795e8a7a0897684df7a07dc283b39fb7bb77b8931658a5cf3b348e6d7425a26e417f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641835596, "uuid": "adbbfe43-b019-4a40-8d60-3191eb0444f2", "value": "T1D8F35B3A1E3941B5C3DEA9FCB7E7107AB9F48213032A9223C9277D1D897A3E4E56D450", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641835596, "uuid": "b8482d03-3577-4395-8d7a-1f8471e30810", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641835596, "uuid": "00cb86ea-4b0c-4d69-ace4-9b82cc6a4345", "value": "3072:dXb3lrQnuzQCaooNjoHbZXGjZz4Zgz29Y0z7a36M0SqXtoOLYz:dbShrNUHbZXYZz4ZgS9vnQ6ZSqXmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641835596, "uuid": "316e7850-4d00-4a6b-b5d6-5a7c4658d651", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641835596, "uuid": "051c5b4a-dcf4-4f36-90d6-90156a36f036", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641835596, "uuid": "35b94a52-0a73-49e6-907a-681c083630d8", "value": "3dcef524944616411650da39a0d3b830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f04631e-7219-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641821437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641821437, "uuid": "7fd567f0-7308-4fbb-93c7-a669090719a8", "comment": "Malware payload (Mirai)", "value": "afdcf790cd17e4873281dca1485353a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641821437, "uuid": "d2a17442-bb42-4e06-97d9-6456119dbb8f", "comment": "Malware payload (Mirai)", "value": "a7c86d65b38ce06b00bc23e626c2a552fef07cc6bab34a4ca7e8a50f83894847", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641821437, "uuid": "86635ce0-e798-4a09-bc87-0d32eb27aff4", "comment": "Malware payload (Mirai)", "value": "13b16e9800f2fc6ab8d2c27e9873c7d744caf60e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641821437, "uuid": "09fa711d-504c-49f4-99e3-7e3044f459f7", "comment": "Malware payload (Mirai)", "value": "599adbeb05353a884b2708f4124e4d3f3f97879f81b56904cc222f0bbde0a9a7965fc124c3010f6d9f845887f34539e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641821437, "uuid": "33ae20a9-f674-4b7e-9b35-b5755af584b3", "value": "T12A634921AEBA2E07C0D4A5BA22F78764B2F5678E35E4C70E7D620E4EFF1064460535F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641821437, "uuid": "b727e146-1bd7-476d-a832-45d36012b1f6", "value": "1536:dl0hHQOHZ++DrICUnbOIZSqr6ulM/LLlxO4vP:3IxH6lN7rb8lVvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641821437, "uuid": "1925df19-2bfa-4ba9-9cf3-5e34da446794", "value": 66972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641821437, "uuid": "3846c37d-1bf6-45cd-9467-e86d0be9525e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641821437, "uuid": "c2daabdf-dfd1-4c48-b178-08541e07e909", "value": "afdcf790cd17e4873281dca1485353a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47c896b-7241-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641838760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641838760, "uuid": "f58f7089-771e-4619-950c-d2d358de350f", "comment": "Malware payload", "value": "6e649ae5127107ec811881b65df3374f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641838760, "uuid": "0e2bcc80-6b17-4547-9c66-0eb09e74bcf5", "comment": "Malware payload", "value": "a84d4b61bab51a5eaf7d9b1a96ab450a5057ddbebb4a38617755b6286d19e9a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641838760, "uuid": "aa52c6a2-d671-4884-be49-588b8c751599", "comment": "Malware payload", "value": "839f27fe6377de7badf7cf5cc621912ad5422491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641838760, "uuid": "caaec2c5-f8a0-4fae-b0bd-a8dc7c8b76e9", "comment": "Malware payload", "value": "a6d2a602bec9f1dea1547fa0ee1c88be72c83de0be80198375e1152587593dff0aad6fc73b3f9a40eddfa9b78cae2880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641838760, "uuid": "07fa20c1-1146-4207-803a-e47b1f03341a", "value": "T14635E5E41478D49FF3A38336FC10B138B5A6EAC86185E0123193EBB86937785256DB5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641838760, "uuid": "ad0e2b8f-840e-44fb-bbf5-e17a9295796f", "value": "73bd01ba16664ef98e493e67bb6c3113", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641838760, "uuid": "ee5d815d-93c0-43ee-8965-ebc31b25ebc0", "value": "12288:UlNAmkC8ExB0Rnq0BMYztQ/3/nAxcNE+v0NpXAAAAAAAAAAAAAAAJAAFEAAAAAAs:o6mAExmRFMYSPnOcNE+99UJ+fyAB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641838760, "uuid": "8ff2427c-b5f7-4a40-838c-019b050fa0ce", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641838760, "uuid": "e7db717a-99ea-4ebe-ad43-98b5745b0459", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641838760, "uuid": "4d8334cf-fde1-491d-8dfa-6badeb083140", "value": "Vgevotozpritipreqjxwvpnvoetnbqmttf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d7499e-71e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641799039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641799039, "uuid": "d701ba5f-caf6-4fa9-b196-9f43c90bb17f", "comment": "Malware payload (Formbook)", "value": "1ce123685d4c782b5719ddffbe0ebfa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641799039, "uuid": "02631de5-c6eb-48fc-a931-71e0b116ddbb", "comment": "Malware payload (Formbook)", "value": "a92ecb180e390074e280143710c718ab92687c893701b7c535f704231c92175f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641799039, "uuid": "c8c7ece1-2e3e-4691-b0e4-eaff482659f9", "comment": "Malware payload (Formbook)", "value": "2557293e7c1b6ed44363dd4d2d0b990a18f6dc46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641799039, "uuid": "578fdc9d-3290-4442-8465-2ae252f294e7", "comment": "Malware payload (Formbook)", "value": "7be27d56025c190bf563fe662ec1d96feaaed69e211bec6a4dfe2f42785048b60687e463b8f1b83d19e15e8d34a038a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641799039, "uuid": "8e132ac4-226c-41aa-911b-f697a3f51535", "value": "T190E4F11863ACDA26C17D43B9C56AD1F44BB46E49F502E30F8ED1BCA73DB27908C49297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641799039, "uuid": "12a7c16f-824d-445c-9bea-efb557ad5894", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641799039, "uuid": "10d8ffd1-52cf-451b-b6a8-08758b0fca15", "value": "12288:Q6M8r6y3wtDTmilHq1Q8U9tGuZ+wjoOJQB5DD8P8A2GcSZO:Q6eygtDTmitq1Q8EDZHoP382GFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641799039, "uuid": "70247664-e2b6-40be-80df-157f48a6bc1f", "value": 658944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641799039, "uuid": "3ff27ec9-8651-48a0-97be-9b65a47b8b3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641799039, "uuid": "d66ddc4d-40c4-4c98-abe1-eed3fe670075", "value": "Quotation Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172e2935-71fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641808378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808378, "uuid": "0d60c5a9-4672-4962-80de-cbbc80eb34c7", "comment": "Malware payload (Mirai)", "value": "222ef6126e7231b61c06804c8767eb7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808378, "uuid": "33a1d420-826f-4e3b-bd3c-e73552e0f3dc", "comment": "Malware payload (Mirai)", "value": "ac836df41f2cf0316b34c2ccdc923970716d2702570d92717b8ffcc623f06042", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808378, "uuid": "2bd09dea-a3d0-49af-a5ce-7a27f99ff670", "comment": "Malware payload (Mirai)", "value": "295d0e924b97fdc172a4edb2f2c2b79ea2926c0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808378, "uuid": "f21002eb-0267-41bf-8083-cb3c6efb1d32", "comment": "Malware payload (Mirai)", "value": "696fb8612427735c80c1b561f1436c9c6920278b1f8f49442a259efb99b51a0da7fb10cba83247e859f8a7018bd853bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808378, "uuid": "94dd9cc3-f48f-44c9-9de5-4f3e38a18914", "value": "T1AEC34A55F8929A22C5C2237BFA2E418D372623E4D3DE3207DD259F2536CA42F0E7B951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808378, "uuid": "7bdd0477-3c0b-4f95-94dc-d659de3b8f6a", "value": "3072:rDhc3/KbuNmzKXoVHLMiltn6pEro6Z//Zm:rDhHuNmzPCpErd//s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641808378, "uuid": "e532c168-47f7-40ea-b33a-a86365550e87", "value": 127544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641808378, "uuid": "d894c587-9079-47e4-b3ae-d942dd9d74b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808378, "uuid": "04c45b2e-5b4f-4769-af28-db3274f9804f", "value": "222ef6126e7231b61c06804c8767eb7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0182aa0a-71d1-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1641790302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641790302, "uuid": "46f0f27d-9a8e-4938-8cbf-c1a6d0656662", "comment": "Malware payload (SnakeKeylogger)", "value": "66ab308f5b670b98c0b9726240b2a3da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641790302, "uuid": "936b1fc0-c67b-4a1e-be32-f89cd6b754f5", "comment": "Malware payload (SnakeKeylogger)", "value": "af325f75c55ea0ca96567ec98f19e3301777b4d04b22f5723b331e69d17a1b82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641790302, "uuid": "af41eec6-dbee-491c-9412-2b499429f952", "comment": "Malware payload (SnakeKeylogger)", "value": "1bfb0fdf8f132d8f372423b8d2dfdd131ce9bc7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641790302, "uuid": "0eee9f9e-8a5f-4d58-aa34-fdaccfc2bcb7", "comment": "Malware payload (SnakeKeylogger)", "value": "7269c1fcd2e3af18aab0175812a2f53fbbbed8daee1b5f27b412be2d15d1a7fc9997bc22f1975de007065013c249929d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641790302, "uuid": "cabd2089-9de0-4871-aba8-6a96f2610b17", "value": "T169D4F15863ACD926C57E07F8C469C1F44BB0AF49E502E30B8AD1BCA73E737909C49687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641790302, "uuid": "3947e8eb-0a9d-47f6-9b5f-5fcdd9cedfc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641790302, "uuid": "70f063aa-7467-40f2-91ac-4f6bb2a2473f", "value": "12288:76M8r+dwtDTmilHq1QgU9tIxlGTCXAugFB3y:76aKtDTmitq1QgEwBX+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641790302, "uuid": "46b46993-04b6-4c71-8d32-6903e7c127ed", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641790302, "uuid": "c0845369-45c8-4805-9502-7777aeb31804", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641790302, "uuid": "05f9c64a-36ea-492e-bd98-9c9394eb0499", "value": "1414YT487285-21 -35000,00-EUR-SWIFT MESAJI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6815b2d-71ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641789371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789371, "uuid": "9d138561-a895-40f2-8538-07789b9b270e", "comment": "Malware payload (Mirai)", "value": "97e087265e80d35f979718101779cf61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789371, "uuid": "999d9d39-e80e-445c-b459-03bceffd057a", "comment": "Malware payload (Mirai)", "value": "affc0d7bf7caef136de139511a5fca5b3c874862df81f8f2221e7b6e24296574", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789371, "uuid": "c5535c19-d962-44e8-8472-009788687654", "comment": "Malware payload (Mirai)", "value": "e17c423e1b175bc6ad7d5fe11767d78d2d651142", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641789371, "uuid": "34bdc3ee-e0a1-42a1-9ec7-129ec5a4022e", "comment": "Malware payload (Mirai)", "value": "2e6cb271959d56108dee744694dfc29d9e6cc085ef4b45231d4c5341443cd514c8f8a2bda0664d48d38cf15de268d909", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789371, "uuid": "72b882b3-a0d5-41be-93d9-bd115f9c5be0", "value": "T170635A256EB23923C1D4697A52F70326B0F6074E34A8CA2E7D610F4DFF99A4075236F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789371, "uuid": "6d6a1fb7-f730-4d62-bda7-02df8c5e74fd", "value": "768:MzozxQ27vnWFp3dt6o9QjzVS0wAv6IcAsVPPw6zwrOV0O+yJT1O6oumP:MzwxQ27vn2pNaBSgv6IcNwXOoyGcmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641789371, "uuid": "674fd1e4-1e06-4ff1-a4ed-43bb4beb2714", "value": 69584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641789371, "uuid": "6ab0e370-66a7-410e-b782-bd1bb6a1b8ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641789371, "uuid": "af22af94-7139-4494-9429-edbdea24b380", "value": "97e087265e80d35f979718101779cf61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6476588c-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641805930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805930, "uuid": "24087ed7-3468-432a-bb57-7f1a5efb87e7", "comment": "Malware payload (Mirai)", "value": "330a4e1364762de876155b655b9ecc4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805930, "uuid": "fc392174-210d-4cb3-8172-b91c4b5cc2ed", "comment": "Malware payload (Mirai)", "value": "b0e490f8e86eb5f4b1e41f4bcca4f4ca2980b2738ff4a7964b190aa4279c9ed5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805930, "uuid": "ba2902a9-7294-4030-bfe9-42fbccb5bf0a", "comment": "Malware payload (Mirai)", "value": "544f3cc7ec32f4279d7274dfb9cf4354cfb43791", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805930, "uuid": "bb55820d-9d7d-405c-854d-00144448984a", "comment": "Malware payload (Mirai)", "value": "88650a9ce33646acf850f4a72d0109a60afce4fc64c40c086c8498bb33dc4596ccbc274d7ac11ce149632c9e932e0fef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805930, "uuid": "76f3b7d5-ebce-44b1-993e-254a0292b30a", "value": "T1FF931792BCA29611C7E0037BFA5F015E371997DCE0DAB3929D356B6036CD80F0DA7A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805930, "uuid": "90300f02-8c08-4e8d-b65f-525f332f2d72", "value": "1536:3x2jjAfBfLp6MWqBR7GCb1cTZhP10/9HOFkCIBeZWR0BiUE:3xUjAfP6P0AkCUwI0BR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641805930, "uuid": "2c3ed8ff-3978-46c7-8873-603fbbc29208", "value": 91128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641805930, "uuid": "682516b6-9d77-46a1-8169-da4270c58ba8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805930, "uuid": "96044641-e2f4-43a0-8a6b-32d55e0c2d33", "value": "330a4e1364762de876155b655b9ecc4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f6700b-71df-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641796720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641796720, "uuid": "e04b063d-585a-4c4a-a6ad-b09d9636fff7", "comment": "Malware payload (Mirai)", "value": "3f2b0fadc5c43e26df82edc2189c14b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641796720, "uuid": "a4fc6e88-a11f-4292-b9d4-5b3855ebacf6", "comment": "Malware payload (Mirai)", "value": "b13f45cc8be986a8116dfde367d160e60d6f1f9fe703fd2c03e3cc640200923e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641796720, "uuid": "d4779ecf-a972-4ab8-b13d-9d00a8c05d6f", "comment": "Malware payload (Mirai)", "value": "a89ba59562548c92ae4c62fa2fe706a04bfd958d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641796720, "uuid": "7042d7f6-0730-4296-b1f7-a5c7cc1e55bc", "comment": "Malware payload (Mirai)", "value": "c80515970677e9c166b10e7b3d4550e069a40e7de70d77d9d98a377395773f33c371ceba825cb030c0c7603c5c9e7f0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641796720, "uuid": "23cd0076-f649-43f3-a23f-f4362651cde2", "value": "T1B0634CD6F901DDBEF889E2770C134E087271B2940E531F626757FA7BBEB6158241AC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641796720, "uuid": "97ed5b43-2dc5-4149-b0bd-48363c638ddc", "value": "1536:zLbfL9zca4tna5yX1Qnx5BzDQeuacWjcW0JcWcBMOk5nLgSJ8fC8aHdg:zLbfL9zcRtna5ylQVDQeuacWjcW0JcWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641796720, "uuid": "e7253a9d-1a66-435d-9311-0b3c748c053c", "value": 69460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641796720, "uuid": "758f6ec9-202e-4248-94e7-a8f69f8a7811", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641796720, "uuid": "b1bb7712-432c-498c-90bc-0271f0396930", "value": "3f2b0fadc5c43e26df82edc2189c14b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4e7643-720f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641817161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641817161, "uuid": "d2f52e15-e4ea-488f-811e-2dfff3dd015a", "comment": "Malware payload (AgentTesla)", "value": "359cd3ef3e83fe4b750579935826c4ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641817161, "uuid": "c36d5daf-0c8f-4ae0-bcc6-00a812c314fb", "comment": "Malware payload (AgentTesla)", "value": "b171e007cd33e3ee25bdce6612e82f13e01678de6d5e5c22f12fb009040c7854", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641817161, "uuid": "49106e4b-18a6-4099-a3b8-6b022aca125a", "comment": "Malware payload (AgentTesla)", "value": "fb082c13e7f050b8f94a0b5db6654ead8ff323b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641817161, "uuid": "7253adf6-e0cf-4067-a213-b6f9cdc0ea34", "comment": "Malware payload (AgentTesla)", "value": "39a92f18ef731a4e8ccbf80f2d00338d4429eb53ada06f7e9d60c712df4ee8af27a2d0af1ae45bb2b9f679981f03db72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641817161, "uuid": "056d2ed3-eed1-410d-8aee-79c64553c9c1", "value": "T159C412AA97C88647CA6C01F97825FB6003FE9D6C883ED36E1EC4B1EE597F3045547292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641817161, "uuid": "ecccf07a-787d-4636-b62f-f698ba4303ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641817161, "uuid": "10702dae-5ee5-469b-9a4f-f6dd7d39f9ef", "value": "12288:ccK4jgWLozqFF/QtFZfamekvIVSfDuJPB1vYUuJ:UQgWk6ZQ3ZvekAmo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641817161, "uuid": "f21fda79-aad8-4e9a-adb6-d83714c61470", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641817161, "uuid": "05e56df5-8b91-40ce-b116-761b48434317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641817161, "uuid": "fc96b807-7a91-4e2e-b2bb-56a8ca843c60", "value": "transferencia.pdf____________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410b59e8-725b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641849680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849680, "uuid": "882bf27e-8b67-4fbd-9b6f-bd6b19f5f982", "comment": "Malware payload", "value": "1246ca9a06bfb1feadb0a5c4a0f0187b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849680, "uuid": "75001edc-4d3e-4a2d-859d-6702464061ca", "comment": "Malware payload", "value": "b2c70db423d9e67c33541a78dabdec9ab3495262a12cbd113f33b9b7b7d23836", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849680, "uuid": "3c6fb195-6fe8-451d-ab27-33879fd39d22", "comment": "Malware payload", "value": "66f8f5e4daf322ed4c7eae030b80e79babf46d5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849680, "uuid": "47fd539e-52f0-45c0-9404-82ac346628e6", "comment": "Malware payload", "value": "4f73c26fae45a309c3b0fb39aee3b931cf49ceb3e11ea7ef2a97af6d6cb4cd7ef8fd9f84dcb90c84ca557f508c19e965", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849680, "uuid": "fdff5563-42ee-4ca4-8887-2c00364a06d9", "value": "T14BF53393FF1A3CA6C38B59743508B7CB1D22043971E49B553F8FB4488A6512ADB9E1F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849680, "uuid": "d897d92a-d9f9-4905-b0f4-986ea6e1894a", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849680, "uuid": "7c9555f2-a92b-443d-8a62-77953c196f26", "value": "49152:9pboODBr2nXQ3+7z5A8YK8gwVtzEKbk8mON857xPs8ELdCC9iV0gYp9E3cUnZbNB:xu7dA8x8vFk8FOJxPPC9iqg69EMcvN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641849680, "uuid": "2db7ee3f-4e25-4695-b1c3-0f02bd28e96e", "value": 3562408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641849680, "uuid": "40cdb221-b60a-4c02-8a9b-18a2abd4c852", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849680, "uuid": "4db04cf8-dcbe-4a7e-9fca-0fe772d6e9fe", "value": "1246ca9a06bfb1feadb0a5c4a0f0187b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29085420-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641797241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797241, "uuid": "05209d54-8c6a-44a1-8f7b-d9d1bdc955e4", "comment": "Malware payload (Mirai)", "value": "7e3c90a6633cc13bff1e03b33ff410ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797241, "uuid": "b905563a-f6e3-4410-a27d-c44873bc2e3e", "comment": "Malware payload (Mirai)", "value": "b374463e2bba6337368e4fda31170671d247f3c51676d0f8e12ca1c34fe17096", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797241, "uuid": "b0b9cbd4-5f4c-4327-8ca4-0a0c8fcb92a9", "comment": "Malware payload (Mirai)", "value": "fbb137b5c0b0760c1f1065f10a094cdde002ec70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797241, "uuid": "5afe1cad-0ed9-421a-a40b-fcfce8449a79", "comment": "Malware payload (Mirai)", "value": "5cfccca4dc96da23ebd6c13187d3543a9e563ba300f1b3d9917b38a6fbe159bf4d29a57b2d544c65eeb67575c90c1658", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797241, "uuid": "20a8c43a-375f-4f2b-922e-018ab789d33c", "value": "T143D2D06ED5E48CCEC86DBCB4909E1336AD14B140B34DE65C63059DE8AB3444F7D8A9EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797241, "uuid": "c5c31bec-2974-426f-9b66-e90cee397500", "value": "768:e8dRkpzp7AoHyC1rdjziNK96BdEg+I+jJW8:Djk7/xBdjzoKcBdEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797241, "uuid": "75e6533f-51c7-48fc-be52-d635e13650fd", "value": 30856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797241, "uuid": "36386aac-95b4-463a-9c4c-1c4ecb19ae4e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797241, "uuid": "f64d2985-dae1-401c-8bbe-8aa3915bd36f", "value": "7e3c90a6633cc13bff1e03b33ff410ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a782bdc6-721d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641823223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823223, "uuid": "53e9433b-0a17-4674-8384-815362b72013", "comment": "Malware payload", "value": "7be735e0faccd19454565137e595b019", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823223, "uuid": "d32a2e7a-8e86-49a3-857f-0ca3a92057f6", "comment": "Malware payload", "value": "b543cce37278aaa30816534edb02c8e1f5e0b6dee0b4daf11f083ed7ee77112c", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823223, "uuid": "3230f348-94cc-4160-bac7-d97ec521051b", "comment": "Malware payload", "value": "d9ff43429b01b5718335365af24cbe990f8c0b8c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823223, "uuid": "772623a9-0cf6-4807-93f2-c3d183170fbc", "comment": "Malware payload", "value": "b964146dc12536aabf9b3f32269b29e117ac46431ed3942e7409daae1e6fdf5d227ab89a26005f5fd58c457edcb13ea2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823223, "uuid": "25b2d180-502e-4ba9-95cb-03e17e6cbb00", "value": "T1C3F5330C22AEF8FDE89949383B6385E1C5E452F1988225F2D77814580C3F57E5BDFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823223, "uuid": "9013efc9-e5b4-4ac8-86db-d295b3ee078e", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGMT:0XSxVJG2fLAqFOfT9sMYNMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641823223, "uuid": "9d9e9b5d-9d20-463a-a1b8-295206bb3fbf", "value": 3624960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641823223, "uuid": "6288fe5e-2bf1-425f-ba41-62751ae0abc1", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823223, "uuid": "1e3ffec6-5844-449d-8dd6-bf5e830ce6d2", "value": "b543cce37278aaa30816534edb02c8e1f5e0b6dee0b4daf11f083ed7ee77112c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8180e7f8-71f0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641803832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803832, "uuid": "d7cca3df-f95d-4685-a019-eeebda54ce3f", "comment": "Malware payload (RedLineStealer)", "value": "2a67d27f9acac381eae55dead0702a28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803832, "uuid": "78b0d095-9a33-44fd-9c61-4ec0a1838dec", "comment": "Malware payload (RedLineStealer)", "value": "b554c35225b03058b8a649646f8c8665100064e1442c458e4f7e1f5c61e19dec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803832, "uuid": "97623424-f454-454e-9ea2-1250375bed29", "comment": "Malware payload (RedLineStealer)", "value": "bc8592800d6f9a00d1e708ebcc7d9820b48f0b48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803832, "uuid": "036536e8-3642-4091-ad6d-8cd4d584aa01", "comment": "Malware payload (RedLineStealer)", "value": "bcc037ec06af34ab64f752e4ce07d396d5a3d2ab563cf3920fbb491527f6685bf9cb442cc8e78e3a065e2c27a88b5c9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803832, "uuid": "ed64e734-3483-464a-b009-ab59c4a221e0", "value": "T154F533B026C13AC5C749DE78409E8B979498C04DECD1E5EFE1C1DE04A2EAB91BF885DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803832, "uuid": "b1c53881-2619-478a-8df1-ed1929896214", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803832, "uuid": "c04384c0-3ece-4faf-be6a-f5d652f1d4f3", "value": "98304:dO7TtryFxx+twwC5QUiasfIERxsxbMhFo7u:cTtrSSpqKx0hC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641803832, "uuid": "3d2d7092-7ba8-447d-a443-6757d57ff798", "value": 3573552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641803832, "uuid": "916c3a72-4033-4bdd-ae9b-0683c1c1ec08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803832, "uuid": "2e2cfef4-e2d4-47ec-8681-91aeef6516d1", "value": "2a67d27f9acac381eae55dead0702a28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e65674-71f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641806260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806260, "uuid": "6716f011-9fbc-451b-86a6-081172586877", "comment": "Malware payload (Mirai)", "value": "71e30c512095d9ca3eb4378980609342", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806260, "uuid": "66db616d-b4d4-4075-a07f-477f082e7803", "comment": "Malware payload (Mirai)", "value": "b5ffd1a6479c41621db057514047dbdf6e3d48d4523d0f8a6d3b1ce66104ae98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806260, "uuid": "e549f496-20a6-4751-a2a0-d16a9a391e90", "comment": "Malware payload (Mirai)", "value": "f45d25bf7c2b4976309886a43aa5fef6e3270b50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641806260, "uuid": "65bae110-270f-47cf-a611-dced2b714a76", "comment": "Malware payload (Mirai)", "value": "372e1937f5be99d67ad5a858daf86db9e94112b58ed335201110190a292cb193edef3c4de4c7e832a21f41344654d66a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806260, "uuid": "a2bae131-8ac5-416e-ba58-461c12b0afeb", "value": "T1B5934A38A5382A62C8D4F47B31FB8B45B6F5329D2974998F7C720E1EFF2468058466F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806260, "uuid": "7c500c61-e355-4c7c-9766-e3a0d0d0d92b", "value": "1536:lYu7BlkSExQmcsOI8cvBbqie5J6EESDasPKaQTsDiWS6v11mgmIOFx:eORjmtnVuvrDTPJDiW3v1G1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641806260, "uuid": "0950c481-ed50-4a32-a9b6-a51b4853a92c", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641806260, "uuid": "6fbcf833-0449-4f63-a280-0dbad7aebe84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641806260, "uuid": "ae216385-1489-45d4-a5c0-111af4b3bc3a", "value": "71e30c512095d9ca3eb4378980609342", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86bcdac-7245-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641840404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840404, "uuid": "18a0197f-21f1-4b08-ba58-9acb3fe7f30f", "comment": "Malware payload", "value": "eed3176f73f4cad98183f4420a9766e7", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840404, "uuid": "fa6a9926-9934-4ac6-a49e-dc0279910dc8", "comment": "Malware payload", "value": "b6a9ac14a6f863101cfc6c1821a82e21ccd63d9cc6cffedd382612efc1793881", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840404, "uuid": "041fe232-f0f4-4c3d-b199-d9c095d6b914", "comment": "Malware payload", "value": "cd13795cfb85f8284f634ca7fbba90d862c661ed", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840404, "uuid": "84bcaefb-01ef-46de-92e3-85c63613f909", "comment": "Malware payload", "value": "034f5dc7f9eca8971e47f2f19c3292207b5cef829dcc6dc50a8cf4a3f5c04ae7cca431256422de5bddb1692e01809b11", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840404, "uuid": "b7909637-30b0-49a1-8c90-ddb15f041e2b", "value": "T1287533668CB40B518F6432697373B82C7F94257D9BE3B9467D8CA3FA21C6BE0075602C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840404, "uuid": "ffa829f0-0530-4d6a-ad46-4fbfe8100e03", "value": "24576:IgI3EApBpFVq/FZwDGZGTbnTTuOm4Xnveslut3sZ602y7k5tEWM97ykH:Y0AxFVqDYfnTi6utcZX7k5tyRyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641840404, "uuid": "12750722-8d71-431b-b923-9c13612c9ecc", "value": 1553841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641840404, "uuid": "da33bbca-b595-4785-a27d-34574ef39ba6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840404, "uuid": "3e8e49fb-e408-4717-990f-22eaba19281f", "value": "RFQ-2201747.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3defd1ac-7228-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1641827770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827770, "uuid": "45d7edc7-f5b2-4e5d-8496-1b23533d3d46", "comment": "Malware payload (CoinMiner)", "value": "f06a4a419211148424034e7e94ca448b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827770, "uuid": "6757f96b-8ae9-452c-acaf-a5c5164c54b2", "comment": "Malware payload (CoinMiner)", "value": "b6e2a4cce6a336b3331f7514ae550ed23690bc5184531e80b33560fda52e0a5a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827770, "uuid": "d3938d92-0e5a-45e6-bbad-7725f8a8113b", "comment": "Malware payload (CoinMiner)", "value": "7e4a9fe01ab661e7534c4d9ec676a1f36618a70a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827770, "uuid": "014819d0-5650-4517-922a-44e63cd48661", "comment": "Malware payload (CoinMiner)", "value": "9643e37378e06a48f5b708644f379a8d2bae184f37104c83116d12e5678985ac5ddca299717c8afdccfcb3aa0408a7ad", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827770, "uuid": "7b1d8285-533b-4330-a1d1-a5faabb66f0d", "value": "T12664D03076A8C432C5A702718825CBE56F3AB8711E6880473735D76E6F30EAC56E6F5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827770, "uuid": "09d09ae6-2865-473a-91e0-2e59fe99278b", "value": "e087163b8fb7bb3f17281a379e5aec9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827770, "uuid": "fc3055f1-afa1-4161-a0af-ae2953c0909e", "value": "6144:myuCLrYajOGJohv6PVCTlO0uuzbgwuJG:l/YajOGJKSP0uunnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827770, "uuid": "c9cff1a2-3603-4de9-a976-ee7b6c448fad", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827770, "uuid": "0f0d6de8-9522-447b-abb6-74f99a6ec81c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827770, "uuid": "63ec2296-bcce-492a-baa5-9b8ef5fcfd61", "value": "f06a4a419211148424034e7e94ca448b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc4edfd-71ea-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1641801435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801435, "uuid": "aac1065a-b01f-4136-b441-9454c64e734c", "comment": "Malware payload (CoinMiner)", "value": "32c4a9891310195be4a43a8c1970467d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801435, "uuid": "a714ed81-fd72-4dcd-ae41-88427f77faa6", "comment": "Malware payload (CoinMiner)", "value": "ba7a55b17174de39cb44b553a52de3d0b3c979d37104a5ad1580cb97a8acc800", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801435, "uuid": "55926261-b62a-4b95-a2dd-74b88b899a81", "comment": "Malware payload (CoinMiner)", "value": "7712c3b551f0412a15b258dfbf1ec224774cde60", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801435, "uuid": "626a95c5-8b4d-4008-9678-2b3e71dade1b", "comment": "Malware payload (CoinMiner)", "value": "620a7efdc22331af3900c7c1a6c6dd4f40e1dafc6bf345a11c7399c95498cbf3d0d474c6bb500256e59c6238607779ff", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801435, "uuid": "77209aa1-aad8-4f15-a127-669a9934d2be", "value": "T1B3C1D61BAA548231D25C07F41D3B814D9BFE1873576909FFA333158B66F12A1F411B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801435, "uuid": "29960020-8f4f-4219-b376-5500a241eee9", "value": "a000d5ec0cb7981aab740e433bb322a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801435, "uuid": "a5936251-cf36-428b-8ad5-efe039930545", "value": "96:WhQTEhiF5QZFfsHxuHuHgPtboynunVCtrO:CUEhcAFcqmgP1oynWUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801435, "uuid": "407daaa1-de85-4557-8999-f8119cd09d64", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801435, "uuid": "a3ea5632-aff3-4301-a6fb-cb7090daf7dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801435, "uuid": "e1ce13dc-f84e-46a7-b024-1a4022dec6f8", "value": "32c4a9891310195be4a43a8c1970467d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c446a63-7267-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641854933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641854933, "uuid": "4dfd3a20-dc17-4833-9434-8e66b6a12276", "comment": "Malware payload", "value": "3017516c5a0434eb47f6fb228178089e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641854933, "uuid": "6cb3a530-aa58-444c-9e0b-0efd2f0ddd29", "comment": "Malware payload", "value": "bb83aacbc4339369e8d0c6e5e9f098762fc63a30421c37cd1581ad17e258ff24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641854933, "uuid": "6cd9bf9b-a289-475e-ba08-eb1616b42166", "comment": "Malware payload", "value": "74d4849d7f842187e09850421bf6e3d62fda5c89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641854933, "uuid": "b143ec4b-47a8-40dd-9c70-25b096c0b2b9", "comment": "Malware payload", "value": "a0d35f49267ebe8661bc2a63d619b70c3bc9a309d8f17da4ab024734287901a49c9f7fbb0a8506f4f83280cc1f29fadc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641854933, "uuid": "6a07aa43-692f-4ddf-b522-2b766c59f993", "value": "T14B06339AD7FE3408F50C56BC31016EA37F6694E414918AC362188F5FFCF1AA2F5946CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641854933, "uuid": "29ba3fc6-6d94-4125-8c28-87fdce36891e", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641854933, "uuid": "f0e32eb1-e8ed-451e-948e-1cda523957d1", "value": "98304:/CHnxi/bs9bweg0UnazHBGFv2FFufvoflIr:KHI/wbarntv2FFufalg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641854933, "uuid": "ea3f517e-b69e-4110-8cb4-595e799307fa", "value": 3661104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641854933, "uuid": "0fff7eac-c4f2-4a09-a72f-6c2d317ebb6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641854933, "uuid": "fbd12434-7dd1-4fa1-b6fe-8aa50c35c2a7", "value": "Immortal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8577c13d-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1641805986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805986, "uuid": "666e1413-c38c-47cb-b6f2-966aef5db72a", "comment": "Malware payload (Loki)", "value": "c76684ec2b6535cb95d89164c034a465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805986, "uuid": "904885dc-c4bf-4112-b943-1e45f2b3ff03", "comment": "Malware payload (Loki)", "value": "bb9d586215a1db740efb34ca5849eaee88da2b370b6fe07c6d63e7b32592a517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805986, "uuid": "74e1ac3f-6a93-4019-96bb-d68757970855", "comment": "Malware payload (Loki)", "value": "e9cf1979758f992e7d4a70856bbc3cb7be82561d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805986, "uuid": "2ecdd103-6d6f-44b3-8caf-87f1bbf5cf4e", "comment": "Malware payload (Loki)", "value": "c20fbef0902f5e24fb21245e15833452220ba6e3dad9ef022a2f4f81a50302f10c9f27d7d2442bbf121de7d5483119bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805986, "uuid": "789ddcd5-7731-4f28-af13-9f52c2cff81f", "value": "T18384227662C50AD7E281967938BBA268C276C63030192993E3B5DF7F1F733CA4716582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805986, "uuid": "96b775f0-f85e-4055-9e1d-50c2ec3ae137", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805986, "uuid": "1d20ee4c-86de-4b3d-8541-c107f04b0ef2", "value": "6144:yybLOKRvmAazy+BSEslBHdsrkxXs4EgoVUtCpGvz5a/RVYZvhjPwfGWp19cX:PbL3vmI+d8srkXEhEvle+jPwtLcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641805986, "uuid": "c40efd75-f000-4b42-948c-686d49cab056", "value": 377023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641805986, "uuid": "1b48a6b9-9bd1-461e-942e-f2cc001705f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805986, "uuid": "3cafe8b7-434c-4a9e-b1e6-1eb9170cd013", "value": "New Prchase Order PO-W-45-0001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158dab05-71fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641809234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809234, "uuid": "28053512-a225-4921-98e5-50eb36bf975b", "comment": "Malware payload (Mirai)", "value": "36bf2cc84371aade1e9374698c22c180", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809234, "uuid": "bab0e359-3ddb-41eb-b408-d8a982ea7d98", "comment": "Malware payload (Mirai)", "value": "bcef08c8a2473ac9d02b8b1eaa8e171d1622dcd96c87103c9d8d01c7835b40f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809234, "uuid": "617cbb08-eb7a-4d62-a6df-314af7ef2b40", "comment": "Malware payload (Mirai)", "value": "1b6959517e2b8add1e378e1edf006c19e47f0035", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641809234, "uuid": "f4b2a703-679e-4f28-8e92-07fd1645e31c", "comment": "Malware payload (Mirai)", "value": "e8b484a8dec8f751afbbde0b9d12fbc71365f65cda24cadba1de8ab05a6c5d8098993e7161274d5f5e0b48a39863dea2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809234, "uuid": "d4765b5b-40f8-4466-b0ee-dd09ca6f9bb8", "value": "T168B39D30D415BE94D08812B0A4F4DF794B23A2D447672EB36BE98AE52447EDCF50ABF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809234, "uuid": "d8e87834-7838-4d8d-8385-5c64c2362360", "value": "3072:8hWd9k7PG129ex7rUKQPIv1qL2yNCjUZg:8hWDCgg8UZPkMPCjU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641809234, "uuid": "63d275a7-d59f-4ba5-b2f2-79bd35d823ce", "value": 112104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641809234, "uuid": "1eb54f5f-e75c-4c98-a5ec-e5c1b6c21d1a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641809234, "uuid": "4a7af83e-93e0-4e84-b4dd-0380ed9cc03e", "value": "36bf2cc84371aade1e9374698c22c180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416f285e-7213-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641818756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818756, "uuid": "f1f7215c-aa24-4af2-8536-785079b3e788", "comment": "Malware payload (Mirai)", "value": "2ffea2304c0d5f8e10b9231f0bbffda2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818756, "uuid": "b6b2654f-4fdd-4373-b654-43d132eac7fc", "comment": "Malware payload (Mirai)", "value": "bcf68d279a990cbd6cb0823070b0e24b9839ed3c38b3b6b7f77116eee66ef1ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818756, "uuid": "2b52af7c-1bac-4377-ba09-5495818f036d", "comment": "Malware payload (Mirai)", "value": "d69122f65085d9512ce108e8cdf00321e0d26a79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818756, "uuid": "095442b7-3f4e-48bf-82d0-fa4c14cfaac2", "comment": "Malware payload (Mirai)", "value": "7f32b6f79cc1ebf8aaca9429f01b1dc1b92631aaa6a521962c9f28d4bbec345a827563e8db9e9f0fea114d6f300ee977", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818756, "uuid": "7bff11a2-929a-4bdb-bb70-808571e7acf2", "value": "T19D533DD5F401AD7DFC4AE37A84960E0DF921723456630F2BA76BFD836D320A86E16E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818756, "uuid": "b303e526-3e51-4955-9fad-6923fcfd573f", "value": "768:KPeril+KxTYbr7JMvLh6AIiDWbQLuj/SEcVWx+KYFGQAWD886VTEs:KPopWgAx6QSLSKx+KaG/g81l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641818756, "uuid": "8b9e472a-7a5a-43e6-8000-fd5919477229", "value": 63168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641818756, "uuid": "f8a1829d-461e-495c-ac63-01b61d6c6bdd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818756, "uuid": "eb2f34c0-a1ec-4cae-a94f-e6f36ced445f", "value": "2ffea2304c0d5f8e10b9231f0bbffda2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcf4b7a-7246-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641840685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840685, "uuid": "6c5dc948-0156-42e1-9b10-d7947a70ac9f", "comment": "Malware payload", "value": "3cd62d0314ca73712ae0df1d082315da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840685, "uuid": "93989c87-0881-48d5-a1c1-8772508f7f84", "comment": "Malware payload", "value": "bd2c21c7795050f076ab1cda5d3440254f6f64d692895e7aa929d2a4ce85f751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840685, "uuid": "0170d34c-2d7b-41ff-9ec0-2b5c6b36321e", "comment": "Malware payload", "value": "5bf630adfe522755a7f8d2907237e4f06cdf89d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840685, "uuid": "2f776667-b704-4925-9d37-9d162f041dbc", "comment": "Malware payload", "value": "a807f2f2a6b236a142d42c83e60596d451989d3d45ea557bcc9ba7137c9513eab8d21a30088a7773746aff72cd0949d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840685, "uuid": "dd021010-de6e-4a5d-8f9e-77b9dff5c6fb", "value": "T163B4AD8A25D6E6D7ECEAE7FC0DB3A0434EB1BDE0D594D1493E4C304A64A1FE8864C971", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840685, "uuid": "a53fdaa7-c5b2-41b0-95c7-96a78641508f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840685, "uuid": "81bd7e96-7a0d-4fc0-857c-8c8231b0f9aa", "value": "6144:8WZOEMLoHQLMhwwsvBZC5PIhz/N023O7uCHVuYxrRr64swnyiUhFPL:8jxMhRgEgr023CJHUYxd6NwnyiUhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641840685, "uuid": "77f8f0bc-e95c-44cb-99e7-e9ddb10974d7", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641840685, "uuid": "2b59fffe-5efc-4459-8e2d-c3115f039441", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840685, "uuid": "10ebd495-4b3a-4273-a4c1-478a5ade37e0", "value": "7qMQZEDrGz46VA3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50882998-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641805897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805897, "uuid": "57c77a34-3487-4450-b34b-701f73c0a1e2", "comment": "Malware payload (Mirai)", "value": "8e417ab05d3ceb6d7242ef8e3781af86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805897, "uuid": "04f53727-c629-419d-8b87-49696d3e59e9", "comment": "Malware payload (Mirai)", "value": "be9576f364059f9371d9aa6f1e87243eb4b866992f6881705cb5e8a54efb54a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805897, "uuid": "fba1df53-38cc-46e6-a1a1-0c4bf3be0d4d", "comment": "Malware payload (Mirai)", "value": "effb9c132598c11fa883395de49564dd446e356f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805897, "uuid": "7de75b52-62bd-4f49-a6b4-709d1387743e", "comment": "Malware payload (Mirai)", "value": "6f194800c7d5eca9c5243b369eb37adbefb5510601be91c77cf9d98e874e88c7bba902076405feab1f7394faad74e5ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805897, "uuid": "319782fc-0af4-4b22-a965-fb79ea4ec442", "value": "T1B583190272258907EBD287F0792E2BE197EEE9C021F079447F1FD76603B5A371599E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805897, "uuid": "cc8bbdd9-7a03-4e42-a3a8-7be0de582ac1", "value": "768:fX0Pm/D+gGyuTPrvKFzRCN9fcjYhHpM9e82uG3bXwQGXQojnBilwzIJSAwW2s1Ex:f/1GZvKRAMNWlGXFnBcvIF01RbhhIHHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641805897, "uuid": "db1e4bfb-acf5-49d5-9cfc-db8794221ce6", "value": 83032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641805897, "uuid": "5c54c0e4-ee36-40f0-b547-8e76feac1b0d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805897, "uuid": "d6479112-f3ff-4978-93bd-c283b57d694e", "value": "8e417ab05d3ceb6d7242ef8e3781af86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d27743c-71c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641786269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786269, "uuid": "cfb262b3-7191-4d36-b0a6-6be242455530", "comment": "Malware payload (Mirai)", "value": "b278c3458ef90de33928ee26108855c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786269, "uuid": "5f72ac92-efbf-4dd6-9116-15786cc764e9", "comment": "Malware payload (Mirai)", "value": "be97f7bba94e085b67a7497cd779a0782fab05547c6aeb3b7b5afe8e2548f49a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786269, "uuid": "b8dd4d70-65e3-4593-9525-863232a9a46d", "comment": "Malware payload (Mirai)", "value": "ddac10368dc381f69965648581cedd3073b22b9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641786269, "uuid": "5e2bce12-a126-4a1d-8606-fc125289426e", "comment": "Malware payload (Mirai)", "value": "c291064f8852b1dfe1bc732096d7a8baa3a59c233250e85b2678a4ebc07ec9623d75ad37e30e9cabb2469bbf2c083fec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786269, "uuid": "ba432162-15f6-44c2-87a7-cd3097b9024d", "value": "T10A83C70D7E218FBDF7AD86344BB78E215649339A37E0D284E25CE9114EB024D345FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786269, "uuid": "ba1717bd-cd2a-421c-b81c-b9f932d8a11f", "value": "1536:Qx7ooS0e6wWjD+M5c8N/GePlsRpYML448NbdGZQ6uZTAIJBWB:+7PSL6wWjD/5QePlsRpT448N4ZQ6uZUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641786269, "uuid": "66bc2848-fe49-427d-860f-3afee2e7c83a", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641786269, "uuid": "2a6e8c7c-72f8-47c8-a613-7fa8c38a2742", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641786269, "uuid": "2ec46a94-8141-4615-b5c7-b08068c29fc2", "value": "b278c3458ef90de33928ee26108855c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e828f3-722e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641830419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830419, "uuid": "62e84fd7-8bfb-4103-a95e-18b26ce12479", "comment": "Malware payload", "value": "87824737a8c988dd603ce278ed8172ed", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830419, "uuid": "eccb1621-d454-4468-824f-349c979b146c", "comment": "Malware payload", "value": "bef6bb9cc2138ed07d80c3c9267e124f81ea4e0dcdbe38840432dec990aaff4e", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830419, "uuid": "f10276ba-fa0f-4723-9771-c0a87826a51a", "comment": "Malware payload", "value": "dcf7e8d3d1869c02c39c05388b9a27abb432673d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830419, "uuid": "3a2da291-73ed-463b-b558-4f8452a225a7", "comment": "Malware payload", "value": "bd3f91b34d9cab94355dfc1042545134c557e11ddd1499913d5b6f5ac59b8eb2477e487fa713270ddca1bbcd1785a511", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830419, "uuid": "a6cf97c5-8b5c-4738-b4fb-b254575f5d7f", "value": "T1FC06330C239EF4FDA49A096C3B2789B0C9E452F5DC8225F3963815940C3F67D5BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830419, "uuid": "e954a39d-7ae6-4a2b-bd3e-4fe04db07f56", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKs:0XSxVJG2fLAqFOfT9sMYNM29s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641830419, "uuid": "535745cb-c192-4efc-b166-19b187154d17", "value": 3772416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641830419, "uuid": "6983f384-6216-402c-88fa-e07342bc9ec9", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830419, "uuid": "2297ed62-92b5-4dc8-9088-c95d5f319cfc", "value": "bef6bb9cc2138ed07d80c3c9267e124f81ea4e0dcdbe38840432dec990aaff4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1de800-7220-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641824356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641824356, "uuid": "8461279a-7877-497f-8204-bab8416ed5ac", "comment": "Malware payload (Formbook)", "value": "87daa273000c61cd0de4624ff8fffa92", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641824356, "uuid": "80c00897-2893-40b2-984e-1dc5d1b89369", "comment": "Malware payload (Formbook)", "value": "bfb063bc82802eaa6658f4b94e81365871054878a81d352f2d97caf2397ffabd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641824356, "uuid": "c0815ecc-0260-4a95-84b5-f44b5e898d2a", "comment": "Malware payload (Formbook)", "value": "a050321cc863e57f32bf0b682f57d75fba0cf4c9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641824356, "uuid": "1fb30bd3-e144-4585-a421-ac7a896b015b", "comment": "Malware payload (Formbook)", "value": "2e8e475fc3c4985afbb602e4bf044ee958450f36bb56adcbefc68321fe0a603e42a9e5f215b584922d1c3822fa7cfd5e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641824356, "uuid": "02089edf-5ffb-44c9-948a-556466e38eba", "value": "T12892C4ACD4974198CF46ABB4671B2F49018D7A2EF3899A33767C877217D2C3A511393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641824356, "uuid": "83a51701-5824-4b7a-9011-4b42c8142c3b", "value": "384:HH+5mtfr2J/KYTn/kfSaO4OkxEUHoirA3+eX096Ci:HU0fSDM7XEUa7uti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641824356, "uuid": "747fe3f5-f215-4318-be79-66e8a103ff44", "value": 20363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641824356, "uuid": "06c22505-6e13-49ff-a837-2e6a129c301e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641824356, "uuid": "207347b8-7f65-493c-bac1-008ce91a8665", "value": "Order_no_2770034022.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ffc336-71dc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641795415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641795415, "uuid": "3e5f44e2-df20-46ea-8be7-4040013bbbfd", "comment": "Malware payload (AgentTesla)", "value": "d2d3bdea2288eceefae4ec496c8d36b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641795415, "uuid": "86a9dfd1-d3f5-4b5a-b3cb-c4ff10d23f40", "comment": "Malware payload (AgentTesla)", "value": "c119959437d802b49b55d3c1f8bff3717c5aefcd3075ba7829823fc969a53fa3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641795415, "uuid": "3e5ba961-dbcf-4e9d-a49c-10263926a5a2", "comment": "Malware payload (AgentTesla)", "value": "0a1c34091e0f318a91c412bde524bee6baf2e416", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641795415, "uuid": "23d3ee34-1b7e-4bd8-8124-b64a279414ca", "comment": "Malware payload (AgentTesla)", "value": "374728fddc1723064eb02cd3b10b9ceafbf8876145bbee2ab5b602192a87f73be7b948534a15ce14e4ba38cacd6bf3d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641795415, "uuid": "8ca0254e-6bd4-4e44-87a6-c4954372e386", "value": "T1CEB4AD8A25D6D6D7ECEADBFC0DB3A0434EB5EDE0D591D0493E4C314AA4A1FE8860C971", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641795415, "uuid": "524e9561-717d-4444-8f6f-c77248545f39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641795415, "uuid": "e33d9070-9a1a-4277-ba50-6201d6be4cbe", "value": "12288:kZqbdS7gInfeQAH3hjBBxXt4hm1hrLVhh:kZqbdS7gKfFAHZ4sX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641795415, "uuid": "f134d0a2-1539-4f16-bf87-229461f1d280", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641795415, "uuid": "f6e76fcc-d50c-4d38-a37a-318cb9d2d1c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641795415, "uuid": "cbabcade-d5ae-4d0b-98a2-f2d98be871eb", "value": "ASEAN SHIPPING ADVICE#202201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e544698f-7224-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641826333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826333, "uuid": "f98d16b9-d569-4e35-9738-647666350a5d", "comment": "Malware payload", "value": "2f5ee317fae6534e138591ad5d1fc5de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826333, "uuid": "b3830514-47ca-4777-8297-7e78b9c9705b", "comment": "Malware payload", "value": "c2f0a4f557cfbde42b28d7d78ab059e20ac40330636ce9f720f2d06c5ee86b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826333, "uuid": "3211a95a-ccd6-43d3-8cf0-cfc24d9e75ac", "comment": "Malware payload", "value": "b7c290bcab36b761badea0782f051ba6befd2d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826333, "uuid": "3c6f63b3-8430-4207-9de6-031d64623afe", "comment": "Malware payload", "value": "6f59505796bd5ca3c7d7892e227caca2b0765f84fb56d92f508099b8297abe3744b47481812e97bb35f76efb1ef74529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826333, "uuid": "1c36d130-8660-4a63-8677-8cc3b7476001", "value": "T163E533037AEFABF8C50146B3DA359018370721601CF485AD6B54EB2E71D3522DFDAE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826333, "uuid": "e7799e57-b4e5-4bcd-a78b-7162f3a90f57", "value": "45c3eee06bcd5ef7518bc946e1677c4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826333, "uuid": "9222694a-deec-45fa-9825-9285222360d1", "value": "98304:Tww4lLiz5liBX+7rj2fel74QEndx+FfF7BUcAx/bPCxqJ:ulez5gET2Cq+Ff0/6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641826333, "uuid": "b181c867-bc23-49d6-ac2c-64a66ae4777b", "value": 3287552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641826333, "uuid": "3f308106-d6ae-4ec6-9418-7d1fda4a9e0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826333, "uuid": "69123bf7-1b7b-4bad-b808-eeecbc4745d8", "value": "SecuriteInfo.com.Trojan.GenericKD.47845374.7822.122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8255c187-7214-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1641819295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819295, "uuid": "950e8991-10d9-42cb-ab7b-9f128c134aac", "comment": "Malware payload (CoinMiner)", "value": "bdb742be28cdd944d6d76e7f848f5a8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819295, "uuid": "278b7b62-849c-4b01-9442-65a1a6e299a5", "comment": "Malware payload (CoinMiner)", "value": "c39b6247c3d38b4e06f05db01e440bd72cc99b2c000c2d082b22b87a64e2cc8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819295, "uuid": "9eeeb57e-0777-41e4-ae44-53d628cf3e5c", "comment": "Malware payload (CoinMiner)", "value": "81ed39584d00f6983f6332d0404bb8e8c0d7ea4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819295, "uuid": "a4c88661-e567-4484-98f5-2c2fe7f3de37", "comment": "Malware payload (CoinMiner)", "value": "cd2cb50c8dc1872dc35cd18425ed103ff3e8d8b03d818a163718f90a847c3275d1adeb7580d72082f482595f7623619b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819295, "uuid": "711fd9f6-76da-42bd-86fe-ae9abca179d6", "value": "T1CC740240F2D182F3EAB1053201B1617FA736663C47A4E9E7C74C3D829552AD5AB3E3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819295, "uuid": "c0758315-11d1-4897-955e-b5ef17bcc77b", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819295, "uuid": "f4a490ae-923d-46af-908d-d31241cfd3bb", "value": "6144:j5aWbksiNTBkofvIefnXOXR0+fw1vRz/DYpSiwx1r1i7w:j5atNTaofwQnCRFw37Yuvr1+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641819295, "uuid": "77442cb6-7e90-4493-9832-bb6d7d97a6b2", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641819295, "uuid": "b26194a4-dc59-43f1-9ae2-29e33d728fcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819295, "uuid": "feae074e-2acb-42f9-b4ca-0de30477f079", "value": "bdb742be28cdd944d6d76e7f848f5a8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead81532-7232-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641832355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641832355, "uuid": "fb3211c9-e21e-4237-a900-bcde04a43462", "comment": "Malware payload", "value": "dffb7bb7ea8817b9662142b27cdb698c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641832355, "uuid": "843d407a-8f7f-42c0-b705-5dd122d91c4d", "comment": "Malware payload", "value": "c3b8865ac4d782a47c8e09d70dddfed33012f1b2dc27f62939d8d58ddda28f07", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641832355, "uuid": "20a3964e-330a-4519-a018-089217f40315", "comment": "Malware payload", "value": "a02d39fb44aece5e13e58f082059590823b1bcfb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641832355, "uuid": "8d5497d5-5fa3-4ff2-836e-273cb605c870", "comment": "Malware payload", "value": "2bb7f1f307e3e5314514928dd5cd11e1c2f6a4d37852f6ec86e5b80727e72815df1046e5b543fdda48059f687821365d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641832355, "uuid": "719f9db4-959f-4a04-ba33-be48223b2668", "value": "T182559D23F2C18437D1732A388D5BA3699839BD202E38984A7BE92D4C5F397817D653D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641832355, "uuid": "d47fe10a-0004-4576-9e4f-41af16affef0", "value": "24576:JVfe5OYQEAhyaSecZjXW5APFMo++Oe6rqsOM4Ibv3Wr0g17KD5TU+cKw:JVyOYQEAhdmDDOe6Os3pTPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641832355, "uuid": "d445bab4-1450-414c-b152-896798db3cee", "value": 1383424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641832355, "uuid": "ba859e3b-0340-47c1-bcda-f2d1e75ea164", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641832355, "uuid": "2391c202-cb2a-42cf-b965-f7a39677762b", "value": "bbclqkhxdppcmycungxbqcplvbcghipfceeakvtcicacp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e022f65-7268-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641855419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641855419, "uuid": "5f5cb0f4-0ec4-4f1d-b60c-110310bd12ed", "comment": "Malware payload", "value": "14dca36a7349e8752ed103caa95b61b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641855419, "uuid": "f0150e68-451a-4619-99fd-677ebcff9ac2", "comment": "Malware payload", "value": "c44caf6214b38598c5268fd04d410da1598f102f4ab4b48c053f548af4f96e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641855419, "uuid": "0d27adfd-3481-43cc-8db4-e959d623407f", "comment": "Malware payload", "value": "6889dc4ac69afea5d4e5cd32eb273937ccfe83df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641855419, "uuid": "2a56aa14-ae65-4689-a239-ec4e7fe96653", "comment": "Malware payload", "value": "073052ea9d85436eab54e6041299057af8e383b9bd69966b5177f0924da757cb383072a64312d46b87ddc91e8601b0c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641855419, "uuid": "f13fcaf3-c71c-4895-b71f-266537fa02c8", "value": "T1245633EA014ACF63EE5BA5FC170D46B7C31313E8685C73BAF9A9536D86092D5B06C1E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641855419, "uuid": "6a018912-0ae7-400c-8dd4-601465d3ce72", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641855419, "uuid": "9214af5e-c909-4549-af75-e7c5c722e54a", "value": "98304:m0vMWS5mwl6r/JmUhOqRhFWb1Eqno5BdyqRIXCNZgefuY+7gvPwmMKaZhosK2IgT:m0vMvlgYnqRfWxjnondcXCNZ5+iNtat9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641855419, "uuid": "9624bbc6-7d21-4ae8-b111-10a720bd99bb", "value": 5886464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641855419, "uuid": "0da82cbe-baf1-4f7d-b0f8-a844c6a2b76b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641855419, "uuid": "8700dfae-5324-4c6f-9bbb-541a47c7d15b", "value": "rundll32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94749e3a-7226-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1641827056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827056, "uuid": "4108898f-6aa8-4b58-90fb-939a2ebe11a6", "comment": "Malware payload (RaccoonStealer)", "value": "e15494bfe62278cef25d474c2c7cc93c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827056, "uuid": "e4baa76d-c83e-4d54-9bcb-a46618e271c3", "comment": "Malware payload (RaccoonStealer)", "value": "c49d02e0ef275b0bbb4d78482baef68eae8adce5c1da1eab45d637d53c560f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827056, "uuid": "a5fb5695-8060-4a9a-a2bd-d5389b7e2259", "comment": "Malware payload (RaccoonStealer)", "value": "2d8b610a252701e215a3504c14091e0526dde27c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827056, "uuid": "1cf4d0ce-efa6-4964-bf92-eb7928516452", "comment": "Malware payload (RaccoonStealer)", "value": "91418b068bf3ee9db3fe73597b1a057195fd18f0298b6a920fa24d41cc391fdaaa10846edad2e1d57f7b6433a55864c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827056, "uuid": "ad5cb632-d9d6-4f3b-a41a-51a5d9aae1c8", "value": "T16F16334DB2120857EBCD67F05A66E3BE0FCDDC1CAA4489F2654CB15625C38E16837EE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827056, "uuid": "a716dfce-6c7d-48e9-ae55-2b7c9dbf038b", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827056, "uuid": "8495627d-ad03-401a-9426-3b2f61bc8242", "value": "98304:QJqcNkNFb2HnvGThUXRjX0nW3yHE5ubtwg2pw6lnMAno:QIqkNd2HvGThUBJhMHn6GAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827056, "uuid": "e4851e10-818f-4365-8e46-849861442f82", "value": 4021160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827056, "uuid": "46b1ac25-08aa-4963-a215-70ef3ea9f5ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827056, "uuid": "07862fee-675b-4078-a933-557b603effe2", "value": "e15494bfe62278cef25d474c2c7cc93c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a987fac-722e-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1641830476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830476, "uuid": "d228b073-0f04-4cbc-bc87-de88cb9e7969", "comment": "Malware payload (Vjw0rm)", "value": "0fe6e10e4918f1babb2e7d1caa3f3675", "object_relation": "md5", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830476, "uuid": "f2e77e87-0ba3-465f-952b-b71cae7ce0ee", "comment": "Malware payload (Vjw0rm)", "value": "c58344f5409f59dc36f3d14ffcaf30bcdbb2d7f8b3157c016ec0f360836a90a9", "object_relation": "sha256", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830476, "uuid": "af85b0b8-ba30-4682-a2c8-c82bfdbfc99e", "comment": "Malware payload (Vjw0rm)", "value": "1c280f2cd869c61cb03bc5170d1e9ef5462fe398", "object_relation": "sha1", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830476, "uuid": "8cb2c8a9-31e7-4dd8-8118-0be98aa9915c", "comment": "Malware payload (Vjw0rm)", "value": "94d07fe5700f1c7df77010abf24f843573bf4e3914c79c2bd0528c735e11d0ca77ba3243ce2ce8b077f34b1a6643ccc1", "object_relation": "sha3-384", "Tag": [ { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830476, "uuid": "5810f919-81d5-4ecd-816e-50bb84bc7c19", "value": "T174339592F296D852C9990B314DE6C2DA7726FC129F62C30B32C9B71F3F796808D13656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830476, "uuid": "ca1ad2e0-e5ce-4164-afc9-b14ec7e678a2", "value": "1536:aGZk3hOdsylKlgryzc4bNhZFGzE+cL2knEbOfm1Mfa2CH:a4k3hOdsylKlgryzc4bNhZFGzE+cL2kI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641830476, "uuid": "fe59b741-d242-41cb-b9ae-ddef431d123c", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641830476, "uuid": "5d077438-cb68-4704-a818-41b5bc89de69", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830476, "uuid": "8c4a5a20-e3d0-4b88-b394-ea823c811571", "value": "Bloomberg BNA Invoice Enclosed 098476796312.x.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c2d708-726a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641856153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856153, "uuid": "d0bcad6a-155e-43b3-87f0-80ec1f45e09b", "comment": "Malware payload", "value": "4208d5e313ac9a7537def69126e76fa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856153, "uuid": "b2133996-a7d2-4f89-85fd-174d45dd982e", "comment": "Malware payload", "value": "c63ed13976b0ee5164890a39c4bdc1fa69a820240c6af9f964fc4a40fefaf67b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856153, "uuid": "a240b10e-8a8e-4fdc-91a0-d47b1dc69a8b", "comment": "Malware payload", "value": "ec5ff9fe33e5643a49bcb60050fdb1310d9ff4b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641856153, "uuid": "cfa007cb-8bdc-47d5-8199-b43c342ec058", "comment": "Malware payload", "value": "12317f5fd42babd6d1a4722b52a60d9e022473d54878997a6278185ef8d367960582adcb11c138d4bad00904ef775ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856153, "uuid": "0fe5b4c0-f222-4f7c-9a2a-61199add449d", "value": "T16184121233B84BA4EC609BB86EF5544953B6FA465450F3BD0E86E0E130A4B0B8DD0F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856153, "uuid": "08939084-83ef-4ccb-b39d-bf66fd2e36d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856153, "uuid": "dc573b65-99fc-403b-960a-ad27ffe128f5", "value": "6144:LmDb97I8sKkqk4dAZpOwsDebZ4uQL3yEe0WGAYsdfZ6pj4SLXorryBDbIibbt:mI8s05qZwghgfgdB6pjzXor2BfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641856153, "uuid": "9bf39b55-4734-4da8-8470-831f0aaa5c23", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641856153, "uuid": "1ade890f-7309-4ade-9fa8-91464d8399fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641856153, "uuid": "ec274193-1971-48b5-813d-a3b4314795a1", "value": "New order 01-10-2022 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e3f0a4-720b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641815405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815405, "uuid": "e874539e-beea-44ef-afc3-96baeb70de14", "comment": "Malware payload (Mirai)", "value": "20066b590cfc091cf9052784132df7a9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815405, "uuid": "92619beb-2acb-4ce2-bcc5-80800668e2ec", "comment": "Malware payload (Mirai)", "value": "c6d70f526742ace4524afc565dfdc65b1332e1c617b01ab5e142e55782680af0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815405, "uuid": "c6bced4f-dfdf-46f4-9c16-4dc4ac46a578", "comment": "Malware payload (Mirai)", "value": "677cccb279d7ee8bf98f620dfba314cff39accc6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641815405, "uuid": "96e3a0fb-90cd-4a04-8327-085fa9d66d0c", "comment": "Malware payload (Mirai)", "value": "3ff037107a88624d7dde5695e73a45c58e4466a4e171b7fcd2b81de3de276976a2be4656fe55afd219e8d114da8e0456", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641815405, "uuid": "52124481-6845-4642-aa3e-b37761146065", "value": "T1CBB2E1E2F274453FE695E43094FFB4B9BBA56850570883440F419412CE7A23AEAF86E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641815405, "uuid": "68560d0f-9e88-45ea-b478-e58bf41caa71", "value": "768:+nMzJ+4TpkUsB9B1o8O4Qs9ClICFXfHwxPTY/j+hNo2z:4MN+6paB1o89Clx4dSShNo2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641815405, "uuid": "ed015a68-cd7d-4941-949e-d614138d0d67", "value": 25156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641815405, "uuid": "ac469a91-09d4-414f-acc9-7849aba992be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641815405, "uuid": "7a21e4ed-a9c4-4313-94d9-c947320b81c4", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4463200-7203-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641812158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812158, "uuid": "70b70f2d-9de5-4411-823e-001fafedfd46", "comment": "Malware payload", "value": "b3cc809e78b178a59daa452af0b33502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812158, "uuid": "b15d0a52-058e-41cd-ad61-8f0a2d2ae177", "comment": "Malware payload", "value": "c8b3ff1b5edaefca6f37ff6019ce811c9edea5a1b14b0714548ab5ff027f452e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812158, "uuid": "31d37032-f0ae-453f-80e7-ed3b30ba1e26", "comment": "Malware payload", "value": "3857f4a8e9c51fd4ee7adbc2ec8b5222fa635370", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641812158, "uuid": "c9898d1c-930d-4953-b080-d1bf73b35e35", "comment": "Malware payload", "value": "6d7644ffd8c0051de8e7156f7b7bea364df910144960f52986241ce6ead91fc66c02c53c440b0b29989a04239bd338ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812158, "uuid": "ec38b9b9-c56a-4922-99b4-f5c060dddc1d", "value": "T119124316FE9355B2F09E0334DC87C32F9E22B942DA33D717F6182B14F52364B961625A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812158, "uuid": "44b73485-9f78-48ce-a3c7-db4d516730c9", "value": "192:rKfD1HX3Qgc2Eww8ebsKIfDzHPnRonjkWt4RhOOxtW5w:rK713ggTw8ebsKILzHPnRonjkW+R7W5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641812158, "uuid": "c6d17f49-9185-4424-bf55-689983d704b9", "value": 9628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641812158, "uuid": "772d008a-c45a-458f-9efd-bda151835927", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641812158, "uuid": "82be41e3-fbb8-4609-865a-6d9e19f5fad7", "value": "SecuriteInfo.com.Malware.27533.3413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece898de-71e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641801005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801005, "uuid": "45af9e53-ef8d-4351-aa26-a39d9de64253", "comment": "Malware payload (Mirai)", "value": "ce943c8141a17b870e0db926e2c26d2a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801005, "uuid": "c79de720-c135-4df2-ac0b-fc3f6c26b1c9", "comment": "Malware payload (Mirai)", "value": "cad3fe99bb2a10cbaf6d4ba5af6e8a2024065005670b6462a9dbb7e5ea9395fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801005, "uuid": "9ef47ec6-65a7-4428-9062-ad6050647c0a", "comment": "Malware payload (Mirai)", "value": "f8c4c0b6e78f738ae5bcb636e3b296332931ff7c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801005, "uuid": "37d2ffc2-b034-442d-b7e6-5617a67448ee", "comment": "Malware payload (Mirai)", "value": "5826e7fd52acf5a4e27960ebc9037ee0744ee7f6f0ce178b96f3e48773578c0e96d9fcb10508f9fecdb0f3e3b022417d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801005, "uuid": "798d0186-0a78-43f1-9067-d33c2f841ae4", "value": "T11BE34B46EA408A13C0D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E63A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801005, "uuid": "ab3d0f64-8e9e-4d72-bef8-c43775794839", "value": "3072:3o2gE6xp200mRTbIpm79mrsplDKZUIQBKXAVanyX+F8Jyvl4hL6AhIg+ER6yol8p:3o2gE6xp200mRTbIs79mrsplDKZUIQBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801005, "uuid": "34080f67-817a-4a0f-a647-4491a0fc8214", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801005, "uuid": "a6889b94-206c-4efc-b6e5-53652b5db86d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801005, "uuid": "b165d963-3f40-481c-87a7-bfe6f80d6ce0", "value": "loligang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aec8a00-71c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641783607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641783607, "uuid": "39f277a3-f704-4773-9259-71f6eca617c1", "comment": "Malware payload (Mirai)", "value": "9214bcc7a4822c713120f082cf30e922", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641783607, "uuid": "0348d2e2-39b1-4a1c-ac98-39f649ed8c42", "comment": "Malware payload (Mirai)", "value": "caf99eca2e29ddd66ab63c82c1715a3a7d0ac0376943100b39b7f268aa534254", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641783607, "uuid": "efceba6d-30b9-43e2-a9ae-11d31ee02d91", "comment": "Malware payload (Mirai)", "value": "5ee9bfd81f07bea5f196bc51bd1c0da1f58e2640", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641783607, "uuid": "7408332e-7590-4157-8a82-9e2973c19548", "comment": "Malware payload (Mirai)", "value": "1c4226cadbf05fe7ff9358ee4e44f33dba1eb5890f863f430a53db3d21576e03d6574f27bf54dae796865a0a455466ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641783607, "uuid": "52bae895-40ca-4942-8b18-b8c439dc1a8c", "value": "T126632A55BC96CA26CAD023FBBB1E128D3715539CD1DF32039E296F746ACA91E0E37241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641783607, "uuid": "1b328b70-48c4-4b90-92c5-8249b203df62", "value": "1536:6DfRRppc7nAZnd8MLja953wvsC2S0kY3/UEg9E5yQdEW:6D5m8d8MLqqmD3/RoE5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641783607, "uuid": "940d7b11-c76f-42ee-acb0-0ee493b713a4", "value": 67040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641783607, "uuid": "c4ee7207-81a0-4ba8-a20d-05d154cf38ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641783607, "uuid": "ec1799f8-e195-46b5-8789-1646ac42cc3f", "value": "DEMONS.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17bd6d7-7224-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641826326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826326, "uuid": "e5d23e04-8789-46cb-8a2d-a7a72817b7ad", "comment": "Malware payload", "value": "67486b272027c5c08c37d2a7dfa3b019", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826326, "uuid": "1b1266e1-8e72-4741-8709-82b1e025583d", "comment": "Malware payload", "value": "cb2f3c7a11ff1993ed3a24d396beeca0f06842b9cd9097351a7c8662250ec677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826326, "uuid": "b23ab127-4e9e-415e-b175-778a34bc39cd", "comment": "Malware payload", "value": "660cd3fa71e480e03b392ccfff95b1a651ec1563", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826326, "uuid": "9f0590ee-052e-44a2-a630-3d9e9cb7c4e4", "comment": "Malware payload", "value": "2f60a698dff14560fa088edd7d6d1fb4636a0f6ff7a1cd8c8aee27492b90ab41a858dfdc06a5ea0d65391d05521f7f73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826326, "uuid": "1797147e-af5f-4399-9873-d785c9172eba", "value": "T1E542C7183AEC4FE6DDB78EF0369CBC5AB8CAEE6719BD450A193105450632A10FD1813E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826326, "uuid": "49821ad9-8eab-438e-88b7-00bfd8f984b7", "value": "d9015199fc550f4d12cfbd6fab74e595", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826326, "uuid": "a6a6ab9e-04a6-40c0-a039-a46efa08904e", "value": "192:vo9X3aXgSJ7F8F9JXVVpLW5ncOc/bi/ZtjSvNHhqXoCxWfSf:AgXpJy9VVdP/gBSiXom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641826326, "uuid": "10f42166-7f46-4f8e-90eb-431bf70f0279", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641826326, "uuid": "9471d65e-9d7d-4d19-9686-bd8841d2f698", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826326, "uuid": "e2421f6a-39dd-4d2b-8b16-5442d2a6b57d", "value": "SecuriteInfo.com.Trojan.MulDrop19.22664.18809.21048", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc02e56b-720d-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1641816492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641816492, "uuid": "12c3459c-7126-497a-b336-b7a62a1e2495", "comment": "Malware payload (SnakeKeylogger)", "value": "eb7bb3ffcb844ad42e67986459356ae3", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641816492, "uuid": "9614abc9-4439-4296-9156-b401b9c7099e", "comment": "Malware payload (SnakeKeylogger)", "value": "cb7778ad68cca8d74c53ff3ccc49c8fcbc27281d9250c94ea5cf0e3dda003894", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641816492, "uuid": "b7ac227e-aa38-4988-9797-5b19b4716775", "comment": "Malware payload (SnakeKeylogger)", "value": "ae2d9cef574fa95bcd9b40fb05dcb68438598b6a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641816492, "uuid": "17085f4a-0807-4751-9995-ca709424f6d6", "comment": "Malware payload (SnakeKeylogger)", "value": "a6a33dae7e82ec2ca889c76596f5a90a0c1dae7f2e82136a385ff07cac520affafbaddd819edc630b948a3049781edbb", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641816492, "uuid": "25be5dc9-105d-40ba-a674-74c69ddf5746", "value": "T10DF423EDA1C7EF228D1D386C2E1E3C7D4BFB08CA9D258A29724D99F76185D67910B013", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641816492, "uuid": "cc8c9320-b3e9-4b7e-afa8-1a66fa8a7afc", "value": "12288:4bJcEPV5DpZBOJdicnqhexe708s/vk7/nXJR/fNIJOfnbLoG0:4uI5DpZBNcnqhies3k7nXr/fqJmL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641816492, "uuid": "fd9025c5-183b-4144-9bc0-22a7c44f77ff", "value": 754961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641816492, "uuid": "b3f1b036-9ce4-4c27-ba30-0ae39b4099c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641816492, "uuid": "ac3e556d-42f2-4088-8634-23629df7f9b8", "value": "File-04070111.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c180bae3-71f8-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1641807375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807375, "uuid": "01f8c747-0ca6-475f-8af3-befd93ea1c0f", "comment": "Malware payload (AveMariaRAT)", "value": "0b24123ef25235842d155754ebdb8fd0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807375, "uuid": "a6892d8f-7766-4f7f-9fa1-e2276ffb5467", "comment": "Malware payload (AveMariaRAT)", "value": "cba7f959382bc1b249045b3a49a3ba2fb8f1b396de6a0dedcf5ef7ad064f4309", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807375, "uuid": "0ef10cbe-db43-439d-8345-f05d592deb32", "comment": "Malware payload (AveMariaRAT)", "value": "373faaa80e512febde52c6d2c112228ece3bdd1c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641807375, "uuid": "3c1e0eb0-ba07-41ca-b27d-f5a6ee9760a8", "comment": "Malware payload (AveMariaRAT)", "value": "45936ce0383294fb236ae089343ceef8ded0210f0404b721be5eeb9e9513df440beaa9cc8425e8f5c824d6efe10c4e77", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807375, "uuid": "6439727f-8abf-4494-9693-65396631409b", "value": "T10BC48CCA65C196E6ECEAD7F80972D8730AB2BDA4D1A0D44D3ECD3C5735B7EA4440C822", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807375, "uuid": "9467253f-e34d-4edf-8741-98420aa24ff2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807375, "uuid": "f3dc8376-7b4e-4a9b-8f3a-2b5535898dca", "value": "6144:MqHYM2oHB9J2W/n0p1fpjHdRDifkjOWwv9wAuDxxo7rZrBaOUrbvS9XmhFPLwI:MA0pFJ90fwONv9wzz6rsOUThhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641807375, "uuid": "79170807-2307-4e7c-8a3d-02f8c1e72b67", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641807375, "uuid": "40f27fa4-78d7-44ef-b607-dd1400d887ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641807375, "uuid": "012f0554-c90a-4436-aedc-8410fb76e591", "value": "OCHASUS33XXX1030317110006FC.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507eb2c8-7247-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641841116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841116, "uuid": "e4e06c81-3210-4f25-8f6e-128502f33a3f", "comment": "Malware payload (Mirai)", "value": "ccf4ceae5a78889e7dd5bef3e810540f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841116, "uuid": "c2bcc443-715e-4452-a1b9-78b845039fa8", "comment": "Malware payload (Mirai)", "value": "cc16b7fb758fc7273f5f11bdbb18eeef127d4ac0c56d0ccbb3192df4e3fbd3f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841116, "uuid": "50c7c33e-5f1e-45b1-9a05-587a6dbe6f12", "comment": "Malware payload (Mirai)", "value": "10d03022bd5cf6b921264c8c304272b6c3c31915", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841116, "uuid": "7ea39b32-178e-4091-9eba-5586656b0333", "comment": "Malware payload (Mirai)", "value": "5093bc899328eb495472ff5c58d75e7dfde1c63cc66aaae1280efcf6bd839b7f22ece76d77d20b99487eee81f1b9f3ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841116, "uuid": "a5f4ac7b-9e72-48dc-acb1-fc5d00c00306", "value": "T1F5339E7BC41EADA8C1458234B82A89741FA3F504D1A76EFA4B86C6A54043FBCF61C7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841116, "uuid": "7e860c38-9040-4db0-bc5b-dda31beb0fb9", "value": "768:haR19QjxGyz+jGeKUTeO3kwtNSh0EdX1CCCd4uA+y36CRoDSDLdCiUI:haRqdz6GOTCwtNOCCCd4x36JDkdCiUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641841116, "uuid": "9265607b-9ac0-4b37-85d7-927c758eda6c", "value": 52216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641841116, "uuid": "c4c71bb5-ae86-4a2e-b943-a239c912d1ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841116, "uuid": "9fd87fb4-2fb7-4801-8d79-1d5676d5381b", "value": "ccf4ceae5a78889e7dd5bef3e810540f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a21562-71fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641808808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808808, "uuid": "0ec22a40-c136-463b-9b4d-be98987ad987", "comment": "Malware payload (Mirai)", "value": "a7e49bc8fe95c7620fdc29c90fb9a28c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808808, "uuid": "b84ae979-78f4-4e67-a8be-cef7b0da720c", "comment": "Malware payload (Mirai)", "value": "cca87f4bfeba3783f55e08d59a47e6be93940479200b0f58c7ecef456a8bb492", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808808, "uuid": "a1503ef7-e3b2-471f-a541-0723849bf51c", "comment": "Malware payload (Mirai)", "value": "16f6d23048a50b34ff6b76d9868dd08bfd752b6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808808, "uuid": "9e701fe2-56ec-46ac-b141-5f80ece84ac1", "comment": "Malware payload (Mirai)", "value": "3388700a287d5bdc280bc177fe0deed612420d390fd00f193b088757d617d82109e45f7c16565278b02c575e27132fd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808808, "uuid": "3e081090-09fc-41ba-9217-37b5d337b5c5", "value": "T197C30848EA07A1F5DE4B0D30205BFA3F8B316561C932DE96DF946E15ED33913A40AF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808808, "uuid": "e21f78d2-838c-4933-8592-14a2066e1d40", "value": "3072:w+962U3E6dKdBaQitnuiF1d/9AuM+nEM:v962AEJaxF17Rn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641808808, "uuid": "313ba943-aad4-463b-8d45-3fa048a9faf8", "value": 127948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641808808, "uuid": "e4f50e9e-dd1f-4dcf-a42b-1f10e7597407", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808808, "uuid": "b5e63b43-8912-4420-98ee-d54abad282e7", "value": "a7e49bc8fe95c7620fdc29c90fb9a28c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e866532f-71ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641810447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810447, "uuid": "523eba55-9b2a-42cb-943a-18e23edb07b6", "comment": "Malware payload (Mirai)", "value": "11db5447470b7a4b622b39eeb25d1ae7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810447, "uuid": "620df3c4-c1d9-4125-addd-98c9c5be3791", "comment": "Malware payload (Mirai)", "value": "cd48639fb66ec93e6eefdba6928d4fa155121ba6318a1eec71b765f2df70e913", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810447, "uuid": "4609a46e-568a-4077-b096-044415ba1c05", "comment": "Malware payload (Mirai)", "value": "92720e8e8f08f02bfc4e2c895c3bc46df91fdce5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810447, "uuid": "f5ec6ff9-a595-4f16-a95a-fc4528cabfd2", "comment": "Malware payload (Mirai)", "value": "bc68a1c8afc33bb839bc5ff6af0e090b3fb9cd0ba3af572deb2d439e67951201809ba6ba123e4c83015059fe6d619313", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810447, "uuid": "5353839f-3d90-4ae5-a34c-57346411a4e0", "value": "T18CC2E1B1C354E472D9B186B2F872C4C3E51364BC72D36A3AAB0C47B897C5085DAB9C96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810447, "uuid": "4e17d5b9-78df-4a4f-8914-0ab7074447ea", "value": "768:Peyc9p5oRRfj2AKTX7UUx1z7XQzG4Es3UozQW:Wycp5Mwrp1HgzGszf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641810447, "uuid": "bf95f4c8-9c9d-497f-88d7-e641d1f7ae7a", "value": 25968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641810447, "uuid": "587abc34-f57e-442e-b3ee-09cbb7815698", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810447, "uuid": "f008148b-25a3-4b11-9b30-18d36a0b4215", "value": "11db5447470b7a4b622b39eeb25d1ae7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfb9fd8-723a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641835578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641835578, "uuid": "35f9d452-9260-49f6-903b-0eb8867ea092", "comment": "Malware payload", "value": "f4f138f5fd918b2967b31b213ca89155", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641835578, "uuid": "957400fc-84f5-46bb-9850-b34bec3a7355", "comment": "Malware payload", "value": "ce1c7d49f099a57525ac4bfdd87a952f675c49d268a85095faf9fdd721212c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641835578, "uuid": "b183aa52-0fcc-4811-9757-6485e7f5f9c9", "comment": "Malware payload", "value": "7332994269fbd4593fdba3ab20c000abb2b8e928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641835578, "uuid": "7dc21daa-6aee-4d74-8a53-40d2e03a4d07", "comment": "Malware payload", "value": "f68effc162e8a50746089af12b873fdaadf8e7c76dacfd5db84906a79433b17787379829062fd30c003772d7de1233d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641835578, "uuid": "17550eaa-7b73-4706-997b-57b87ce07890", "value": "T1336733577E08EB25E5993A3382CF3E31E3B156D6173396076F09ED5928902124E3B72E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641835578, "uuid": "7e496282-fb2a-4ad6-b665-06b047114bb6", "value": "786432:CNpQr5SyJW631azG0dvixKy6BuStH7mHID:CNKrQYgysnHC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641835578, "uuid": "5ebdc521-be03-45d3-8387-6de1ed5a8a95", "value": 31397888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641835578, "uuid": "baecab28-8b9b-406e-82f7-7c6510f7517c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641835578, "uuid": "a5a2b420-4cbb-4a7e-8067-f2c6e0c19b82", "value": "f4f138f5fd918b2967b31b213ca89155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cde4a62-7246-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641840680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840680, "uuid": "d2941940-1d80-4d24-b83f-3f44c4e78426", "comment": "Malware payload", "value": "20145e7f8444637b2cd90534228d2ca3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840680, "uuid": "545f818c-4eea-4a0e-84b7-884a4d9894b6", "comment": "Malware payload", "value": "ce46473c710c009e4b533ea58afd1b6035a46e52d6b1a25438fe3fcb8ad4bbb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840680, "uuid": "caacbcd2-4dac-41bc-b90e-e0f95b0fecc1", "comment": "Malware payload", "value": "c8ad9a77beb8ee343846535a941b1ac90eaf5bbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840680, "uuid": "1e5ea830-129a-4a44-b983-3021eb877e93", "comment": "Malware payload", "value": "61f20a2d8354459f6db5166e6ff432d8100c245f9e430c509493613126e1e077995cd35fde6112b689c8a5764125f757", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840680, "uuid": "3b2fc4c5-11aa-4936-9a6f-b622a4f5f148", "value": "T1EF15CF05E204DA96DC1AABB08232D9B617727D7AE530D56F2DEE7D773BF33821802452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840680, "uuid": "c7f41c79-8007-4881-b422-5b45213a842e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840680, "uuid": "a797eda9-4141-41a0-a890-a80117bf45c2", "value": "12288:DVWlW1lfKhLo5C57mMtDe+cRhNu5J3AEwtDTmilHq1QWU9tgW1C4FhXLqcN/0tPp:JtDTmitq1QWE2Wfh7qcadgcmq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641840680, "uuid": "fbce64b5-6412-41e7-a3cc-0647da276366", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641840680, "uuid": "f02fe02a-abc4-4b2f-8082-c3fbf3b92f5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840680, "uuid": "1d1efab4-f187-4200-8ba2-c6546aadb818", "value": "qmx~0000019363nr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be31fcf3-7226-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1641827126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827126, "uuid": "b52851a9-8baf-4a80-b070-7c5ba43bff04", "comment": "Malware payload (Amadey)", "value": "1d0cd9e6bca1e69189fe0bdff5cfdf67", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827126, "uuid": "a20d63fb-9c18-4e78-a8b2-83c97b1c4373", "comment": "Malware payload (Amadey)", "value": "cfa59f9ed46e26e343f098a7efc367883ce9998e9653defe67f48a58800da5b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827126, "uuid": "a6364c66-d464-48f4-a244-1857a1cbb57f", "comment": "Malware payload (Amadey)", "value": "e7d01c760a1b78fbf97ed271f7375d911bf64d21", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827126, "uuid": "bb5289cc-3130-4dea-83da-2b41497053cd", "comment": "Malware payload (Amadey)", "value": "f0a107123a742c3561b0e8bc0707c0ab04dc5bcbed9433fc1396ed47abc0080faaa9228ddc7c6365d89b1e10b85d16e0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827126, "uuid": "03f8cc6e-6080-4488-9926-1fd462618ffa", "value": "T11F54BE30359AC432C89352718834CAE55A39F8317925947B775B277EDE30E8C86E736E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827126, "uuid": "18b6902e-5205-44dc-b819-8ec56cfa4664", "value": "e7b242aa111a6e2727550eb7ec803c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827126, "uuid": "3d6e8cce-4497-4959-9c67-2331d7ba3a48", "value": "3072:zlBhL6FkBRW1n5sdu4YyPkX5HF8UekOs5HWrxpzbgqruJnfed:BBhL6GW1c0yPk5F8Ue4uzbgwuJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827126, "uuid": "92b30da5-05aa-402a-9906-a5ad46527433", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827126, "uuid": "3e9f6c01-6502-48f2-b621-32c1cbf243fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827126, "uuid": "81ab5bce-6866-42da-82f0-abc4b226997e", "value": "1d0cd9e6bca1e69189fe0bdff5cfdf67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8ad586-721b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641822372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822372, "uuid": "1b945a0d-f983-4a99-ad4d-e98dc00328a3", "comment": "Malware payload (RedLineStealer)", "value": "05c9b325a4f1c698a8691b64907f7c9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822372, "uuid": "3de259b4-86c2-40c7-b4ea-0bd26c9f2b64", "comment": "Malware payload (RedLineStealer)", "value": "d0bbc0cd2135edff8ad0bce30d1e99634cc3f48a34501b35ac6cd162278fc19e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822372, "uuid": "030528ca-b7f1-4b3d-a2cf-660a9a0d473b", "comment": "Malware payload (RedLineStealer)", "value": "d3bae671bcb42924501f4e20a46a7ea8b95e457e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822372, "uuid": "c61e71de-ad57-4f17-86d8-208e426b3dce", "comment": "Malware payload (RedLineStealer)", "value": "d9ade9820ff5f5b0c94e2f5f7fcade901db5b0854b22756befec8572d478a0db8e6dbfea25d274cf5bf47bfceb4702bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822372, "uuid": "39386fb5-2a50-45c2-b43d-cd1525551aed", "value": "T197F533CBF1EC367CC17B67BB83874E3CAB48EA299FDB72814A8774628505DD1586409C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822372, "uuid": "59d37361-6af7-4471-b76b-d896cc5d2ba3", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822372, "uuid": "056cfb7d-9d36-4268-9e59-2f36dbf7af00", "value": "98304:i4Lzpg3gTPacUbkaTzU5S000Z+O+AQEj86:i4LlvycUbGJ00Z+O+oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641822372, "uuid": "bf528ac9-adf8-4b49-a0bb-1b775aa04cb3", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641822372, "uuid": "b9083047-b0bc-4632-9f63-b5fe4dae9af1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822372, "uuid": "c47d03c2-bd4a-4e9d-95b0-d20ded04c34b", "value": "05c9b325a4f1c698a8691b64907f7c9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8b7b34-7226-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1641827043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827043, "uuid": "dd7d7557-9260-49f8-9326-e85a9ceb8866", "comment": "Malware payload (SnakeKeylogger)", "value": "bba29d869b701809757edd623c225e66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827043, "uuid": "bc2fee53-a937-41b9-863e-93512294ad96", "comment": "Malware payload (SnakeKeylogger)", "value": "d0fdc9259b8a73d3faf90544b0e6792b5f747d9a26af662e95d3f7f9c24322c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827043, "uuid": "2607ce7d-0e2a-4f90-8bd2-b4108d027e06", "comment": "Malware payload (SnakeKeylogger)", "value": "6fd9824c99b0d52cfe805529f24e26fef914da51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827043, "uuid": "6cf4b215-b603-4805-ae60-f726218d9f4f", "comment": "Malware payload (SnakeKeylogger)", "value": "c66c9fc97cd7adc21d1f01fa1afc4046d392be67b253de4b9daac7dc68d0ee6d12b9914138ff9206f2855fd072772780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827043, "uuid": "ae9aa2b9-990d-4d9f-a7ff-9b648f8730c0", "value": "T141D40283B0539326F9451431E4B78A95BF73EC6BDEAD68522740B72E68B20B1C17D70E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827043, "uuid": "ad6b8ef7-d112-4e7a-b367-9cf05daf5296", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827043, "uuid": "b1a21189-fba6-4967-958b-175f61746632", "value": "12288:2bLdZZZZZZZBwa/9dH/L8PF+DNMVBdO+FrRFP+SU+nl:2VZZZZZZZBpfOF++VBrRFP+S3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827043, "uuid": "ac3d55df-6340-4e92-97f6-5a41c71e08a8", "value": 608346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827043, "uuid": "8533fd9c-f3e0-4714-9c52-9403774189e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827043, "uuid": "125d311b-b530-42ce-896a-2c8fb3ca0b79", "value": "20987654323456789009876543200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f57b7bc-71fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641808794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808794, "uuid": "2bee7b9d-7cda-45d3-8091-669aaa4e81de", "comment": "Malware payload (Mirai)", "value": "854bbbd7a4ed3ac37623ecbb33bca2df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808794, "uuid": "9e0f64a9-2c2e-468c-85e4-48482eb15187", "comment": "Malware payload (Mirai)", "value": "d1185f5f4711ce5fea47aaea91b65f3e21af75b0487d3f8276884214ad2a6253", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808794, "uuid": "11cecea4-90b2-4da4-a35d-075495bd34dc", "comment": "Malware payload (Mirai)", "value": "cc6b4000d8fcb5663835c553e23ff6f57488fb40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808794, "uuid": "79e4979c-da8b-4ac0-a3b6-1d06f37e5884", "comment": "Malware payload (Mirai)", "value": "5a031648ac12dddfdfa60f47dffeab974aae5827f44590767691f396063f5469d53f8608bb0e5b22223374098bcfce99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808794, "uuid": "f5b20f33-de1e-4a51-85c4-68d9c9b6ea20", "value": "T18CB35BC5F643E5F5DC020574306BFF329E79E5FA1229DA43D7E8AE32AC519028507AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808794, "uuid": "bb748e17-e6d1-40f7-a119-7cf25256858b", "value": "3072:RPN5m9cS4MLWyYwsDu7iao1L0sqM0qgvZ4nimV:RPN5miS4MLWyYNDuIA9Feni8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641808794, "uuid": "8a3f8ae7-ad5c-4f77-a8b9-7cfeb60ec639", "value": 109136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641808794, "uuid": "5ed28673-d086-4cec-8258-d11fbd832c24", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808794, "uuid": "6ab2cda8-f984-4867-95a2-28442f55c1e4", "value": "854bbbd7a4ed3ac37623ecbb33bca2df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5d17de-7228-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641827900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827900, "uuid": "495a7f0a-3b5f-4728-9f6b-70e04d4a07b7", "comment": "Malware payload", "value": "06444db708f2251f8f7ec251b046097e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827900, "uuid": "372ee17d-fd66-458b-869f-068173183060", "comment": "Malware payload", "value": "d188f505ff2702722bf5ccd43eb3451025e8312fc38cea0d6d47131d0c870ec8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827900, "uuid": "9f6b41c6-b39c-4e6b-a9a6-07fba81b8763", "comment": "Malware payload", "value": "0f3a999d04713f2e87e960e88ac3f38ea55d19e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827900, "uuid": "f65acff2-fd46-49e4-9f65-1b7231d598c8", "comment": "Malware payload", "value": "ef69ac6a90355a21393c86c358780cf1232b592f645691901dfd108786e493e5bb42398792b80b98b81f840e833a7a69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827900, "uuid": "16295430-d30a-4b0f-afed-5bec860accc7", "value": "T12B152342F7E2DB12C8A1BA7A8D4DD6D937BB7C221885970575D2DF1F7E8E2018C8E124", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827900, "uuid": "1062989e-c8f0-4bc1-9153-982a8f6fa0c4", "value": "d123a69e1a76a1d4c228975990208112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827900, "uuid": "faf6753f-f9b5-4bd3-ac43-ced02eb2a3a4", "value": "24576:8SNcUtoKY6kMHE36g6MM/nF2Iub5x2oFI8:CfKY6/EsC5BI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827900, "uuid": "107fd7c8-43d5-446e-9fae-109f0359b5fc", "value": 933696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827900, "uuid": "46bf06ad-b32f-416f-9a1e-186fd281039d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827900, "uuid": "8bf93684-6a9c-4d3a-b9f4-0efaf2392787", "value": "06444db708f2251f8f7ec251b046097e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85becc08-721d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641823166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823166, "uuid": "04d3f534-fd88-4d91-aff2-b38ae296347d", "comment": "Malware payload (Formbook)", "value": "f6b1f0ebea9a3daae202e14bf021de74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823166, "uuid": "9289b6c3-b62b-42db-9b2d-25714c6e3ad8", "comment": "Malware payload (Formbook)", "value": "d1b784c5bf13a6a45204633c506ef49906ccadbac510649408bb698b7c96487b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823166, "uuid": "84e86cbd-541b-4513-8c06-1a912e88c385", "comment": "Malware payload (Formbook)", "value": "ea03380c95e699665dd4bc6e8c7f7afff7d47a95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823166, "uuid": "c23663aa-a00d-418c-837b-3f7e8366fe94", "comment": "Malware payload (Formbook)", "value": "90f6e1c079c34ba0739a5007e2c652940458dd0d21a03da32c6b3116395663ce14a9eab9ea6dbc4495db60586c1b5093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823166, "uuid": "409e5d9d-8a8b-48ca-bc17-c663b1260f46", "value": "T16EC4CF8173BCEDB7E2A223320DC0DE746969F9705E3F588BB7CA5B8E84389805175716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823166, "uuid": "50299cd4-96b1-4f86-8c86-a279452c762d", "value": "cf6a6d4cfbd4eaf85b2795df0626b1d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823166, "uuid": "3abfc5c7-9933-4e24-9c81-134965c8ffdb", "value": "12288:nIlLNX+OnUoEIf9SBB4GgW+0MTGzTzXbfbsEbHF:IlLNX+OnUoeBB4G/3MKTfQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641823166, "uuid": "ba865ce0-3298-495e-bc42-0c4e2a7bd788", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641823166, "uuid": "62868e47-ec25-4db6-8962-6294bb44f757", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823166, "uuid": "403289f8-2e38-4d6c-84a8-9eb879e16f59", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cf4964-71ee-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1641803163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803163, "uuid": "9ad659c7-b4c6-4ce6-a8e6-8895e2fd8b34", "comment": "Malware payload (njrat)", "value": "cfca60135ace947b42f62ac66f22c512", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803163, "uuid": "0e8cec5d-2698-4e18-8303-2116b6e823a9", "comment": "Malware payload (njrat)", "value": "d26cea6912e11e87d9fa8782f69b01d38c4e8d40c9548341629b8281f9aa2ab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803163, "uuid": "c3652e95-252f-41a3-a9c8-d0b58b6c4e4d", "comment": "Malware payload (njrat)", "value": "89d5914fa02ed618d4eb4fe4d6a8a601b41ec42b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641803163, "uuid": "298b1904-d631-47e4-b23a-e109c43108d4", "comment": "Malware payload (njrat)", "value": "77dc913c564de77099bc6297f9267ce2c9f0183ae965db87fb32dadfbacfaba230608480bda2ccebe92c92bd6aa9bdd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803163, "uuid": "964f5173-17d8-433b-9419-e873a41c0e71", "value": "T189E21AADFBE64466D1BC0AB50571950013B4E043E523E77E8ECA24E62B2B7C84B94DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803163, "uuid": "72b02c97-7b2c-4b98-8ea8-4eed01ff8b0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803163, "uuid": "eb97caae-7368-419c-951d-92cbe947a29c", "value": "768:XzfgTV5VXPKzxF+dtMzK3n+rv8lQmIDUu0ti9Fj:mfqsiQQVkGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641803163, "uuid": "c4a7bec8-7c5d-4eb8-b299-1bed7f05f10c", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641803163, "uuid": "378e23ad-3ba6-4483-ab00-b587dfa91f2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641803163, "uuid": "d2bc383e-2aeb-472a-8465-5e78481cd1ec", "value": "cfca60135ace947b42f62ac66f22c512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8273d9ce-7228-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641827885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827885, "uuid": "3186afc5-8e2d-4bbe-ab34-9a22af024742", "comment": "Malware payload (AgentTesla)", "value": "fe3bd8055d9508e2c27ca3903453af05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827885, "uuid": "e731a564-431c-445d-9aff-dd675dd57137", "comment": "Malware payload (AgentTesla)", "value": "d29a968d9d378918cf76854c1a44226adbae7d9a4e4a47b4838d1101278284d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827885, "uuid": "3b89426f-91a6-42d0-a3a6-89ce1fb01023", "comment": "Malware payload (AgentTesla)", "value": "091d7e9e0535dd0c944796d69d50fb850cd25d73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827885, "uuid": "a30cba3f-7751-406c-a385-02457ae69c5c", "comment": "Malware payload (AgentTesla)", "value": "5f6795eb22dceac4913f7611aef9b1b0e580ae2fd80a3708aa699d7b7735a18e7e5f8aed256f5fed5250131bf8430c67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827885, "uuid": "d8d7daa2-a752-4127-9467-20a9a76b9041", "value": "T1DC05E1057A45C811D2690A77C5DBD2B44BF47E44A583E32B79E53E2F7E32362BC0C68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827885, "uuid": "a30607ac-9b63-4311-b503-dde18b6ba33a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827885, "uuid": "1be3ff91-b69f-4161-95e9-1858319dae53", "value": "24576:i4YBtDTmitq1QnLAzrAGAUO4ieKV0nEtGG:iBtOitq1QnkHLy4ieKVSAGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827885, "uuid": "e5fa97db-f3b0-412c-b57d-5eb28abed395", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827885, "uuid": "a235631a-182a-473e-87db-5998049fee4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827885, "uuid": "b2590866-cc95-40d9-a3c4-9d4a01c868d4", "value": "fe3bd8055d9508e2c27ca3903453af05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0996d5d-7221-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1641825036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641825036, "uuid": "5c6650ab-09c9-400e-b166-d4a9d5f1116e", "comment": "Malware payload (RaccoonStealer)", "value": "a72a990abb597de74ce1149969b93a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641825036, "uuid": "19d908a3-de0f-4839-8b9a-d93c7472db02", "comment": "Malware payload (RaccoonStealer)", "value": "d3992dab522fba1ec6659a8502ed4a12d4390d0f450291a6918ed60419b3a7ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641825036, "uuid": "75b820dc-b238-4842-a0c8-0744746c99d8", "comment": "Malware payload (RaccoonStealer)", "value": "f9477bca71355182be997964bfb53ca71e79dfc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641825036, "uuid": "0a69187f-8975-4525-8243-09fbb2ae89e0", "comment": "Malware payload (RaccoonStealer)", "value": "1c83665633a8a50df0592a471fdaf53288bbfe63abc14128dd9cfa5b5075cce434332e6e8b4a8a3dd0ec298fe1e40670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641825036, "uuid": "891a3262-a299-4228-ae4f-ad054475ec32", "value": "T1CD54BF3179D8C832C4531571C824CAE79AFDF8311664954B37682B6E7E30E8C8AE6F5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641825036, "uuid": "706376fe-55d6-4725-9850-b2c1f1f264fb", "value": "e7b242aa111a6e2727550eb7ec803c78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641825036, "uuid": "a60da4b3-ee02-43db-9d46-12bbe323213b", "value": "3072:9dftLibke3nZg0sdB8Z7OFxrlmzPWrxpzbgqruJnfed:TftLivnZ+B8WcPuzbgwuJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641825036, "uuid": "d0ec4617-deb2-48c1-8768-67a650e422a2", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641825036, "uuid": "0a34a7f4-ac5a-43b1-a3d9-57a1e5df895e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641825036, "uuid": "a8a8db9a-3acd-4baa-a0a8-e7da8dcbc138", "value": "a72a990abb597de74ce1149969b93a60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727233ca-7215-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641819698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819698, "uuid": "413393eb-04a7-4ef5-b778-014c43b80074", "comment": "Malware payload (RedLineStealer)", "value": "518fee63c857be5bed646dab951c0292", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819698, "uuid": "2a46e3cb-8be9-4f71-9173-f63ca23a5ec1", "comment": "Malware payload (RedLineStealer)", "value": "d75dd5c5d8d0b71c93e68bca59f2aae989aef87f311b6ee0ba6629abf26bdb28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819698, "uuid": "1844e074-1e9b-408c-aab2-848bda9f12d4", "comment": "Malware payload (RedLineStealer)", "value": "4014288a4a2c8741879bf9d3fd85e311cf7db627", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641819698, "uuid": "53698139-cd74-4a2f-aee0-221db6adedad", "comment": "Malware payload (RedLineStealer)", "value": "80a424f21648c144d0af13b639f99e4265ac91cfecda8fceedc47130f218f2a3be63f903654e8e22da959f9896d27202", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819698, "uuid": "79988970-2728-463c-b508-8620d660b86d", "value": "T1B4F533CFA196F847E00F95F831B45C93A455B214A8FC8103E66E7DFE863C27A7786624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819698, "uuid": "8c562b83-53fd-4471-a4a1-9403d88d81fd", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819698, "uuid": "1e89f2e1-c321-4d35-b24d-371ff553c3a5", "value": "98304:5OnMQnzqK4e5vt6zqbIC+9K9Yoctxnq1Liuz2Ra/yNBuw/P7WIHx:5anehe5vkus/Kk+iuzE7uw/P7WIHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641819698, "uuid": "3e6267ae-6ea4-4898-9373-0b2067e31aef", "value": 3648816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641819698, "uuid": "8469ea7c-ed8c-44d0-80ec-b790450546d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641819698, "uuid": "74441ffd-ab6f-4c19-b3e9-e85e15664eb5", "value": "518fee63c857be5bed646dab951c0292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1d2495-724f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641844811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641844811, "uuid": "e1ccd8d1-4bc8-4112-9fef-f1d393e0fe5e", "comment": "Malware payload", "value": "4b7e2c274066e8f95ea998ecd5555907", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641844811, "uuid": "410dd178-f20f-44ac-be1a-474cd9caf7f2", "comment": "Malware payload", "value": "d7a8b6f3cdb47746430e7386adda8031dc9d05021391dc481af71d739b60032b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641844811, "uuid": "fb1b7df3-cbe6-4852-bb6d-c2cff59fa6e6", "comment": "Malware payload", "value": "4abeb73a2bb4ecb3b1eb0064b1d227144c292190", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641844811, "uuid": "29ff59f5-d45b-4ceb-94df-84cadf5fb661", "comment": "Malware payload", "value": "3c4309dd06936e3d206a77488ca0c3e089be39ea3c7864df26bc09ed9c517a39f89bc2f6e5c8a58c22ec1145e9cc2028", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641844811, "uuid": "719d8752-fb51-4920-894e-47f6c09b6da6", "value": "T14D652B64A3A12115E9D7A7BF72A08B90C4BE3C405D6D97CF4D460AC6CB2E2F479086F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641844811, "uuid": "d8a01e66-7703-4304-8102-3c680b4b2988", "value": "c30f597f5357329160231d67b16edbcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641844811, "uuid": "df29161c-2951-49fb-b5b1-94f299aa804b", "value": "6144:LzDiI1THCeALFxdDPaD0CYw5GDsTpx00RiTwSltgxCKYPMXq9NmiQBYGhpX8x4M8:LzvieALNbaD0CLViD4pa7+oA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641844811, "uuid": "b2df57ae-4f35-4970-a3f7-db43cd9358f3", "value": 1465344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641844811, "uuid": "d7cfa0db-1af5-454e-9138-a2ba96dc87d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641844811, "uuid": "c565dc6f-b930-411a-a2df-14afd3c374ad", "value": "HomeBill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8d1add-71ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641810432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810432, "uuid": "c9697e17-2e58-482e-a74e-4a0fc40490e1", "comment": "Malware payload (Mirai)", "value": "ea178c90c57c51c04c44a2aa6ad37c12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810432, "uuid": "f02c849b-f4ad-451a-a7a8-b0d64da08ff5", "comment": "Malware payload (Mirai)", "value": "d7ef7cd13fd810860c386dc32aadc97fd7cd531c38acb02b674d9764c3048ad9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810432, "uuid": "9175b12b-be38-4373-8d25-1ac765278525", "comment": "Malware payload (Mirai)", "value": "d9e35147a15fa3982d3744ab587c5bd811d00051", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810432, "uuid": "77cece4a-9dd4-4149-a20d-7688bc8d53f3", "comment": "Malware payload (Mirai)", "value": "15c43ce8fcce7efb310751eb0121034b4e03d64d73aa0f9cd16ee011cc3d27c31e6d7bf059c83d4617dd812fd744b1d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810432, "uuid": "912e7616-2d87-4de7-95a8-bb2dad77d6b9", "value": "T121439EA2C5B92CD0C20812B869294E3D2B63F5155A636EF55F1AC7A5900BAFCF14E3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810432, "uuid": "1ec3697f-3998-4968-ab4a-75678f851651", "value": "1536:hEp/ydbPAuzwtFkhT1H8t29hqY8aeJSImCp6:hWqdbzz5Z5DqYcJSIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641810432, "uuid": "f16cbcf7-70a4-4974-9380-90c5b63f7616", "value": 58360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641810432, "uuid": "971b439e-b15e-4d62-9cc4-0e2411dbd4e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810432, "uuid": "65b3d613-f51e-494d-8f24-df5142d00791", "value": "ea178c90c57c51c04c44a2aa6ad37c12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158f3050-7212-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641818253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818253, "uuid": "914cd473-e27b-4faa-b8b9-5098b1352b17", "comment": "Malware payload (RedLineStealer)", "value": "d1d6342903b69d7dba569fae9248d302", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818253, "uuid": "f7e32d61-58c9-429e-bd81-82f7c6a2412a", "comment": "Malware payload (RedLineStealer)", "value": "dab063501a89fee630ba03134d96f1f44441bd099984148e0352ddddbfc643b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818253, "uuid": "2f706603-9cb3-4ed9-837b-d5622302d4d4", "comment": "Malware payload (RedLineStealer)", "value": "33379bfda25fc446372a25824eb18947aa2b23d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818253, "uuid": "3f5681f3-a9bb-4767-a8f3-2017aee47163", "comment": "Malware payload (RedLineStealer)", "value": "748a6e2fee451e0a343b9866ddd80629d9a95f64b32f8d042ff377e21096a82b4e16210e740c63fff8e6f4355b7a3eb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818253, "uuid": "70b981fe-b1bf-4976-906b-9c674f25f07b", "value": "T19C553364828F6A09C86A3FF48A878FC64BB8E520F1D4E26D75ECF34716207A181573F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818253, "uuid": "b18bc998-47fd-4a91-b76b-a0d3b7038702", "value": "f6af73011d9ad7cbccf66eb190442910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818253, "uuid": "010acd8f-c6cb-4eb4-a5c3-e6a3225fa3aa", "value": "24576:Lz5f9QVkTYroDcGIgEzHvOa9JB5vCuRkEaHNYK3f7oy3NVzLr:Lz5mVksroDcGIzzHF9JbCMNadU6NVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641818253, "uuid": "cfc9c808-ff7a-469a-bb6d-01300e6f2f8d", "value": 1397248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641818253, "uuid": "5cac9f3f-1fd4-4b98-a8d3-8aeeadaaf6fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818253, "uuid": "d0945a43-502d-4003-a3b2-d477be33461c", "value": "d1d6342903b69d7dba569fae9248d302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a01f65-725b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641849686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849686, "uuid": "2a02dd75-483a-497f-94d9-ad240384a1c9", "comment": "Malware payload", "value": "60c67252bf119039b2138168a6e97ece", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849686, "uuid": "46a9b29b-a19c-4465-9b91-2f7234a4c920", "comment": "Malware payload", "value": "daf8772c9ec3be51800121c695f70edd58d19065e561bb796265a558be7f9e4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849686, "uuid": "69c2419f-87a7-4266-94a1-bd898fa1b4b7", "comment": "Malware payload", "value": "d9ecf5084e9d0d622a85df03de9e2d9b103ac1de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641849686, "uuid": "9d3442f9-f06c-43fa-b8bf-2cef1e597bb1", "comment": "Malware payload", "value": "b2713a224a33e4c32f93ef0022ed3f611519511e08d1a3cd57c8aa1cd29dda52522d2d8501bec4cb47d366c73828bb51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849686, "uuid": "4801a8a8-4175-4b3c-8158-bcc38aa48e74", "value": "T121F4D0067A59C802E2660673C5CED2B447B46F48A553E31B79E53F6F3E32391BC0869B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849686, "uuid": "80fef70a-cdff-4196-a1c4-3e4b63c962a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849686, "uuid": "b95f60fd-4bfb-43bd-9d98-d3a21c25e78b", "value": "12288:IJ49KAM+uwtDTmilHq1Qv7eFRmaHOWF96mObSHZup58ZJcs+UUknsU9tjtGG:ICawtDTmitq1Qz+RmuF4jKZJb+UnnsED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641849686, "uuid": "8a33b19c-af92-405b-8d1e-8c3f183eaefd", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641849686, "uuid": "da2c2858-af9f-414f-aad2-b710b8b8e829", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641849686, "uuid": "7c428b5e-c5b5-4a4c-ba3c-fc3fcecc8935", "value": "60c67252bf119039b2138168a6e97ece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f180c1a8-71ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641810462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810462, "uuid": "e538f019-d520-4836-a616-848447339e02", "comment": "Malware payload (Mirai)", "value": "77ecbe7e8e3ffcc6b1654f6d4f915b4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810462, "uuid": "404a30a7-91fa-4056-8706-54cf80f7e8de", "comment": "Malware payload (Mirai)", "value": "dc5a228c863aa365e62540873cddaf951ccde8fcd5a00aab1f9dca9c4296cc22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810462, "uuid": "d82190e3-b08a-4d12-b3ac-530a6d7ca126", "comment": "Malware payload (Mirai)", "value": "13cd7f392c3589c10f9e9123a2ed1385f8eaa1df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641810462, "uuid": "213c6f7a-f98f-4315-a08f-8190d8841be2", "comment": "Malware payload (Mirai)", "value": "c6b84263a48b11c833c775600599dc272696a8374759f363d2f6bfc044b3808299aba2fa608d92ce57f77db96dfd330e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810462, "uuid": "edb68383-b8d0-4047-ba2e-e43149884aef", "value": "T11AD2F17836BBD9FFD43A873A51DEB95F01005714E0EF670C67AC9C95A10802A902A3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810462, "uuid": "aec7c060-5284-47c4-a1ec-4a2d52a65ac3", "value": "768:uR2T0QcMwLOz5RvWe4AuzTDeS6qVaMgAL:ukPcKz5dWesXaMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641810462, "uuid": "76458dc4-7798-4147-93d9-a4f69c6b1abd", "value": 29844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641810462, "uuid": "ea8a969d-23e8-4b57-acb1-827f656b56eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641810462, "uuid": "5d655c24-3df8-41d1-963c-ab8b9f8e681f", "value": "77ecbe7e8e3ffcc6b1654f6d4f915b4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b0f74b-721b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641822334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822334, "uuid": "f72c0e77-069f-4b69-a2f1-40155cea2c78", "comment": "Malware payload (RedLineStealer)", "value": "c3b2c5a14962f6255d5dec89df0290ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822334, "uuid": "271da66e-66ef-49c9-a83b-32413271bdf0", "comment": "Malware payload (RedLineStealer)", "value": "dd10774c996d64884b0cc34c42c1c7f3e43565e557183f636e37871ed6749901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822334, "uuid": "e382f491-5c45-4d50-9518-9293a3026866", "comment": "Malware payload (RedLineStealer)", "value": "5d58a9d83155abe4de0d4aacf6e2f3fc506d3cbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822334, "uuid": "26506f48-7a9c-429a-97e9-10e78e73ce44", "comment": "Malware payload (RedLineStealer)", "value": "a24000dfd3756dcfaa9132116d13e7dc13fdc02d96c130d2fc590bef18a4fb73ef542440c3fb1d2cbd9d145bae162f7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822334, "uuid": "bcb4bb7b-33bf-483d-a304-e5c7b39a38d8", "value": "T1B1A31A6433CC9904E6BE4F74B8B1559943F0F5536501EB9F5EC560FE0EB2B80A922AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822334, "uuid": "1192ee59-0b1e-400c-af56-95d68a75096c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822334, "uuid": "7b27d5f2-eb57-4c3f-9b41-4580a373555b", "value": "1536:vUVrM5Rh5B+HD8vy/4jcHXn14kSaxMabYpfFxeRCPvsS0000:vUVgfCHDiywAHF4AxMO0UzBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641822334, "uuid": "febc8f19-2f36-4b14-928b-2e60cc0bd1fe", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641822334, "uuid": "75e30ae8-e2be-4883-803d-64519fc16a67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822334, "uuid": "e5e37298-ec7b-4197-91a6-7a7469985d6f", "value": "c3b2c5a14962f6255d5dec89df0290ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d8f3f2-71c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641783606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641783606, "uuid": "c26286b8-191a-4e16-9baa-051f7e6cec76", "comment": "Malware payload (Mirai)", "value": "818f6614769c567c82d7bd0b7e65ff84", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641783606, "uuid": "2c26d382-5446-4981-9149-aaa9c96bd683", "comment": "Malware payload (Mirai)", "value": "dd7beb493ad7668f03b56870109e16c5ab5a107dc1e35726638d480f134a3b26", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641783606, "uuid": "e60a1652-4575-48be-811b-c21abe0b52f5", "comment": "Malware payload (Mirai)", "value": "793b1d5f15331fbd12cc5731deffc5a3876e06b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641783606, "uuid": "6280ad6f-0b8a-4a04-aa91-aae02baabfc9", "comment": "Malware payload (Mirai)", "value": "7bd2e6c4af40f20e0599645d92ff6f618ff5dd9215bfa140d2d345385fd3eda0bc70cd6c9cdfd32e70b5d8e5f732fc24", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641783606, "uuid": "8b001910-e057-4ad5-b2bf-8113538c7585", "value": "T1F8436CC0DA83D8F3DC22467534779F328E77E57F2166EAC2D799953BA94A400A1033AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641783606, "uuid": "5e017972-dd7c-4b85-a7e2-32e34693651d", "value": "1536:XgjlE3BK7or6uSjyvbj03EG9kVgpmixd0W:XVBK7or6RyvU3Qwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641783606, "uuid": "5c22ffc7-f3ed-4aaa-8335-931563e1d446", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641783606, "uuid": "ca156ac4-8089-421b-afdf-b27f0b719a2e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641783606, "uuid": "52fb8c80-3b68-438d-a9f6-9fcd09a538e3", "value": "DEMONS.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087c5d20-7226-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641826821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826821, "uuid": "af72793e-7c49-49bd-9930-7123d0f52019", "comment": "Malware payload", "value": "ff285b9451cbea14e30b03e2e170ba3d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826821, "uuid": "88416e49-81ae-4442-a817-1ca456e6a9ab", "comment": "Malware payload", "value": "df28379b382dc604c575952aad804e9b196c484a92d9d2c8d0ca916909a8c766", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826821, "uuid": "dc03241a-c606-4d38-887c-c7709c782569", "comment": "Malware payload", "value": "4157abd10aceb4ca641d96835d9f317d24212287", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641826821, "uuid": "7afd6f47-cfe7-4ef0-af56-80f32ad60104", "comment": "Malware payload", "value": "e13eee8e9552185891a229f043305ba59d650fea488d47a3b6ce02bea62c7215444d54fbe784e227d241ef2f0c112f26", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826821, "uuid": "7d506076-f2d3-47ac-b322-e8fada96e819", "value": "T1F206330C239EF8FDB49A066C3B6789B0C5E452F5DC4225F386391598083F67D4BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826821, "uuid": "1319e595-51f7-494b-9fbe-1baff95d81dc", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKR:0XSxVJG2fLAqFOfT9sMYNM29R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641826821, "uuid": "65547a06-301d-4ab3-8448-7c8a21f6dbb5", "value": 3801088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641826821, "uuid": "8123b880-de93-40ef-814c-e13b6bf679a8", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641826821, "uuid": "4ba9d9ef-9796-4506-bbf3-51a07d874edf", "value": "df28379b382dc604c575952aad804e9b196c484a92d9d2c8d0ca916909a8c766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60dbd639-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641805924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805924, "uuid": "34d72bd7-3034-41f2-a5b5-bc24f16fab0d", "comment": "Malware payload (Mirai)", "value": "3f5eeba65731d112139c36fa8b04f82f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805924, "uuid": "f6309388-bcbd-41ce-8ab7-e2b78fca1c8f", "comment": "Malware payload (Mirai)", "value": "e0a3a06488fd30b6538d901458309ad265b38f9a6f81562dcc8761bbed704a89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805924, "uuid": "9002d48f-bdd4-4ec8-9614-7b687290d83e", "comment": "Malware payload (Mirai)", "value": "4b48d1d923dff54248d7ca01ba0ba5bcc6940f14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805924, "uuid": "d56be023-445f-4897-b91f-26b727575970", "comment": "Malware payload (Mirai)", "value": "955b1854d9126e1970dc0d152cf077052408568ac4e06c0a725a5fee1fca845d6966bd67b6ec3db1b5e72b5015b2619e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805924, "uuid": "fdb0cd2a-3467-46d4-87aa-293a34439abd", "value": "T194B35109BB215FFBE49BDC3708A92B0625DC541731A93BA9B975D808F60F24F25E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805924, "uuid": "d989d3cc-bb29-46f7-8077-eaaff7f5038e", "value": "1536:I85rm9KQjsuAuAA1GL32U/wAfZ4wPnc8NOfSCd9LZETLtK:X5rWKQjsuAWm2Lq8d9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641805924, "uuid": "cf04d329-9e05-45a5-8020-1061fdc3faab", "value": 116824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641805924, "uuid": "259210b3-00da-4f9a-b104-c1ab934eabbe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805924, "uuid": "7c620f31-cf4d-4d86-a43f-6159ee80b5cd", "value": "3f5eeba65731d112139c36fa8b04f82f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a665db7-71fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641808383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808383, "uuid": "16784b1b-69ac-427c-b735-76ae5db69d3c", "comment": "Malware payload (Mirai)", "value": "2bd6e00606867405c7207f2abb02eb09", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808383, "uuid": "0276ed4b-7597-44d8-ad67-8143561fe615", "comment": "Malware payload (Mirai)", "value": "e3e81e4f1bff17dbd1858e4cebf072450053447aa9c7bb95e91bff74d3b8af86", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808383, "uuid": "507e3ae5-8e5e-4c12-ab7a-4707d592dde5", "comment": "Malware payload (Mirai)", "value": "d14cc172a19685980741c261711fc45a960393a0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641808383, "uuid": "67868dda-fe2e-47bc-b9bf-be76307a3831", "comment": "Malware payload (Mirai)", "value": "8dafbc195a47f2c1a0970867fcb414efacacca48920234862d381a7505b217c08eaf75ff8a7c844c84f8f6b4d851214e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808383, "uuid": "0ad7a65a-7ef7-4193-90b8-974ea67cb1c5", "value": "T11AC34B07B5C549FDC08AC0345BBFA537DD35F8AD0238765B2B88EE212D29E311A1EE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808383, "uuid": "97196b95-1803-486f-a7ca-10cd34ab6d4a", "value": "1536:XDbRFBW2U7mO2U7TVZIJhA42zjsBuBKkeSN5newKEG39IjLqr95:Tdz6qUH3IJhAFjs2xeSOHE60S95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641808383, "uuid": "d0c45f79-e672-488b-ac25-21c51da1be72", "value": 126368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641808383, "uuid": "6ebdca8d-53fc-4661-8d60-4b2df967a600", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641808383, "uuid": "75a95ffd-b875-4189-8372-6e5b4be92e2b", "value": "2bd6e00606867405c7207f2abb02eb09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa85cdc5-7226-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641827093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827093, "uuid": "f1b493b7-a143-4fe7-82bb-288fa8a962c7", "comment": "Malware payload (RedLineStealer)", "value": "f0f02ae4f0ae52140f113d24ab511533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827093, "uuid": "b2d31601-862f-4684-8d76-1afa9b2c7374", "comment": "Malware payload (RedLineStealer)", "value": "e6d45a4ef17ee6d76e616076fb117050eb03492f7499b24a0a485dccf95a9802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827093, "uuid": "940ae474-05cd-4851-9c0f-75c9c24a4338", "comment": "Malware payload (RedLineStealer)", "value": "ec97238ef9b93e3cecc0cd85ddf56afa296dc544", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827093, "uuid": "66649d27-8167-47d8-9f7b-03ae4d5111f5", "comment": "Malware payload (RedLineStealer)", "value": "be1482d330b4a4adcd46b13cf30e3278506ea88da0cb268480097eaa8d7a1f0e77d23ab8c192f6e2cf11b60a198a2602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827093, "uuid": "cae91958-eaf4-42f7-89c7-a191745d45dd", "value": "T1132523867BB6ED39CC94617C8D99C2C83396F9642E565B5230E27F1E3FA93034F49218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827093, "uuid": "c5c9ac17-b091-48a5-98a6-87387440fe68", "value": "d123a69e1a76a1d4c228975990208112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827093, "uuid": "27ccd510-c277-48a4-acb5-ca460f81edab", "value": "24576:XgxSPAYQRdfMr6hSOq+02hHghkcNVcy9iVB/kRcMVlZ/fsCUh7AFw:XgGAYQzEroSVd2hHgr9i/cRcA/fsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827093, "uuid": "a756a604-0581-4406-8bef-88837ef23eaa", "value": 1023776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827093, "uuid": "dc8433cc-0f58-4718-9f88-320567b5146f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827093, "uuid": "05c0a29e-a16c-48d8-89f0-4a51b250211f", "value": "f0f02ae4f0ae52140f113d24ab511533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f496687-7218-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1641820900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641820900, "uuid": "bc3cf904-f80b-4f8b-a7e1-0294aabca871", "comment": "Malware payload (Loki)", "value": "5ebc22e8c5652f871de797209bc76172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641820900, "uuid": "38a4b878-8e99-4cfa-a319-41b86989a138", "comment": "Malware payload (Loki)", "value": "e721a98aba7fce7a6af5f381e018db614aa9b114e620213d5118b807d643ba38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641820900, "uuid": "327c169c-32a7-47c7-988c-a5dd801f2953", "comment": "Malware payload (Loki)", "value": "cb24a112702dcfd16f1c1acc4fb0b0b35535ef87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641820900, "uuid": "e78f8e52-a6b1-445c-ad43-89a88c0af271", "comment": "Malware payload (Loki)", "value": "ea7daac5373fecc0c3a821b32ff3a7775aa5f265b67064a6ae8a865ef5182d4ac6520b8cedbe31d43f918a1ce0ce38ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641820900, "uuid": "6b1bd8ea-9a6f-4edc-a4ed-d7e642c86ce2", "value": "T1AF8422222845B977E0C65A334EAFEE784672D74C049313E747D24D7E3263AC3CA4B2A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641820900, "uuid": "33c82397-2a26-495e-8cdb-0b4fa347bb32", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641820900, "uuid": "ba61bceb-4a41-4ee4-a113-9b12b420a984", "value": "6144:yybLOisk+f6CyxkNfxCnB6jw+F/bqyj4U2Go0IEbF5BO+GAG1luUjMzUa9mECPYZ:PbLQRfiClxiF+FWU2bybxU1XA9mtPMrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641820900, "uuid": "b3578c74-d400-4f1b-8e38-e8255c719087", "value": 377318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641820900, "uuid": "a7777902-7251-4fa0-a1b4-019e4aaeebce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641820900, "uuid": "a23e39f0-94f4-4ff1-959c-08b3647022df", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bffc422b-7226-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1641827129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827129, "uuid": "87bb1622-27db-4877-bdc5-1b323f5d0412", "comment": "Malware payload (Loki)", "value": "cefe4488b49d19a0a10aeaa5e985263b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827129, "uuid": "5169a3e1-29d6-48b4-a2aa-5f5bc017d878", "comment": "Malware payload (Loki)", "value": "ebcfc53df10283d3c19c3764f609cd5b8848ca146985f4044112d88d1455deb2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827129, "uuid": "2c5f1326-ad5a-4b5b-a05e-feebc23984af", "comment": "Malware payload (Loki)", "value": "6cdd6895cb06b59e6add51ceb40c3bacbf834d5e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827129, "uuid": "a14e1d81-2b1b-4c8e-8db8-d1c647e81633", "comment": "Malware payload (Loki)", "value": "0b8f3ecdad18874c4d010dc802f347a78fe39322c64e35d1cc28bb837f978aed017a0f6511edd36e7a27ef0b8c502f18", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827129, "uuid": "fd5a7fb1-24ec-4917-bb4d-d67a3ea40d09", "value": "T12164126DF30CA600EEC3783BB759B3E6A34EACD18A482554842BF5C64DB0F4B1F49569", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827129, "uuid": "23a0392b-3728-4b42-8efd-03b49e7f8455", "value": "6144:MVShYw2HHzbs1sSJDmU80I7hrIrktulpIJSOWtC/dvEqA4adcPQr:8SKwss1VMzzKwYU4OblA4McPQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827129, "uuid": "0cd1dc22-cd72-40ba-92cf-933162ceb447", "value": 317672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827129, "uuid": "70618ff8-e1c8-45ad-8a0e-aa9d4d2b3f58", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827129, "uuid": "bb506dd0-c388-46b0-ab13-b9707af7a17f", "value": "RFQ_Order_6203ZE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdd053b-720a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641814935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641814935, "uuid": "59b0dce0-1b11-49d6-95ab-bb76413768f5", "comment": "Malware payload", "value": "d3eb39d26f60366de0ffb4be35272ff9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641814935, "uuid": "1aea585a-74d3-484e-98ef-77ebadc90d6f", "comment": "Malware payload", "value": "edf6a9238f833741d59372caa5b62b0c19ba322c4fa2e18ffc0bffa1ff582485", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641814935, "uuid": "33a3b60a-a462-4d9a-91ba-1db6f57aba22", "comment": "Malware payload", "value": "0d7ba4c6b52706cdd7774ce70102464c48d8a461", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641814935, "uuid": "c5969ad1-d6b7-4679-a182-c9b9adb0c6ed", "comment": "Malware payload", "value": "e1c3be8d02416429f2749017a6f9458af7c8f78a7856f2a4c5200a601a37335260ab465b1670e99216fbfa7341df6ba2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641814935, "uuid": "466c09b4-6cce-41f0-ba14-29a8a353cab9", "value": "T12B425B707BC05314C1E64A366B938CF33320FC6AFF6853222056A5595E79D0D2BE21F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641814935, "uuid": "923e91db-f9f8-43ef-825b-0b53697876f7", "value": "96:p5hf6KWU869T1l+Jfp8Jm5a6xJaoSPCDWklyv:pfy9U8qGHRJgsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641814935, "uuid": "9ccd5140-fe71-46a0-90cc-b0dfb772b0bc", "value": 12006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641814935, "uuid": "7c1cee53-7eed-4f05-b9f1-708453be1d59", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641814935, "uuid": "ff1c62f0-56bf-423c-ad15-64f413f68120", "value": "CARGA DE IMPORTACI\u00d3N.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a4a9f9-71d5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641792054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641792054, "uuid": "119d4139-8a54-445c-b4a9-81b197369abd", "comment": "Malware payload (AgentTesla)", "value": "dbeb7c90248beb95a19ba038ebe17069", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641792054, "uuid": "90d7312c-1572-4423-9943-864e3184d864", "comment": "Malware payload (AgentTesla)", "value": "ee448f8c746610231bae16be68c1886af5c4442d7f1d2fa9658b5d27ed309261", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641792054, "uuid": "f4e8da3e-41c8-49be-8617-b3c4d3c05034", "comment": "Malware payload (AgentTesla)", "value": "801849b5a18a9dccf8340935309623ae110fe494", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641792054, "uuid": "91c80723-91bf-4d15-8764-8dee9bbf632b", "comment": "Malware payload (AgentTesla)", "value": "0afd4c0eb6b4dc0f6eac6503361f463878603586eb58055eea855927e6e8b048df86c2d4af4f3c7a90c4b00d3ac1014e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641792054, "uuid": "6b0c0095-7ba9-4692-bc7b-3e008713bd06", "value": "T15A15025027F88E23E2B947FB5A30524017B0652D7742F70AC99678DF1EA37D6060F6AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641792054, "uuid": "f479618b-4daa-4b12-9ec9-9a1ee41512ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641792054, "uuid": "38d50ed5-8004-41a7-9622-84a3f5826d14", "value": "24576:CcQs5gVr3/ukDC6PBZ0aZikYpb4Efsj8Z3:PFg5BCA0ackYpb7fsQZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641792054, "uuid": "45f0ee25-473a-4ffe-9f5c-754613ca7369", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641792054, "uuid": "7ede0275-432e-4f3c-be6d-f903da8798c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641792054, "uuid": "d9bd0cdf-dac7-4ffe-9e06-5c2e7af99fd3", "value": "QUOTATION202233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e10100-7212-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641818282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818282, "uuid": "94f50aef-2ef5-4d90-88cc-0585cd1d2229", "comment": "Malware payload", "value": "7253e37821a58f94999228a8d8655e9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818282, "uuid": "b69269a7-7303-4855-9b82-1acf7407a4ba", "comment": "Malware payload", "value": "f0dc61d1e7bcdb7bb9d521538db9f4380ebb382f8dec8629433b3181c8b42b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818282, "uuid": "75c4782a-5398-4d3c-8645-50d97b7a83b6", "comment": "Malware payload", "value": "3a5d828823e6c05e996e0227a97d85a63edc4ad1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641818282, "uuid": "02451098-4d3d-4bb3-96a7-114ade4621d4", "comment": "Malware payload", "value": "1fc68ff1a9f5223fd2b48c7c8a9c3fa2f200a917faee62554152d8fa875f4d3704b0147d70ecd1eeaf85604dfba63ef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818282, "uuid": "b0b522d1-1b29-4d06-aac1-eeff68f32606", "value": "T1BC452214EBF9165AF4B78F34A9B5874287B5FC21BF36D71F4208328D1D21A10EA66732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818282, "uuid": "a4276ff3-e86e-4719-bd3e-299f1dbb2820", "value": "d5328904bde60d9e1bf25a5ee4fce2be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818282, "uuid": "1570aaa3-cb6a-4d14-be25-67d6399f40ff", "value": "24576:WVawUmKP50zf4Vt6buYeMp+P0vziwnq5useVqqWpTY0T16+q0E83q:+awUm+544Vt6aGgYiuq5useoqaW0t3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641818282, "uuid": "cdeb0b02-7e70-4923-906b-a8f201e24667", "value": 1246528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641818282, "uuid": "7d97361f-db43-4c01-8805-6a6706615db3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641818282, "uuid": "879df5b5-3a13-4751-9b70-c77d97c602d9", "value": "7253e37821a58f94999228a8d8655e9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94f71a9-721d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641823226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823226, "uuid": "eb1003e5-adb5-4b9b-a169-aa1928082c30", "comment": "Malware payload", "value": "f34a51d0f06da01cf2a6ee8682513f56", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823226, "uuid": "68eab30b-43e5-4ac2-848e-d62532a7863e", "comment": "Malware payload", "value": "f17b97d4b3530e3c5757d04ae5519751709f3bde586a0ca548d9544e4e468a63", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823226, "uuid": "4321075a-b690-4aa4-b4fb-d45b2cf9da6f", "comment": "Malware payload", "value": "7a19825bdc3c39dc13e6b78bbb3f62999e53e59d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823226, "uuid": "f9c0b171-eca3-40e8-a7b6-aefd638c770d", "comment": "Malware payload", "value": "e8be714582e6b3a60c4f1556522db8b0bf1f15e9608d049794b2380d2335b581844acb707f8a51aa6fb6b9f4bad195d2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823226, "uuid": "d09941e6-9cbd-4cbd-b03f-2f1a7c624665", "value": "T14906330C239EF4FDB899096C3B6289A0C9E452F5D88225F3963815940C3F67D5BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823226, "uuid": "66c4418d-e610-4497-a6c5-86b370a8efc2", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKo:0XSxVJG2fLAqFOfT9sMYNM29o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641823226, "uuid": "6327d5cf-9841-4f70-8d19-d763bda94a6e", "value": 3768320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641823226, "uuid": "335ad56b-02df-4857-bf7a-9ee94c5b43ec", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823226, "uuid": "333ab439-0949-4637-b0cb-7097357f062f", "value": "f17b97d4b3530e3c5757d04ae5519751709f3bde586a0ca548d9544e4e468a63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9c3cec-7227-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1641827526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827526, "uuid": "218e85ed-4d50-456d-9563-3668b1627d2f", "comment": "Malware payload (Loki)", "value": "22943417bdb76eb2d0cc1e8cd3a541ad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827526, "uuid": "6973719e-7629-4556-a5a5-82d26e30deee", "comment": "Malware payload (Loki)", "value": "f1bd253d391bc58580a0f04125b472030bba66afe90e12c0969af977ceaec42b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827526, "uuid": "c1247b6e-e39f-4c31-8e54-be6630c9242c", "comment": "Malware payload (Loki)", "value": "a16ae43a498a6282f78f8617161049fbb36c4d60", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827526, "uuid": "db80e0bc-73c7-405d-99b3-89caa9c93867", "comment": "Malware payload (Loki)", "value": "7f321126849801b97a85a8f6cb5f6c741accdc1b00ab329c8a4b3c3ee55ee2db52b7f767b6c082b7d69cb6857311c6b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827526, "uuid": "e8d23ca5-a606-4fee-b5cf-2eabbd63270a", "value": "T1CA923198BAD0B4C407C72BB6A63F70DEE57B29DC3488081FC112F491B97561AE9E1936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827526, "uuid": "171b56e4-bed2-4b35-bb51-49e6259ee965", "value": "384:WHtjdLIfnsQPKI+ilsSYkc8tIZAsG6cQdQzwRGi7EoZ7F+yYF/wlWjOY1C9Jbs3F:+dLIfsQPKI+ilsSYkc8tIZAsG6cQdQzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827526, "uuid": "b98f4ae6-492e-4162-a0bf-43762d0f4bea", "value": 20885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827526, "uuid": "b2a8708a-9d36-44cb-811a-7be73d78a27b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827526, "uuid": "053e050a-40e5-4d2a-82bc-30b7869d7cc1", "value": "SWIFT006_010012022.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9bd08d-7246-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641840602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840602, "uuid": "9899161e-2190-4a57-ad8a-903824475460", "comment": "Malware payload (Mirai)", "value": "96050ead31adbd813e92e8eca8023b63", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840602, "uuid": "ee4e965d-5773-4a2b-8e4f-0ae8d762f97d", "comment": "Malware payload (Mirai)", "value": "f251783a28ea18efb60565a09521314d20fc7f288deda8a14e366f8f1ed86530", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840602, "uuid": "e0f0f77a-2be5-4dfb-bf07-2f6473d1a9af", "comment": "Malware payload (Mirai)", "value": "a595131e1cf21f95076ae02efee16710211ae934", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641840602, "uuid": "6456be94-9410-417c-9352-2d84bafe7da5", "comment": "Malware payload (Mirai)", "value": "583f4b9a4fc9c78cb8f79d5b44a21772eda3f68fd192332b268f9fc69e531aee2a11c91febdaf0cddcb2f55592896681", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840602, "uuid": "77083420-5b06-40a6-9e08-145262a8831d", "value": "T1EE3339C5A683DCF5ED1506B13073EB328677F13A613AE9C7D798A523B882A01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840602, "uuid": "cbe0982b-54d4-419c-9ef6-be69ce3464d8", "value": "1536:X7zgRb8gswA1+A9afOsPWROehJuPgRyd1Qe0b65J:L8RbBswAUA9UPWRNhJoSG1nMOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641840602, "uuid": "540d5338-9349-4cb6-ad8f-d162b2b4630f", "value": 50832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641840602, "uuid": "b29c47c5-d9d0-4e66-ad0b-e1956ab59eaa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641840602, "uuid": "d23198bb-5c8a-4f36-bc5c-cf57c49b3855", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2deaa2-721d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641823229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823229, "uuid": "29d338c5-af09-4640-a10a-86aae41aaa1c", "comment": "Malware payload", "value": "eb54b9f16313cc6c1a7f4c5b8516fbec", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823229, "uuid": "555a9d2f-4f9a-4a41-9ebd-8bb37a908fce", "comment": "Malware payload", "value": "f2771fbb3996eb37b2d324563aef223830905f0f993c59027a26ea2655ce336f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823229, "uuid": "d64559ff-2937-45a6-857d-f98954172a00", "comment": "Malware payload", "value": "65e51219e90a505a26a796806aab2f8530414959", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641823229, "uuid": "4ee5f3a5-aa45-4125-a778-b7c72d0a1eb8", "comment": "Malware payload", "value": "f89670ae79d63a6ae38c4c7e1438926f27af4f0080b9ef09c8c977f3e153a8bd72993cb97cdeae7f0c12702806098bd9", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823229, "uuid": "6699e6bf-9404-45d7-9897-af4c44a6b835", "value": "T16D06330C239EF4FDB899097C3B26C9A0C9E452F5D88225F3963815940C3F67D5BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823229, "uuid": "05e2fc29-8767-4070-b4f9-f8efbb70de90", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKD:0XSxVJG2fLAqFOfT9sMYNM29D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641823229, "uuid": "db32478e-0b4c-4ecb-896a-562e5e7fc332", "value": 3760128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641823229, "uuid": "b65ce404-9b5f-4d19-be95-c53687de48fa", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641823229, "uuid": "e60df87e-da46-4e9a-963f-99856ea972cb", "value": "f2771fbb3996eb37b2d324563aef223830905f0f993c59027a26ea2655ce336f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64ed3af-71ea-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1641801397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801397, "uuid": "d8ba2414-86f5-495c-86c4-3e37bc457448", "comment": "Malware payload (RedLineStealer)", "value": "1bac2a91f9c0823252408f7b820279b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801397, "uuid": "2fd00939-3841-47fb-a995-c90b4859567e", "comment": "Malware payload (RedLineStealer)", "value": "f3f186877f81f2206a1e578a89be7b2bcd04389a7a74ec7ea8ae60d97169d8c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801397, "uuid": "375cb24e-9e3a-41d8-8df4-e39b434931f0", "comment": "Malware payload (RedLineStealer)", "value": "6b03f206b61347b151b0294edf0aa6dc2905f936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801397, "uuid": "23393e97-66ad-41fb-8f3a-27868f27eab5", "comment": "Malware payload (RedLineStealer)", "value": "09c8da1d2ebb291c3ec9020db9f9869d3d71495dae80a96cbc96cbae3c9c00c279a5f09c10f14140446d121c7b6aa4b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801397, "uuid": "453ad7e6-6d5c-48bb-8475-1daba7b86769", "value": "T198151ADD51C15849CFEF07F00DFBE62E897292C613474BEA732E91F06B6209EA56D4A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801397, "uuid": "f2f0b686-9937-44d5-9622-cf4536a5a6ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801397, "uuid": "6f1cca29-bac5-43dc-ba79-1f2e3cae36cc", "value": "12288:9skFfC+enOji+CL2aDdU2AdCZIaTDZcN:mjOC5DdU2CCFTaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801397, "uuid": "5680b651-18ee-468b-8c3b-f9ba5d2fe600", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801397, "uuid": "f347ff20-b924-403d-b846-6569b523396b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801397, "uuid": "3728055f-6bcf-4a2f-b1ec-1a9bbec633da", "value": "1bac2a91f9c0823252408f7b820279b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5853d35f-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1641797320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797320, "uuid": "1117dfe0-6a64-47bb-978c-b170ecb8ce8c", "comment": "Malware payload (Formbook)", "value": "63614e4c1f7c86c41ade29b98f006f64", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797320, "uuid": "6c0c0607-0761-48eb-b1c5-e93a4c9a8835", "comment": "Malware payload (Formbook)", "value": "f637bd1f5fd0c0c1fc12d69a95ff12582dcbe6ba0b09e25fb085598f9dcdb3ab", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797320, "uuid": "468051ce-ddcb-4624-b17e-c2e60d81fc5a", "comment": "Malware payload (Formbook)", "value": "42fbc34e108d77b4f1856bb5f29dc6e5aef2fce5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797320, "uuid": "47401970-6383-4bda-8573-f168013093b7", "comment": "Malware payload (Formbook)", "value": "a83a01c820fb01a0b0df9b02288cbd5d0e3d219048fcc6ae66485e1be77be22144fc28786d6e55a2bddf01255afd3ce1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797320, "uuid": "8275440c-da1a-4b85-9999-2215772c9513", "value": "T168741353BBE7430BD183287CA82D62270694FD0BBB151C2D56E17367437BBEB85029E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797320, "uuid": "fc9100b0-5e4e-4bbb-8974-84bfcba12563", "value": "6144:+Zm5xiWLUCpZOmFG5mFPu9S3glDzUm1fI1b6O0slK6MEIk/R7bf3s2TX1lddMLMj:W4LUCpZOmFGIuUyz9chXlikh3T1xj82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797320, "uuid": "7d2cad4a-2f65-4836-a07d-05107b1ccc71", "value": 358776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797320, "uuid": "be8301a2-6e03-47ad-b5ad-6db57f5c239c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797320, "uuid": "2ef441af-5a20-4509-ab60-52200490553c", "value": "Offer 00122.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d09fce-722d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641830144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830144, "uuid": "84a3156f-ac83-40ae-bc72-d15c3588fbe7", "comment": "Malware payload (AgentTesla)", "value": "dfa3fafa4d1b2772716c65e9e7b42b79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830144, "uuid": "db8239e6-8dae-4dac-94b3-47fe4df1fe1d", "comment": "Malware payload (AgentTesla)", "value": "f74ad8a84f5eb2d900b72b9f04a04bbcede1fa4a1be326ccf3e3607fc53ccb45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830144, "uuid": "9a8c6cc5-b09c-4bbd-a8cc-c9fb781bd441", "comment": "Malware payload (AgentTesla)", "value": "30f6144b77157a260d3e03346148e1ba3943f118", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641830144, "uuid": "3369d277-75e0-49c6-ba8f-76f2c1073fbc", "comment": "Malware payload (AgentTesla)", "value": "b73ff4079f47c211bd04fd36a232fcd7fe44080a7727cc8e792a2ebee0a9988579d1fde0d7dd9d3367eb84c8870f3a4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830144, "uuid": "a2b4cade-9f5b-4270-9eac-bb20149aff9a", "value": "T1E905D0063A59CD11D22A46B7C5CBC2B447B4AE48F553D32B79E53E2F3D323A57C0868A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830144, "uuid": "dcc2f929-e4d3-4b0f-859e-50c90c036b90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830144, "uuid": "88ed1be9-4c0a-4ff0-bf29-4b38586895e8", "value": "12288:A1s86sEz9QrwtDTmilHq1QkK5CqopFwsPsDwIHzKTn3ZU9t:A4Q0tDTmitq1QkK5poprPsvzKTZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641830144, "uuid": "e14801f3-efbb-4149-99f5-6ab0aa440235", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641830144, "uuid": "36251835-8d12-4563-b009-aa0bccf889d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641830144, "uuid": "8d0c6d3e-99cb-4ed7-9a75-917094273ab0", "value": "dfa3fafa4d1b2772716c65e9e7b42b79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f55742d-71eb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1641801573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801573, "uuid": "346f0eb3-60fe-469d-b1c4-f8f197a41d93", "comment": "Malware payload", "value": "fb369d38090dc1378f6530264b70f4d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801573, "uuid": "e8b03ef2-2daa-4b05-8e5f-dda58d238816", "comment": "Malware payload", "value": "f86543a29ebe80ae64d7c89efe017b7129ebd56d4acb036ae5f4585e03ff232f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801573, "uuid": "95f65093-ce0d-410a-acc6-00332bf51e48", "comment": "Malware payload", "value": "a2b3d8b987350269089267f57705d71c697e0a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641801573, "uuid": "2adb1831-274e-40f9-b109-3e1cdc9edcfb", "comment": "Malware payload", "value": "34106ead35ee025b18db8ec124b38df1a3fbe93db1deb635d8c88514167fc53558c698769378eafd6d9ee5eed36a50c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801573, "uuid": "e481ea31-d814-45ae-a1cc-aba7b596b92a", "value": "T1D4C1C61163F84735E9B69B7AAC7343004679B7524C73CB5E28C8611BAD13B248B22B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801573, "uuid": "c98bca29-3b14-4b0e-ac12-f2609fcf4f83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801573, "uuid": "9bf78a3b-2a2b-402c-9e8f-e989e0b6b3c9", "value": "96:Z/tIx6qHc9lXjeBJhyoNa/lrk5PtwAkVczNt:DIx/H4iJhv5PSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641801573, "uuid": "0778bab8-4830-4b11-b95b-f281733c8ae1", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641801573, "uuid": "cde528de-a9cc-4ffc-a3da-724b946cb619", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641801573, "uuid": "e757a298-8626-4c13-988c-f945cb0acce8", "value": "fb369d38090dc1378f6530264b70f4d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2934257-7226-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1641827187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827187, "uuid": "5b874033-f567-427c-a50d-78e1eca94283", "comment": "Malware payload (AgentTesla)", "value": "9533897c2baa741dca27919cd28d49ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827187, "uuid": "418fda16-6a36-4d74-a636-c739d1480a3d", "comment": "Malware payload (AgentTesla)", "value": "f94d5916c8a02c65a76d7a6a174bf603f26e69c6e30317352c0738ca524f0ce1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827187, "uuid": "8b652e38-f478-494d-a5d8-d95671ce89f3", "comment": "Malware payload (AgentTesla)", "value": "5873ced68d8f8d855b0321071ed8440b3080a3ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827187, "uuid": "fdd92b4d-3a45-44df-874b-4ff5017c209c", "comment": "Malware payload (AgentTesla)", "value": "40ddc5986150ca395847c8964b84d246fba6f4206985807a41e7bb0763bfe41b5a2797c05c021a4dca757ff81abdc6bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827187, "uuid": "e787dc8e-5d57-45ef-8eac-ef74e9e947b8", "value": "T1E36412A6BA954783FE4A763E80B689E00942DF3FBB34F980F78674F215723615560B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827187, "uuid": "c2a99bd1-f8bc-43ce-b2ee-57ea8618ac40", "value": "6144:pWKV92F86D5rwptX5faZvUb6M+tv+CqhfSD/EdqmJbdCKW:xV9p61cpHSZUbEtvdqhfw/Wq0bpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827187, "uuid": "3a8988d9-7380-4f18-b28f-c9c56bccb45a", "value": 317512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827187, "uuid": "53379460-a57b-40dd-94db-8f4196e5fba9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827187, "uuid": "397c0bbf-3972-4a4c-b8b5-1e6b7a7fba41", "value": "RFQ Offer 22020901.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "872dc03d-71cd-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1641788809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641788809, "uuid": "6fa1ccf3-bad0-472a-a0d2-18751cfd2fcd", "comment": "Malware payload (ArkeiStealer)", "value": "2d6eca88082c6abce764f8a54b9b9917", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641788809, "uuid": "7bd443d1-a7b7-492d-a191-c4520240119f", "comment": "Malware payload (ArkeiStealer)", "value": "f960b96c81f71d848a119d18aa4074ecaa71e39086a611f2dc637d579b9f6afa", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641788809, "uuid": "0b727fe1-3850-4c6e-a6d5-ec3599be865a", "comment": "Malware payload (ArkeiStealer)", "value": "c461c6e6da306986d9f853729c5ed03af1ee325e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641788809, "uuid": "ab28395b-d763-41a4-8fd5-ff0c5c760f8c", "comment": "Malware payload (ArkeiStealer)", "value": "6d0c5103d88e995238d18b287cbee03e65817751660097e6c2f0d7083755a4343883110f1d0e56935e051c9b6f404efa", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641788809, "uuid": "c87c8963-aff3-48c8-8a3e-89e547f63d25", "value": "T13775129A87288C03F3D455B5D5A8FBB887786EBC6E9FC01574B23CAA763CB855C42113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641788809, "uuid": "1388f3e5-54a1-4e2c-9ef9-0e0bf9cb2121", "value": "690f2725a2fa40ff79738d73e090bb58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641788809, "uuid": "b726fb03-797c-460f-9841-f909a3e77e5d", "value": "49152:vOgtnAdge/fTkxEBqzdrZi830nMWHfBfJZpN5e2v:W0AdlTgHdrgxMW//Jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641788809, "uuid": "9f94a6df-f427-4ba2-a645-a91be1ed173b", "value": 1670200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641788809, "uuid": "369a1f09-4c84-41f1-9a43-2f70d56f2dc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641788809, "uuid": "e79ff948-dd32-41d0-a145-6fb315ca5886", "value": "2d6eca88082c6abce764f8a54b9b9917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e20254-71f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641805909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805909, "uuid": "f0d3af0f-041b-4bef-9043-2a6ec6ac4b11", "comment": "Malware payload (Mirai)", "value": "9316c9702e0e74ffbb8dc62c7b9a451c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805909, "uuid": "b0126030-be0e-46ba-9b69-de997e1fe691", "comment": "Malware payload (Mirai)", "value": "fa737d3b749917559b822ad82a3a3e375cccd37ca45301f5f4f47a35612ecfd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805909, "uuid": "c3f09573-49c9-439e-859d-97390acaab33", "comment": "Malware payload (Mirai)", "value": "a12f18f9c5228129114457ac97d28fb5442e4c11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641805909, "uuid": "8c102589-1169-46a2-a38f-12526b2b57dc", "comment": "Malware payload (Mirai)", "value": "de3b43b16290725e3d8d1838f4979667089819d5543d6b53024fecd0b69d278e2a7a6991df5a28590196eca66e64ab94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805909, "uuid": "03235b27-e413-4265-bfec-f4a684566293", "value": "T10A83E592BCA29328D3E0537BFA5F121E331957DCE1DA7392D8346B6076CD80F5D62A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805909, "uuid": "f4c81e82-03c1-46e0-9044-9e3f56bd6ba7", "value": "1536:o2IKKPzlMKbJELsuaid1PvpRGYJ2SU2nMcHbmiMcBLgweZWGLaL5z:ovKMzlMKlELE2ycBkwwDat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641805909, "uuid": "852168de-f802-40d1-b62d-c45651084195", "value": 81368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641805909, "uuid": "91f96618-24e6-4fcc-b690-ff3ac7689c9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641805909, "uuid": "1d7e5b8f-fca0-453a-a9e2-ddda9026d05b", "value": "9316c9702e0e74ffbb8dc62c7b9a451c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0657b2-7226-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1641827039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827039, "uuid": "d714e8e5-e0f7-46b3-b86c-b96185468b9c", "comment": "Malware payload (SnakeKeylogger)", "value": "e24a6f28f08507a2645da2a101d13e3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827039, "uuid": "6ec47a5c-9c1d-4a10-a734-8eace8ef29ce", "comment": "Malware payload (SnakeKeylogger)", "value": "fc80365f929ad6a647ec2c98b910fdb8b7ae8bd6bb090213934137edf4def264", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827039, "uuid": "3334240a-7996-41ce-8397-767a9d3e881b", "comment": "Malware payload (SnakeKeylogger)", "value": "b5e6c20491239fc6aacecea0019a811924082abc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641827039, "uuid": "346d998a-85d0-4531-93a5-0ef9287af2a5", "comment": "Malware payload (SnakeKeylogger)", "value": "7b2ab8010d8fecb63c1cb3036f6f6e148901e901ecfef847108d9a3c0db80c4ac6d48c71e6bb7446d00f9c9160ee09b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827039, "uuid": "018be295-41b2-4004-80e9-63db78e6c475", "value": "T171D402CA7A56E5B8E505D4709EC4E621EE356CEA7C113FE3B648BF260A320F7D1047A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827039, "uuid": "31ae6c3c-17a3-418e-a2f8-4626a12d3132", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827039, "uuid": "aa1026d8-53d9-4753-a57e-5e099a3a57f5", "value": "12288:hbLI065OnmeFpdT6Vik5eJKS2fvM6R7uxOtiaSntZvFKY5oJYlw6A7OYN7:hA06UmeFpdT6Vz5e12M6BDHc3FDQUTAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641827039, "uuid": "692c9d68-21d2-437d-9442-740fc0cd74a2", "value": 646227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641827039, "uuid": "08e17dcd-69b4-4831-8eb2-3241c57e9de8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641827039, "uuid": "d2fe05b1-a537-4f48-bcd6-499f96f5504a", "value": "20987654323456789009876543200k.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec41f52-721b-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1641822376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822376, "uuid": "528dafc6-c2ec-4125-acab-49b87b942e65", "comment": "Malware payload (DCRat)", "value": "58cfa3457f3b836c80deee4ca88e49c0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822376, "uuid": "f2b90dc0-ca92-420c-afda-aa372520b1e0", "comment": "Malware payload (DCRat)", "value": "fc9399d6b40b6b8a27c41b1db3c28bd3a598022f1d03d2008b2be33f3d986089", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822376, "uuid": "3f334134-ba70-4fb7-a188-2cf7243619a5", "comment": "Malware payload (DCRat)", "value": "398bdb2da0ae79d5c128e0c00e1b624986f35645", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641822376, "uuid": "721e6143-7bcf-4bd5-89ea-3faf523fd97d", "comment": "Malware payload (DCRat)", "value": "19a517c00aa737f32adb5641c0a5c3ad1f93ab009f986d2d4db7a80a439a92e23c7c304f04ac6ae08fc0d3ce05808fbe", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822376, "uuid": "ed602321-5f53-4a07-96d5-b2a4d85f6ef4", "value": "T189A42B242AED5A29F1BFAF79C4F12455977A79537B2BD70E08D101CA0A23701ED80B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822376, "uuid": "5660444c-0f8d-4a85-b44a-6c790b7df717", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822376, "uuid": "89d47d78-ec87-47a5-9730-16978dfce6f1", "value": "6144:tqqDLOiXss4hyfmngjg7hkCMO43BfUr943xZMHmRw720bmxmY7TfJfC3YQy4T:QqnOEss4gfmnZ7heTaz2Dxp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641822376, "uuid": "0fb42b3c-1ca0-4ba9-a433-decbaac45e25", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641822376, "uuid": "86548bab-5f66-4dac-b23c-ebabc56813a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641822376, "uuid": "7db113d2-455b-44f0-8c66-72c0f005970d", "value": "58cfa3457f3b836c80deee4ca88e49c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b09328b-71e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641797405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797405, "uuid": "37e9da72-dda3-45e3-a568-9aa5dfa6f32a", "comment": "Malware payload (Mirai)", "value": "823f2aa90978cbfd26e4e534674b448c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797405, "uuid": "5f7f3854-d7e7-4c55-a59e-c8dadbac5b37", "comment": "Malware payload (Mirai)", "value": "fdc7256522f3723166e81c9e380f5b3d1ba9c655ffe41c93e67a0db59c11cf3c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797405, "uuid": "544a27da-9009-48c0-a95b-9ae97775a8ed", "comment": "Malware payload (Mirai)", "value": "b87e0357ea8b0e296b268366bcb764bc88e23107", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641797405, "uuid": "b8c2e84f-f732-443d-863c-f072d33d1a17", "comment": "Malware payload (Mirai)", "value": "9de441033afeb333b4b037cfb352efa8c92c7bb9fe4ae6a32b96a25149a5a6ad7349bc7a16e66591b8fac9bf425d76fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797405, "uuid": "18cedff0-6c8f-46b0-800a-925ec80f3afd", "value": "T1A9235CC6DA87D8F5F8660632217BEFB29B72D93E2034DB13C3985536DD52A02E21634C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797405, "uuid": "0955e0b8-451c-4d87-b477-8c8880d5cafd", "value": "768:X2BsHfwkdejZ1/HcuUJe6Uvbpj6D8IVyk5RK0x0a0wJxU8CXSi3Ip:X2BAwn3Hcu4e6KFyVyk5UAJxGXSi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641797405, "uuid": "62deca13-b2eb-4890-b3eb-8c097dae2c17", "value": 47060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641797405, "uuid": "08945609-f645-4640-a20f-d5209957d5ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641797405, "uuid": "50a38ca3-e022-4340-9a5f-c23c08ecec04", "value": "pop.x86-20220110-0650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd6ad1b-7248-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1641841646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841646, "uuid": "5f9cc09f-ae54-4cf3-b610-3f3a3f2a33c4", "comment": "Malware payload (Mirai)", "value": "b771c0d342344bd3f7a32648a7002bec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841646, "uuid": "bbeab304-2e73-48e9-bea3-5f9fef83cce5", "comment": "Malware payload (Mirai)", "value": "ffb2c4aee99e794b2e6c9f36e7801329a36ad0bca8f21d50dd2a5d4ab579cf96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841646, "uuid": "f1cf12f4-0d92-4f3f-b02f-ba5af436d0dd", "comment": "Malware payload (Mirai)", "value": "b0f4e85b83db07efd9921a0786f6be4a0312065f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1641841646, "uuid": "5280f5ba-59d3-4207-9d61-f2b76ac93d54", "comment": "Malware payload (Mirai)", "value": "55a00d32319f8bf7eb7ce9d4a5eaeb5fc9be3148983bda19dadccac7024777f29fe8488bd7ca2dc1c3b45a8768533ff0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841646, "uuid": "d45bd200-7146-4142-b4f4-a020f6343c77", "value": "T1A9430891B8D19A16C6E423BBFA6E40CD372563E8D1DF32179D212F1077CA82F0DA7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841646, "uuid": "7c533839-5805-4d09-8f0f-120af8e5b21f", "value": "1536:6p2BWWcHT5JL9FMafnJK2BgWhKjFgSndyDk:6p2bgfc2BzhMfd+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1641841646, "uuid": "8b791d37-7977-444b-bacb-a973918a0bf2", "value": 60264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1641841646, "uuid": "46ded09e-aa49-4e45-9fa2-cbb32bd8a6e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1641841646, "uuid": "0021742c-eb7c-4edd-a676-97ea44597677", "value": "b771c0d342344bd3f7a32648a7002bec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }