{ "Event": { "published": true, "date": "2021-11-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-11-13", "timestamp": 1636848181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "51b64420-75e7-46e0-b763-6ec291bd8ce3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cbb3f1-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831260, "uuid": "f545a41d-2b28-42d7-9e97-aca53d6fd6f0", "comment": "Malware payload (RaccoonStealer)", "value": "30d55353e81d7df017139a2f0a31c9bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831260, "uuid": "848a0190-1eed-4629-bd8c-4f61a97fdb09", "comment": "Malware payload (RaccoonStealer)", "value": "0166d0fc5da4d3c12c8955d1cebe10f366cd0a0674f2a5d403e2cfc40804209e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831260, "uuid": "3c8b682e-a2b0-4a59-8301-271df531d29e", "comment": "Malware payload (RaccoonStealer)", "value": "719ed4511b45c4a047d2de51e6882af729b473e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831260, "uuid": "1d536df1-dd5b-4826-8900-ed347f370bd1", "comment": "Malware payload (RaccoonStealer)", "value": "70ccae1f75b01cbb7c16461ef2f3125b62798c753cbc90bd729ffa294cc59dcd46b53c049e22d502bbf9419b9752e276", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831260, "uuid": "26bd678b-ac22-43fa-958d-1488031e89c1", "value": "T1D2D4E000B6A1C035F4B662F949759369B93FBDE1A76950CF23D12AEE4A746E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831260, "uuid": "d773f6ab-bd52-4ff0-a200-a8019a0e0b57", "value": "17d363df494bcb38053d0872594e66c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831260, "uuid": "e02cbc37-bcc8-4939-942e-6b1165b8860a", "value": "12288:JJWRSiKRjarSiiSHAXMTnlRN2Ick0kdCrPl:JJWFKlardiSHAczlfL5IT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831260, "uuid": "a320d1dd-2d9e-4203-a335-3a9016954364", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831260, "uuid": "d614cdb5-1163-41f2-9dc5-314a9c93244d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831260, "uuid": "c0ed35d0-631b-42b8-9f55-057f9616c962", "value": "30d55353e81d7df017139a2f0a31c9bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa59d0e-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831276, "uuid": "57b40ef4-872f-4423-89d0-ed5a964588ca", "comment": "Malware payload (RaccoonStealer)", "value": "63ff07103816cc3c73ad866911e9314d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831276, "uuid": "dcd8b1c0-5d57-4cca-84cb-5985105876ac", "comment": "Malware payload (RaccoonStealer)", "value": "020dac2b02fd8df13e8782aa3aa85eb28f3dba4193dd5fecacee4905ede8fa6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831276, "uuid": "7a3a94f0-d025-45a5-b632-18d733039568", "comment": "Malware payload (RaccoonStealer)", "value": "0b9a5d557c464d8904eb56c7593f15a712bee631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831276, "uuid": "06de0159-807f-42f2-bc3f-8c25f41dea65", "comment": "Malware payload (RaccoonStealer)", "value": "a07f64ef467922949acbd364a5878e2eb0259dc8ce4601ce24b753a9b06c5e1f38d9f3272f32839ca9d2a9656fe43066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831276, "uuid": "ad7d5cc9-e309-4442-9eb3-1b28f9e10a56", "value": "T16B649E00BBA0C435F0B616F949B69369B92F7D91AB3490CF23C53AEA96756D0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831276, "uuid": "281f1b37-9824-4da4-8dd2-698ddac6dce3", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831276, "uuid": "fa61290c-5ef5-4010-b5ed-da214fc14d2d", "value": "6144:mHg+S88TIkp20YybcxrV0cGE+Dj3XTKS:1+GIc20YybcxrV0cGE+/TK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831276, "uuid": "2877eb6c-5bfb-47ee-b26e-ed2b79bfcb93", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831276, "uuid": "1d2f0fb5-bfb7-4e42-b69d-76bd24f995e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831276, "uuid": "cc0667f8-ee9d-462b-800a-f3602737040d", "value": "63ff07103816cc3c73ad866911e9314d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee9fdea-4455-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636789265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789265, "uuid": "74ab9375-1936-49ee-a3fa-3c7447032c54", "comment": "Malware payload (SnakeKeylogger)", "value": "9a8f2b21f9a1519f8c94b6b7ea315d4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789265, "uuid": "bd5904e3-0a89-49ef-8621-a85e7902945e", "comment": "Malware payload (SnakeKeylogger)", "value": "024dc716d487ab0ba41efd4bf824a6a18ca0174867c4754985bdb70a6d728d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789265, "uuid": "081bd52f-3ab2-4b98-812b-ca4ddf299ad9", "comment": "Malware payload (SnakeKeylogger)", "value": "621d78365c7e52f1b3c2e3824176387a4dd65e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789265, "uuid": "58b72bfb-55e3-41ce-a663-c2cf92249afc", "comment": "Malware payload (SnakeKeylogger)", "value": "e3cdca4724cbe532e4bab07e612408658ee0259887788e2b00f34eb723a1f7524bfb8fa56121a4721405983e9dcb7872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789265, "uuid": "0a2d0198-4821-4861-8222-2761246475c7", "value": "T11013F916E10539FBC2070972C34AB555463B976F893F869A742F47AEE1C378903ADEA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789265, "uuid": "298e03a9-7cde-48a6-bfda-7cfd08df9ff1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789265, "uuid": "0ad4c54f-667d-45c1-91e6-47bdb6f42331", "value": "768:2Mdhz4sFnh7icDv0LZfrJPwuWNn6CvSYSg3l4hMAPnh7:jPt58ZfQggOhMGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636789265, "uuid": "47db43e7-e66c-49ff-8343-183422a180db", "value": 45496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636789265, "uuid": "9b20575a-a44d-4e50-8d30-4acf47ff262d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789265, "uuid": "ce74c021-def3-41d9-8290-0af6882fb768", "value": "inter snake.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e2d06b-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636831278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831278, "uuid": "6639ffca-f6b1-4827-967a-36e9cdf8b717", "comment": "Malware payload (RedLineStealer)", "value": "287958c0e68afe52ea4a0fb86382428c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831278, "uuid": "6ead5de7-3bd9-42e4-8ab3-bd043accefc4", "comment": "Malware payload (RedLineStealer)", "value": "031f3061288baab3465b00aa5ff222b85264e2692392c1445ee67f6808b2c2c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831278, "uuid": "9120babd-27c9-4419-a310-c2b4bdc80994", "comment": "Malware payload (RedLineStealer)", "value": "e3da8c2ddff9b51161548a3b7a842e9a20b403d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831278, "uuid": "964ee75b-fcb5-4543-8463-8a9e24c46035", "comment": "Malware payload (RedLineStealer)", "value": "51d3aefb57ac55d1a8a0d9b40b60b49700a6cf8831ea130b825dc2a7111572bb6d8ed5a62aacbd6ed9aa8f3180f3ddd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831278, "uuid": "86ac6b6f-d422-44e1-97f8-a9f5018d2d64", "value": "T144648E10B7A0C435F4B716F889B693A8B53E7DA1AB3594CF22D526EA97346D0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831278, "uuid": "7271f9a4-cb86-4b7e-90fd-e0a3af153901", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831278, "uuid": "2c4e97a4-31e2-4a87-8d23-37eb0c5097ce", "value": "6144:a/5Ui5+nBgD7x29Df7mj2V04GIbDbqb7KMlBNy:pytN29Df7mj2V04GIb07KYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831278, "uuid": "e598f3ad-f02a-4405-a30f-f91ed6527b23", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831278, "uuid": "a22b766c-0936-4da2-86d4-d83bba5e5fac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831278, "uuid": "a5235a92-3343-4c64-b2a2-31c6cf771cb1", "value": "287958c0e68afe52ea4a0fb86382428c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdcd954-446c-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636799219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799219, "uuid": "9da165a3-55a3-4f7c-9660-583df0f8e5ff", "comment": "Malware payload (Smoke Loader)", "value": "df1004ebf283062e65e1955c3e08649b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799219, "uuid": "04ff9808-be5e-4eb1-8e5d-71ae38af57f2", "comment": "Malware payload (Smoke Loader)", "value": "03a8e7d6944e5b0431d732bde69f69c319fc827feca236884605db47d35a3ac3", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799219, "uuid": "85426d48-3df1-4d97-b2a9-76b7c0090ade", "comment": "Malware payload (Smoke Loader)", "value": "d0b5670466af3e6df52ae7d8caf9d7ecdb78ce6c", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799219, "uuid": "f2ae7393-3348-4594-b1df-9beb79cdb0c1", "comment": "Malware payload (Smoke Loader)", "value": "80112d0da5fd22f019a89441dff3bd98e9e1c6b8ace71cd09b35c44f731be49f49f52547df1f534fe74a11fce0473f8a", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799219, "uuid": "d7b08c67-02e0-44c1-bfee-e9f174e23e09", "value": "T1F9749D00B6A1C435F5B216F849769369B93F7DA1AB6590CF22C42BEE4634AE0FC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799219, "uuid": "602ce9ff-989c-43f3-94b8-f95c86e54be2", "value": "ea99ca467492cc4d133feba5a83ca2ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799219, "uuid": "bb9c91bb-132f-4161-a8c0-f4256e498b49", "value": "6144:90OcztEcSofb+2aXGbofhK6tQUNIG3NFEz/vplx72:9cztEXof62aWbofhK6tQUNIG3NAp/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636799219, "uuid": "d72ed484-fd6c-4df7-8777-508dcd3a5e64", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636799219, "uuid": "1a6ba43f-4f8d-4bce-9df4-e860834d5d3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799219, "uuid": "5bcad3eb-bda6-41f8-af2b-284cd39396c0", "value": "df1004ebf283062e65e1955c3e08649b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808c728c-44c7-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636838418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838418, "uuid": "fa032ba3-9af5-4415-919f-1db7fc269f6f", "comment": "Malware payload (Mirai)", "value": "e40c812f19bd6e305b2d9250618f0271", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838418, "uuid": "b5da8286-5f1f-45b7-ad06-a5858687155b", "comment": "Malware payload (Mirai)", "value": "07da81e1f794b45cc1fb69349faf708da69c4dc93a76cd092b3439b7751dcb30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838418, "uuid": "6f9c8d04-17b1-40a0-8037-9aaccb6e8675", "comment": "Malware payload (Mirai)", "value": "afccdb55f6dbddd7a933fabbca1e4c984f2afba9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838418, "uuid": "cd5e2f48-0bd7-4dc8-bd96-0db0295c98c3", "comment": "Malware payload (Mirai)", "value": "3d32aee0008ff3d79c9efc801dec82b06ec293edadeebd37ed15f7ccdf9b477f112414344cb8ffbd2d9b63e4fb3530d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636838418, "uuid": "fe1fbde8-4a27-4628-a7ae-cd7d3fa57ce3", "value": "T19F0302BC511948ECEE5A4A7300585B903C964F72B892925F3D57F383CADA0E978439E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636838418, "uuid": "b21ecb60-d0d0-4ee4-aa18-d41392498e43", "value": "768:gcTsC2GU6ozAq64glR/IMYtY4yaSSWBA+iYiAIXbXFYffiZZJgGlzDpbuR1J1:gcv2GhsA3lRaY4yFSWFiYibXFYOLVJur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636838418, "uuid": "e4d1e153-7cee-4c95-86fa-1c4934572813", "value": 40372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636838418, "uuid": "bf144a1a-3c9f-4dcf-ac9e-f10f775a5923", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636838418, "uuid": "bb6ec268-a466-4f99-9c01-13a4298bbf78", "value": "e40c812f19bd6e305b2d9250618f0271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f319f6cd-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831309, "uuid": "78768ad1-9e14-4484-b3ec-ba795d0e9c51", "comment": "Malware payload (RaccoonStealer)", "value": "7ff6899d42790d2fba7bdc369399396e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831309, "uuid": "e5aff2c4-f5dd-4068-a5de-20333f15d065", "comment": "Malware payload (RaccoonStealer)", "value": "0817382b55fa0fb671559dbec5922054113eadeace44511616f035f718013a55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831309, "uuid": "cc0fdf75-b0b3-4f87-8afb-2af584dbc8a2", "comment": "Malware payload (RaccoonStealer)", "value": "ae72ed3e7ee09b4192e453a20f6883d347b2295f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831309, "uuid": "f3e298f7-9895-4f74-97b1-daef5bc03c68", "comment": "Malware payload (RaccoonStealer)", "value": "7ed813c25d9de99c94b024164db591097239b189636b7f7cc42f2d18b2e1fb819f1144ad8b67031ed5044de28c37d464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831309, "uuid": "845a84e2-efe7-402c-90ad-aed3328ea03a", "value": "T1DC648D00B7A0C435F5F756F949B693A8B92E7EA1AB3490CF12D526EE86346D0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831309, "uuid": "78332fc0-79bb-491a-bdac-52ea2ef82601", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831309, "uuid": "dc12d00b-62c0-4902-be25-e174b0b775d1", "value": "3072:js06yd8y01zBl0KBmSbF8d/vIN12etF+Q8yqet2wWZ0GZGo3DvR7LlRT7bkw66XM:jk1UKUdXu2ejD8aPWZ04Go3DJ7P7bRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831309, "uuid": "96db5248-511a-470b-8ed9-e5b7fd2ea47c", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831309, "uuid": "8618ce35-4be7-423f-9924-21ab7bd45f25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831309, "uuid": "86f7aedb-4ea3-44e0-87b7-5aa1743fb6a1", "value": "7ff6899d42790d2fba7bdc369399396e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56b79ad-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831232, "uuid": "ff725c03-b832-48b9-949b-5c08be11aa8a", "comment": "Malware payload (RaccoonStealer)", "value": "1d94ea172014286eeffef82bc3e54b0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831232, "uuid": "0331cad0-6ce0-48d6-9153-73b4fb855a6b", "comment": "Malware payload (RaccoonStealer)", "value": "09a00301556acb4de926b4416267d9de24fe6378b6a9e82132179a87d6e6bdde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831232, "uuid": "ad171a03-40ff-4cbe-98b5-40c250e7323f", "comment": "Malware payload (RaccoonStealer)", "value": "140ceff4a466e7c3cfbeccc51f27f7a0d07456d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831232, "uuid": "5123291e-8215-43c3-b95b-bfca4f1ce93e", "comment": "Malware payload (RaccoonStealer)", "value": "b25a373e7c1bf733cdcf9fee8cb135de73746e7a42e4ff20c09d9f4646d6227639784e2104ef32384856567580714bd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831232, "uuid": "1d4c55ad-fcee-45e1-b0e3-3e9e3ea07aaa", "value": "T1AED4E000A6E1C035F4B216F84A799369B53B7EE1B73594CF23D52AEA4670AE0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831232, "uuid": "357ad4c4-8e9d-4fc5-9529-e09c2bf32c07", "value": "ea99ca467492cc4d133feba5a83ca2ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831232, "uuid": "caac2f7b-aab1-49cb-8672-0754b34f021a", "value": "12288:f4RT9pojkNdtAFRV/bRsnYjTj9hio6IyeTLB/Fajny:f4RuWQVzRyQTZhvfT92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831232, "uuid": "4f849d20-97fb-41d1-bfca-0be53c37a9a0", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831232, "uuid": "a737440a-d060-47c2-8d9d-6d18df4c9ca1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831232, "uuid": "bd5b6dab-a57b-423e-a127-8c2176adb0e9", "value": "1d94ea172014286eeffef82bc3e54b0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3c4b3b-446e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636800159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800159, "uuid": "e374da5d-ca9c-406b-ad38-99b26f54574f", "comment": "Malware payload (Loki)", "value": "c4318a253bdb17851bcbee433dc988c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800159, "uuid": "97a6ca06-b872-4997-a7de-a542d0a6f0e0", "comment": "Malware payload (Loki)", "value": "0acbc590ce3db762b9c014cd006ec2c46aa61d8827b7739c53a204177d032cc8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800159, "uuid": "c08ac137-5451-48ab-855f-2798a783b9c6", "comment": "Malware payload (Loki)", "value": "06099f1de60cf5d770a8e718b6f18984522561ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800159, "uuid": "b8a04099-9f0a-4c3f-be0b-6c6aa0ddcd5d", "comment": "Malware payload (Loki)", "value": "59ea3cc1fe1961c8b9ba4c8e9e7da7e25b009421574a69d5fcd4648d9657385921e4600c73cd429861c3f7eeaabb3810", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800159, "uuid": "a4bdee2c-96e1-49f6-8782-d60264468301", "value": "T1A344022477A49F21C63DEBFB5A699A4003FD98AA2453FE3D5CD2A1D60892FD14340F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800159, "uuid": "8b568eff-4cfa-4e32-8b13-1cf0a7eb36b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800159, "uuid": "df6e9f6b-ee3f-4a0e-b55c-fa4f52ff922c", "value": "6144:H/Kri2GhNOcf/KsoPlPhV14/pdTg6wpXW7cTn6ksT:CW2iNnXKBZT4xK8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636800159, "uuid": "828d211c-2b86-4b10-897a-e1d3f46d70e0", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636800159, "uuid": "5ccfb427-3a11-491a-890f-2df7742b5812", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800159, "uuid": "043fc4fe-98df-4f9d-80db-0237fc3ab476", "value": "c4318a253bdb17851bcbee433dc988c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b698cf-4420-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636766735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636766735, "uuid": "881b6b7e-c600-41b6-89d4-16eb72406da0", "comment": "Malware payload (RedLineStealer)", "value": "a45ccc93d468795b4aa9c2842676b95b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636766735, "uuid": "626a625f-b2cc-4232-a896-8985091bf416", "comment": "Malware payload (RedLineStealer)", "value": "0bd71ea13d68490c12e62e4a4e8b17839cba71bacbe16653656e89c65a945652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636766735, "uuid": "0830d3bd-c071-4d56-8767-ecd0bf07193d", "comment": "Malware payload (RedLineStealer)", "value": "9028ca71b69815c7b1650487b87f2f80def02362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636766735, "uuid": "be1b8311-d109-422e-8d15-5a58ecab94f7", "comment": "Malware payload (RedLineStealer)", "value": "e99a0349961418e22b753f94407c26d42632c46107226a3b924511ce86cf1e5f52f16e6720baf8a56d86591be5dceb8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636766735, "uuid": "d9a29b3c-7a33-4029-91e0-ec6d3c6e0fff", "value": "T1B7749D10B6A1C435F4B216FC497693A8B93F7DA2AB7490CF22D42AED46746E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636766735, "uuid": "06b09bb3-faaa-4310-a37f-e864be61e68d", "value": "ea99ca467492cc4d133feba5a83ca2ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636766735, "uuid": "6d53e9f9-6ec9-4fbc-84df-5404ae7add78", "value": "6144:30O1EE+6BjjNhkYsQu2ZBpN2o4/8UBON:D1E36BjjNhkYsQu2ZBpN5UQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636766735, "uuid": "487a5cc4-d51a-4b17-8c6b-a2340ffcac02", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636766735, "uuid": "26093629-60db-432b-b8e7-5c910e8fff21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636766735, "uuid": "3070dafb-0f39-49aa-80e8-74f3936e2577", "value": "a45ccc93d468795b4aa9c2842676b95b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d7772a-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831285, "uuid": "dca8c582-bbcb-4f25-9a16-586c69a3c19f", "comment": "Malware payload (RaccoonStealer)", "value": "b9da1b2f828e52cae7638c55eb10b0ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831285, "uuid": "82f9addf-bcbe-45aa-8499-9de57c9f076e", "comment": "Malware payload (RaccoonStealer)", "value": "0d694fadcddd12ee2faba5478b69ceb251b9eda82aeb392003526cd4145a28dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831285, "uuid": "3a240fb5-d8b9-4253-9dbf-b2e832e0fd3e", "comment": "Malware payload (RaccoonStealer)", "value": "547a6a38fd051236bdd61eadc4f059b9662be453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831285, "uuid": "89a99cd6-0a68-4d67-b613-8a02dd30e97e", "comment": "Malware payload (RaccoonStealer)", "value": "1283a90f0d1e9cc6536e3200c76d31c711585d76748f21f7645e1f5db414d5aa4a8277b190d49a6a60622860e42d36ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831285, "uuid": "8bdc7978-2b55-4e95-89b4-5a7215c0a664", "value": "T12DC4E100B6A0C035F5F766F9497592A8B43F7DA2A73990CF22C53AEA56346E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831285, "uuid": "b4b539af-3776-4769-be6d-11edb73549f0", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831285, "uuid": "eb4fbe6a-8732-40eb-b74c-cf0c5fbfadb5", "value": "12288:F9WzBdkaUIJsEl1+Fgz0QRTqWcPjVOc7277JGgmJXkzsvmvi6D4:0dsosElsOq1wc72ymd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831285, "uuid": "62263191-428e-446f-8263-5f4734b82dff", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831285, "uuid": "5a32f46c-368d-4dc2-959f-b96e95bf048b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831285, "uuid": "4e9aa7c2-b175-4ad1-b88e-920a85420708", "value": "b9da1b2f828e52cae7638c55eb10b0ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f669d7-44ce-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1636841479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841479, "uuid": "d86ef1e5-18e5-44f2-b0d8-8ffd3d153373", "comment": "Malware payload (AZORult)", "value": "33acc3ea7a7ce24000ab6a34f1a83374", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841479, "uuid": "d95edb2e-3eca-420f-a3ad-e6255d3969ff", "comment": "Malware payload (AZORult)", "value": "0db58143b95364b1c6216bedf0c05a7c0bcc192099d87ebd650b3ae862e2218d", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841479, "uuid": "d7b59fbf-50f9-40fc-adac-1785eb42bd31", "comment": "Malware payload (AZORult)", "value": "110dc2cfb4cfb511ecdff7555e1e416f64a05350", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841479, "uuid": "e3809679-95cf-4b76-88eb-a5d379f92282", "comment": "Malware payload (AZORult)", "value": "62ef195c9bd47428fabc402a2694b14eb47c6708f3d66aaf553ae9173966e5a2e84a5bcef871445c192669ec6a743a21", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841479, "uuid": "acbf6a51-05e1-4df4-a4d9-574b2e834ede", "value": "T127E39D0339D89433D111C1BBE9908E6C36767CD97B76BF8E224C257E5A71240A9A4F3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841479, "uuid": "79f83df6-e484-450a-989c-8e44f1ae0d08", "value": "32205cacfb37cc837c94c7fe5bc17890", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841479, "uuid": "4eaccfb2-3b22-483f-aade-6f4f3a9d3635", "value": "3072:T1qU2YR284Xu7ku6Am3BtLVJZDMLJxrHhz8HdYJQ4R:TV2m4+f6Am1JZgDhqdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636841479, "uuid": "0580349d-825d-4e6a-b693-713a8192d9a4", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636841479, "uuid": "c245ed50-87b9-4710-aa45-810672a02e1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841479, "uuid": "a63275ad-bee5-4414-bc25-07ec3bf32d8c", "value": "0DB58143B95364B1C6216BEDF0C05A7C0BCC192099D87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d887446-44b2-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1636829313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829313, "uuid": "1ad229a9-bd5c-4e60-aa9b-a7fbcc4c0b4f", "comment": "Malware payload (DanaBot)", "value": "e6a1af16ead62df0e7109bbd2e436810", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829313, "uuid": "04a675b3-ca10-4988-a5c8-39c31f3d94db", "comment": "Malware payload (DanaBot)", "value": "0dfa43fcb0e4e7c9c54b9f9dc6f40ffb89cb2511e20a37816c768211e5cf975e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829313, "uuid": "40a07a87-a6fb-4f58-836d-11cd5b81834c", "comment": "Malware payload (DanaBot)", "value": "efc490b66d39438f756151f40f52f96a01954b59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829313, "uuid": "39b3d357-b4d4-448f-a4c0-c2cf3c79a604", "comment": "Malware payload (DanaBot)", "value": "ee3c7ba338fd87c4ee74a46cfcbff916dc5fc121b530f02d4cac8f9aeffe69d5a36f56028d241327eb4835b686ef5b7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829313, "uuid": "a2c695b3-e4e9-4921-9c48-425be32c9e6e", "value": "T134E53385B899C613C9B225701DF0B7246F34F9526C70DF2FF291AECDE87149C8DA528A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829313, "uuid": "11c9a147-5e09-49a3-85df-740086092f18", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829313, "uuid": "60274475-42fe-4140-9ff0-bdf0b899ba3b", "value": "49152:i1ZwiNO14Uj8CC7nLCdFDbMxdDwNJZGFyJ6WLtQL3gEgUiE62l/ZvbwA6HFP4MD4:CZweO14Uo1QFE/wmWrLOWUiM/dGh14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636829313, "uuid": "b0d0cf41-b522-4c8c-ad07-a249395e3c3c", "value": 3216690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636829313, "uuid": "b645e87c-da7a-450e-9936-e3baf6f44003", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829313, "uuid": "3ec83059-2e07-4edb-a8d9-5a7bd0640e8b", "value": "e6a1af16ead62df0e7109bbd2e436810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfff69cb-4424-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636768544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768544, "uuid": "53520be2-1b1e-451a-9fc7-70d1e14522b4", "comment": "Malware payload (RedLineStealer)", "value": "d612f933a765ea9a122d3f66b9f278a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768544, "uuid": "66ba184a-8cab-4074-a4b2-3ce7cd728f64", "comment": "Malware payload (RedLineStealer)", "value": "0e1b327a5e01bd02cad3efd16cfbbec4e22355e9caa702b6f04474fb31e30f88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768544, "uuid": "c2731e39-3c80-4521-9513-64ed2ac923ee", "comment": "Malware payload (RedLineStealer)", "value": "f4537961ffe64c6938a24c42b5592bab286e7e3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768544, "uuid": "cde4326e-3f74-4772-9349-e9174262be38", "comment": "Malware payload (RedLineStealer)", "value": "e6083491fe4eb662c37899b7c674f935ee4cdad59f963d1041dbdb838c48ad4a00aabbd52b557ec0499b991732ba8901", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768544, "uuid": "962238a7-53d9-4381-b48f-ada27ed21306", "value": "T15AD4632BEDD38225FB626936CBEBAA41FB3761D623070BC8D74487C44B01561EF41E69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768544, "uuid": "c73c2b26-9ed0-48e0-8d86-58e3738ae3d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768544, "uuid": "f9c5055c-b70a-49b2-9c20-f7c9ed8afd0b", "value": "12288:Db6Zp/3oCgsOLXnzwcYdQEv43bTYDUrlRiqTxPuWm6:f6ZeCVQXnzwl0pL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636768544, "uuid": "47488ad3-e2a9-4357-be72-b38a681cde81", "value": 646040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636768544, "uuid": "0409dbb5-c99b-4c6d-87f3-6ebcbcb6fde6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768544, "uuid": "ba81d0c3-4047-437d-9573-c7661d345837", "value": "d612f933a765ea9a122d3f66b9f278a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52fc8d8a-4466-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1636796681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796681, "uuid": "725e0ea3-6164-4184-b396-4942252f480a", "comment": "Malware payload (Vjw0rm)", "value": "3de5c2ee8983f583ee714a64289ef262", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796681, "uuid": "5bf1f242-f9f2-4dd4-a759-a87fb72f61da", "comment": "Malware payload (Vjw0rm)", "value": "113e3f792a7ecb4db0c6776c5bcc128022e944a9bb04216887811de502b259e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796681, "uuid": "67336af5-3734-435a-8bf1-186a9b8dcfa9", "comment": "Malware payload (Vjw0rm)", "value": "a99b60617b87f76a75204b2bbc19ed5dcbb5b0e0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796681, "uuid": "16091fbe-502e-4de8-9f1c-dcb552fbcfe9", "comment": "Malware payload (Vjw0rm)", "value": "ba0ab4ee798e1a79d23e116ae34c5a1a2289da37f777c6caaee20d812c11e7f8e1966871e997ce2cd68705e23c4fce5e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796681, "uuid": "e93736a4-cc0d-475e-a2e2-a8a97b99aa82", "value": "T1D5B29FC5FE82B4685B02D43189AFAE6D5FB8E381D455E09F7821EAC09803D4ED51BB0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796681, "uuid": "81a02fe7-0101-41fd-9cce-4f90d17d1ebf", "value": "768:DX2OyOWYsO/qt5ooFL1jpBeeECGRM9FXH/FHdVJVVGSZn6dC:qOyOFgmojj7ffGRM91/FHdXVV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796681, "uuid": "e3cb6c5d-46f7-4e04-9eb1-520faec44cbe", "value": 25174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796681, "uuid": "7bb51350-2f8d-4024-b5a6-7a202a198e30", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796681, "uuid": "ed6ceb18-c000-45fe-b57f-92823748b707", "value": "PAID_INV65218990473.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62ec6b4-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1636831314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831314, "uuid": "ea9972ea-3008-4321-a253-4c81807f755e", "comment": "Malware payload (njrat)", "value": "aee836f94d476c42f3078f1463aa6e80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831314, "uuid": "8672b392-8df5-4621-9deb-75f6a42a6c02", "comment": "Malware payload (njrat)", "value": "1339aec2f0f3c803e549efce6e60bb3e7030b30b3959521554584b454f8b3b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831314, "uuid": "27d32147-54fc-4847-84d7-5a2e6c2ffcbe", "comment": "Malware payload (njrat)", "value": "7d53870bb3386d62020062839622933f7cbb6c1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831314, "uuid": "14bc1047-e098-41c7-8fe7-58c9960f180e", "comment": "Malware payload (njrat)", "value": "1cd6d325de56b87aa48dc11b2e173a6980925b55344e2aee337d66f0c042ff63dc08b0d6907542e6624229277f7b6172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831314, "uuid": "844061a7-b266-4678-bb03-0d90ff04e61b", "value": "T1C674D012B9C14471D5B21A3449F9E670693DBD301F348ACF93943A2E1F705D2AB3ABA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831314, "uuid": "ca2c987c-63ad-4a68-bfe1-e61338f276c3", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831314, "uuid": "222ff4b1-317c-4e9a-a0bb-298bf35da673", "value": "6144:WQ+KaiKX2omqZEIvjzmW6/So0hlgccaRy219Ik8C:CKry2/qZXzmfSRhlgcpTUk8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831314, "uuid": "cd3addb2-8ec8-44a4-93fc-72250f2ef0a2", "value": 369534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831314, "uuid": "c139bd0d-f71f-455e-91e6-783778bf474b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831314, "uuid": "f1893571-6831-4e5a-a6de-77fd5415dc24", "value": "aee836f94d476c42f3078f1463aa6e80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88fecdc-44cc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636840633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636840633, "uuid": "2441d1aa-b038-4944-9468-a6d4cd80b585", "comment": "Malware payload", "value": "f63e1268d0d33af7abee3329cb23e0cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636840633, "uuid": "d3005fad-05d2-4fd2-8bc4-a8b362d3f3ba", "comment": "Malware payload", "value": "17189dac59b8bb01a4d2785d978d9007c8c0f0768aca013ef9abfef0c14fe7ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636840633, "uuid": "712f7950-4c3c-4a34-b245-a1794beed897", "comment": "Malware payload", "value": "008ebacf8c12d8ca177daf0676717b970ada7817", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636840633, "uuid": "bbe00c7a-d8f8-47f3-a3ea-d68c5f9dc4a7", "comment": "Malware payload", "value": "d153d75ffcf5c72d4dba384dc8a79e8c8a90c2fc2c4a6bd37dfddbc8b2364a79494eb9017957d6010107c7d79ca1b1a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636840633, "uuid": "07db1046-d304-44c0-b260-c1672ab60e0e", "value": "T1B9E4320E6A04057BED1CA530C58D2B0466411EBF3A42EFA5BB4A31C3EB373D5586F9B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636840633, "uuid": "6bed11ac-4bb9-4b48-ab8d-d8481436153f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636840633, "uuid": "6d568d4e-a304-4a80-bc98-2c88d75d5449", "value": "6144:63kR7UyLolIpuY+VQbGIZHt4yc4tX5QiU+2vu:60RIfIpyVMGIZFVXClY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636840633, "uuid": "ace2dbc0-087b-4be2-9eea-56053755d7f2", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636840633, "uuid": "c5827d61-ee43-4ab5-9f54-56062e7fe5cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636840633, "uuid": "f86f405a-99bd-4eb0-a88d-a56b702ea053", "value": "f63e1268d0d33af7abee3329cb23e0cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a36a3e-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636831229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831229, "uuid": "28444d48-536c-4822-9fe9-78ac281f1579", "comment": "Malware payload (RedLineStealer)", "value": "5971755052944c36973bcaf20e3f5375", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831229, "uuid": "1a82a778-9986-4c25-8a1c-f7f4efe0288a", "comment": "Malware payload (RedLineStealer)", "value": "17f45d34280590d59f4851d038d3fff4949787721aaa1c0b68d59f5084c6e639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831229, "uuid": "cc2ded99-604f-4c39-890c-bd1439810cdb", "comment": "Malware payload (RedLineStealer)", "value": "f4fd22d95901883b33f3849f11571055c313a996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831229, "uuid": "1660bb8d-3f4a-46db-9849-7a78a2b78503", "comment": "Malware payload (RedLineStealer)", "value": "18e23ff15f9f39f8da7199e2ee86ca806fa1216b18856f8a6224e6331ceb0f718516fbc90acf12c025d7bb53b940c6f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831229, "uuid": "dfc5b027-edc0-4675-9590-89445c9e140a", "value": "T1FA748D00B7A1C035F5B216F849769369A53F7DE2AB6580CF22D42BEE4A746E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831229, "uuid": "70fbc00b-962a-4efd-84fb-e36927020845", "value": "17d363df494bcb38053d0872594e66c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831229, "uuid": "9eda94bb-38fa-4491-9776-91c428adf940", "value": "6144:uaEPABxLqTUm5SlSq7Q2/d27DN/wnMP7:mR4m5SlSq7Q2/d2mnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831229, "uuid": "c3e49f23-7a8f-40fe-8656-6e31d7685cc1", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831229, "uuid": "37186787-8a1e-4618-8090-5b9912a41008", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831229, "uuid": "e89a7cbe-213f-429c-8529-9d5563eebf0a", "value": "5971755052944c36973bcaf20e3f5375.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5dbffd-44c6-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636838059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838059, "uuid": "84196491-47a1-404a-ae04-848d8ce5b61b", "comment": "Malware payload (Mirai)", "value": "1199f4769e0f0f1b162d69b0f21c3d74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838059, "uuid": "a17ede33-eff3-442f-9491-18a4017d7efd", "comment": "Malware payload (Mirai)", "value": "180755b49d984eca861f33f870979641fe78f7d329b3c8ac01329434a7e6cbdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838059, "uuid": "165a9916-3375-49ea-b550-afc3190a91a8", "comment": "Malware payload (Mirai)", "value": "87c70a8b228d2abcbb6d63cc0087395c9468a89f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838059, "uuid": "86678f53-99a4-48c4-80e7-2d366da316b8", "comment": "Malware payload (Mirai)", "value": "009b5fac3b3b1f1c7e728a2f4ea6b31513b7fcd38c03d5f5d33919a62fc4b105f00cf2730840445fea3afc4621ffd446", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636838059, "uuid": "bc776828-55f4-4fee-b510-68b81a7c03f4", "value": "T194F2F1E8E896436BC6FF6EA36D80A3C43A952E01A772CDA31156CF444E3A418171ECD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636838059, "uuid": "a9e71f02-3b3d-4ac7-ad1f-1574977430ad", "value": "768:t+tP+k1v2OjvCwa0BVla9vohJBsqWn8eJ1qtvyYOBZcHf4uVcqgw09U:oYQv2OWd8VYJYHsqWn8Sq9yYSc/4u+qB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636838059, "uuid": "4f9d751f-6689-4c40-9dcd-bf9642ddd78f", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636838059, "uuid": "d4e2a91d-6efd-47e9-80a1-b925303b763d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636838059, "uuid": "16bd336c-48fb-4d20-83b0-2e8700b994a4", "value": "1199f4769e0f0f1b162d69b0f21c3d74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10aa23b-44c6-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636838043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838043, "uuid": "3fd38f1d-885c-4fb0-8ad7-c19d1686e009", "comment": "Malware payload (Mirai)", "value": "e50a4af3b956ac636e2e681d85dda926", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838043, "uuid": "194dd33c-667a-421c-ad1c-8bfc7bf3d6bb", "comment": "Malware payload (Mirai)", "value": "1af70c0218083ae24d68b99a1ad15f15684b4f3a46293e9e2c0252718ebf8551", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838043, "uuid": "873a0267-e7b2-41a5-aab4-b2df0c803237", "comment": "Malware payload (Mirai)", "value": "86d8faa442e6d824d8d5d3f119645500fc50cd0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838043, "uuid": "db8c4f80-6be2-46e1-ad95-f66d9582be1d", "comment": "Malware payload (Mirai)", "value": "44c92bcd88c51ebfd935128449e20b7e482c001e2c074b8985200018374805bd260e038aaaea1bf7ea8f40831b850e5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636838043, "uuid": "e10b0648-cafc-4edc-962e-a40b7dc2162b", "value": "T17F03F18E599ADA87C79EDC3E019E136DCC58BACF37988DAC83108580591BF6E7883015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636838043, "uuid": "a9527391-5463-431c-a8cf-ed243ac9dcdb", "value": "768:D4SaA80upnzVW7sdYS4FolXO28Rwlq6McFxsWW5:D4SaA80upnzYsWSwol+28Qq6MBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636838043, "uuid": "5d7bea0b-8f03-47e4-82e2-a1195f19ac83", "value": 40708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636838043, "uuid": "34fba124-9c7a-48ad-b19a-54650bc142bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636838043, "uuid": "b6a5c2c9-0922-481e-a209-40a63aa6d4b0", "value": "e50a4af3b956ac636e2e681d85dda926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1244c02b-4424-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636768225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768225, "uuid": "a17f73a1-352c-4487-8d0d-0316b635f620", "comment": "Malware payload (RedLineStealer)", "value": "78e819ad6c49eda41528fc97519d47d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768225, "uuid": "6fb53a9a-1c12-431d-9f1a-c80bb9dbe473", "comment": "Malware payload (RedLineStealer)", "value": "1b0daf8b1b8a09ae26a72e30fa638b000a991a7dfaf7c9297bec5c7f9d277574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768225, "uuid": "3b3a0d70-42b1-4398-9a02-c2273bc392ea", "comment": "Malware payload (RedLineStealer)", "value": "1335fbb4d4d36e0d67ea715b883bb0e3324cf3fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768225, "uuid": "cf0620c7-a745-4c10-9fd9-d0322ae3806a", "comment": "Malware payload (RedLineStealer)", "value": "f152fc6c7c21274b2361cc76a0da93845d84808d6bf017be82efc09ef3762da35b3571bb5325e99fdc7ca7717f58435c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768225, "uuid": "94e00a5a-b498-40d1-b7a0-18f8b4435d6b", "value": "T1DBA46C00F28098B1FC77057588AB9871A23AFC6503648AEF235DB65D5E733D2693AF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768225, "uuid": "1ff4cc1e-1849-40b7-9ba0-6829404c44fb", "value": "d34cb7f3f974e9c89037b663aaa0d6a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768225, "uuid": "84b21155-7a91-4074-b397-31ba3651be12", "value": "12288:q/e1wdUO7kuvxJsgPoxntMRWru3Yo6T9XPp:qdd0gPoxntMQru3YLRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636768225, "uuid": "73cf27fa-200a-46d8-8fbd-f08d748593f1", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636768225, "uuid": "9fd415eb-d35c-4fe6-8333-8b2e153bad91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768225, "uuid": "539c2af6-430e-4e4d-bdec-f1d0883b00fd", "value": "1B0DAF8B1B8A09AE26A72E30FA638B000A991A7DFAF7C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fca0cf9-4455-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636789266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789266, "uuid": "8ebb188b-7d35-4900-8c95-54987991927f", "comment": "Malware payload (SnakeKeylogger)", "value": "011c69d8f6ac2df5974985f6dc3ff206", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789266, "uuid": "58e1e0ac-c4cb-45af-819c-e6b154024843", "comment": "Malware payload (SnakeKeylogger)", "value": "1b2bd6e81ecdb88693ebd72c1d1276f842a4225501531a76eae8b0019921cba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789266, "uuid": "6fa121b0-1097-4b7b-a8c8-74b5c9bac871", "comment": "Malware payload (SnakeKeylogger)", "value": "906f365c4835a185d37007b931cf0ed3842bfb47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789266, "uuid": "c1cfc8cc-41b2-462a-82d8-a39b3e80546a", "comment": "Malware payload (SnakeKeylogger)", "value": "9509a5256e8a167055288d687d77d6b0ed18de2af46482c6ae6d4d37ce863cee387f14620574b0c3c303991d8a54243a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789266, "uuid": "cecd4a4a-83a6-437f-bce8-7a590183f5c8", "value": "T10B84010CF1906FA7C36A5E7E54D3B10187F43E4AB963DA472EE2B6B9613AB420111F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789266, "uuid": "a676e5c1-9c13-449d-9e18-51c339b6ebfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789266, "uuid": "c5a66dae-5e76-464b-ab62-27bed7b2afd0", "value": "6144:nmfJ7T2GhN8TWBH8numrWLE06AUeu4ouix2D/cKECjo4ZD32/s:mBT2iNdBH+uFt6ui6/cKETU3Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636789266, "uuid": "e020fd6e-0919-484c-8f29-e5d71fd3bb0b", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636789266, "uuid": "ac5257ef-fb5a-44fa-bef2-09d7cf6e1fe0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789266, "uuid": "206e237e-9de9-4288-8437-ea07dc7e98d2", "value": "Request_0001_0107206PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d381d2f7-4486-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636810640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810640, "uuid": "8596ba08-f385-458b-ae8d-b6c3f2b50ebf", "comment": "Malware payload (NanoCore)", "value": "02ce207aeb61c6871428efd8a263cee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810640, "uuid": "cb466468-7444-4063-9a6e-bb0714f5007f", "comment": "Malware payload (NanoCore)", "value": "1b2f9383e48ac98a9e79e2ab36f6f12ec3d8bc3bfc0cb21ef949d32491066484", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810640, "uuid": "2654ad5b-bf20-45b6-87b0-99c75b30c8ba", "comment": "Malware payload (NanoCore)", "value": "0ad034fa2a66fc408af4cc24d623402bd1c399df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810640, "uuid": "cd66a575-d148-43c5-80f3-40078b30b3a8", "comment": "Malware payload (NanoCore)", "value": "9c9a76e89deb378415bd229a49048fc4fe8876de91e99ac2accdeafedc5290f4fc1e69ee1a2403c5300aa0b6d6a5c21b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810640, "uuid": "f61ea58e-d48c-4fd2-bf41-2898c93c9247", "value": "T146A4122970A75D11CB3E4DBA1D43000043F06A6BB916EB6B2ED563FD25EEF560342BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810640, "uuid": "609630bf-0711-463c-baa5-e1e3a290d1fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810640, "uuid": "b439f076-d013-46a9-ba07-2ce174165bfb", "value": "12288:A22iNrHFVn4+z8tIUJMbXSTJt1h3Oi9pou4Sr:A21F3naPs01NOi94u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636810640, "uuid": "db11ef88-1c5e-43f6-b72f-1fd810bd090f", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636810640, "uuid": "e4659345-00be-4036-867f-4b5b04ed2001", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810640, "uuid": "d21a0927-ee90-46a1-9848-dec9627b73cf", "value": "SOUNDBITS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4e27c1-44cb-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1636839992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636839992, "uuid": "5fd3d001-f581-4b44-8733-2618ac11ccb6", "comment": "Malware payload (Pony)", "value": "1133fea54acfdcaa0234c6f0c7e5fc10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636839992, "uuid": "09b1f245-3bc1-46d2-aecc-44fb20f4c11f", "comment": "Malware payload (Pony)", "value": "1bb237693b65a079d222911862863cee9b17879ff4874a6f36ac30413ad748f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636839992, "uuid": "ba4c2128-b198-4ca7-8c67-3ff2a83e0bfc", "comment": "Malware payload (Pony)", "value": "0a7735f12dccbe62a79ceca470d8b09b0dcda681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636839992, "uuid": "125154f6-f8f6-449b-acf5-c7196ecc205b", "comment": "Malware payload (Pony)", "value": "5c124f1a1bd91c685a77f279402f1e79d81c895637dceafa19e37ae3da4adfe3754f46fa62b688ff8b9d80aab99ae13a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636839992, "uuid": "d9ef0bd1-0f00-41f0-9ae2-bb9bf951f8ba", "value": "T11F930903FA80E0F1C0A22A7137C15761E7FD9E797C3A8D4AEF9C49856DB22877B16152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636839992, "uuid": "1ddc5541-3994-4b09-93b0-e7ad8ec09c61", "value": "09070e021d4505e6183701ac6e022a16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636839992, "uuid": "1fc70e1c-f9b5-4063-b2e6-989a39d56874", "value": "1536:UnSncgyGqTDRXmGcwSCfZDalZNg9tvo0iO3AX4ApTvMEIikzmt2l:2SnMuGc/CfZDap6COU45EI6tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636839992, "uuid": "7ad2f6e9-42ef-4bce-b6a4-717e1bed12a0", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636839992, "uuid": "e5fa2150-b4f8-4f8e-b2b9-6e5d403d7f98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636839992, "uuid": "89c5a964-15ea-4b05-9164-abc607061227", "value": "1BB237693B65A079D222911862863CEE9B17879FF4874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19088c7-4423-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636768144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768144, "uuid": "4e7f825d-0ae8-4351-b362-99c737485c02", "comment": "Malware payload (RedLineStealer)", "value": "4c6c3005cca19a8f340e00927fef994b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768144, "uuid": "7196629e-1eba-4c4f-bb63-c44ef98b9d5e", "comment": "Malware payload (RedLineStealer)", "value": "1bd828797937b0a573cbba02d61eb01e2120f51a6f47e701a4c1e6ab2a5399f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768144, "uuid": "6c4d2596-9722-4fb8-a203-7b5d05a229f3", "comment": "Malware payload (RedLineStealer)", "value": "8261bf75af3cfd04aeb6b1de85567afa0fe6fb3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768144, "uuid": "59e1829c-1d51-4b36-a474-e86ae1e6ea97", "comment": "Malware payload (RedLineStealer)", "value": "ce2b02e7e971a217bf2d474bffa62adfcf136ea639c426878c44f46cf2e0afdbd7cfaccefd57f4b99260e8a07cea50dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768144, "uuid": "3580c3fb-1252-47a1-96d6-708fac1e5f45", "value": "T182653369E284AF3FF38F82B976997F49C9D27076E9D40437C0E981861B78062E931D35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768144, "uuid": "9f145c5b-ba2d-458b-b839-ba31868d965d", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768144, "uuid": "52f8cde7-527a-45f9-adec-abd9bf8d010f", "value": "24576:A6xeHXq67c8FlO15iNxLGf/m10GgbkWcDmi4hiFrcByn8CQkEaHNYK3yp+8hI+16:Acoq67XFaIN5G6jNUyiNaEpu+1rW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636768144, "uuid": "32c969e9-d1ac-47e5-827b-63239dd10cc6", "value": 1473024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636768144, "uuid": "144cf14e-1044-4cee-b2fb-3f79ada29e5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768144, "uuid": "507c7189-a869-4c46-8e65-813f19eab5d0", "value": "4c6c3005cca19a8f340e00927fef994b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4963915-4486-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1636810642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810642, "uuid": "00e7bf6f-e735-49f5-a4e6-c0ba55fcf7eb", "comment": "Malware payload (STRRAT)", "value": "a82ff13574e93ee1696f0ef0ce2063dd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810642, "uuid": "2a7ff703-20d6-446d-a396-c4df48dfb602", "comment": "Malware payload (STRRAT)", "value": "1d2e66ba064b8111fb08c2163344fa9d6452608c149d56b7f0dae055fe6057b9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810642, "uuid": "9d389d9c-228d-4361-904f-6860eb31cfee", "comment": "Malware payload (STRRAT)", "value": "af1aa8d4dff91969dd0979374265c2227c0b7058", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810642, "uuid": "d4beed9b-8d86-48b3-8676-8e0462391303", "comment": "Malware payload (STRRAT)", "value": "361bfdf78d7bc11b14301c6556df4afbf214fba041efdd5ec423d1651cbf9b27fcc7911885bb7683eeb5a3088e3128a1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810642, "uuid": "27be6ccb-b9e0-4b26-b80f-b21bb24019e2", "value": "T101C31284125C9CAFCB7CBA3DE43B0665A79BE990DE13E422C5C71ACC5C69BDB6136041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810642, "uuid": "4bfcfda0-b154-4d25-add1-44609d846ebe", "value": "3072:WsEuZT6jlq6Q+eGTOiPsgJxJwslEgsLEAiNUrx/VozRQB:WsslqshfPrkqEgGEAq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636810642, "uuid": "accd74a2-68db-4c82-8837-a2f4840c6582", "value": 122901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636810642, "uuid": "f7b302eb-27bd-4156-b0f7-9b170d38fb90", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810642, "uuid": "755d9f25-7205-46ab-b1e6-a6220cd1c5f1", "value": "Fedexamazonreceipt.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef70966e-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636831303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831303, "uuid": "74d1d905-4e04-4b2a-9d33-0b120ff642c5", "comment": "Malware payload (RedLineStealer)", "value": "cc7590ad77db99aa8516ce847b0743c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831303, "uuid": "bc1f27a4-a3e4-4e9c-9457-58583eedb478", "comment": "Malware payload (RedLineStealer)", "value": "1e18bdbb00ab59d4e8692f898a0d05f4aceece07ec6a457b8705b795b732e6e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831303, "uuid": "4c8b7998-b019-4f9c-a338-8cb5fb5a8ba5", "comment": "Malware payload (RedLineStealer)", "value": "4972e788348c15be6f228b2104d9927586cfa840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831303, "uuid": "cf79b032-c17f-42da-86fd-f8db5fda5644", "comment": "Malware payload (RedLineStealer)", "value": "25bb26f54a4510cb419cea0267859531d443b8e5439374f23766884cbcfd5251513b866f766833c83e7aa924402b7d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831303, "uuid": "2e32eb96-a073-4164-9cd3-51f883fab3b7", "value": "T1E974E2232FC9F718B1722D3393EB295587A67AD1AA71C8CF2F0C9B0A15319016D73769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831303, "uuid": "f6a2effb-d056-4fb5-9474-2058047b3e2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831303, "uuid": "a67fa20a-c347-4fe1-8fde-521e33f87e04", "value": "6144:ghe2rsEGL0lltWSW5qoFMR/tZvS7q7/IoisKvOrneGFP4RRRwe2:ghe2N85qoKR/tuq7/RKvitwp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831303, "uuid": "4560e69f-22d7-4161-8fc8-4978cf3b7f46", "value": 350616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831303, "uuid": "e26f68c5-27ec-4f40-8555-ee5ff54819d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831303, "uuid": "0886e4f5-99e5-4768-b05f-3bc932c530f5", "value": "MultiHack_GenshinImpact.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b37a38-44ae-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636827721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827721, "uuid": "cc06c8c9-f230-4f94-a250-c7f8b0d20225", "comment": "Malware payload (RedLineStealer)", "value": "71df7c31b5caa8df5b9e7725852afeff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827721, "uuid": "f0bd34eb-054e-47f9-879b-97ea0ebabfe5", "comment": "Malware payload (RedLineStealer)", "value": "1fb1982ea5a8d329048f3ff1ac72b2050db15c8eed5e971dc9f54d1187221105", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827721, "uuid": "a9d5d04a-5ca1-4a27-b20b-19c96c9ce060", "comment": "Malware payload (RedLineStealer)", "value": "b08121a808675c73ef8582d2a185aa5c29287c4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827721, "uuid": "ad9c6484-9ed5-4e33-833a-93e2770e3a13", "comment": "Malware payload (RedLineStealer)", "value": "edf5b47befe20d13b6f2d92317fac88a56b1f700825f949dce2769f4728bb2b0f65e5242fe004905a05045ff476f2f2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827721, "uuid": "2dcebd3b-26ab-4693-9005-8367a78fec19", "value": "T18CC40E1865C6FE90CA6825BB87F395048F5200D342634FFB57BE8AC0BA45D31EEE9395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827721, "uuid": "5d8fef1b-e5f0-4eb9-826f-53f45e268a6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827721, "uuid": "81bfe482-f259-4290-bb9c-655847f9c7e7", "value": "6144:u8l4BOI28Mw4uv0Jt/87pON8xN+KExMusQ8td1sdq4gp9:vOuw4ucJtEMN8v+KExMNtd6dWp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636827721, "uuid": "78d869d3-d790-4a65-a1ef-c1210c7a5594", "value": 588184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636827721, "uuid": "8df90cb6-1a8f-40ef-8069-2d21956844f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827721, "uuid": "71887b83-dd33-45db-8aa9-198e2033720b", "value": "Genshin Impact Hack Global.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f42e452-44ce-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636841449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841449, "uuid": "e42b2e8d-31b1-4c5c-8c6b-1643104577c6", "comment": "Malware payload", "value": "aea6ed7b9aa802d2c188fc66cb7f70ea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841449, "uuid": "3b1d1358-b541-49c6-bed7-c5ed60007a46", "comment": "Malware payload", "value": "2196fe2f79495368d26102d5d54a771316455fa4917c6edd12488059662cdb8b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841449, "uuid": "ca27709e-fde9-4d58-bc40-35e72b1e5bb9", "comment": "Malware payload", "value": "d74063bc65fcb9c1bbb838b12dae1776d1b57878", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841449, "uuid": "1d998b9e-fe8b-4fdf-905a-fcb694d492a3", "comment": "Malware payload", "value": "acafdab3318a573eddbfbd489c2c424c38d72e86ac11529e66abcefc5cf12b001cf5a31470e6ebf64cc8f553f0811a82", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841449, "uuid": "59545f23-b9de-4293-8e13-188ff73a8592", "value": "T18E4210889FED14A2D51D6015496E51CC8C2DCD331B19ECE6BD79C9A838D82BE43BC73A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841449, "uuid": "59984c90-13c4-488b-b72b-51e66277d928", "value": "192:VItoiXonfIs9i9zxcZfVETJaETJ3ETJPETJnOstwlnOjnfIanfIkr:VIuvLwzD9qnOb5vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636841449, "uuid": "2b788415-fe4b-439d-af05-e977af4c867a", "value": 12541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636841449, "uuid": "bf356858-092f-4642-9e42-24c112d025f7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841449, "uuid": "e3a8a5a1-4004-43f9-befd-38d3e89fee2c", "value": "20170110_9330ee612a9027120543d6cd601cda83.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72835b5-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831262, "uuid": "7534bdc7-b3cf-4f75-aaf1-8fcb7fee367b", "comment": "Malware payload (RaccoonStealer)", "value": "bb809bf0204e43a6f3dc84c00ad07ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831262, "uuid": "02bafc91-e7cb-48a6-8a81-00f660539432", "comment": "Malware payload (RaccoonStealer)", "value": "21b63b7388447bb43eb1824063119b558b59cf93ef07e5071ba2d213794ca28a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831262, "uuid": "66fdb43d-d2bb-4d3d-bf65-81ee2ff5cf69", "comment": "Malware payload (RaccoonStealer)", "value": "97dbfe9021baa8022ebbe74f22e742c0a4d5dd4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831262, "uuid": "059bec15-53fb-43d5-aab7-5e6570752531", "comment": "Malware payload (RaccoonStealer)", "value": "8f7e2a50bc5af6863ad5e1650dbed3df06b95ca6051b5838ede47ea60638f8f606e8c7e09b1cb78c1bcfec4061d9033c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831262, "uuid": "bb1e925f-1ed5-47f3-8dda-7a3cfdbbd6af", "value": "T103C4D010B6B0C034F5B266F849B992A8B53F7ED1AB3594CF62C536EA56346E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831262, "uuid": "e7d181a6-a2b1-45ba-9c60-5bf357aa1f65", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831262, "uuid": "a92903e2-000b-4f5e-8075-96d2e86900a8", "value": "12288:eawQ5qTKheX+qWClIr5CbzKTdv4QHEJ2qj0wTm3mpb0:aNOjr4bzKT54S42Ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831262, "uuid": "d605c1ac-2d54-4b09-b9cf-b9d57033fc00", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831262, "uuid": "160630c5-4d51-40e0-ad66-4f86389987a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831262, "uuid": "7052b94e-4c6d-4378-aca3-ae30c4ecf059", "value": "bb809bf0204e43a6f3dc84c00ad07ee3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6edc4d7-4454-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1636789171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789171, "uuid": "48eca00c-de43-4ab0-b23b-85576baf16af", "comment": "Malware payload (Socelars)", "value": "a32775be778fe3e5340fb381b6c519ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789171, "uuid": "e3eac252-fd81-4e65-a60f-2948037fb6ba", "comment": "Malware payload (Socelars)", "value": "21c4934021ee6e69acc5124679eb780c37f18daff6be06464f9a1ea2396f0baa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789171, "uuid": "6443f5d4-c83f-467d-aafc-97e48eb6c29c", "comment": "Malware payload (Socelars)", "value": "77b35a4422362dc3fd1b95866b92a9397f093103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789171, "uuid": "53008161-8a71-414a-9242-5fca4a380d92", "comment": "Malware payload (Socelars)", "value": "f8555c7ebacc147203c1079cd2fde4b8570177dc8c962d67b9f804dddd6e71ac1bcfca73a15db3d154f73263ca66abf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789171, "uuid": "26e4731e-b7e6-4edb-8ccf-f0e7bbfd8c27", "value": "T10F65AF11E642A036ECE3007286FF4AFE9D2CB621070854D7E3C45DAA5F619F37A36A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789171, "uuid": "308892c3-225a-4909-be16-6d836f9f833f", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789171, "uuid": "20f336fd-613f-4e35-b057-50ea4ee97588", "value": "24576:I4XpVcF5a7U1fPzCtylzeM8W/SFAU2xb7kox8znSOkr5aY2a:vpkf1DXNl9uznSOkr5p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636789171, "uuid": "72791bd4-18f6-4c05-b2b8-8fe4607d3938", "value": 1491456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636789171, "uuid": "51f7e3db-884f-4194-a527-3b4f14f8a3d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789171, "uuid": "9968e2b5-33fc-4612-959d-620b43a08843", "value": "a32775be778fe3e5340fb381b6c519ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf625107-44bb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636833370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833370, "uuid": "55f3ba9d-319e-43c8-9597-6e829d0b210b", "comment": "Malware payload", "value": "5668e9870ac2e476a6f59b83967ceabd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833370, "uuid": "82de9a26-b95c-4d4e-8b50-3149e8b3cdc9", "comment": "Malware payload", "value": "222a154defdcefa2d227551fc8216bb1849676704cd99db1a743a4611f58718c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833370, "uuid": "94e21aa5-f3ac-4163-8e42-de56a8dc22b3", "comment": "Malware payload", "value": "2f26954dbe0c7f3c8fcf2d2c74df67d6d43390fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833370, "uuid": "59b45d5c-8234-42dc-a9f0-e28b76a67b96", "comment": "Malware payload", "value": "d3a976d6823bcccd4719057255d7068841dd4b814bbc3995ea5d8e59d9cf581e8d9961f05450072bc2b58ddaadad4674", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833370, "uuid": "50711783-fe77-468b-af98-df8086ef8ae3", "value": "T1C606E09C762071EFC857D4729EA86CA8EA5038BB471F8603942715EDDE1D88BDF244F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833370, "uuid": "7d08474d-7cc6-4797-9a5d-717a580ff6a7", "value": "98304:SqkSJqf/x9k48lauQMOeT7x5Ag+/PxXZv:xqHxSLwFMOeT7Twx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833370, "uuid": "fb97413c-816d-48d3-bd11-f09eee671f2b", "value": 4004352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833370, "uuid": "d07f856d-7e92-420e-885d-7653e1149d9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833370, "uuid": "5786e47f-da5e-4b8d-a00a-52d11f7ec1d3", "value": "antiban.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d390018-446b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636798711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798711, "uuid": "e4e0ecd4-15d6-4d3b-a23c-cd845deb87d1", "comment": "Malware payload (Gafgyt)", "value": "cd03fc0599a406201d0fe12d3256371a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798711, "uuid": "62e8aa43-d951-4f3c-86fa-ee54b2183f40", "comment": "Malware payload (Gafgyt)", "value": "22940e1f954d5be783120d5689050aa7e30c0c4d5ae91d7c46c81cd25cfaffe4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798711, "uuid": "0b07bffa-db67-4fc7-8fc1-8a92353e894d", "comment": "Malware payload (Gafgyt)", "value": "88352ed792c4858018d725f29ca1a58c0710a9e9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798711, "uuid": "3499eb84-4a4d-4306-8f4f-99d6894d2362", "comment": "Malware payload (Gafgyt)", "value": "f4fd8ffc657cc3c1ee749d42a6066bc697378686f8dbfa9479c301c904694226f8c1e77d8b8a79ee2368f0686a720135", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798711, "uuid": "b287a7e1-231a-4595-9dfa-7e01b17ce194", "value": "T148C33D27B2E2C9F5C483A6B426DF66A1D423F47D0B72321B73946E702B598CA1D1AF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798711, "uuid": "a5b6a483-5f7a-4591-bfc2-aadd5be1a586", "value": "3072:P8k7cDIa2v47j2FRI6mGhGIrphaJ0PHMmZUVOX5tUZoRq:OGv47STI6HXphaJ/mZUVOX5tUZoRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636798711, "uuid": "45afad8b-fdda-4b2c-bbea-84aa1889fc01", "value": 119794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636798711, "uuid": "e9497771-b3df-4b36-b394-97575ce953fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798711, "uuid": "0a39d4dd-ef5b-4d18-a3d8-f4478af6d6b2", "value": "cd03fc0599a406201d0fe12d3256371a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f403a15e-446a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636798669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798669, "uuid": "75e334e7-4d24-496e-a7e6-1205c4961fae", "comment": "Malware payload (Gafgyt)", "value": "e971c9fbce03517a60e527e9b62faab5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798669, "uuid": "24e81bf3-bf31-426d-a268-c71e72cb2019", "comment": "Malware payload (Gafgyt)", "value": "22dbbe5d053f521ad1cbdb029e5237c55e071c1819d9e100818b0ffd27ec247d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798669, "uuid": "018d2d4b-dcfc-44f2-a045-316674aed2aa", "comment": "Malware payload (Gafgyt)", "value": "537b0b687920faf455aed67220e2fb898ba76514", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798669, "uuid": "c84d80ee-3024-43b7-9122-c36184e9919a", "comment": "Malware payload (Gafgyt)", "value": "593d575a7ad1d7957bbf67f89ab4b7871a52d274c781a60779092a44882dd35be2c5ea6d0d8861ac4feb62e63f0441ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798669, "uuid": "096e9434-d97b-4a01-8454-f8186c313127", "value": "T11CE31A05F4549767C2D217BAB68F424D73225BE493CB33219934EEB82FC1B9D1E3A960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798669, "uuid": "2d040143-53e0-4f4e-9923-eaaa20c7cbfd", "value": "3072:/bRdBuVtva6F/udJfWFfGes5hXs/f04EiSAxmoQOYJxXTEb:jT8Vtva6F/XGes5hXs/FxmoQOYJlTEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636798669, "uuid": "6793f329-eb2f-4f80-9697-00a048d8eec0", "value": 145930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636798669, "uuid": "238dc91f-521b-45e4-9bae-217aa2616374", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798669, "uuid": "801dd301-934a-4d5e-b91f-9a32894c20e4", "value": "e971c9fbce03517a60e527e9b62faab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393da4d2-44bd-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636834004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636834004, "uuid": "50af6ac5-b1da-4594-a63b-f4bac24ebdc5", "comment": "Malware payload (RedLineStealer)", "value": "6c4ae2a1e73208c47cc38f154e0734ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636834004, "uuid": "017afa6f-fd0b-494a-95c7-c819afe183de", "comment": "Malware payload (RedLineStealer)", "value": "23f66190a2c59e4ab6da005de3097ba5b9275424f6bccabdca86d51746436575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636834004, "uuid": "0fabb170-6bf6-47a3-9b36-68ef9caacfd1", "comment": "Malware payload (RedLineStealer)", "value": "4997dc7471a725a28677711c9c7a50eed98e7a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636834004, "uuid": "a492c653-d13a-4047-95ed-ea0ba2d78986", "comment": "Malware payload (RedLineStealer)", "value": "d1d3cb879377fc21bdba700cbbe56075d1c97f3263a74b343e96bf1cea1f4fd5cfa226f276e41e297f8ba01ccb5ee607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636834004, "uuid": "44584296-5b79-4439-a0df-1d80c0ef1ff8", "value": "T19C1633D6D14D1B1FDF975DB807384AD5DD92D4386CE8E24F3F288448CC29AA2A3644EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636834004, "uuid": "993baa61-63f4-4114-a118-a237da2dec5a", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636834004, "uuid": "2f691f7c-6582-4c69-97b7-90637559c945", "value": "98304:YFjzMU2qrpkzyIqu00a00XmdfI9NXQvbcjitZ3nEUlA7ju:YiU22pkYR3+KQvbcj43n5Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636834004, "uuid": "143948c3-0316-45dc-a44c-068f8d4394a8", "value": 4400640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636834004, "uuid": "27a36803-9bf5-4889-a83a-ccf06401a9a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636834004, "uuid": "1db85448-e145-4dce-99ed-cd4bdc29274a", "value": "AIM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71658385-44ac-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1636826796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826796, "uuid": "48f04c83-5873-49b1-87e3-700355377c63", "comment": "Malware payload (CoinMiner)", "value": "f1fe542f12c122031621140b0d11367c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826796, "uuid": "8e0a39ec-8bfc-4323-b30a-09eca5b72d99", "comment": "Malware payload (CoinMiner)", "value": "243f09f57979c04e8820101edebe6fc720a67e97d3a7e1bcd5c87c131bf78f18", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826796, "uuid": "fe200426-45a9-4a32-8a2d-713aaa006ea4", "comment": "Malware payload (CoinMiner)", "value": "b7d37a787a26c4b06e149e94ef85462d5b11f1c1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826796, "uuid": "990ed52e-76f7-4bb7-9c6d-54c31022eff3", "comment": "Malware payload (CoinMiner)", "value": "680b05f8c449fdbc7fc98e896a37e3f072418e69a2c3aa17f197f19446dc1b7b428289c2e84e4fb24b8429695b31430a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826796, "uuid": "55297af3-fa02-4d87-b9ab-28ef46d117f9", "value": "T10036233326290085E1E4C83AD527FEE432F30F6A5B42AC3D60E7BED536B1990E553A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826796, "uuid": "a88cfdcf-990a-413c-9326-e05df3bdb5b1", "value": "9ebcd018a747182c37aabf2ab1139666", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826796, "uuid": "94cfe027-ce48-48bc-a4c0-2a34d1460608", "value": "98304:hwvgwokGxAAGeIwSjTbcwG/14qfjqqUBoXtin5YWpnplpYWm2+xX/:TQGxAjTbc1d4vxBf5jnpPYWv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636826796, "uuid": "87622521-f463-426c-9fb7-f198d71c79ee", "value": 5057536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636826796, "uuid": "a805c171-92ba-4122-8028-b7f169448735", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826796, "uuid": "1bf6f6d8-92ef-446b-9370-47f690de5247", "value": "Utility.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ea3625-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831253, "uuid": "6c9e358b-83af-4ed4-ab07-d19a9c5df7d9", "comment": "Malware payload (RaccoonStealer)", "value": "c755df74371deed1af6438335fb9477d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831253, "uuid": "16cdcab2-7102-4d27-a37b-17f8f49137f4", "comment": "Malware payload (RaccoonStealer)", "value": "25ddb8f090baba92c6dc7d59a2af59af17e5e945f4a5891c186f2fae58301aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831253, "uuid": "79b7448e-588f-4ead-8a33-08777850f8c6", "comment": "Malware payload (RaccoonStealer)", "value": "ef8adac6439e63f9c4679afe7ffabda7a2adca57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831253, "uuid": "07ce8cfc-f194-432f-bd2a-5f730d74d613", "comment": "Malware payload (RaccoonStealer)", "value": "4ea692d1384eb016a34e688eec4be862db204959bc59d6609b9a858ce16f7839980cede29aac2a43680696340bbf7e15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831253, "uuid": "40113008-4a46-4a4a-926c-caab22140396", "value": "T116749D10B6A0C035F5B216F849769369B53F7DE1AB7890CF22D42AEE4A756E0EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831253, "uuid": "45fa3874-3470-424b-bfd5-f3ac99cf3511", "value": "17d363df494bcb38053d0872594e66c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831253, "uuid": "f7d998a4-c271-4620-894f-7dcc5309749c", "value": "6144:lAEcV2J1ipFrxjsPDcglUUJQe34ucQU/oBf+:nAIyFrVsPDcglUUJQe34uhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831253, "uuid": "66d69200-9bf7-4a90-997f-4bc4760b15a5", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831253, "uuid": "a7760e51-69dd-4a26-9577-3fea6b636834", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831253, "uuid": "5a4b5ce5-fd7e-41bc-9a44-af13426f302e", "value": "c755df74371deed1af6438335fb9477d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a8c414-4466-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636796665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796665, "uuid": "8ff6bec3-0509-41a4-999e-01cea21b1163", "comment": "Malware payload (Loki)", "value": "bdda5d16da6a71154c1fddc07a3a8471", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796665, "uuid": "a722cb36-5115-4f48-82dd-65b320b472d0", "comment": "Malware payload (Loki)", "value": "26eac4b61ee19be82debaf5aa6a9380eae4aa0ee77efc80b6299ec6873292672", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796665, "uuid": "2a72a399-2dcf-4136-b598-ae79ae6b0e61", "comment": "Malware payload (Loki)", "value": "c36de0053524ded67ec58583cc344d30a615aa0c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796665, "uuid": "98057211-5e33-4786-ae3c-7851781437f0", "comment": "Malware payload (Loki)", "value": "0c88ffea3020084a04d7d78a02508595fe8b05ead340d361ddd72f22d281906cf2e938bc2a69e55894229b96e7c6071d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796665, "uuid": "e4f503b3-958c-4226-84b7-bf329212fd29", "value": "T170840208B2D05E25D77ADFB6085310018FB4A76A7E5AEB6F2DD966F8112EF900340F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796665, "uuid": "125313dc-b251-4b1a-a25f-070d4d4e1a95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796665, "uuid": "f8fd793e-ef69-4656-a37e-6534f49b3b22", "value": "6144:Nj2c62GhNPTQx65T4VfQBugrQbHiAcbxTy+7PGRlECjlRnlzM4fCbl/HWImqxxqA:Mc62iNMx5+uAQ2y7ECjlPzM4fKUqxxq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796665, "uuid": "d95a7192-3fb3-4638-b778-5b48dda30174", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796665, "uuid": "1ed2ad53-1013-4a3d-96b0-666bdd014e7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796665, "uuid": "6143ea22-abc0-49c4-903d-183dbeed5b61", "value": "DHL Delivery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac44f36c-44af-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636828184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636828184, "uuid": "3954a966-d625-4ffd-a3de-16ef769fba42", "comment": "Malware payload (RedLineStealer)", "value": "fa60b1266338a7801ede1f0f9ed8274e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636828184, "uuid": "d14d578a-c3cf-4577-9aa5-369f036d0b6e", "comment": "Malware payload (RedLineStealer)", "value": "28ae75452f06cfa45dc41a0329aeff5630f92189188523cd6d663b98a4fbccc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636828184, "uuid": "c6bfa373-d472-464b-86fb-234ae583069e", "comment": "Malware payload (RedLineStealer)", "value": "70a939e5f3344e6265137cb7e3c4e65a0f577144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636828184, "uuid": "bf7a7f39-12fb-4d29-8d8d-e6a160142fc1", "comment": "Malware payload (RedLineStealer)", "value": "c43975d736cbe692ef5f4489841ed4e91fb6c996fab2b32f78bf2e6ed96a664ffeedc3b4b40d2139a608cbdaf6a31d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636828184, "uuid": "d3971ac9-e72b-4846-8825-99a17b556573", "value": "T16E74F1323E44F658D0F33E3782DB69954FEA2ED16A7249865E089A005D11F87EE6333D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636828184, "uuid": "3cf69b5d-e212-45f7-94e4-649465153040", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636828184, "uuid": "1f39719b-4796-4385-b74a-565a586c7c3a", "value": "3072:8VcsBaFP5F4RcBPxZJxHQvnvc/GekK+IAVg7ixJCDUw2g5unVWaK0b/I/X0lQgpE:8VcVP3PxPxH0U/X+pg70CDUhZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636828184, "uuid": "b16a8b44-d69a-44fb-a5d1-a2fb4d96af5d", "value": 344984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636828184, "uuid": "9c876e69-4f72-4002-b4df-4296917b61ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636828184, "uuid": "4312cf2c-2ba0-4a46-8737-05c85a1a25d4", "value": "Genshin Unicore Cracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d85be21-4430-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636773398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636773398, "uuid": "afb9e480-6453-4001-8b31-13b7a9692097", "comment": "Malware payload (AgentTesla)", "value": "b39e2368cecb8f3dffa399f9112e758f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636773398, "uuid": "19233775-a6bf-4f6d-83a5-ed03ddf121ba", "comment": "Malware payload (AgentTesla)", "value": "29891027306c8c6997d2ec5d86e0d8dd78aeac3ce4c987d02bf474e69beecac0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636773398, "uuid": "cd7b28f2-32ad-4d16-83c7-757c2237508d", "comment": "Malware payload (AgentTesla)", "value": "104534895ab8a614895bc9020bf84cddc0219b20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636773398, "uuid": "3bc42a53-088c-402a-b6ba-036d60f36578", "comment": "Malware payload (AgentTesla)", "value": "c2427164c147e416749d706012d8d4b7dfa0c36d0409f3db3d7fce7e8c93f5c8338c0c989a7d493073d6f3eec592c14a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636773398, "uuid": "39683582-4005-4320-9780-f0c774531275", "value": "T168741304696AC372C4FC4FFE71B336450B304944E4676B2E9498F8B90F5BB506A62DE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636773398, "uuid": "7a4db268-4779-44c7-8798-f24491319421", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636773398, "uuid": "4029554c-2eb8-422a-9e8a-a02ff126df37", "value": "6144:uRyo8QvqcT+soV/HuDyC5DcK9MtWt7gj1DeS3Qk4WCe5bcWz9TJ/kN3dleT:ugo8ea/HujDl7gjsSARKVEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636773398, "uuid": "091ee51f-f86a-4175-8d3f-6f02d7ad2e58", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636773398, "uuid": "4dbd8d2a-541e-4552-97e4-23c1cda32796", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636773398, "uuid": "67a43977-ebac-47bc-9e9a-3c43dac94459", "value": "3KLMtSQ68IayKtz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d83091b-4466-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636796618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796618, "uuid": "b405b745-b4bd-42d7-9707-ea58b379ea6b", "comment": "Malware payload (AgentTesla)", "value": "c273315e2f685460d4cd913ad302f29e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796618, "uuid": "1473e510-9880-4cf3-b9c7-b60fe6105e69", "comment": "Malware payload (AgentTesla)", "value": "2ac58211375b4eef7a104e8578a37ad8ca5457aea827793a7ad44362b8b08671", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796618, "uuid": "baac4d6c-3fc2-4256-9517-45de75be8436", "comment": "Malware payload (AgentTesla)", "value": "7c87fc7016cc02c2d39347b0f8cda32928783eb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796618, "uuid": "30b129f5-49bd-4b50-b1d1-47aaa3e48bd1", "comment": "Malware payload (AgentTesla)", "value": "467772e3491321f250304cd6566307e3659355403d9eaef13937b9dc9ccc84c57fc8e6a30aeb0b3fb0c7af4fcf1a45cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796618, "uuid": "e1f1b1e4-bbff-407e-81b1-7d495cf0a450", "value": "T1F2B4124935948C15CB7ECFB7042348010FF4AC6ABC61E74B1EDB7A9A26BBB860251F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796618, "uuid": "ec51cb64-37d4-4cff-a237-e96432d0cc78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796618, "uuid": "decb32fd-a533-4326-8305-a8d6c11f152e", "value": "12288:1pRu2iN9RCfI5LpdIV2YcSEnP6S/OEYa9YtBf+bEYay1:E1vg+7RiEni4OEYWYn+bEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796618, "uuid": "b8f63da5-48b3-4168-812d-1ecb95d9bdf7", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796618, "uuid": "e5b261c1-0cd7-4bc8-b97e-c09ba3839299", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796618, "uuid": "80557e1a-903d-4a34-a561-eee30bc2aceb", "value": "Documento de recibo de DHL, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a46434f-44dd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636847776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636847776, "uuid": "8c1e310b-a3a4-49b0-862f-760d6060b773", "comment": "Malware payload", "value": "fcb63eaba491f872aa88f9ae02f257f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636847776, "uuid": "ff489213-f643-43ba-aca8-6b3e1e7dde4b", "comment": "Malware payload", "value": "2bc3c95726f91e7dbfb361105535d89b9633d67001cb07284f1ea933b6ed8d83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636847776, "uuid": "1e270807-01c6-4e69-82cf-0c5534c4cbec", "comment": "Malware payload", "value": "d0c96cfaa9d489c62d16ec63b71fe6f41e9e99bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636847776, "uuid": "21dc9c55-1335-44fa-be55-3e3a14f624f6", "comment": "Malware payload", "value": "469146173679b07ff9229d0c79eaa450f801b4ef1c801be9cf32cb333b4fb15cbd5dad481b81da196a0fe0e411ea0cdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636847776, "uuid": "6a279e92-1834-4137-b630-18ab84f3a0f0", "value": "T18FC5230A7F89B637CB2FC734AA474302E378E1601BA68713794D52651F623C4DE5EB98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636847776, "uuid": "5db37e70-609a-4936-b404-04477d249365", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636847776, "uuid": "c888dc61-ddff-4855-9803-cd7ca83b5255", "value": "49152:pOf9j0VFC3VbF4328ht2fjEUMkS4BixpaWbuyuMFoZaQfWYYOu4d:p84sXN8hQJbixpaaXuMCsQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636847776, "uuid": "55818ed3-c6b8-4a7a-893d-dcfa876cf36d", "value": 2522288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636847776, "uuid": "ee8f514a-7e7e-4303-9067-6eb995b54e65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636847776, "uuid": "85b8002f-bd3f-47d3-931c-196b4beb4c87", "value": "fcb63eaba491f872aa88f9ae02f257f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798dbcad-446e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636800181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800181, "uuid": "ae88667c-4bf2-407e-b6de-81b541cd966b", "comment": "Malware payload (Formbook)", "value": "862cc74dadd15cd9f8cebfbd23dcf07f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800181, "uuid": "5ef7211e-a1bd-4bea-8e86-01d2439c3631", "comment": "Malware payload (Formbook)", "value": "2bee14cbe1953b3a702d00e40417ff1d6b090f46116d62abaf2e255468d93bbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800181, "uuid": "d1fb8d3b-1908-4f2a-9080-e01fed08266c", "comment": "Malware payload (Formbook)", "value": "cf527d95dfafb68d9b0925d9432dac38c8138de0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800181, "uuid": "01b9048e-cd00-467d-a387-c213294492d9", "comment": "Malware payload (Formbook)", "value": "73d227f2f243a9b647338c1d3b0a9f650e1d70864b36fdf6e1add09b788a7a1b311ead01354683294a414110c4c8571b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800181, "uuid": "ba2b92a4-39f1-44de-97d1-70f6c7f20b49", "value": "T1F594125CBBE94E28C73E8F7B140309415BB09A6E7E55E78F2EE616ED244EF910240B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800181, "uuid": "1ef8981c-a3ee-489f-a3d3-7d3a7f0818f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800181, "uuid": "1c1a4c79-ad3d-41dd-a974-a07ecc4094e5", "value": "12288:ujQKVK2iNQhw2Q8oiFZzn/122T/VoForbaFI0:uJK1iaoL/zn/TMor4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636800181, "uuid": "90e84d73-2ff6-475e-9a2d-92ace17de28e", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636800181, "uuid": "74760eef-e834-4179-afb0-fefbfc6c8a07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800181, "uuid": "1480f582-d4ee-4022-bcd7-a17373ef9c49", "value": "862cc74dadd15cd9f8cebfbd23dcf07f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc31468a-44bb-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1636833391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833391, "uuid": "5e15ef27-4a3c-4281-baa4-83863c7d114a", "comment": "Malware payload (ArkeiStealer)", "value": "b1216d0a89ca722611d5d61c8f5800b3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833391, "uuid": "3812ef9e-4a44-485a-8cbb-6e3fccb3f2a8", "comment": "Malware payload (ArkeiStealer)", "value": "2bf85b8f85928d7a4740f9eb334d626577bba84dad786747eed237d793a1fcbb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833391, "uuid": "1728fb25-99c5-420b-b4d0-f49c1ad6a27c", "comment": "Malware payload (ArkeiStealer)", "value": "5b326a05eacc949c586c8dabcdf9b372d1fa105c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833391, "uuid": "b4645081-9431-4fb3-b85f-3e7582f40229", "comment": "Malware payload (ArkeiStealer)", "value": "0e01e32f01f19b66a9614f73490793ea816bd68e4747a3fce6fd7ab8b63f433115912ea20dd4b5f6c56ceb06b981e5a6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833391, "uuid": "e8d9005f-36cf-4eb9-85e1-7627f11703af", "value": "T182C4F12132D1D032D6E335715729D7B60EBB74722665A48F6BCA0A391F286F1EB24337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833391, "uuid": "840b647b-a76e-4a3d-9939-bb65ca0e8ff1", "value": "bb5e8dd2efb34fb1eba2f10832a836b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833391, "uuid": "ce4b23eb-f39c-40ed-8fe9-39cc2e7215ff", "value": "12288:+SKd+NWAVjbmGpU/1Is7XOD5PuZPqdVbvSKI5qAH8mrKLcU4rzWKKy7:+Vd7GppsII/PqdJdtARKLdGWK97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833391, "uuid": "280d16e5-0c62-4fc7-bc87-ab1c8e96de0b", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833391, "uuid": "cbc06262-b8e7-490b-8618-59e4008b81d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833391, "uuid": "ad2d57ea-8932-487a-b60c-4f697fb1b590", "value": "b1216d0a89ca722611d5d61c8f5800b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5218cff1-44ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636826744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826744, "uuid": "1dff9c13-fc0c-48d7-acc0-68eac3f0b304", "comment": "Malware payload (Mirai)", "value": "cc9d89732766b81795122e8a0241180c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826744, "uuid": "8f31052a-42e5-4d83-9f1b-29c87fd4c8ba", "comment": "Malware payload (Mirai)", "value": "2d197d1a975c9433a9a76ab14764f73e7985f614f70091d1478f3ea4e546ec0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826744, "uuid": "0bc2b1ab-66ce-4f51-8530-0105ac39d8c2", "comment": "Malware payload (Mirai)", "value": "b6c5d5bd221388bfcf471d657952f158041ce8ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826744, "uuid": "3aa33407-ee2e-4cd0-8cf0-62d4acd5c600", "comment": "Malware payload (Mirai)", "value": "5af2b05c18910d9f9728f5c2214e614c5cee0392ae8b269b963af06fa7156fe91b8357a195879c69b9ecf3515efbf1d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826744, "uuid": "dea94198-f3d1-4a86-aa1f-4b6ad5124255", "value": "T1B5B2F2A15CF9D77BC572067121CC9D9FE0F030C266CE4B0276899B9AE668442B631ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826744, "uuid": "60a7cf26-0657-4148-89d6-da9c0bc6b7d6", "value": "384:MY4kzOIpW9hNRBDFReUC7svKAR8H1OlBmwE5QzRLGKN6k5q6OfD6FlyckofkmtQH:R4Yy3NRxe3AiFH1pgN62OfD6Fs9tq2jL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636826744, "uuid": "2a79088a-3ff0-4196-b317-2a43e902a39a", "value": 24704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636826744, "uuid": "6bc5d079-668a-4209-9cba-b6f05906de7e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826744, "uuid": "9c72f4af-21e9-4de3-a0fc-28ef1b86de08", "value": "sora.x86-20211113-1805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab86b3e-446c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636799136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799136, "uuid": "8f649648-6985-4589-8c3e-1c5a86884254", "comment": "Malware payload", "value": "100f096abf7738fa5c86e0886f47f2e3", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799136, "uuid": "2359ce7d-cf90-4120-a425-0b7aa56b1aab", "comment": "Malware payload", "value": "2d8c517e8ada7ab3c73c6bd6b67b2a8528d83e31eb1b4e9ddd2ec27c2b308c94", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799136, "uuid": "b3f9f4cb-5bac-4fbf-82d8-567eaade438c", "comment": "Malware payload", "value": "a97b8ba1c58f52ded4f1aeafcaa142a6fff181e9", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799136, "uuid": "ce8989b6-371c-4700-8417-5dac7aa748e7", "comment": "Malware payload", "value": "43389a56aed59e6e99b417c11f3cbee3a4d6e41c6917f153c93cfaf90b68f42593cb39907872a04d355a4c354175fa9f", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799136, "uuid": "7b3d4605-4584-4a02-a081-d4ba129cde3c", "value": "T162344DC5E94466A0DD59AB716A37CD3542237EFDA874A42C28DE3E273FFB2935022053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799136, "uuid": "d0bb566b-0225-4ae5-b1b2-057f688bff89", "value": "6144:TjD0AkzL7r9r/EDppppppppppppppppppppppppppppp0G:TjDAP7r9r/+ppppppppppppppppppppt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636799136, "uuid": "a4019e39-6528-4d88-ad88-50aa40e65eba", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636799136, "uuid": "6c15d78a-b2be-4277-b7f7-f29e539508f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799136, "uuid": "3015a993-46d7-45d4-b39c-bf43132fe03e", "value": "Aviso Pago 30711235675867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78b7483-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831290, "uuid": "a836c8d7-37b7-4ca6-aaed-ff5d24b8f09d", "comment": "Malware payload (RaccoonStealer)", "value": "0c81b03370d07e06734bc5bee7c321ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831290, "uuid": "c94a3d94-b35d-46f3-927e-c4e001dc23eb", "comment": "Malware payload (RaccoonStealer)", "value": "2e5e0f3a0ef05f284db9ce55be116751f7a85a0193235619115bd3c166d9b352", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831290, "uuid": "fbbd186e-dddd-4675-84f1-28f79dd5ad07", "comment": "Malware payload (RaccoonStealer)", "value": "5091537bf7de901cfa98b2eaa294cf4ecc42052b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831290, "uuid": "65f5b9bd-59d8-42b6-94db-3dbb1bf05c60", "comment": "Malware payload (RaccoonStealer)", "value": "a17552c55af58947eb70b311aaf1536a9a44667d84a1c039b5f14f08b7ba0bba7d963c568b6fdf5fb3e8434fdef72866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831290, "uuid": "fcda5e94-30a7-49ee-b30f-1210a8e35ad9", "value": "T1C9C4D010B7A1C035F5F226B8497593A8B52F7EE1A72594CF52C53AEE96386E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831290, "uuid": "6938c311-a71a-4007-bde7-cadae7012277", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831290, "uuid": "0409292e-40f3-44d3-8972-b562409aaad9", "value": "12288:DVQT3lpz892tEC9WTobcmt53KL0sFnQG2gbrxfm3LzruH:6TVd88tQUcmt53KwsFn529z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831290, "uuid": "2aae79f8-2b03-47ac-ad9b-224bccb70e02", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831290, "uuid": "dbcd6abb-f2f1-4e42-bfad-d74f5760fcb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831290, "uuid": "5201a90e-42dd-4cc3-b52f-d5422f7fc66e", "value": "0c81b03370d07e06734bc5bee7c321ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760731de-446e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636800175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800175, "uuid": "525cd938-a2a9-47b6-a253-8fbd752b948e", "comment": "Malware payload (Formbook)", "value": "adedd0a626c33f977decd245ccacc218", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800175, "uuid": "898007ca-5bb9-49bf-8702-54497d195efd", "comment": "Malware payload (Formbook)", "value": "2f46c6eb0fdc1567d3d51a3fb9b7c3d6247a4f51c8043d2f076770bdd193f4ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800175, "uuid": "bee1d42b-ff37-4126-8f49-2ccaa2919e7e", "comment": "Malware payload (Formbook)", "value": "bb3ebaffd4cf2920b8e22c9e613b88189ea7b73e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800175, "uuid": "0de86bb7-169f-470d-856c-206e467f6346", "comment": "Malware payload (Formbook)", "value": "9b9cb312fb80e07034138d380b66ce5f2984f4b56f160844fcfe77668411ebf11127a0b811e96b51c0dde5690de4d945", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800175, "uuid": "d0e60ee2-98d6-4989-be6d-fb9cb4af6223", "value": "T1498402547FE84F39CA7CDBF66A20880003F8B55F1542EB2D5DE663E6059AB928341EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800175, "uuid": "69c8ad19-b94d-4011-83b1-552b1669dd21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800175, "uuid": "2d1c746b-d7ff-493b-aac5-ea3596f37251", "value": "6144:Au/nl2GhN+TbePmfB9u4DY2+1pxsLt0oDk4+MOq2scQTE3lpCSocCih:7l2iN4ZhDc1PsvA4+MYscqglpRo4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636800175, "uuid": "e0c41a8e-a9da-42ed-8643-038abf1ec103", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636800175, "uuid": "e1147c76-b716-406a-8fe5-539871a1cedc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800175, "uuid": "dc145154-5344-4428-aad8-a2978451ce2e", "value": "adedd0a626c33f977decd245ccacc218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9c2820-4486-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636810659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810659, "uuid": "333dbe94-b06e-41cf-a31e-8afe9d4d07bc", "comment": "Malware payload (NanoCore)", "value": "b38d84ee978cb72c7ef1bfc9db5b6668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810659, "uuid": "d9bb2d24-1fe5-4aeb-a83f-e85945d10c06", "comment": "Malware payload (NanoCore)", "value": "2f48280e62cda02ac601adeff841beeb2ab946856f01e8d29fdd861d28b82479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810659, "uuid": "bb9da973-b86c-45a9-883a-f8edf72f8896", "comment": "Malware payload (NanoCore)", "value": "3b98ba961681e70072315229791f8e5d740ba7d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810659, "uuid": "520c8659-7854-4e33-97b5-60b1683b82eb", "comment": "Malware payload (NanoCore)", "value": "276c468cd45ddae80461f22df1d7522cba706ac22665192de50fdb9ce3c2e2523b004f1d213e0b0f04d5b5fb6737703d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810659, "uuid": "b834a318-a083-4715-a680-ff1933609369", "value": "T11BE46CD0E5AFA88FC0860B3A686BBF14159D6EC9C975C70F255F771D94A3382201BDCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810659, "uuid": "ce828a3a-6ee5-4968-b2b4-cac2db5e5038", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810659, "uuid": "c40fa518-8480-4418-9153-07e1d96fd433", "value": "12288:ZlNkLt1zwe7JFrV7Dk/HfUSy/vfGb2N1ZWQaQ:nutZ3Fe3USSGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636810659, "uuid": "d5d1a967-55df-4685-b49a-206bd6d234fb", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636810659, "uuid": "5bb47b75-628e-4abf-b571-c157a00a4bbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810659, "uuid": "cf97f6d1-3f3b-476c-8b79-8e25199b4da2", "value": "~PY56789845678-87655678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd050e20-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831272, "uuid": "c7d88652-f417-41f1-b1a3-0f7614512777", "comment": "Malware payload (RaccoonStealer)", "value": "4d6901a8d52561bcc5c342b9dc000f73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831272, "uuid": "36a08941-5b38-4176-a370-ab2301643fad", "comment": "Malware payload (RaccoonStealer)", "value": "325a40d50434589e27368c440cf300413aeae8fba0044ff292182c6b82175ba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831272, "uuid": "7bf091fb-8616-4e89-b057-a7c648061a79", "comment": "Malware payload (RaccoonStealer)", "value": "b482533acb3a83cdf2ce0a0b01202d9c662f44c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831272, "uuid": "2ba2afdc-c898-443d-9fb3-7cc4688058eb", "comment": "Malware payload (RaccoonStealer)", "value": "c6c22e0cfcb8c296cde20abbf714ead6a22decf4e93962288b5993ef0f26e400e48410690efa65b671759571a7387d11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831272, "uuid": "17a6b2de-196b-4e2d-b157-c940955530f1", "value": "T190C4E010B7A0C075F4B652F84AB69368B52E7D91AB3590CF22D53AEE97346E0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831272, "uuid": "5ee8af4e-379e-479e-93a1-28f4cbc4a7df", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831272, "uuid": "eb3b73d7-81b8-4898-bfd1-b28cea92cac3", "value": "12288:FOP0j++JvF2r4zWdGN62LnirKWfA2YYM+tmcmSzi:Fal+Jt2SWdKn8xA2uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831272, "uuid": "3bfebba6-eab1-4658-8973-cbb18a6e3ff4", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831272, "uuid": "f116cdcc-3347-41e7-ab31-b0e87bed1023", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831272, "uuid": "c99754c7-0256-4b2d-bfcb-91d242c7b195", "value": "4d6901a8d52561bcc5c342b9dc000f73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88a1a37-4486-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636810649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810649, "uuid": "579d717a-55b7-4f56-87e3-49a782e28c74", "comment": "Malware payload", "value": "8e3428d6477a1230cd260c62acdb7668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810649, "uuid": "c5a4277d-0f99-496a-97f7-da1d8b9aad41", "comment": "Malware payload", "value": "33082f1f702c0919efd47a7c935aa3972c90f7f7419c9aa6c87492f57658d403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810649, "uuid": "64507d40-5af2-47b4-acdc-1ad88c4e3445", "comment": "Malware payload", "value": "f978593d538ea3c71ba8ea2b9e14b7351a5b3f97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810649, "uuid": "46be79d4-7aea-4331-892b-e333c23f26cc", "comment": "Malware payload", "value": "a29c3b034772a36ae8d65187ac7c9e2759303d96ca8e6eaef70ef779493456ffd144855b78abcc873123fe7d35b9e969", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810649, "uuid": "2f6f5eab-55e9-4ba1-8556-0753b375cdf0", "value": "T17FB4BE8A37590DE9DDEB407DE9A3E301EA6C34A183F484D703A8A5FB4E13791543DA72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810649, "uuid": "db35dc85-8994-4a68-b4d8-fad777f25584", "value": "a4585b02e9865ca7dab7867b81bc3a92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810649, "uuid": "2a373de9-0b3c-4a70-b983-89417127ab5b", "value": "6144:VGr7Yna6SnW7+z9Dp2m3HUjMH4y6gFxKIiq8ch9/H5WeSYnwxammoP00s579/cku:K2gn48pfGWYgbnga57ZcwDLPWtjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636810649, "uuid": "7608aa40-ba72-4e97-8ed6-2a4a8f1d214a", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636810649, "uuid": "afad0d70-2bbe-49e5-a09e-c87fa5aed4f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810649, "uuid": "bbaa6c99-cdff-4e14-bc3c-d75ae0a5f490", "value": "load.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79055c6-4450-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636787481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636787481, "uuid": "2fb2680b-15e7-45af-b10d-1aaa3d86ba4f", "comment": "Malware payload", "value": "cdfb55fc43a7b0a4e5e13f8c0af5f6a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636787481, "uuid": "f9a550ed-54f0-49b9-8675-49ffeb323a81", "comment": "Malware payload", "value": "331df11f37914f6198f16dd51527abfecd77ff93fd875970f16e92978047ec74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636787481, "uuid": "1550cdcc-c945-4190-a6d7-27b67e0bee39", "comment": "Malware payload", "value": "2b1b5aa4f8807d2e5f7523828140a8169b118727", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636787481, "uuid": "8edf4f5f-edf2-4e1d-9f01-57a08981004c", "comment": "Malware payload", "value": "2f9e6e0eca9d6c32dccd2df17dc54be6cc682d474a852464abb5101ea46081e64d85a2886d96987819badc47f138efd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636787481, "uuid": "ed7d79e8-58dc-4321-bf85-676e4f77bdae", "value": "T1D3F3AD10F7E3A836F5A62E30587487A11B76FD32A570414BEB5C166E0EBB3D08AB5713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636787481, "uuid": "237b0518-2251-403e-a21e-5ccbdd74ef38", "value": "88ea31429606f3c27e7c33b4ee10c07a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636787481, "uuid": "474b389a-000b-4108-9134-763213bfde07", "value": "3072:g7VUQyGGiy24YKuDbqxXoaeHCi59zP+NVs75DopZa9uD6VdyhkOMLzD:uyGGiynYKQq6akdP+NVs75swVfNLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636787481, "uuid": "2ad7e7b3-5108-400e-9751-eff03e253442", "value": 166816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636787481, "uuid": "18238317-cd87-461c-9cb6-2f78929e1656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636787481, "uuid": "917231bc-7246-491d-b4af-fb66862158f5", "value": "cdfb55fc43a7b0a4e5e13f8c0af5f6a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53711da-4489-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636811932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636811932, "uuid": "5d585ea3-fe9b-4066-aa01-d2be93f0c142", "comment": "Malware payload (AgentTesla)", "value": "75901df8091e9769971fb550d1de2144", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636811932, "uuid": "23576bd2-9180-41a4-b0ca-0a32ac7562a0", "comment": "Malware payload (AgentTesla)", "value": "34302ae724db13394bc7e2e06ff9b46b319c74975f4bef78cb97d1e16aff460f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636811932, "uuid": "747d9837-c28e-47e3-9951-62a958ef5884", "comment": "Malware payload (AgentTesla)", "value": "b29eb3d9babda15b8d64b80b1e6a7f6f2f8bddef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636811932, "uuid": "73a5d0d1-f349-4175-90c5-98efe3f983c8", "comment": "Malware payload (AgentTesla)", "value": "aab54b191bf233a6e582f86c60b5902ced3850a00eaca89849b43bd60bbf06def155cf7e95681fc91182c2915360987f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636811932, "uuid": "0b343807-83c5-498c-b2e3-41e81401cc47", "value": "T1FAB4122471D19F67C37CAF7A1D0719411BB4A96B7F11EA6F2CD627C821AABC20205F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636811932, "uuid": "409ecdf1-cbca-41d5-9c65-aeff9f7003ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636811932, "uuid": "bc9e9df0-b7db-4ec1-8b7c-14d0cd6dbda8", "value": "12288:T6D62iNgoep7i4xRBG6p8h3VLQKIQsey2jHE:31yrpR3GrLQZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636811932, "uuid": "b6aff2b6-a565-452d-a339-2d5fa3019d06", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636811932, "uuid": "ceb86782-9a8a-48f8-8085-c82bf435bef6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636811932, "uuid": "32297d04-3ad8-41e2-b0f8-7570e4be28cc", "value": "75901df8091e9769971fb550d1de2144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13045c39-44d0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636842100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636842100, "uuid": "469930f1-a079-4bdb-a60e-9fd3213130ca", "comment": "Malware payload (RedLineStealer)", "value": "189ab8a50ad6c519aadd95f96a7233df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636842100, "uuid": "574b1f20-33d9-46c9-9cab-8a1e55207633", "comment": "Malware payload (RedLineStealer)", "value": "34667ec337d12991e243afa9c3f3a61b84042de7b429b25f2f889dc0938f69d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636842100, "uuid": "632550fe-053a-4a07-9b44-f3df9f867174", "comment": "Malware payload (RedLineStealer)", "value": "814714fcaa7d0d1b0c8d499973cf14e7663cbc0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636842100, "uuid": "da2efc80-dbd2-4972-b529-4cab4e96d3ab", "comment": "Malware payload (RedLineStealer)", "value": "2679fddbdece5b568c0cb5afd4c687a93efa5346eb5b8c48a020e15e7393fb6452e1c2e22a0976961b49e8e0f8c5d91d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636842100, "uuid": "92964466-757d-4d23-8bdf-ec5eeb7b7e1f", "value": "T1EA052AC6F1B3608ED7A3B0790F0155924A471C7A6B119AF9AF35E92B11F36A1CAD7303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636842100, "uuid": "c4269b4b-b0a7-4191-a827-08cfca1b3599", "value": "77baa691e6143dcc53adb7b2c5e44e0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636842100, "uuid": "605e2e10-95ae-4842-828b-8c650af59083", "value": "12288:0o8Wh0Dh/0tc+aSGpvVK11hp3zLpoVaoCbT2x1kL0keOaSSogV8Y53F:0o8pDrLvyfpDdnqGcSSzV8Y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636842100, "uuid": "e7289710-2acf-4af1-935b-183f072cd94d", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636842100, "uuid": "7fc0cc59-03b2-40f1-8188-2909f5de05d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636842100, "uuid": "95e2dc63-0422-4ed5-ac3b-735b50321e13", "value": "814714fcaa7d0d1b0c8d499973cf14e7663cbc0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da522b6b-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831267, "uuid": "70358360-4b33-4974-89f4-1a1eb491af36", "comment": "Malware payload (RaccoonStealer)", "value": "07fa9231563c7f1935c010de3383db2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831267, "uuid": "ba9a5c48-bf8f-404f-97f6-afbae5fcc1e6", "comment": "Malware payload (RaccoonStealer)", "value": "3479b7419ece3f4c774cb55e73e7d538b8e8271d9d5cccbd3fc48266874a3ce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831267, "uuid": "012d1269-7114-42d1-b8c8-2a3498328888", "comment": "Malware payload (RaccoonStealer)", "value": "d15c2cf779cb4a08a961954a0957e924290efa40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831267, "uuid": "4e42681e-414a-48a8-bc97-ceeb98e93c92", "comment": "Malware payload (RaccoonStealer)", "value": "bfe6c6eea2d8368f30cc26a789fbf6d738ab82bbca3222d6b3fb7a5a7362d94562d56baba21f1490e93cae1d5998b395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831267, "uuid": "1ac9939f-97c1-4688-a950-0c674b3b498b", "value": "T1C1C4E100BBA1C035F4B656F8497592A9B93F7EE1A72554CF12C13AEA9734AE0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831267, "uuid": "470e145e-1a76-4dc2-894b-45350f27f8a6", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831267, "uuid": "b1b089e0-bbee-431e-969d-ed80ef9ab222", "value": "12288:vBlzKy9lRF8KzAYx7+uGyUc5lJFDuc2LKCIQmRWrPCUm:vBBKwKm9xJPH2Vrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831267, "uuid": "5036014a-fbc2-4e89-bada-44e757d94476", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831267, "uuid": "a93011cc-3d7d-404d-9961-7ac21739b296", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831267, "uuid": "dce07a1f-d342-4cf4-8061-45f8bad71047", "value": "07fa9231563c7f1935c010de3383db2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf46ea5-4454-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1636788911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788911, "uuid": "ae6c1fdb-cb2b-4845-aa5a-af768807483e", "comment": "Malware payload (CoinMiner)", "value": "9411240acd30d986d9db1eeb8d003691", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788911, "uuid": "5f42738d-c842-4a07-b8d1-14df341ae035", "comment": "Malware payload (CoinMiner)", "value": "37c3db846b611722768b95c17585624f476def65d0332b3cfb93709c1273a685", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788911, "uuid": "084d040c-758f-4c17-b155-8c8a64c43827", "comment": "Malware payload (CoinMiner)", "value": "bef350471c595da4cfc809f1d92145616876677e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788911, "uuid": "c0f2bada-61e1-4e47-9cce-996e592155eb", "comment": "Malware payload (CoinMiner)", "value": "3f68389a3a9a46bfb513ba6d9ea69a18746bc61ee6a628c48a806b2b69760f0832bab7ab6c2e37e2930bd0151fc70210", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788911, "uuid": "50ac7098-e4b9-408e-9d1d-d3457234448d", "value": "T12D84CF02FAD284B2E57219325A39AB206A7D7D301E34DA5FB3D44D2DDA315C1B231BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788911, "uuid": "2b4ece70-ba5e-4654-b27d-9d5e57589657", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788911, "uuid": "ff60acb0-bcc0-4c97-995d-a6e6f3bd99ec", "value": "6144:8/fAhvV6B8ErzPZp5wdz753RSkKJUH4C7xkzvrO9gaTv4cU1:YfAv6B8azBwdtK2H4C7CzDzas7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636788911, "uuid": "8dfceb36-b78c-43b0-8bd9-e9246837a05b", "value": 374147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636788911, "uuid": "83451d5a-3dbf-4d6f-ae9f-e150567a4061", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788911, "uuid": "2d7b23fe-2e76-4a41-8cea-0ec3446775a3", "value": "9411240acd30d986d9db1eeb8d003691.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077a2053-446b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636798701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798701, "uuid": "bcf65e52-f285-432b-bd94-cd69b0fbda78", "comment": "Malware payload (Gafgyt)", "value": "9e06c2b777b4d76b471e2659ba07cf38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798701, "uuid": "aaee0d27-17ea-4f47-b896-b770fa33806a", "comment": "Malware payload (Gafgyt)", "value": "387410225626403b9c3b2405b07501d8a8291a58ac138da6392190fa37cd50a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798701, "uuid": "0ef3f5b4-e31a-47d8-af23-8c992bc2b964", "comment": "Malware payload (Gafgyt)", "value": "21e6460dd32af67db2332121bebadcbc18caa9ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798701, "uuid": "f747f1e2-0f85-422c-8fbd-2eaba3b5496d", "comment": "Malware payload (Gafgyt)", "value": "6d432a0a8228e5f5890642723605f8c3aba802957891624f77b8b75de663d5958acab6553443a9fbb3627c81b5a10cfb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798701, "uuid": "168cd917-84ae-4240-b6e7-f4f7a1d2cb30", "value": "T14CF3956ABB619EB7D80FCE73059A4502118CD58A42E93FABB3B4C55CE78B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798701, "uuid": "84b83f69-145b-4ea9-bc0a-54b2c864de18", "value": "1536:s7eTSLFyv1cbtMjZ4bXQMIXJ08SDzsHIi5hRYewhmvhfOqx13fDWRWq:s9xtgHJ0LfC5hRYDhmvtOqx13LWRWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636798701, "uuid": "de12e330-ff65-4378-82a3-c5d536c4ace3", "value": 158653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636798701, "uuid": "52a832e9-46e0-4249-b2d5-efcb90a5dc86", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798701, "uuid": "aa83ee27-35d6-4359-ad6a-01b604134a74", "value": "9e06c2b777b4d76b471e2659ba07cf38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db0225f-4455-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636789263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789263, "uuid": "ccd353b8-060e-4f1b-a9e1-02295ea470be", "comment": "Malware payload (SnakeKeylogger)", "value": "0dcf38a21174e5a9c7671fbf4e89f927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789263, "uuid": "add0e9cd-babc-4eb2-962e-b16b15884013", "comment": "Malware payload (SnakeKeylogger)", "value": "3ab6845719b7a7e83a96662794a8480d986e55b18c8344250d52f37e2c93c8fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789263, "uuid": "9e5e4821-8639-421e-849d-e076dce313e4", "comment": "Malware payload (SnakeKeylogger)", "value": "f1320076be8b92760a96e49f692d020177fc0d82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789263, "uuid": "34b3bdd8-376c-4000-a994-7aee6d76a07a", "comment": "Malware payload (SnakeKeylogger)", "value": "5187dbafe18ef61d504f6efdc604992986d22fee9d961c1a918ee9a5dd15ce67336bb208048cc3a606652a8c45142ec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789263, "uuid": "33163f63-f7da-45dc-bc93-210e479bc2ba", "value": "T1B664CF8CB660B5DFC867C9729EA51C64EA607477530FD207A05312EDAA0E69BCF190F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789263, "uuid": "82105fac-dbe5-47ea-926c-a56413493fff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789263, "uuid": "f80e29ee-caa8-4b8d-8efb-b0896b55a5fb", "value": "6144:/vT6TSOxGGIWKVlHdYf17oDA4CqoAj5Mox4M/QTD07T6EvPS+EeKaC:/76GGmVMcDAM5STDAvPS+EeKaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636789263, "uuid": "b458e762-2a75-4782-b848-04cc6d98f797", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636789263, "uuid": "8d3c03c1-323d-4484-98df-bb5d92c7bcdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789263, "uuid": "448f89e6-3bde-47a9-b7c8-927f6e7a9f97", "value": "PO-5626620988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536021f4-44ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636826746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826746, "uuid": "859b01bf-30aa-4fb4-a22c-3025c0db944f", "comment": "Malware payload (Mirai)", "value": "9d3debb951dbbd017a461bdbeda63a09", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826746, "uuid": "34eb3707-07ba-4d73-bf76-92579773886d", "comment": "Malware payload (Mirai)", "value": "3ae55d55e496c2c364fd8fcaa708db7b3f9f6fd2a5cb21f212ad02c1cba8a055", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826746, "uuid": "f008c2bb-c18f-4790-8844-5b3f6a74ed51", "comment": "Malware payload (Mirai)", "value": "77cdd5a4fa9054f4670f775ddd6aeb0fbe5155a8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826746, "uuid": "6e7d2bd5-b790-48a8-8dbd-07dac30ef286", "comment": "Malware payload (Mirai)", "value": "2904588299d38c14f251607d22df948637458a1182c5481ea1ab111c9a3f9cc3418950ca1c31afdd811060d9b0b0d16b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826746, "uuid": "9b10d924-81d3-4e55-8c6b-b8dd40749e1f", "value": "T12923F235AA36B640DA201172CA670D467A467BF4365C7F0C1998523337A7B4F4BBC1EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826746, "uuid": "3b749ad4-66b4-4939-8568-f4450171b2b8", "value": "768:HWlM7My/3JtoInAE516S+LMQZryN2m9q3UELPg70nD6OJrL5QMrs7YK:2ap5toY95p+tZrygLY7MDHhzYEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636826746, "uuid": "a746323e-b502-4949-b2ac-2632970e320d", "value": 48676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636826746, "uuid": "eebcee75-40da-489c-840e-29207eedb787", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826746, "uuid": "a34c892b-cdc2-4e3d-9a72-f9d7c4e07edd", "value": "sora.arm7-20211113-1805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba607d1-4465-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636796346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796346, "uuid": "b87a74b1-8816-4f68-9d5c-b30e24a43f66", "comment": "Malware payload (Loki)", "value": "c5713bc50bbf2a8e696ef53295063569", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796346, "uuid": "641e42d6-c48a-4c71-96ab-fa296655f076", "comment": "Malware payload (Loki)", "value": "3b3f1498d7caeac6b03c89a081184dbf779188f4c6d4cf0ebca3df400cf33ba3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796346, "uuid": "0edd4e92-2d87-44a1-904f-55ae4d53d6a9", "comment": "Malware payload (Loki)", "value": "1fffa70cd706d0561f36b052c21582b9cea39535", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796346, "uuid": "5daa7c52-c973-4340-a165-558b0fc33e07", "comment": "Malware payload (Loki)", "value": "8dc19fa653746a3726548e227f33793dcaf4a11366b4513f353f77d50feec909e95658344023c2c6547dd4b7fe7314fa", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796346, "uuid": "1beb715a-8e0a-453d-9aea-9e55a415f445", "value": "T1CB34128975E048A2FF698DBBCC39960A868BFEE13D55D70E3DA6B1564131F091CC370A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796346, "uuid": "a78989de-3c0e-4cc0-872e-b2f193e8e59f", "value": "6144:zFBoE+NQewSbGxEnoEv/WgMtEsXBQAIW0nH:HoE10AlC/sRAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796346, "uuid": "9f30c8e0-8b0d-4d8c-904b-74143fa2cf94", "value": 233352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796346, "uuid": "a0bf7456-6f7b-42c2-908a-10a7dec50b1f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796346, "uuid": "3949d0a2-f9e6-469c-8d4b-8c21f1e29886", "value": "SCAN-DOC110-1002.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe9d84b-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831297, "uuid": "b8dbe96d-f115-405e-8f6c-ae03959308ec", "comment": "Malware payload (RaccoonStealer)", "value": "321c346f541251b03fdeddacdb06520e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831297, "uuid": "429e3f44-5ca8-4939-802b-d4961626fbaa", "comment": "Malware payload (RaccoonStealer)", "value": "3bf5e3b569ce7b7c421c15e8f1ed09740f71a9897e98702e648b9a3eab9ecb7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831297, "uuid": "98ea8c81-804a-4119-ae65-d31d6b809e5b", "comment": "Malware payload (RaccoonStealer)", "value": "9375d4fdc47f3cc56d4eb704ab9d3a241164f608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831297, "uuid": "9ca1747e-8bbb-4a63-9e34-c41b905d47c7", "comment": "Malware payload (RaccoonStealer)", "value": "a1b1a65699234c44e340e07aa43c94f88759c2970a72f1d0d7b753b148ee454784dea7e5760656c34e31e984f8a5b0c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831297, "uuid": "5447b607-6ea1-4bfc-a364-2f882fb4528b", "value": "T17EC4E000B6E0C034F5F663F94A75D2A8B52E7DA1A73594CF22D52AEA97746E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831297, "uuid": "ebfb8ad3-4663-409d-97ed-45a9750eecb3", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831297, "uuid": "b4c11813-00b1-4cee-84e6-2be296b5ca94", "value": "12288:BoJSvABYhzrsrhJovEE/yEhDEXR32rLP0imJtEfC:zvmEMhJov/uR32WE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831297, "uuid": "b5ced930-0b4a-44dc-b099-1e7daa56f503", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831297, "uuid": "be33334d-35c1-4970-bca8-58195eb47e6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831297, "uuid": "9c69bbd5-dca9-429e-8873-87df9c5593d5", "value": "321c346f541251b03fdeddacdb06520e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414473a4-44b2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636829293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829293, "uuid": "31e7317f-f301-4c52-ab17-68c9074a5f90", "comment": "Malware payload (RedLineStealer)", "value": "71d4af7914dd6fdf10dac641add4b063", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829293, "uuid": "9a2629f4-14c5-49a4-a5e4-84f3b2632b77", "comment": "Malware payload (RedLineStealer)", "value": "4248b627c09a67e427dcb07d55df46103915fcccb673a422a1a6543f3bc0afa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829293, "uuid": "319796d4-af22-4d9e-a723-fa548209bf36", "comment": "Malware payload (RedLineStealer)", "value": "21e21b4931bfe78c5dffa5b4f1208774073f66e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829293, "uuid": "6edf3f6c-d535-4f4c-aaf1-eb51d398f9b3", "comment": "Malware payload (RedLineStealer)", "value": "7e79b67dd0e0923d05fcae3e0d853c3c78971fc56c8526616ec8802ef88668cff7058ccd1a4f7c3133d95aac9e4c174d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829293, "uuid": "4394ab9f-79ab-48e2-af60-fc958c56ed27", "value": "T1017401327DC5F624C0B66FF39BCBFE910797DBF2463AA9861F089A4911141826D63339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829293, "uuid": "2c059b13-099d-4cdd-b7b0-ab1755c4bd40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829293, "uuid": "1388ea86-cf1c-4e9d-87bd-e8f4fbbf21b3", "value": "6144:zZJIWF27yFLxVZrteWvXzgEOtRWAVqVoEbiIgNU5hzj0xXgvPX8:DIQuoxVZrcWvDgEOtRv2NYUvIwnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636829293, "uuid": "310448b9-42f2-464d-a72a-7c9ab68992db", "value": 351640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636829293, "uuid": "8e1695b7-28b0-43f0-9288-f860779c145a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829293, "uuid": "6100db7b-f8ff-4757-88bc-585082396660", "value": "GenshinimpactHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351c6bdd-44bc-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1636833567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833567, "uuid": "5a627822-f401-468e-a1b4-a5ba8b6388d4", "comment": "Malware payload (AsyncRAT)", "value": "12f8eebac9aace481e0d7b362d3e011e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833567, "uuid": "87b6cc1e-64d3-4ee2-8d9c-23577f08bcf8", "comment": "Malware payload (AsyncRAT)", "value": "43ceb57ce38fe40853ddc5a5e17e4176a7bd3e2ecd92eaea125c5fd1ea7fc7a7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833567, "uuid": "b2373acb-80ea-4958-a2f6-ceba6ead9519", "comment": "Malware payload (AsyncRAT)", "value": "537adb8fbdc71f1b051dbe1fd57be808aaa223d7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833567, "uuid": "9c9d7d4f-5ef5-497a-8b94-dc1abe0f2c00", "comment": "Malware payload (AsyncRAT)", "value": "4565191233eda418bc586482e1b94e80a61fa15701d8eb9198ba1d0aa7ca4d51c89cf35269538cb367bfb5fbdec1ce77", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833567, "uuid": "fa4e5758-6726-449b-a13e-257a49b6a146", "value": "T14501AC6EE9D713E70BA330C3F5F16E6848A25003E6E0C564766863EE5B5504475CD1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833567, "uuid": "3512bfd6-9164-4a55-942d-136f71043c58", "value": "12:EVK3qlssT3MCularamdlNwvF0fMWDBZWzdmRs+3RRbh7otjm8tE+DOH1Esan:EVQsJXwaLaF0fMWcURKCgSHusan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833567, "uuid": "14ff72ab-8f8f-480f-ae51-7ef411651249", "value": 662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833567, "uuid": "ea5de1be-4d18-4240-b489-38feedae23e1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833567, "uuid": "bd117eb5-f529-4f42-af44-92ba9a635a8f", "value": "EDfQUwMp.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e731bc91-4423-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636768153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768153, "uuid": "3fffdee5-7d1d-4047-9c23-6363650f75b4", "comment": "Malware payload (NanoCore)", "value": "c545169abecbc4d469952b911066ab0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768153, "uuid": "ac55f6f1-f6bd-4972-817d-3e939e2a5ed8", "comment": "Malware payload (NanoCore)", "value": "47130aa591c0a1caf936a45027b95220f93b34b6c3890103c611ab6c766b263e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768153, "uuid": "17e3c3c9-37d8-4b1b-ac85-b266c2e02ca9", "comment": "Malware payload (NanoCore)", "value": "0c1f8bea8678b47d7f5338300868afa9281da317", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768153, "uuid": "da518348-55d6-43c3-8ec5-49900233a206", "comment": "Malware payload (NanoCore)", "value": "72f91957573635cc244f60d1bdc48a89063a80c175829dffd2a2a43f50d6a080e007af3b17eb9e5ed5bdd2743e0b4b8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768153, "uuid": "88baa132-db83-400a-9884-fa14afb6d42f", "value": "T13DD4D0360206ED8AEF360FF6D8406D805EF56C17172DCE62AD7A299626F74D0CE0C9B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768153, "uuid": "7fa969ae-b7db-46ba-93fa-217bf0b5b15f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768153, "uuid": "adeb6343-b4d8-4356-a925-c3af429d1bc2", "value": "12288:sYEygqJFTP3Hr0aF9YPb1xA6MDXATkZlWdTsxeY4:sY4qLHzCPb7A6MLEkZEdAYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636768153, "uuid": "ce5a16cd-3351-4512-a87b-2f1ef8829593", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636768153, "uuid": "b6c9b7ae-f501-4292-8e2f-912f558c2929", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768153, "uuid": "38a1af43-99fd-4746-aacf-97de8b30feaa", "value": "c545169abecbc4d469952b911066ab0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fedfa576-444d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636786232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636786232, "uuid": "2af859ce-8557-42c2-a00d-0cd887194b1e", "comment": "Malware payload (RaccoonStealer)", "value": "693a5e94e659b697fd63d7930858cfd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636786232, "uuid": "79fece52-8299-4aa7-963e-d93cdf3debf7", "comment": "Malware payload (RaccoonStealer)", "value": "4af44e0b7a0277b0e21c9edfd65eeb1d833cbfa66b8ba6a933685eff3ce607f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636786232, "uuid": "ece896d8-f9b2-47a0-83a0-9b1ba3996086", "comment": "Malware payload (RaccoonStealer)", "value": "a45c654c30a3957466bff9af568a728a163d45d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636786232, "uuid": "cb7c147a-7c53-4f97-b289-a951c4564aac", "comment": "Malware payload (RaccoonStealer)", "value": "545513ff6888bca62cc3b0c048d6ce5a1d8133b7def0ce76723bcdf9503bf7ed9040d4a62a75ed372d136e79413a01bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636786232, "uuid": "622661bb-7bb2-41e8-811f-f9999ca41004", "value": "T1E3749D00B6A1C035F5B216F94976A369B93F7EE1AB7490CF12D42AEE46346E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636786232, "uuid": "f232b432-74fa-4318-9421-0f19b76722f6", "value": "ea99ca467492cc4d133feba5a83ca2ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636786232, "uuid": "36ac2a4e-da19-46ae-a5cd-0347a804b4d1", "value": "6144:SNOO/fj1oJQbWth6DbQ84Yj5O2j3/ju4jBG:FO/fCebWth6DbQ84Yj5O8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636786232, "uuid": "a640059b-b045-443c-bef5-fc6017baeacd", "value": 350208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636786232, "uuid": "5bbbcf21-4d95-4d44-b62d-323c00ab8511", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636786232, "uuid": "a5509fb1-4485-4648-9690-3d405668a7e5", "value": "693a5e94e659b697fd63d7930858cfd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd421ea4-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831246, "uuid": "b3b3125a-b640-408c-905f-9ffc2f8b3fd7", "comment": "Malware payload (RaccoonStealer)", "value": "cf93dc297fa6070582deeaeaa6621211", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831246, "uuid": "ed40ac40-a487-490f-ab27-598ebefe2f77", "comment": "Malware payload (RaccoonStealer)", "value": "4bed5412c52ed11f549d5c6d703ca56de574a4af942fb81efa46b54b94d35a03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831246, "uuid": "4897a197-febe-400b-a9b9-e89618044829", "comment": "Malware payload (RaccoonStealer)", "value": "dd1a464a8610a3ab19e23540d4258b1c1b61b0b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831246, "uuid": "11ed59ea-34a1-4771-b1d8-e3f31d325196", "comment": "Malware payload (RaccoonStealer)", "value": "c8785dac74cf490c432e5fdb4ab63265945801f44acaf94ce442c476fab14bf78d11a35f87ccd898e53fbe935f942e8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831246, "uuid": "429d92a1-f00e-4377-afc8-c8ef97fa01be", "value": "T171D4D0007AA1C035F1B752F8597992A8B53B7DE1AB3844DF62D52BEE4634AE1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831246, "uuid": "04c3b44e-5477-4ce9-99c8-703032ff052a", "value": "17d363df494bcb38053d0872594e66c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831246, "uuid": "b55f17f5-96d1-4af8-82f7-78d367e503ab", "value": "12288:YbVzdgEIIeDSnvghTDVsorH1zElHo2IcMjECQr:YbVzdghIroTDnj1AlIL8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831246, "uuid": "a05e5893-49fd-41b3-9a55-a68d67e66ed1", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831246, "uuid": "498b8d5a-5f29-4001-ac59-2206927e64e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831246, "uuid": "70ca7ab0-9f94-4217-9c66-3ca8dab4328b", "value": "cf93dc297fa6070582deeaeaa6621211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b21caf-446a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636798672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798672, "uuid": "9bf2ff65-04e4-499c-a73b-eb37f3876b18", "comment": "Malware payload (Gafgyt)", "value": "bcb26511dde6a300b569342f7ca5c8d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798672, "uuid": "b44ed65b-edbf-47dc-8d94-99f2c1b51177", "comment": "Malware payload (Gafgyt)", "value": "4ca1bce342da0c6e49783ecbe0c680cb9d1d4c3ad51a3738011a99e028320c4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798672, "uuid": "19edafbb-abdf-4ac8-86f4-0732196ab270", "comment": "Malware payload (Gafgyt)", "value": "112329192f2a0960c5e7628a0decdb777529194c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798672, "uuid": "70cfcd7b-1e5f-4204-bc58-1b7ce1361a1b", "comment": "Malware payload (Gafgyt)", "value": "550f98e5f6cc5608a8b87b7e64ca15c606fc7c02bea45019d1265953673efe0dba3e7545fb07c2d5a07cbea5a7e79dd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798672, "uuid": "6298f550-f550-4316-8a40-89d37f2ff276", "value": "T15A043B05DA904757C2E3277AE68B428E33335BA463DB331599389FB43FC1B991E36921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798672, "uuid": "a1038eea-0015-4c09-8095-893872fe2d3f", "value": "3072:XIdA/jD+aES0fvE22bTstqz8Acnp5hRr+/fw1M/9ZfXrmRwfBL+QWyb:XUGX+aES0fLUTl8Acp5hx+/fmM/9FmRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636798672, "uuid": "7476b45c-be3d-4161-8573-31dadb5f3333", "value": 187243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636798672, "uuid": "32e21f5c-333c-409a-b27e-f31f83b9c11f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798672, "uuid": "f9de1ae6-5940-43d0-8da9-18b6cbd321dc", "value": "bcb26511dde6a300b569342f7ca5c8d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05690172-445a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636791397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636791397, "uuid": "056a2c36-8ea2-4c2c-9e28-31acd573c4ed", "comment": "Malware payload (Formbook)", "value": "9c4e7af0e5d0a8c69fc7f8aa2713a28c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636791397, "uuid": "b7b140d5-c3f4-40e5-8e45-4c109d49e70b", "comment": "Malware payload (Formbook)", "value": "4cef73e83df4c6bb091a157a975a38a2c50be436649414a2ac7a55bc62e67da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636791397, "uuid": "08b01371-8b93-4ac3-91f0-29844e872a46", "comment": "Malware payload (Formbook)", "value": "edd4dd68733c8cb5a798fddf16ef9fe2af4b8cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636791397, "uuid": "2e7b7844-b7ff-4934-bd00-6b38b0aadfc8", "comment": "Malware payload (Formbook)", "value": "a4e3fc8a3dd22dc0757fd189451b1eb87adb81cfb3e5bf72fe9cd562499a900ee8b00b96422217c58fc680df6acc40b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636791397, "uuid": "a7fc611e-b829-4887-b8bc-590d9e46d57f", "value": "T1E65423186DAD4319C8AEABB290823C591B75C4447963FF5D5C85E0BA8D3B313C639ACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636791397, "uuid": "7fc99b15-0f48-45c9-b732-6bb3455fd821", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636791397, "uuid": "d6c05799-7a0f-4ede-98d8-33792c631528", "value": "6144:njTy0Ahvw/zGZff7lfFzZr20lPnokvT0xXr1DdyJlGdPT:nHy4Ao0lPDL0Zr1Ddmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636791397, "uuid": "5f8b973b-3e01-43a5-b6fb-81173f170d71", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636791397, "uuid": "36a16380-38dd-41e2-87a4-586fda5a2ec0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636791397, "uuid": "1981e97c-02a5-434f-bbc4-77d102d7f381", "value": "SWIFT-MLSB-11,546__doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8527733c-4465-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636796335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796335, "uuid": "3310c9ce-9afe-4bee-b0ef-d395e1c8c409", "comment": "Malware payload (Formbook)", "value": "8580b837d36557eb8c3f427d09516ac2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796335, "uuid": "c28e375c-4c2a-408c-87f4-fc164390fa9c", "comment": "Malware payload (Formbook)", "value": "4d42a8ac965539112d0afb5f75d6c2c28f44d80d8441bdb3a4ab890275d9cd84", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796335, "uuid": "e56118f7-d324-4803-8eba-efcd29470bc1", "comment": "Malware payload (Formbook)", "value": "6be039af32e0308859330f02679d90fcaf2c1a7a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796335, "uuid": "bef1b4ef-48b7-4d70-b02d-5ae8c617b8dc", "comment": "Malware payload (Formbook)", "value": "062e1907f2cb3f1d9c80a26c074b61584c718842d18ef81b00325c27b9e6a583f2fb1dc320ea3ac8150293eca2fb74df", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796335, "uuid": "5702f26f-3852-4375-9a1b-b6997b68eb0a", "value": "T15A341212E094993CC090563A0A2FA53F8B14DF1F9A132C2F3CFEB71F5CBB5958A55266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796335, "uuid": "13198503-37de-48a1-8d43-a2ff70a1158f", "value": "3072:8zZ6ms7/+VqkV/hQc1KOvIO//HZdANgVWlaIt6NxzewdSKiOD3a6nRdspqjzFww1:kukV/qoXHbAbtQzeLQO6R5nFNRiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796335, "uuid": "be6e9713-c84e-4329-9c5e-c6dda8de3585", "value": 233400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796335, "uuid": "991caf06-889a-4aa7-8486-dafd0267af70", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796335, "uuid": "0f6376c2-ceb7-491a-8125-402c2fe9e64d", "value": "Shipment Documents (BL,PL & INV).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c71233-4473-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636802373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636802373, "uuid": "399dc094-7c1e-4efc-ba35-0c45ebcd254a", "comment": "Malware payload", "value": "83a39ec648f04bdfc64288a4c503c7ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636802373, "uuid": "cee37ba9-6ed0-4dd3-9f87-e827bef9040c", "comment": "Malware payload", "value": "4e5880dfd0ca4f8bb2e7575b34c7c99212c64aee12af64a7be1e47aa147fa54b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636802373, "uuid": "a8b2ad8d-6461-41a5-b889-c481afdf9bf8", "comment": "Malware payload", "value": "2c7b85a6438c12eec7d8f12d263d63e02ab3b2ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636802373, "uuid": "34426a9a-34cd-43a1-bc17-a47e04f69563", "comment": "Malware payload", "value": "c7a50f283e4a1d8d7a4ccfc7e74899710f5db32e1c79408a341614b25713541e43e689547c0c8ea302cf62688402feb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636802373, "uuid": "476cd471-62d8-45b8-a21c-e2ccd9d95cdd", "value": "T12534C49D365072DFC867D472CEA82D64FA6074BB570B8203A02316EDAE4D99BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636802373, "uuid": "9da3f85f-62f1-4f53-a4b2-76231165cd93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636802373, "uuid": "1a90ee5c-0718-4443-928d-a6eee1225741", "value": "6144:gRbUxkLKL5KQdhqYvTPoiujX5s35LIPrGHlHSMttf3PNhlJ:2bUxM0KUgGTR2nrGHlHSMttf3PNhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636802373, "uuid": "d3a9f545-3d4b-480f-9a62-6a9ff3615b39", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636802373, "uuid": "be09c57d-bb4d-4a53-aaf3-5832a8ca7d6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636802373, "uuid": "23c17d77-6cc2-4b17-a602-70d5847cce03", "value": "SecuriteInfo.com.Adware.WizzMonetize.1.29373.32175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbdd2ee7-4466-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636796910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796910, "uuid": "21631cca-7caa-46f7-b884-aa39aa017d3e", "comment": "Malware payload", "value": "71825e4f43fe9f747914d4cd0729e758", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796910, "uuid": "63eeb097-b747-406a-83bb-29f5b80a160a", "comment": "Malware payload", "value": "500ecfe7d62bb7bac33c4cdc5710f92539059735a40c3d86948d614f2e2773da", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796910, "uuid": "aa079103-cc29-4b03-ba8e-9e54a533ecf9", "comment": "Malware payload", "value": "3d87c23ddc1ff48414190222070fa6a4d4bed6a6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796910, "uuid": "c27db63d-3cc1-4d94-af21-b17f5fe698c5", "comment": "Malware payload", "value": "3a1e197b156f9fcdea92ecd631db9736b6251cc2abfe0c9384c09491a20a3be9097d7d1345f89da283ed282c11f750c9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796910, "uuid": "db7d357f-1f1f-4375-b944-1608c5723683", "value": "T16D016D2F909722534BB0728FD7F78B14CC205551BD8655587A6D074D7B3BD847A8A07C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796910, "uuid": "28bc135b-9cdc-4b80-9252-c9c331f610a3", "value": "12:9b2V0Voloio65iZCztVo6opPoAaV6lNwvZ0fMWe70BfnzdmA8jtL3tjd4XvwReLQ:9SVyoloio65Hzbo6opPoAemaZ0fMWEaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796910, "uuid": "c6436728-b619-4b69-bf72-3e60c2d958ce", "value": 739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796910, "uuid": "bd1c2ac5-dfa1-48d7-b03a-e8ad83fc3e51", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796910, "uuid": "1522587c-40f0-4f1b-88ae-96c9c1b3dd38", "value": "WTPQK979881.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0bdfc6-4466-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636796880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796880, "uuid": "6c1721ce-255a-47fe-9896-43028a7f7169", "comment": "Malware payload", "value": "982765aa079364b393c9819d7fbe28a6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796880, "uuid": "339d4953-4301-47e7-9543-679bb093481d", "comment": "Malware payload", "value": "50afc47e4c3f762c680f345d82b73188f837d0894be45c615a78da582ed436c1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796880, "uuid": "e7f2ba5d-cce7-4db1-bee4-c7753cb54366", "comment": "Malware payload", "value": "25117b3c79e7966991c7d09c1cf8c53b38a4d41a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796880, "uuid": "b4d6b316-c365-459c-99ff-e12e419ee92c", "comment": "Malware payload", "value": "b3c8c4cf7bf27fbbbe072ad1f722f65ba2ee17900f505c874e2e3c35f1254b5504494a8e39edc5046e62b92a692a770c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796880, "uuid": "d70551dd-4c30-43f6-b47e-5779661fe5ce", "value": "T10E41EF9AAF212A545342AFCF98251145CADFCCD968C89C4D6340E8C43B0092D9EABEB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796880, "uuid": "55525b9c-e1d3-426b-bc3a-7f4abd788a5e", "value": "48:uwl9jytJXA5ffbPIQD7fCCuH9GpbXcsY97:nz+yffbPlDDCNH9GpbXcsM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796880, "uuid": "cdc90968-429a-4319-9122-2706ff27b736", "value": 1893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796880, "uuid": "8f936cea-e2b8-49e7-b3fc-194b9733500f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796880, "uuid": "de2f2131-c9fb-4ab5-8f74-e857b5f85e13", "value": "Comprobante_____5667764676746662884646.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c79b32-449c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636820093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820093, "uuid": "7ac99dd7-4209-4fcf-a76c-0f553dcf9404", "comment": "Malware payload (RedLineStealer)", "value": "eab61e05d00c017bc2e4d719277406b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820093, "uuid": "2151171c-b024-4867-b836-52a589ffb7cb", "comment": "Malware payload (RedLineStealer)", "value": "52f81503c78310cb6a7636ddce30b78d55bb82022782efcb8b9d2a172af62de4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820093, "uuid": "f9685dd2-97e9-4db3-84f3-68987a305cf9", "comment": "Malware payload (RedLineStealer)", "value": "6bba60e369097452fdd4af93f0cab9bcd2c3530e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820093, "uuid": "f81100b3-f893-482e-b412-366d5cfbe649", "comment": "Malware payload (RedLineStealer)", "value": "55cda8f05349e331a9b6483db38c622b6723c9c785022a5587b732f002b5a09f122d0090fd2485de5f7ddc30802a5eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820093, "uuid": "ac0f3df4-cc11-49aa-88f4-b8524f3fca92", "value": "T16D7413032D4AF718E0F77E3342DB7AB517A32DE66A318AE61F0D9A0113521816D73B79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820093, "uuid": "767bec3e-5772-41a6-8dc4-80dec36367f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820093, "uuid": "c93c47f6-e444-450b-a5d2-37a6dae3b041", "value": "6144:pxIBt8C6MjOWw9yJueYc9oyuqdZ8o32v+CEfXoady:jU8CbcAJhYc9oyuCZ8U2oldy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636820093, "uuid": "7ac01f05-2118-4449-897f-68eabdf4a866", "value": 362392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636820093, "uuid": "9bf4ed22-63cc-4afd-895a-422ac7840be5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820093, "uuid": "32b9c19f-963f-428e-adca-872858ef2244", "value": "eab61e05d00c017bc2e4d719277406b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305f1cef-449d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636820245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820245, "uuid": "8e96dec8-0911-4b7f-85e6-8d8a870e8113", "comment": "Malware payload (RedLineStealer)", "value": "f7c8553cb5880150d68424cc2eaba1d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820245, "uuid": "74da31ec-ffd9-49c0-8614-2ad5b79fe1cc", "comment": "Malware payload (RedLineStealer)", "value": "54b303697038800ec2bff266c8d38915d0094ee0ff53468a003965bd7c9316d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820245, "uuid": "5b79a9e8-a7e3-482a-979b-28e0f147ad3a", "comment": "Malware payload (RedLineStealer)", "value": "dab6549a10369fe39c85cd1d4f0cd90844334633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820245, "uuid": "b69ecf7c-2788-4296-8879-1f39f4b4ad3e", "comment": "Malware payload (RedLineStealer)", "value": "807bc1f377470978476c43a030a7a022499215dcf79c6ddb9d4fae91139b78d8e4190e0cb7e8b4be018f194b301cf16c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820245, "uuid": "07243caa-9aaa-4062-b135-4ae675c261dc", "value": "T15B063343BE859371D4624AB56F2E6764B4397C100B288EABB3D5713DE6721D0F720AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820245, "uuid": "cfd71c96-36e4-42a1-a8c8-02c1ec8fe503", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820245, "uuid": "cffc611f-0002-4f05-92c9-7ef6d9ba7158", "value": "98304:JnH3jEn4LunvYMxNEx2zkrvH5napG5Gy26GdgSairzD3SFTfgsNsw:RtC1iQorvNl2G4zDCFcm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636820245, "uuid": "8cce0d32-ffe9-485f-8622-c78210872811", "value": 3875196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636820245, "uuid": "e4d16969-d282-41c2-8f74-97b426d25836", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820245, "uuid": "6e6abdf6-e3d1-4c49-9447-4887b6e28af4", "value": "f7c8553cb5880150d68424cc2eaba1d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b4ab51-4466-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636796687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796687, "uuid": "b5b65cd0-699a-443c-988b-65791b2da0e0", "comment": "Malware payload", "value": "988ad4f1b8f52c17f4773187764f19d2", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796687, "uuid": "ceb8899d-8cab-4a6a-b71d-dca1f73c0aac", "comment": "Malware payload", "value": "55abab66157c0bdd330e76e92d72942959b733bb23db978761a2dc4a7d0b1ed0", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796687, "uuid": "eb5215b2-6068-419b-92b2-1f17caf1ffba", "comment": "Malware payload", "value": "f2001246ef331512e9ff6816de1fa3a6ac20ef99", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796687, "uuid": "3f7edbbe-cc8b-4cbb-a8be-94876a0fb983", "comment": "Malware payload", "value": "addbb01d8d514b5df496256e59cfa563fe5f4a40df8dd7630e857dad45e3231b1a45fa98c72617e9f688db64df9190e2", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796687, "uuid": "234dde76-3149-4ef2-a34b-cf6335c17974", "value": "T1D23523B02C15347F4BED332810AE4F5D4F710CAB40BC5B75056980FBA6AE68299B7A3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796687, "uuid": "9c3cb953-72de-46d3-85f4-5913c9ec42e3", "value": "12288:/pRQkGveRycSpCLATkidQTE2DQ3wqnTDJdQIjyWpmsVkQ1lxT5qmNolHEOTj5VF:3PRy/sLJTE+QJnTDJiIjiQ3xXUHNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796687, "uuid": "16ef0a20-fb93-43c9-b46b-5f9171c47300", "value": 1155604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796687, "uuid": "375cbe92-bca4-4e5b-a9f3-d302d517bdcf", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796687, "uuid": "6cd45bc8-f97f-4a61-860e-04f1e544b816", "value": "Documento de reserva e foto do passaporte.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3ee1c1-4426-11ec-843c-42010a9c0014", "comment": "Malware payload (Amadey)", "timestamp": 1636769425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636769425, "uuid": "1c3d6032-ad7f-485b-89aa-151a2e6bca81", "comment": "Malware payload (Amadey)", "value": "84fb9566dcefb5619fe1e955aab264e7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636769425, "uuid": "78d2a792-b671-4493-8cab-bcd63f6ad449", "comment": "Malware payload (Amadey)", "value": "55bea97718d10ad6dde683d1316015e4ed475558d725ee34858b15ce8b434afb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636769425, "uuid": "150daf82-f575-4b3a-9ff5-c5230f6e6aa6", "comment": "Malware payload (Amadey)", "value": "70e9eac09836c579889bc816d503a8311da7e7c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636769425, "uuid": "1d0f36e1-a92d-419d-9682-a17877dfa439", "comment": "Malware payload (Amadey)", "value": "1932247395120e474240745376b90f05f5a340dcbd9bd8c3497b22d90d36a4c90e50cb031f54f98ec9291397facf8f75", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636769425, "uuid": "888ea419-4e97-47c7-817c-8dbc2aab2f0c", "value": "T1C7B47D25A280F073C5632833DA6BA3F2086D6D30E45099AF97543D387B356D2ED25B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636769425, "uuid": "29b0193b-f0a9-45d4-91c9-9ec51f7f9995", "value": "3fb56593721582eaf53e6d1586e50cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636769425, "uuid": "4e3d310b-6b34-4e63-81dc-74427bc29ae2", "value": "12288:C5OUkodNs7vBrCRazTaKWbZz51jKSSV2jnTFucAQZ:C5OUkodNQ5gbZz51tSVQnTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636769425, "uuid": "490665e5-bdc0-4e6f-9473-bd1c06f77a16", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636769425, "uuid": "8bf4796a-f266-46c6-b08a-660a32a88c55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636769425, "uuid": "ce26864c-c065-4799-8028-90f80c3629d8", "value": "84fb9566dcefb5619fe1e955aab264e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940ddab0-44d5-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636844464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636844464, "uuid": "6df06abd-eeea-44df-999e-4ab532187897", "comment": "Malware payload (RaccoonStealer)", "value": "5825bd27ab8d574694cbabdeeeb24e5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636844464, "uuid": "5d9ed789-cc75-490c-aed6-6053bd38f89e", "comment": "Malware payload (RaccoonStealer)", "value": "58177414ce7cded267953804df02097df17d2ca711c175bc9a1d9c0681cc3093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636844464, "uuid": "0e3debb5-cef8-4e04-94dd-e6bd7e89d2f1", "comment": "Malware payload (RaccoonStealer)", "value": "60bc25523bfe7d255caf0e8ad1ad56f584a5ce0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636844464, "uuid": "1ba2c594-7be8-4485-a6b0-154fbe63b565", "comment": "Malware payload (RaccoonStealer)", "value": "4881fed01147ffdc2a32da32b3aab28060ec3434295827f1b2d152626f929e03ffa913f86e07e1e17b859d233ebdffc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636844464, "uuid": "f1062899-4497-4261-818f-e3b6ec4b511e", "value": "T151C4D000B7A0C035F5B766F949B69268B52B7DE1AB35A0CF52C53AED86346E0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636844464, "uuid": "c950ba87-8889-493b-a828-f3e007223eac", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636844464, "uuid": "b2b0ade5-e625-40cd-a3a9-5808d210b58d", "value": "12288:TjacPJHEk5uzVED11GM6LA0p73NNFoeCqUz4O21bFU8mN3urKp:pmwuZzMh0F3NNUhh2eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636844464, "uuid": "a4cea9ef-b908-47fa-a06f-9c401d224d59", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636844464, "uuid": "961b809a-1ddf-4121-b399-d7ec7320fe21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636844464, "uuid": "dd6b12fa-64ac-492a-9bd9-b9c01db05a01", "value": "5825bd27ab8d574694cbabdeeeb24e5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef77ddfc-44bb-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636833450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833450, "uuid": "403ffedb-728e-45e8-bb31-e081403a3adf", "comment": "Malware payload (RedLineStealer)", "value": "b3e98feff2f0b394afcdf9d9d49efb57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833450, "uuid": "48acbb91-cd2d-413f-a042-177777cdf99f", "comment": "Malware payload (RedLineStealer)", "value": "591627e452beb70031affd00211cdcbb21de03baa994bd90691c10581385292c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833450, "uuid": "8febf873-0e6e-4838-b24b-f2cdddb8742c", "comment": "Malware payload (RedLineStealer)", "value": "ab9e2ce92170b51910b602621165968c9097ec6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833450, "uuid": "b814e85b-db5a-4a87-8cea-26e588bb23d5", "comment": "Malware payload (RedLineStealer)", "value": "5b80d5cce44508f34b84ce706f3780eefeee02d3d0022887ccb2e1efe80618bbe47f865dbafb93e4d1b766110733f4c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833450, "uuid": "420dfbe0-27b6-45ac-85c7-4a3514a29f90", "value": "T1C574CF533AE8F618B0516D3343FB5F350FB2BDE18A32469D2A099B051B61F016DA773A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833450, "uuid": "5a56ace1-22ef-4cef-a237-6c18392428b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833450, "uuid": "3fea2499-1fcf-460e-9619-dd74ae37718f", "value": "6144:zV0MVCpT4w4ztCtTHZXzriJl1zaxV0JI/2Hk0:hb24FzEtTHZXzeJXz40JI/r0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833450, "uuid": "293c32a2-b644-4281-a751-6af4d6fb55b4", "value": 338840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833450, "uuid": "706464b1-0b48-47f3-940d-586ec4e1c871", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833450, "uuid": "f936ea08-1743-45f3-80a2-47cc93c6aeb6", "value": "fortnitehack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48204f24-44c3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636836606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836606, "uuid": "0b74e93f-5aa2-472c-9ff1-13cc8a266b13", "comment": "Malware payload (Mirai)", "value": "adb915fd5094e7a613d88b4890a67416", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836606, "uuid": "ada4e707-2334-4359-a3cf-b4144dbb52b9", "comment": "Malware payload (Mirai)", "value": "59597632d8565cc0621ce09dc98d311be440bfa555a0b8e1fb39f50f8a53dbad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836606, "uuid": "f6982a90-4cde-4654-9274-ee1cc9ac090d", "comment": "Malware payload (Mirai)", "value": "81a8a9bb477ca6c5de1bb83ef7998876ff34ee20", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836606, "uuid": "fb992cb7-81ca-4890-9d62-9cf4270c6c20", "comment": "Malware payload (Mirai)", "value": "f6fc7e98da4635d7e1e3c7c3bbb03f831d24406a0e466f2ee50d150d42f7adc86245022395806348281f7575293c4d04", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836606, "uuid": "229b12f2-e10c-421b-b182-96135248aba7", "value": "T19EF2F1A2DCFE868BCA39227798DF340F1921E4ABC53C98C7D1E8107E8096F6729117C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836606, "uuid": "19e4ab87-6856-4cc3-98b4-0c7367761022", "value": "768:0wXR2TsuMHO7P4wOXPtfAyOHXC1XT5jpr8xUSe1SnbcuyD7UHQRjH:0wXR2TsuwEcXPt4c1D5lYe1Snouy8HyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636836606, "uuid": "bee5d3d4-9134-4fb9-a27e-2b38a799adcc", "value": 36244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636836606, "uuid": "6c50c89d-8b1d-49e3-bed0-495e93bfc28e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836606, "uuid": "03f3bb1a-7c21-4982-bf2e-66310b2f502a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8ebb71-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831248, "uuid": "0f3ee28c-3157-406c-a25b-530674f4bee6", "comment": "Malware payload (RaccoonStealer)", "value": "b584c89f975eb9b55b9bc9cd73faaec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831248, "uuid": "386e96e7-7a79-44ac-a7c1-00f10e94c7d7", "comment": "Malware payload (RaccoonStealer)", "value": "59f5b3b26ae37d44bc12ccb03292611a6074db6a1ec6675f77bac0153f4c1357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831248, "uuid": "8d4e7150-421d-4927-a710-e51f513b81cf", "comment": "Malware payload (RaccoonStealer)", "value": "a7dfaabfa4277df3555e4e1a659742d1b3814775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831248, "uuid": "ac44aaa9-2aaf-4cd9-aee7-999d0fb918ce", "comment": "Malware payload (RaccoonStealer)", "value": "541ba1aa9d63435670cc739dc99d9d91105675185143ea3b8660f76b211b24f86686425599e06e36382ededb4eac7b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831248, "uuid": "45834be6-0c80-483e-8b64-b14604508c89", "value": "T1BFD4D001B6E1C034F4B712F949B6A369B53B7EE2AB2454CF62D526EE4674AD0EC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831248, "uuid": "ab5d9635-94cf-4c8a-807c-fc9b75c97303", "value": "17d363df494bcb38053d0872594e66c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831248, "uuid": "d8568f1f-538e-446a-ab0f-0d5f388f9aee", "value": "12288:TaIkdAT53LxW/P0uiFsgLRubFmwprlrLPIyyP5T1YYO:TGA97xW/PcUFhBl3gFTLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831248, "uuid": "97fd4dab-f6d3-48bf-aaf4-94577cb6792d", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831248, "uuid": "01332436-3a6e-4a22-9beb-f75054cf2f05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831248, "uuid": "6f229e6a-e6cf-4dd9-8b43-ceaa7236d16f", "value": "b584c89f975eb9b55b9bc9cd73faaec7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5597e55-4460-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636794376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636794376, "uuid": "ff70552f-289b-49bf-9344-8884ce077058", "comment": "Malware payload", "value": "9ff93d97e4c3785b38cd9d1c84443d51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636794376, "uuid": "a4f44ea0-0168-4a4b-8bae-a7ab8c4dee70", "comment": "Malware payload", "value": "5c269863992aa5b22c8b3d09247c33bf75504ec5faf116bdb5bc9efa1793a26c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636794376, "uuid": "5ba909fb-f6ac-4171-9922-ea179f179a56", "comment": "Malware payload", "value": "17a49846116b20601157cb4a69f9aa4e574ad072", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636794376, "uuid": "ddd3b25e-1cdf-4d41-9bdf-8fde8de2194f", "comment": "Malware payload", "value": "a3e55da76f66fd4acd1fc4165a3afb04b12f943fb5fbdaa2be52b3169ab0cb95cbe7ed183e23af3b43851f0146ab1d5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636794376, "uuid": "edb120d6-af62-40d3-b06c-9c7b76b321b5", "value": "T114548D10B7E0C034F5B752F849BA9378B53EBAA0AB7495CF62D116E95674AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636794376, "uuid": "e3766922-b0ce-4694-b486-036f7f4badf1", "value": "7f33ee523ae6aeda6f666d7f1fe6c7d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636794376, "uuid": "a0b0cd48-bba6-4aad-8d5d-ca6c8812e00b", "value": "3072:1SSbg0NFjtuVHpnhKFs4h/bYBc70SDqgwoa+4Tc/spSIm5RHW2eQYJ1V+TBGTU5L:pntuV2j0WDqDP+4TctIKRHWhptTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636794376, "uuid": "ab4fd537-8f14-4313-8414-b48958cf1278", "value": 293888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636794376, "uuid": "cf6241ed-98b8-4c02-8d48-e83d271ae7ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636794376, "uuid": "d7848f92-9f7e-4437-99bd-b46f3435a881", "value": "9ff93d97e4c3785b38cd9d1c84443d51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb077b54-44ab-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636826571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826571, "uuid": "139376ce-01c2-4ed5-9be3-41a660c0c5c7", "comment": "Malware payload", "value": "d16b1ea79c4617469782b613638c0e02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826571, "uuid": "135a2dd0-bb63-45bd-867a-5a12cce74ebe", "comment": "Malware payload", "value": "5dae45e24e9ba77e0384bab7d981d91bc610fbf1690a86fc6cbd30fb343ed0ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826571, "uuid": "ffe05243-c868-4fea-a412-f9951a7143c7", "comment": "Malware payload", "value": "4e3a1cf96c3ed55d781760fb63fc83ee791afc14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826571, "uuid": "0b391197-ffa9-4ce5-9425-f382c8ba0034", "comment": "Malware payload", "value": "34f2c3810ae8089d63f8c07cbc5e4fd1b4cd2fd7ad94b70e702c8e81438369838a8358b1cf790f7bd721571db2db1039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826571, "uuid": "73cef655-3de5-4e77-bd44-31b73cb1f9a8", "value": "T131055B1162A69152E3641FB0AC782A8B48382DF8C7BCC5E773D0277D06BE5F254E5B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826571, "uuid": "2d5941a5-e769-40db-ba6d-f9abd195544e", "value": "fec6b51b8b6036276f67493047b0f572", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826571, "uuid": "a05c69e9-b47b-495c-a9a7-4bf571492834", "value": "12288:Ee9MkSKkKBvQ18tNoir755PQVUnKrHru4GY9j23oaBIQuSLtkzvw334:VkevyiNoijPQVcKDj03PBIQMzo334", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636826571, "uuid": "987d829d-7b62-4e70-94b5-d48aad2e1538", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636826571, "uuid": "8526d890-86c9-4345-965d-e0d355a05108", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826571, "uuid": "cae05a0e-c522-41b9-9b67-5e250549a5a2", "value": "Eris.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9dffad-4486-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1636810652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810652, "uuid": "46cc2923-d2b5-40e5-9cbf-da0e6fa81341", "comment": "Malware payload (STRRAT)", "value": "9bc581bbc0e78090068dacb634f785e0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810652, "uuid": "80057916-4b53-424c-8bdd-48fa66359380", "comment": "Malware payload (STRRAT)", "value": "5deff3d958382466f480b4044c6620f6d585ef34bc55b97bd128d4c4970e1a6f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810652, "uuid": "7bb607bd-171c-48bf-a07f-c27ac18d281a", "comment": "Malware payload (STRRAT)", "value": "b616326566382a457cf108489892f8c5430b2c03", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810652, "uuid": "e9de0024-566f-43cf-be8b-836222054b81", "comment": "Malware payload (STRRAT)", "value": "700a3f7c6c66b25545d24d62ebdbd059e5faf18ae4258f68e4c0636f9fe1a4ffe631b4c03c1601b0e14cc3e07478ef5f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810652, "uuid": "30dbd146-ed73-442c-9197-82442b72a376", "value": "T1EF156B1276878632C4821131596FD7B01A39FC214B7181C772ECBB9E2FB27D0A7766DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810652, "uuid": "849c1be2-af4c-4849-98b1-dec6b7734d32", "value": "12288:GP3J9u7vfDE9Q23Nn7ByIuyBlpOuq+8wAb19QtN:GfJ9u7vAq23Nn7BjlpOu3dAMtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636810652, "uuid": "aee85acd-756c-4932-a5cc-313627666d41", "value": 901092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636810652, "uuid": "c7f08f29-c1e0-4f93-88de-105ef6f9becf", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810652, "uuid": "b3163f9a-e44b-4484-aacd-e782e179c926", "value": "infoupdate.shipment.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8d1729-44ce-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1636841475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841475, "uuid": "031fa3db-16b9-4b37-83cc-2909976ddb2b", "comment": "Malware payload (Vjw0rm)", "value": "93eacadf5c9ff492f46b65a26b063095", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841475, "uuid": "17ac50a8-6c27-499f-b0c8-3797bb96757a", "comment": "Malware payload (Vjw0rm)", "value": "5e8039fabb4fd18f30f2a7ab9c416e75382e90204ab32d84ec1d103dbdeb4227", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841475, "uuid": "246857a1-ec39-46ee-b182-7d4c0f036b64", "comment": "Malware payload (Vjw0rm)", "value": "22648131259412680ba20763163d533b43c15d78", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841475, "uuid": "c298937e-7bee-443a-a8d7-18180a683117", "comment": "Malware payload (Vjw0rm)", "value": "c9e3ffaf88746e1e92b7fd861728f09ddcd704a013c4cdb3a4a025aac132f51e5ecb0c182f4dba35d1cdeb5858128a68", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841475, "uuid": "09301438-d146-473a-87db-760b767ececa", "value": "T13D81109C2C5BC63C53D23B8A902ED148CDF548B47F28D2B6148CDAC5360E97987B19BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841475, "uuid": "896b2d43-b209-4219-a5eb-2be723a1ca2a", "value": "96:SABNo5DRk2c24ZRMHXE6/BIs+Ys+fJ/l+5DdQqR7bJyKhEOS4UK:zSa2c24ZRMlBIXYs+fJd+VfRfNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636841475, "uuid": "3adee53f-c333-4206-b39e-b15cce73b81d", "value": 3885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636841475, "uuid": "77ebac2b-db59-4e51-b6f1-15e5414d94b0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841475, "uuid": "80dad42a-65cd-4989-a775-e5e553404edf", "value": "SC190567PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fdb3639-4466-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1636796649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796649, "uuid": "0ee76590-ce03-4ff3-af7f-9563acf7c051", "comment": "Malware payload (BitRAT)", "value": "02095f7fbe9aada16586666e2b1f5f1e", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796649, "uuid": "35dd16d4-0fe1-4c07-bac8-6b8f30e3f65f", "comment": "Malware payload (BitRAT)", "value": "5f321a80d688e137c01dc1220eadf0d50354252b2083bdac7f3a6725ce08d6a0", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796649, "uuid": "4c38aea3-a9bf-4fa1-96e4-383c6952520f", "comment": "Malware payload (BitRAT)", "value": "f0e434ed3aaf154e309e463b6b974ed129db5b4d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796649, "uuid": "bba82ffe-8b38-4ccc-afff-b80aaee5ca7d", "comment": "Malware payload (BitRAT)", "value": "b81052a67cb0d6672665736f4b3f85d1844da7926b4423d24337fc118be1124f499ed0fe036c27b6c2dffd5bef9b5fe1", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796649, "uuid": "6ed7e4ee-1777-4394-866c-5cf20e333fba", "value": "T1C685335836A93425D73DDE7A5C740D4006742462FAA2FF9B3DAA9BBE26993C00100FF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796649, "uuid": "b068c48f-327c-4747-aab2-901bc9a39280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796649, "uuid": "eab4ec9b-2b3e-43ee-b57d-62ee6ece8220", "value": "49152:JQEEerry9NeDUXbMi11NH+vAsdmf+2sk:JUeqW+tbUHsf+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796649, "uuid": "24441fc0-f7cd-4e4a-8971-b7dd7f58da14", "value": 1799680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796649, "uuid": "f47cb16a-313a-42eb-bb93-bd2f5f809494", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796649, "uuid": "c75394a3-3b0b-4631-b670-b59294d265d2", "value": "DHL_Shipmet Parcel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc863fce-4466-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1636796911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796911, "uuid": "d806b6a5-55dc-4eee-bef3-b5bb8fb9dada", "comment": "Malware payload (AsyncRAT)", "value": "e26edb171a7b2b411e6e453ef82c5269", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796911, "uuid": "99ffca56-05bb-42ed-9867-f14afdbba69e", "comment": "Malware payload (AsyncRAT)", "value": "5f6a0e347bda3ef1484f9a987931cda0ed68da9ac9eccea81cf51b54a3967d39", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796911, "uuid": "645b5ca3-a09d-429f-8543-ce9247b9eb56", "comment": "Malware payload (AsyncRAT)", "value": "aefdca0e61121478ed849230b584711eb99546da", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796911, "uuid": "aba084bb-5c63-47f3-8c04-e3f2a4c5bfe9", "comment": "Malware payload (AsyncRAT)", "value": "7ecf69bb5012dfca0ad4546002433786896acfaece5abe4da86256cdb8aa9ec27d3f93b119836204aab7519da4d0a255", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796911, "uuid": "16c77f86-f71a-450c-8258-d51b46bbd56b", "value": "T1FD3167EA126843D54AF378B2015BEE824C6733CF8ABA8E6E1104CD15E9D43DB3657CC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796911, "uuid": "151a40a7-b7de-48a7-b36c-f74218880b46", "value": "48:BFJlIblUMAoIizRtX8mA8wZcZSeM855zL4:B7uBUMAoD2ZySeMKzL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796911, "uuid": "61047a1e-a9d4-4247-83e2-37da9ca28ff6", "value": 1559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796911, "uuid": "58241e09-dda0-4755-a225-e41c88e691ab", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796911, "uuid": "b205688a-6338-45c7-9b32-b62cf086d492", "value": "AWB1145235666.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c257e0ca-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831227, "uuid": "63c4a2c6-1731-4acf-8468-18b2d671a74a", "comment": "Malware payload (RaccoonStealer)", "value": "21c90d672ce8b7f7b26a73a317a1e582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831227, "uuid": "75d2b062-77d6-426c-bba4-373798c8dfd8", "comment": "Malware payload (RaccoonStealer)", "value": "6266bbc36a8b0d3046013224a77c22a79dd7f2e97d4d33689f76a92c6ab7f2f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831227, "uuid": "b1054b02-7b3e-46ce-ac62-090a982f0977", "comment": "Malware payload (RaccoonStealer)", "value": "91545cc63b064b18a58d59934573dcb5931891de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831227, "uuid": "a1b4f2f9-28d9-4bae-b6b1-2c59ef43b077", "comment": "Malware payload (RaccoonStealer)", "value": "aab6d52d000d8a9068655f59d31698cc5ad60374585f152000d39b066eb15448a65d0f3e7c5846ad45be511518d8c226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831227, "uuid": "522b8eaa-8ef4-4b84-b535-7c5cded796f1", "value": "T151748D00B7A0C035F5B216F889769368B53F7DA2AB2594CF52D42BEE4A746E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831227, "uuid": "16be0f6d-0736-4e0f-88b5-6acb5b238038", "value": "ea99ca467492cc4d133feba5a83ca2ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831227, "uuid": "7c3f416e-5dc8-4232-b68c-0c3ca8a593fc", "value": "6144:90OATbTCgipv5M6+JjNhkYsQm2ZBpN2o4/8UYu:9KixMHjNhkYsQm2ZBpN5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831227, "uuid": "3d53b023-80b7-471d-aa44-c5002875cc54", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831227, "uuid": "7cdbac11-317b-41ca-981d-45a0d5b43fb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831227, "uuid": "070b9fd7-8e7f-4969-8223-78eb68b4d65e", "value": "21c90d672ce8b7f7b26a73a317a1e582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa690b4a-44bc-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636833898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833898, "uuid": "e8a8245a-9b67-4897-828d-5b9c24d371a4", "comment": "Malware payload (SnakeKeylogger)", "value": "2d89365f7751f810ed46b63bc2011bea", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833898, "uuid": "8864639a-4801-4453-949f-a8922d0a7755", "comment": "Malware payload (SnakeKeylogger)", "value": "63fc612c46d976a38b2cc7ccfa8cf102730105264b996b2be8975db9d27115fb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833898, "uuid": "2f3ad6cc-1c19-46de-8769-2f5179d63433", "comment": "Malware payload (SnakeKeylogger)", "value": "ab080fecb8b98b96a8cdbd9cc257b98e673c5dd9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833898, "uuid": "41b93355-c903-426d-8741-27ca0e8a1301", "comment": "Malware payload (SnakeKeylogger)", "value": "6c6560415f2ea4328a20304e3b3dabd50ae648619a3e6236007fcf0bcb620e8bc5b99160dc08825aad356f61a5d7c0e0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833898, "uuid": "04b1c991-c74a-48e1-9be5-7e2c914fc2bf", "value": "T1DCD42392B1D4DF9BE41B66391CC3D09C7E18FC889E6DD20B3A45BB5F4EB97358202819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833898, "uuid": "3e5e2aa4-34e4-4119-941c-79a389f64f78", "value": "12288:XbqTtukI4DLk+N76BI7G+eDYYQgc6gID6ijVAm5vbZ82NHKLtO2x:LmukI6Y+N7uDgl6gI9VAm5vzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833898, "uuid": "cb01fde3-1c75-440b-83c0-83b6205c3462", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833898, "uuid": "b46c918a-8609-47e2-bf02-dc2d43afd92c", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833898, "uuid": "1e1f662c-14d5-4597-a7b8-1244ec2661d5", "value": "Payment-details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30837ba5-449f-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1636821104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636821104, "uuid": "b89ed03e-da07-419d-965f-670d458096da", "comment": "Malware payload (AsyncRAT)", "value": "71eba37c406bb95b1ea2a531838af53e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636821104, "uuid": "4a8b3627-5b8e-4b21-b6e9-01faba764ec3", "comment": "Malware payload (AsyncRAT)", "value": "64a8750ad0296a8091abe82794d15f24ccc48eefeebba736e07638cd9fcb6f13", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636821104, "uuid": "6aafb771-d1b6-4259-8fe9-18757854b214", "comment": "Malware payload (AsyncRAT)", "value": "49761fc53e6cb0d7238980c7aa9f5d4aa03f41d9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636821104, "uuid": "511a9052-37fd-41be-9c50-c2d3d72d0e39", "comment": "Malware payload (AsyncRAT)", "value": "0d366850a2230a29a8a819fcd023d74c08577d7464f56c63c5d5f832b712a9bd0b49ed35ac1c9b32a7e36c3979684932", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636821104, "uuid": "7a1ad0b4-994d-47d6-8094-46d971efeed0", "value": "T16E01A28EF44B19630753F093D1E79E2CE9510446EAE0C764B66543FE5752C9079DC0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636821104, "uuid": "2a4b5f1d-50f3-47c4-9965-04b1618c85a8", "value": "12:/CV6SsJiCC/hreoYlNwv400fMWNfBgzdmFWz3RVZbh7xtj33zAhUEoHsan:qV3l/hQa400fMWGAWrT7z3zAQsan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636821104, "uuid": "34f0451e-1348-44a3-b786-443b8342303d", "value": 662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636821104, "uuid": "303ef653-3f1f-4996-bc36-0b1d77fcda58", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636821104, "uuid": "3ba579c7-8e3e-457b-8fc5-c315aa11cfcf", "value": "rSPYUJZB.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d1ba20-44c3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636836607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836607, "uuid": "a2c66a09-2def-43e9-970c-175eddc3e376", "comment": "Malware payload (Mirai)", "value": "7ef2d642a891c9b18c2d6f0963267b53", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836607, "uuid": "e305ca63-bebc-4cde-809e-777f6788cd9b", "comment": "Malware payload (Mirai)", "value": "655fc35862816310c82bd26eaa5d08ca8fc7d393fa0d5624ae692ca0703055d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836607, "uuid": "a8ea4b84-0a8d-42fb-8ed2-a8885a4b1d4b", "comment": "Malware payload (Mirai)", "value": "b5e6fbadd992adb03427b33ca57ca33481ee5c72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836607, "uuid": "6e22ed38-dbef-44b8-a292-9175ffd108e6", "comment": "Malware payload (Mirai)", "value": "e6f003b104c7cbeb4ed86b2dd49195b37bcbfd3c087f15702b0c051777b92834ce3b4017c4a534b1e56c8c7ae8c8edc7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836607, "uuid": "648d7681-ef15-4146-ac75-86a993550c3e", "value": "T1ED03E12747D579E4C9B40535A67FD4E6E38217B445F2ABBD31006BE4A3C824323E53AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836607, "uuid": "9000277b-d42b-4005-97f2-f2df9fa642f0", "value": "768:rFDuUbk6s2BrnbdN3weudVmqscoo00qCOUlvLl7Rn14STs3UozwkQ:rZJQ6s25bd1wfyqspxCOQxdWS+zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636836607, "uuid": "793f1e23-d93b-431f-8038-28ae3f1d1136", "value": 38468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636836607, "uuid": "c165dd07-1bfb-4d63-b308-b0415de34e23", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836607, "uuid": "7176505b-bd46-45b6-9ed6-da739f9b735d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81136f9-446a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636798676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798676, "uuid": "c9acc267-c121-46ec-8df2-626035737a3e", "comment": "Malware payload (Gafgyt)", "value": "3b52f0d6d17f5f668296365659e74745", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798676, "uuid": "65801a9a-c2c5-4167-a980-3efbe25c3616", "comment": "Malware payload (Gafgyt)", "value": "65849d36b28520bc95d2ab15c2d2048b0550a1d92558e5825b977a136e4a9515", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798676, "uuid": "d77aa833-bc5f-4c38-9932-e11b010eaa31", "comment": "Malware payload (Gafgyt)", "value": "e7e4d95a34c3ba3cbc98f5ee82735b9375fe2296", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798676, "uuid": "9950eebb-5da5-4a62-b4d3-8e33dd23c367", "comment": "Malware payload (Gafgyt)", "value": "c87992585347135cc3948cf63fb6b3cfb01655d53c5cf7159a24d3209fb9995f9693b81ae6f7985a573cb9e3006b5783", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798676, "uuid": "e6f98f63-c1f0-48b3-b932-2b251ebbee77", "value": "T1D3B35B4794215F73C047AA75A8EBAA300716A9935F9F1A8A71385BF0034F5DEB40FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798676, "uuid": "6b7afbd3-1e9a-4b1f-8405-d6b91e0cb97e", "value": "3072:d+1FnpoRD8qejl2/O45h0nv/2W+mjI0q4+2flue:g1FSuq0mO45h0nCmjI0q4+2flue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636798676, "uuid": "01253ebb-36c3-4b4e-aacc-80a762260b50", "value": 115213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636798676, "uuid": "7eee53df-f56c-4d87-8664-1617b70428bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798676, "uuid": "8335ea05-db27-46eb-a03a-521f0e14c42b", "value": "3b52f0d6d17f5f668296365659e74745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16708e52-446c-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1636799156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799156, "uuid": "605251e4-8745-4442-8398-80cfb5cb41fc", "comment": "Malware payload (BitRAT)", "value": "1c7f2bd4a62681721653066adcdce977", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799156, "uuid": "a0f0bd74-8e24-4976-89cb-98f386b51839", "comment": "Malware payload (BitRAT)", "value": "677890096bad46b0e589094bc7bf25ec5ce8f54161422548da6a253dd387655d", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799156, "uuid": "a3fe9f3d-5d7d-41a2-b01a-8f6404ec0fa2", "comment": "Malware payload (BitRAT)", "value": "c77f9e08ee7bd045df0837b4ba6c54a42e2fe385", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799156, "uuid": "309a73e2-ed17-4171-adee-c2ef414d756f", "comment": "Malware payload (BitRAT)", "value": "2f7fd18a6652a8973d36b7e792d85df9256fcbdddef5e74065474a82c43a5a24eeda2a447e3713b9c0d99cfd3425b2dc", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799156, "uuid": "5394b22e-ac13-4bcb-acb8-5da2d1086242", "value": "T110056C22AEDD9432C16E16358D17B7659825BE0139D4A8B676FE3D0CCF393813C2A19F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799156, "uuid": "95b036fa-a887-46ea-9300-ecc7faab16e1", "value": "771d05838293a8356c469b98086d5fef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799156, "uuid": "806ef235-7316-43ce-8e21-d53bcb150d8b", "value": "12288:uBI5fjs/RGn87z7htHHqdmKRcdbmfdRa1P2AI5mlQ45DgyYLaSU3dyBL7Uo2jfnz:Bwq9NofGKsPArGfhFEvOcld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636799156, "uuid": "bbc2743d-069c-4eb8-9839-e7d003861186", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636799156, "uuid": "18b5c41a-e301-4d46-9a04-eeeb1af2853f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799156, "uuid": "d7467ce6-548b-4385-b475-4b5a06172009", "value": "Zjlplybnevshbsykrojjqajtzjofayyayb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8d1be0-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831301, "uuid": "1de3cc64-b888-484f-993a-f2f2c27fa0b6", "comment": "Malware payload (RaccoonStealer)", "value": "87f689568dd4bef5c1d82ebe2b9972fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831301, "uuid": "7426ef7b-1523-4a4a-a7e6-546f5cd04cd9", "comment": "Malware payload (RaccoonStealer)", "value": "6dfcb0213344348d16738cdfb03afb66eafd9e569a923d256608c2711be4d1dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831301, "uuid": "943c635b-4be0-47ab-ac7c-5fea710d568e", "comment": "Malware payload (RaccoonStealer)", "value": "1d2043b653732e8943134aeea7e4abbd9bfd8429", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831301, "uuid": "eeff5589-1c68-417a-a415-41207be2b9e4", "comment": "Malware payload (RaccoonStealer)", "value": "6bf49f4b0fb6f13a57b0d4d207e4e507c747be5e150cb98e7ac5ef9b2d89aa705de9f8bb5af5be6f377d8bd23ce4a072", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831301, "uuid": "ee22eaf3-b9ae-4c92-9e75-f0fe6cdcfae4", "value": "T13CC4D000A6A0C034F4B767F94AB592A9663E7DB2AB3590CF13D527EE56346E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831301, "uuid": "00511149-2d31-42b5-892d-cba3a78f4679", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831301, "uuid": "173c0e4c-4831-402d-b298-cef154882e54", "value": "12288:nqT6PDjXfCvEv6B0iju0e2uDqy1mXwvr0YN:q8e8i2ijw28vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831301, "uuid": "8791f9ba-6a91-46b5-b1f9-f156063ae6b5", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831301, "uuid": "74c1e1e3-ce23-4135-a319-505fcd24cb01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831301, "uuid": "d096c841-8aa9-461f-9ea7-48ab5b437ca0", "value": "87f689568dd4bef5c1d82ebe2b9972fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cefe707-4455-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636789262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789262, "uuid": "62bf4075-cfa7-4a06-a3f2-0f4b123fd1c4", "comment": "Malware payload (SnakeKeylogger)", "value": "d4291079ce5e2dd844d16b495cadab57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789262, "uuid": "bacbe615-79d3-4b21-b08e-5b8a5159c53e", "comment": "Malware payload (SnakeKeylogger)", "value": "6e89c8881474efe9edb9dc441e837b17dc3fde446fc557d2acd7b91b78e84727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789262, "uuid": "c87cc269-a583-4a73-bd77-61e012e54ef1", "comment": "Malware payload (SnakeKeylogger)", "value": "e03b03edf44253e82c02689d5914217cdc0e9cb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789262, "uuid": "3c3ca402-dc37-4472-b2a7-47f6c59e11a3", "comment": "Malware payload (SnakeKeylogger)", "value": "715d70540ed38fbb5f4106e63c059669a0157fb62df6a23ad2a61182d26aa582165ee30baf89589146f3d6c71a15f3d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789262, "uuid": "d5a1c654-a48b-4665-bb7e-01f4678d2c1f", "value": "T190440115E5FD72E9D854A6F95C5271543720EC21181A8F3E9D8830BDAE32B62017BF8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789262, "uuid": "ba41f8c2-5812-464e-a2a5-9e32495c529c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789262, "uuid": "a5ec7b33-73da-49a6-8415-3c390126fbd5", "value": "6144:Q2eH6nTyT1oPBomoxYU6+MJ0wtCJjW6a5cTT:LOmZfEYUdMXte65C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636789262, "uuid": "726bf184-ac36-4769-800a-dce1f5cb1cf4", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636789262, "uuid": "6d5dd265-b816-4ae1-8495-291d26a77476", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789262, "uuid": "9233e479-a388-4d19-98fa-4db20cbc4ed8", "value": "Temporary order (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21878767-4467-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1636797027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636797027, "uuid": "f9a15532-7277-46f0-bc8b-48827500e565", "comment": "Malware payload (AsyncRAT)", "value": "898f46f2714d3999b195207765753c19", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636797027, "uuid": "243053f0-9e0b-49c0-b1a3-5b8b3b3ec295", "comment": "Malware payload (AsyncRAT)", "value": "6e8ec031aa14b689b7db1e91d18c309b337427efabaa3385c987f40231ce4d41", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636797027, "uuid": "01746383-ddb2-4bea-81af-d870581fff4d", "comment": "Malware payload (AsyncRAT)", "value": "f821940a51c9dc0173be487f6604e29836d31bc4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636797027, "uuid": "94839ee5-5c5b-4d40-b163-2930de8bad01", "comment": "Malware payload (AsyncRAT)", "value": "d1097422745268d107be287cf5f4227de779453a8dc7bcd188ac370c42d7cfcac96ebafd32e20ef08490575bf7139030", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636797027, "uuid": "0a9bc707-572f-4da1-ad21-5325ae8a838a", "value": "T109318D3CFE6365860D31ED2D936A5EE3CCAC1417CF70E531519943898672875295C06F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636797027, "uuid": "26fa3450-0ffc-46b2-b793-510d28676bab", "value": "24:p4OtGAKvzjepfMWPnwJASMVQ6xV3cJeWB23LV7ANAtGApaAdZJA4yoQNAx4hfLOC:egG/vWpMRALxsJDIZ48Gdq9ce4hfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636797027, "uuid": "c8f962d2-6790-4557-b8c7-e42c173364ba", "value": 1509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636797027, "uuid": "5d4821d8-edd9-42b5-a5e2-30311ebca1bb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636797027, "uuid": "4980bf53-f847-4e16-b507-ea0d4b6dbdf4", "value": "Invoice #3291.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f673f985-44d6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636845059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636845059, "uuid": "808dc8f2-4ae6-4231-ab44-ebc4ecd55298", "comment": "Malware payload (RaccoonStealer)", "value": "94cdb7d747fb129a710b25bb4044b5a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636845059, "uuid": "1709845c-1007-4ba7-8688-4dd017c49aef", "comment": "Malware payload (RaccoonStealer)", "value": "6f391d149f103ec2e7eb5af33aa119d7977caa80a815d388044d50abc0607a72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636845059, "uuid": "4f821f03-7e54-4087-ae44-d5e72297888d", "comment": "Malware payload (RaccoonStealer)", "value": "99c604bacdd53f192b102c3bd08da41fe6f29f6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636845059, "uuid": "29cf799f-fe06-4698-bd0f-96ec5abd7342", "comment": "Malware payload (RaccoonStealer)", "value": "104d9da21b1303c3bdee5377c23809eb70802d73af1fec06d81e666414e337fad6ec9bcad95a7629ccc4c3f88948f981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636845059, "uuid": "59d7038a-1cf5-4cfc-9e2b-c23a93fd3d99", "value": "T1E4C4D000A6B1C035F4B716F849769369BA3F7E91A73495CF21C92AEE5634AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636845059, "uuid": "bf0d3081-8b13-4ed4-b6c3-5329f904f490", "value": "6d58d46cb4da553c2a028fd56457c4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636845059, "uuid": "6b6ce98b-ca6a-4d98-a2c4-73f8e809cdfc", "value": "12288:21kcRxVxvu3AtKAWfK70K+m21sc7TlujI:qxzxG3AtKAW++Hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636845059, "uuid": "c660dbb0-59b2-45fc-9e3d-cdc41b70bd56", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636845059, "uuid": "e0ac1911-7018-4472-b0c6-11fe21b000fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636845059, "uuid": "61ac05a0-af38-44e1-9a00-9630af2ca9e8", "value": "94cdb7d747fb129a710b25bb4044b5a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c1b693-443e-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1636779697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636779697, "uuid": "c97a4831-056f-4cae-b1f0-57a40a5dd208", "comment": "Malware payload (DanaBot)", "value": "07ab47ba492cb4ce3b9255ecbfb543f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636779697, "uuid": "c357f07e-01fe-4465-8c89-e7fde95ad99b", "comment": "Malware payload (DanaBot)", "value": "6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636779697, "uuid": "fee76fdf-bdd0-4510-8406-da419b62f2cc", "comment": "Malware payload (DanaBot)", "value": "b86f8aeddddd245f0198ad92ff6cee605cbe1d4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636779697, "uuid": "610980df-33bc-4f44-8e8b-1931103b74ee", "comment": "Malware payload (DanaBot)", "value": "058ecefd2c839c7653ba0c21a872b65409688e417ad86dcc89a7e2a3a7e598709a0fabd4e957b39bb89f8ca86d1fac6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636779697, "uuid": "9fcceb92-a7c8-41c3-9b61-3f7d4b491fb4", "value": "T1D5E533039F91A02FE2656F35A3A08B173FB5DB582774EB0D13014ABA3E13B559C4866F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636779697, "uuid": "8aa51592-6acf-4f94-b6f7-664e4b17d335", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636779697, "uuid": "84a6b8e0-b949-49d7-9e41-4426a497868a", "value": "49152:fb1ZTEb66GZQJAaYqh3owdV+xYtb/Khu0Ar51hRzEHgR8wfXhxld4sl9O3/TvHv0:5ZQ+6uQhYEom+mtkQ1hRwH2X9i/vFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636779697, "uuid": "139c2740-83ea-4adc-9599-0b83e9f8041f", "value": 3137354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636779697, "uuid": "996357b6-bb40-4b05-be3a-54d57ec76697", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636779697, "uuid": "0b92c598-a1b6-4fca-9f5f-21465fe582f5", "value": "07ab47ba492cb4ce3b9255ecbfb543f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3fe473-44cc-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636840641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636840641, "uuid": "3406f701-7e67-4017-9173-8d6114e448dd", "comment": "Malware payload (SnakeKeylogger)", "value": "bcf64360f1b1dd0f4dbb00f69fb1637c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636840641, "uuid": "1ad0a294-80d7-4a71-aa3d-03b8fb68bb53", "comment": "Malware payload (SnakeKeylogger)", "value": "6fe626105e92733a8c3119e1636c72daa63ffa0fde2407c654c2f9ffe3f77ae7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636840641, "uuid": "604d8831-80f8-48c7-8a44-7b1c78cc72f7", "comment": "Malware payload (SnakeKeylogger)", "value": "87692e9d99708b33f46f9a8254797c4156434006", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636840641, "uuid": "6c237519-a3e2-4bff-bfb1-c2a161475333", "comment": "Malware payload (SnakeKeylogger)", "value": "7ad80d54445b6d611bb59d711b997031417bc262d5326427fde6753aa887a2bd32aff8f7c616cda0087de9a4881994b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636840641, "uuid": "aa1d25a1-83b5-4fab-b069-3eca74aad273", "value": "T1CCE4330D2E00057BED5CA931C51D2B0467510EBF2A46EFA7BB4631C3EB373D5686B8A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636840641, "uuid": "8bcbc8a5-34a4-478a-908c-a9738649235e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636840641, "uuid": "64264d5c-604d-472e-b1de-ceb1c8688a7c", "value": "6144:r+OKUvf9I4553Lz6cF7OHwuRHXVckUJa4hUL8JFSSlBJZOXu:r+8vf9IILecSFXspyL8BBJZO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636840641, "uuid": "71e1e57d-33a7-4c1a-b909-dfbd00d7143e", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636840641, "uuid": "0a0d87ad-eac0-40e4-943c-1f58f6c8b465", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636840641, "uuid": "3e969ed5-0482-4d14-a4dd-98bf0e7cf876", "value": "bcf64360f1b1dd0f4dbb00f69fb1637c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d8ce1c-4486-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636810644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810644, "uuid": "7961845d-8b63-4ad8-b32e-b4dc9a1fc716", "comment": "Malware payload (AgentTesla)", "value": "da051b9706014641337025acde89be98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810644, "uuid": "4687c31a-d3a5-4cae-8418-09eded37113c", "comment": "Malware payload (AgentTesla)", "value": "70ac9a290eb44a379cc20387c0ef7736d000477f6a71f3e00e9ece6bd492a37a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810644, "uuid": "2d346254-ac37-4be7-8acd-fa3b8038392c", "comment": "Malware payload (AgentTesla)", "value": "da08243e8cb03a1fab73f587620a111ee2cbf7b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810644, "uuid": "dd836379-30ff-4c88-97e0-38742b6dce4e", "comment": "Malware payload (AgentTesla)", "value": "08b9a5db63b9bb24dd171599a849e368163ebe708c59a691751cbd49e7e86eab89db7dc0b14b47add021bfaea0ac1ec4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810644, "uuid": "c40e3fee-ac06-4c3c-b89d-fad3bd9245df", "value": "T169C2A58467D1F8C5024F6BB7772AB0E4E85A4CA971C44CA9F100FCA8F0EDD6AE6D4970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810644, "uuid": "27cc117c-a42a-4b1c-8efa-76837c3d9cd6", "value": "768:+9f7dVVvKOLdSnGcM3PGKjdGA0/5l3oRzhapMLai/F9M6pKXfE6XPdXgQezx/oDx:27G7eoP9cIOuXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636810644, "uuid": "19b46b7a-14b3-49d0-baa6-022503df94ac", "value": 28002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636810644, "uuid": "7a0ec83d-8ffb-4839-99a1-fdcd27ef7af7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810644, "uuid": "82e06e82-7613-4bce-a698-adae3ee83acd", "value": "Purchase Inquiry.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5519c1ba-4454-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636788953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788953, "uuid": "ae9f5625-4677-490a-94c1-436d7a440da8", "comment": "Malware payload (Formbook)", "value": "931eb08655c6773d789275985c9ad453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788953, "uuid": "33ff8b4a-8791-426b-a399-aec64f8574d4", "comment": "Malware payload (Formbook)", "value": "70feb250296689487181315061462e7f7598b75fb79666c0aa986b49b8c789b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788953, "uuid": "95915d24-4e6c-4a81-b9cb-926e56d0ee8f", "comment": "Malware payload (Formbook)", "value": "59571b746af2daf4e4995c9d3071f22abecc9884", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788953, "uuid": "ead08e35-2ace-4a7d-be2d-66381e8c87aa", "comment": "Malware payload (Formbook)", "value": "3233ae92d0e4e97681cd3a16597efe0292fc279697901b32e248583a5d860f6d4d9b874351f6d9b115333c64b2deb260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788953, "uuid": "8755e2a4-e69b-46ac-b5ab-2bf9cea61547", "value": "T16464D4B26502AB2EF908EF73C35FB71878606EDA6CD1465CD90E372855381F54EB6388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788953, "uuid": "52e8543f-97ed-4221-b47a-9c5152ba43b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788953, "uuid": "d8707a9c-7d0a-41fd-b411-eedd49c7df5c", "value": "768:a3pY5Q6/Vml5Ao9nTyt4VskUKrBTO7HehOfV4xPe8rGB0JLl:z/SBG4VskUKrBa7HeZxPe8rGB0Bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636788953, "uuid": "8d2b870a-e057-4cf7-9113-5a2e1c33e2e8", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636788953, "uuid": "97cb1711-f5de-4cf4-9061-1c72c11f8663", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788953, "uuid": "512ee961-5222-4d46-81c3-087dddf20f16", "value": "931eb08655c6773d789275985c9ad453.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7c24ed-4486-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636810654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810654, "uuid": "e27f2813-9491-4cc0-8752-627777bf7c6c", "comment": "Malware payload", "value": "062f5101f9dd70a728fd2b53cea9bd15", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810654, "uuid": "c9a3f4ce-fc6c-4bad-ab9e-15178b184c5a", "comment": "Malware payload", "value": "72ea95ce9ec88bd6ca092706879bb75d1e1db69063995b98c857fbc62ce6bde7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810654, "uuid": "9f72ec15-9d6f-4892-b2be-31fb2bdc536c", "comment": "Malware payload", "value": "8648df09501c044b51c534c4ec76f677182e1cdd", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810654, "uuid": "4f375921-f24c-4b5c-97fa-65e12abcf1fe", "comment": "Malware payload", "value": "ec52b38047fa8005188b30bf373ddc35ef293083a4f955d3b89831902c19ded26fbf4acaaf76620cec022db54d3ade9e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810654, "uuid": "5ff9293c-027a-486f-b7f6-7533709543f8", "value": "T18021B1411BFC4224E2B78E76287BE3108B31B515AD67D62D4198D29C5CB0A18FE35723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810654, "uuid": "afa95324-45db-4310-89be-3c4c7b743c8e", "value": "24:8MJVbzLWesDA3OZ1+/oCpk+/ClkFBo0aPfkWBpAXD/zusmv:8sb9sk3aCpkNlkTo9BqXjzus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636810654, "uuid": "c800a090-fc1a-42e9-ae5e-f26299c78b88", "value": 1366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636810654, "uuid": "06640f38-3a68-4d6f-bc5b-a1cd7f0431d9", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810654, "uuid": "70b87338-654d-485b-9418-509c2fb17c43", "value": "Documents.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568bcf0d-44b2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636829328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829328, "uuid": "0326c2ac-935c-4066-ac26-a2ca20012538", "comment": "Malware payload (RaccoonStealer)", "value": "84dd06d1e6237944e337d213947e1949", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829328, "uuid": "6eb94eda-e19e-4ab8-8236-8d92789c0fdd", "comment": "Malware payload (RaccoonStealer)", "value": "72f0a495127d1b3e3bbab9ab771ed6adeb94ca7663c282679b9d115e0de1af30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829328, "uuid": "6a0dde20-d148-48c8-9cb7-fc30fc3360f6", "comment": "Malware payload (RaccoonStealer)", "value": "ee6f9e3a5c363d4ac4dcf449a3c1c590886fe8d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829328, "uuid": "cfa89218-b36a-49d4-82f7-aee97486550b", "comment": "Malware payload (RaccoonStealer)", "value": "2305e9dedc4e35bde0d6063cffd4a3e4d15aa4d1a647575ded1174e3e3cb326260b39396b6f71e005cca3e55463b1c71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829328, "uuid": "8c751f46-8877-4840-8141-2b039852e20a", "value": "T17CF4F010BBA1C035F1F756F849B59379B82F3AA2A76855CF52D516EA4734AE0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829328, "uuid": "834ef336-eba4-4295-b6d4-79c9c31c2ac9", "value": "0da13809a194b2b672473d74453a5086", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829328, "uuid": "5dab1063-ea8c-424c-93be-1d7ebcb1b4f9", "value": "12288:IhtxVQ3Gkm/6BVWJO6AMTvog30AqL19PKwNg6kfWEPsvRhGELzE55:Ijxu3hmiBQO6AMTXXK5Ng6O5sJho5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636829328, "uuid": "7835c251-2afb-4627-9560-397941cf58e3", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636829328, "uuid": "05c88e1d-5c98-4c4e-a6b5-1016871cc301", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829328, "uuid": "ee8dbf48-05bd-46cf-9ce5-c62d77fdfb95", "value": "84dd06d1e6237944e337d213947e1949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9297162d-44d5-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636844461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636844461, "uuid": "81bea7d2-c21d-4c7e-ab14-2a85206e56ca", "comment": "Malware payload (RaccoonStealer)", "value": "561c37203cfb5a9b3ac60b68e56037c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636844461, "uuid": "0de3f733-b550-4f6e-ab86-4bcecea04580", "comment": "Malware payload (RaccoonStealer)", "value": "749543031579c39e1ee8621db7979aaa5a9bd7b22c05486a55b8b91e537bbf54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636844461, "uuid": "8fba2ab0-03dd-438c-97c3-0062338ae64d", "comment": "Malware payload (RaccoonStealer)", "value": "1c1818c185a9de745f73be8228e2792672de7888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636844461, "uuid": "143c92f7-f765-46cb-905a-5f4c29a89d4d", "comment": "Malware payload (RaccoonStealer)", "value": "f3ea6ca9d646ce716aa46e2468ccc35284080d049175cdfc289cac55f39d46caddcffc5a3943820c5d196c2dd64b4e31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636844461, "uuid": "8ff3e08f-456c-4a2a-8ddd-9cfb2883313f", "value": "T1C3C4E10077A0C035F5B766F849B59269BA3F7EA1AB3594CF32C526EA46346E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636844461, "uuid": "50e44524-20d4-4d2f-8a17-e5209f3a33fc", "value": "6d58d46cb4da553c2a028fd56457c4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636844461, "uuid": "c7a49728-a0df-47f1-8d5d-c4e0914b4f14", "value": "12288:5YWqthPdnDSXqYHOhAit+BJYEs7Li4fDcID1:9qtjn2aFpt+Z8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636844461, "uuid": "04b963e7-e276-4faf-959a-6a498a6a178b", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636844461, "uuid": "8e12257c-b141-4f82-b144-ce2c9d17f8f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636844461, "uuid": "dac347d5-84c5-4189-aa4f-8be43894505f", "value": "561c37203cfb5a9b3ac60b68e56037c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab43b064-44d0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636842355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636842355, "uuid": "8825bc73-c4f5-45e9-bded-65897c85b57a", "comment": "Malware payload", "value": "2e649f5371a9d615a3d78e17d177fa50", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636842355, "uuid": "71d73756-8ae4-49f6-a574-c4362ffaac81", "comment": "Malware payload", "value": "779ff8f75b49553e79dcb059fba65e6fc3315563d8fb0f2723abff8fbb74079a", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636842355, "uuid": "a4de0225-d999-490c-98a5-d4518c09a1b1", "comment": "Malware payload", "value": "16e014607ef407acdade4a4e7d9d64413093c219", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636842355, "uuid": "bf93de43-8d2b-4e11-b870-d1c497d51616", "comment": "Malware payload", "value": "77fa0034dcfb1a74b9f75104e537a4978e1770008c22af65531830f06ade53d04d79f987fc2da36900e106e5966e2cce", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636842355, "uuid": "c3a602d1-fbfe-499b-8f58-67b9e3961ccd", "value": "T1E051860AFD47D15C9B752357EC97C522FF1B411B5DA2104C71DCC2495F20809A6ACF9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636842355, "uuid": "64d3ede0-703f-4437-8095-19f57df7c921", "value": "48:AE+4jiLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozl4:1GhrffvIypvK0elkEYZ85zK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636842355, "uuid": "4d8461bd-c74d-4c1e-8a72-57d019bb6cd7", "value": 3156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636842355, "uuid": "e1360fc4-553a-4960-b793-28069c951113", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636842355, "uuid": "1675a2a2-7c82-4b83-ab96-74d9dae5b4f2", "value": "zVuHhcun.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfdc80f-4454-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1636788913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788913, "uuid": "ece2c0e4-a16c-45a5-a335-e92bb3d5cfb5", "comment": "Malware payload (CoinMiner)", "value": "2671a85eb7c3f11633b22a8e9f58efac", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788913, "uuid": "9fbb8a59-ded0-4279-9447-cff3d0267f76", "comment": "Malware payload (CoinMiner)", "value": "780b58f0b7718cdfbf733122b8e8a1fb490596951dd3ead4cdc2059d352d616a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788913, "uuid": "bde55933-f864-4a33-b6a0-69eb49bb9c63", "comment": "Malware payload (CoinMiner)", "value": "4d43546d4a77c9047f9e591ff3f890c58977a9ea", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788913, "uuid": "f6d7d88c-56f3-4282-9404-355bea4f625a", "comment": "Malware payload (CoinMiner)", "value": "6a550045af7279aadce240c3347b4508d7791046f0e53312f84bfe6103f1af7e21be5dbee39d731f0046e3df53c00185", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788913, "uuid": "e304731e-d8e9-41fa-9264-71be4d8bfa9b", "value": "T187C52301B6C289B0E43319350A1ABB64BC7D79240E24DAEF57D12D26EF319816B35FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788913, "uuid": "3dab3040-39e4-45b2-8b14-099b56590b70", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788913, "uuid": "7e2feade-1bfb-449f-a1c8-2f3b687be4b7", "value": "49152:mbsdjF19nufSMdvzBnckraOsFSdZj7UbJeB:JZuagvdckOOsFSQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636788913, "uuid": "3548a6b3-5c7a-42fe-9c2b-1ba14d5cd4e3", "value": 2716042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636788913, "uuid": "85f656e6-0c87-40ae-876e-7d570f9a8529", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788913, "uuid": "020e3f0c-d173-42fe-a518-319e0c008a1f", "value": "2671a85eb7c3f11633b22a8e9f58efac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0742bc2d-4476-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636803426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636803426, "uuid": "50976b48-f546-492e-aef7-31161c7fa2cc", "comment": "Malware payload (Formbook)", "value": "818d16854f5251302c051d419dd3d5b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636803426, "uuid": "66c5fe20-5fe4-482a-9d5a-89d29cb702a5", "comment": "Malware payload (Formbook)", "value": "7930bf3f1be9acdf429e2433aa7d0c36985d9a97e580571fee1ffe8cbc0d8f5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636803426, "uuid": "c5438cae-0539-402b-96c3-d091f403a5cc", "comment": "Malware payload (Formbook)", "value": "38a4de3caa65b906b2947bd7bbbcbed0575de785", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636803426, "uuid": "d38b15ba-85c8-405c-a38c-4d29edd9f73c", "comment": "Malware payload (Formbook)", "value": "44032efa04f9df5845dac492a999677a861c29b09614f903e68daa0ff3a91d41ac037e4fd46d06f968f3cb94835f1be8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636803426, "uuid": "9fa42135-3cc3-4281-a08a-4474c417e1ba", "value": "T1E3741218B7F59F39E23987FBAB50495017F858772A42F72E5DE313E508687D14A80B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636803426, "uuid": "54d459d1-6991-4836-8554-b01c34e10cda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636803426, "uuid": "45dcd4f0-d6db-4b99-878c-1905a3e90c15", "value": "6144:W/c72GhN3oRey43E+ojTw2g6imybA6vEnRZXZ5medbXGMqYtTtM6vCquf6FECT:572iNw9+omKHMORZXZ55E3Y17v8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636803426, "uuid": "5735f0ae-5dbe-43a8-baa3-9b64dcaa1930", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636803426, "uuid": "0252c8e2-f831-4be2-96dc-3ef73c64252b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636803426, "uuid": "e09628de-4adf-4ddb-ae28-358fa3b314b5", "value": "818d16854f5251302c051d419dd3d5b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f4fad2-446e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636800152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800152, "uuid": "648b7385-0d95-40fc-98da-ecf084fedaa4", "comment": "Malware payload (Formbook)", "value": "7d22b7632fc02e12438e7748eca086b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800152, "uuid": "caa49fd5-c460-44cd-bb27-423a627dc268", "comment": "Malware payload (Formbook)", "value": "7a1b8316f5ab5e580a39374469dd8029949c791b6ac33627b3824868bd5aaf28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800152, "uuid": "ebea33fd-87a5-4cc9-b07b-6336286b49f9", "comment": "Malware payload (Formbook)", "value": "e7e9f311c61a9aa1537053e96f9b8f5273c47dee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800152, "uuid": "cea3500e-bc74-457d-a219-39fe9e3c623b", "comment": "Malware payload (Formbook)", "value": "fedd70e9020942c22f065f66f7c7768cffdb5682f1ec8367fc877eb92f0c43a17953a7aa385ea5f1c69ef5d66e706fcf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800152, "uuid": "ea091ef8-ea29-4f26-9398-ca03db8e48e2", "value": "T1DD641216A336DB35E8975AB97830401617B4F6CA2D11FD2C0D25F0B826BB3FA4A507DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800152, "uuid": "ac099f43-d93a-4773-a2c1-7532e8b480b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800152, "uuid": "3b003d93-1a09-4844-a962-bd3195c58891", "value": "6144:s0TXgBrfVjChpKneYHzQHuCl0knGuorc0IOOr6aee4asD:skgRRWpngzsue0knlOlvZas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636800152, "uuid": "c0f42766-8219-4f63-82cc-3d45b793c99e", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636800152, "uuid": "58f8f5e6-bff5-4273-8423-304ffffd214a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800152, "uuid": "3af50beb-7a2b-4207-8255-944dfa129071", "value": "7d22b7632fc02e12438e7748eca086b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798716f1-4447-11ec-843c-42010a9c0014", "comment": "Malware payload (DiskWriter)", "timestamp": 1636783431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636783431, "uuid": "a40a9060-55da-43e2-b20d-cfb8bc0d2522", "comment": "Malware payload (DiskWriter)", "value": "95dcc4006123acf298786376db9d7bd8", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636783431, "uuid": "b8bfddb2-fc15-4b95-a4ee-8dde041cf7ce", "comment": "Malware payload (DiskWriter)", "value": "7a6b9bdf1406f4f0ee311aa40a2c39a6b19ee2e49ccde470fbe0031e4451e2df", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636783431, "uuid": "87f26d27-ba72-4408-8c68-49f865bfcdfb", "comment": "Malware payload (DiskWriter)", "value": "3136455a57bc0b90ae5cb62e17f8ea146be9638a", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636783431, "uuid": "245244a1-b025-42c5-ab52-793ba50070d0", "comment": "Malware payload (DiskWriter)", "value": "5c723bba693e0dba556d9152f83d5d209130d3c448ab24f812c89d75ef1940f04a6f280cb54d4ceb7e5b039bfe7ac9bf", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Killmbr", "colour": "#D99058", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636783431, "uuid": "61af8dc4-750f-45be-896f-c796b941281c", "value": "T19CB1B647CD508577E173437240DB44389ABBCAAA43F6525F7FB5D3201FB26169A49143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636783431, "uuid": "587f458a-6f4c-457b-803c-f8b38f0b6c7a", "value": "e5bb51345c7b1d3be1a9f4abfc1b2e71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636783431, "uuid": "c246b22e-b6db-4e01-aaf7-a5fe51620e7f", "value": "48:qvG+gMjZayd92QyU29TjLvR2zCBLUR9pu7wtFeG1uHpi45RuqSA:prMYYHyU29zvR2WR69g+eRDxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636783431, "uuid": "43acc155-fb3b-49ec-ada3-2a42a4e18922", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636783431, "uuid": "fc78f75b-d5a8-4754-8ba8-95f46f101a46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636783431, "uuid": "6a0606dd-0014-4947-a537-b3c7c4acaa9b", "value": "95dcc4006123acf298786376db9d7bd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003e234c-446b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636798689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798689, "uuid": "e8e4be96-1262-4d53-b3ae-7c0b53d6d26e", "comment": "Malware payload (Gafgyt)", "value": "61d30efab5adb1c63aefb94119773a06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798689, "uuid": "05d5d216-0163-444c-905b-40300fe0941c", "comment": "Malware payload (Gafgyt)", "value": "7c1c0b53b9ae173ac43906eb772edaf23f8445a58990e2cc4c91f739f8e96262", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798689, "uuid": "b043029e-0184-49b0-af0e-dd841588f9de", "comment": "Malware payload (Gafgyt)", "value": "337c13ef0b506f617398067f7e3ae6606de0842d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798689, "uuid": "549bdd63-2175-4365-8357-ea7af7904909", "comment": "Malware payload (Gafgyt)", "value": "ece96305541a60ef4afea31f2b330184de9aae692e0d50431416187fee34e7d94b7f3c954c858aeec225fa8c7e1d3c2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798689, "uuid": "a0cd1b50-218b-4903-ad99-6696789f2321", "value": "T1F0C32944F840476BC3D327BAE78E438D773557B897C73311AA38AEB42BC1B992D29560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798689, "uuid": "47210a3d-c130-40a5-b0ef-4709c01be46e", "value": "3072:oRMB4zYjbsYLWA5h5Z/e0NmZuDQ4DPsHXtGq:vbxqA5h5Z/HmZuDQ4DPsHXtGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636798689, "uuid": "5f205e37-5830-4b52-8db5-60827a617107", "value": 127520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636798689, "uuid": "dcc28b78-7688-4875-ad91-da376b882445", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798689, "uuid": "8dfc6ea4-8088-4b1a-be8c-19774d794eda", "value": "61d30efab5adb1c63aefb94119773a06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b8901e-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1636831206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831206, "uuid": "fd900783-7d81-49df-87b3-d85cda508655", "comment": "Malware payload (njrat)", "value": "10cb99fab4a2d03fb923bab83d64def6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831206, "uuid": "a54c8e15-38b1-41a0-a022-278472bcd1ef", "comment": "Malware payload (njrat)", "value": "7c5469c3254fa9aed13789fcbfa40f777d735e8cf0a69b567e02f602aca1a36a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831206, "uuid": "38a95dd2-2c49-4ad4-aec0-1b41417f35e1", "comment": "Malware payload (njrat)", "value": "c7966732d261bac2e2eb7de27f226be2ee1f7722", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831206, "uuid": "cca0b0d9-ca2e-47e2-b6d9-9a0cb79c54c0", "comment": "Malware payload (njrat)", "value": "161f0ce081e95065a0103c1c4539daa52cddf18ff59c395171447ab00bf1744552e0da2248fba9bc20a022544ad08eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831206, "uuid": "d8a1022b-d87f-449d-b70b-5a3ea73a3c6f", "value": "T1C10441512DFB91ADF3A39BB15FC8F8BF8869E97B554A30B9314117024372E418CA2736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831206, "uuid": "68209e91-f241-4ee9-8c7b-383fb92385ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831206, "uuid": "5cd00192-1d3e-4e01-9550-52478a3f031d", "value": "1536:ncvgDGtMck2aJzQjGIhkh6+DD3ob/ICATnX2jjXmT18xROpD2opA1uNZ8qEOVKTv:ncvgDjMmDQulVKY8n54RkyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831206, "uuid": "8ab2fcb0-5309-4b75-bdee-b03093e65ba5", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831206, "uuid": "0b2dbe8f-2e28-4824-97d5-3f359165cee0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831206, "uuid": "3a51c38c-32e4-4a3e-9023-86505ec20846", "value": "10cb99fab4a2d03fb923bab83d64def6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d35183-44bb-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636833427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833427, "uuid": "4c64bfdd-9003-4604-853b-e9f4f9d33f6f", "comment": "Malware payload (RedLineStealer)", "value": "4985e2542c5b1e027e050dfb6e92e056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833427, "uuid": "bde7cc8c-219c-4cfd-b3f9-7a9ac19901b2", "comment": "Malware payload (RedLineStealer)", "value": "806deaa5e351d11d2f73d119a43aa00fb4252b05d0f7022013ff0d8e1c5a5aa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833427, "uuid": "7d035fc9-f601-4745-80b3-98940a98e8e3", "comment": "Malware payload (RedLineStealer)", "value": "dbb32a93a0022472852653290eeb7c5f8929dbaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833427, "uuid": "88b308b7-7d8c-4a87-8a56-04caf6968110", "comment": "Malware payload (RedLineStealer)", "value": "630fa8aefba73668d818727bd23e0895eb961578094d98520b480e10f676b25c71558efc9ad2aac7b93c710ed4ffe1b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833427, "uuid": "e3bc0406-a96a-4fe1-99c3-8bc6d6dba396", "value": "T1BC2633401480630BC616B7780B6A11514B35FAACE773E15B7B73ADDF332E4A0BAAB5C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833427, "uuid": "bb3e9d87-1c42-4b4d-8b07-13a4ec29912d", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833427, "uuid": "4c17f9e8-9b6b-4232-a76e-166fac39f4bd", "value": "98304:AnuVaQR/JXWdikb7+wAXLPc2z9bafkY0yWuEOIrkeFRZN:BaIRXLO72LPnzxnvLwSRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833427, "uuid": "f45765ff-0500-4ead-8654-7980dc41f605", "value": 4425728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833427, "uuid": "bf0b53d8-ba43-4b59-9095-9b49c40216d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833427, "uuid": "22700b06-9d0c-4d6e-859d-9a6d1732736b", "value": "hwidspoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6462437-4455-11ec-843c-42010a9c0014", "comment": "Malware payload (ServHelper)", "timestamp": 1636789573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789573, "uuid": "88ebd6c4-c3c7-4935-9c27-0ffeeae2ab45", "comment": "Malware payload (ServHelper)", "value": "9151c95451abb048a44f98d0afac8264", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789573, "uuid": "03341744-4c25-4721-903a-dcf871272711", "comment": "Malware payload (ServHelper)", "value": "8082bfe8a9f63854d6317cf6ddc0c18c54140ee5d179a96bfe9900c90d994518", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789573, "uuid": "ec6ce0ce-262a-400e-8fe5-f3ef3a31565c", "comment": "Malware payload (ServHelper)", "value": "22f447b210eb25c11be5a9c31f254f5f2bd50a78", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789573, "uuid": "0996988b-b18c-4eac-b38f-d683ab628789", "comment": "Malware payload (ServHelper)", "value": "52e3d4601c49706c647db7a39d06827517f6df1888b4b2babe2227691dd7ce3e5403ff55b7b9b01b89b1e4da28bbd45c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789573, "uuid": "97e970ea-22b8-4c78-8398-401273a0530b", "value": "T1BAF42385E6A4CBB3F429363D5D102FE2A1D924CCC7C7A903AE9A34F63D7A1D019AD057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789573, "uuid": "755b8d40-3a5d-48f4-96af-9d0503647cd6", "value": "eb7697ac38be5e4fdd7bfeafa886a0ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789573, "uuid": "ef2753d9-84ef-48ba-b71a-a5efaffb6b93", "value": "12288:6K/B5QF5BV3wW9uD/mhCQFhvLulYMoGoPMP7ki0H6JFXfu0Lb68caBEe:ZB5QzB2W9xhzulYMoGoU7BXfDXWaye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636789573, "uuid": "94a53e8c-477e-4f5c-a908-1ba039260fc7", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636789573, "uuid": "4f9ab4db-64cd-4399-8a6c-63030382440c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789573, "uuid": "51d96f6f-42c5-4967-9abe-d10caa8d8add", "value": "9151c95451abb048a44f98d0afac8264.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f93c0b-44c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636835738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636835738, "uuid": "7c50faa3-d2a7-4c14-8155-24010aa98e37", "comment": "Malware payload", "value": "2413bae183737165b8340bf9e0348b79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636835738, "uuid": "20deb29f-6d98-437c-a7f3-0211efb10ab0", "comment": "Malware payload", "value": "81f0fe354c08436a291b00d516852389e271f40179ed7b5d2de2dce6641b0892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636835738, "uuid": "f9a8e37a-d371-4bd2-b06c-3dcec3ead8ec", "comment": "Malware payload", "value": "18a956f909d3647f709f830a86f0f0a9b5666466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636835738, "uuid": "f59e24a7-d013-45d5-b9fc-39f8aa4f91cc", "comment": "Malware payload", "value": "12100ea14870267792d3359ce29f17e63929d99327e81116d65c9ff36b30ceb7d2c4d380f1219bb4dd12939e8cb398b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636835738, "uuid": "bf634b07-f498-4fe1-b9ff-2eae7bc6ba06", "value": "T14BA4CF0673F497B4D9BE3FB94C642A7087BCFA240720FA471E8169CA5635B90FE24653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636835738, "uuid": "b31e10e5-2064-4d0f-ad6a-9de2ac09549e", "value": "12288:DDCXTOcCf6ynZgckGRb+34dhgZOUyVFzCT73:DOXTOpYGRSo8ZGcT73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636835738, "uuid": "1e1b7a15-073c-4fa3-83c0-9856f0fe0b99", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636835738, "uuid": "fe2ebf32-8b49-40ff-8e14-6b88d2ac21f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636835738, "uuid": "e5cf8c52-3507-4d62-a566-2959697e0077", "value": "SecuriteInfo.com.Trojan.MulDrop8.65451.7529.360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6403897-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831287, "uuid": "a3b5b38e-8e31-4ab1-8754-fb74840a2835", "comment": "Malware payload (RaccoonStealer)", "value": "c86815e6da90a776df79dc0c8c6892a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831287, "uuid": "adef77bd-7bd3-494b-8582-17b465fad91f", "comment": "Malware payload (RaccoonStealer)", "value": "8378882572dab3574e094ea453aebae67493ecace0196d87fb2a6ad29282b5b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831287, "uuid": "a9f989f8-7933-4b8c-a639-78f6e93a4ee8", "comment": "Malware payload (RaccoonStealer)", "value": "d60a4d0247e0a76d13a6bf86e7529e1be65bba0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831287, "uuid": "a26a2e14-0c71-477d-84e8-104043a02036", "comment": "Malware payload (RaccoonStealer)", "value": "aaa32e30b8bbb2ddb9427f21c96e5a02e89738d5b0b22b6c9ed66bc2570f04f54be7351327361d31c6b0f4043d28c705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831287, "uuid": "e7ce232d-c6a2-460c-9c49-2b1c43d83fa1", "value": "T18CC4D00166B0C035F5F752F449BAD2A8B53E7EA1AB3594CF62C476EA56386E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831287, "uuid": "115425e9-092e-4e3e-b2e2-8e4354ee3e76", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831287, "uuid": "23b4abba-5eea-4ac3-afc9-491862a1e40d", "value": "12288:wJs4HmzEqBuijRRlZ5qwgMgDe2sry8Nm/0Dr4Z1b:wmdYqEi1RlZ8FMgDe2IDe1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831287, "uuid": "4e303980-6c46-4273-972d-6406f6b9d809", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831287, "uuid": "d8ea9287-94ac-4910-a797-a76f16456599", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831287, "uuid": "391620c4-a784-4ea5-a82d-7c6d6afbebd1", "value": "c86815e6da90a776df79dc0c8c6892a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2512be09-44ba-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636832681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832681, "uuid": "9dd95764-0edf-4d39-8592-903e098d6d8c", "comment": "Malware payload (RedLineStealer)", "value": "feb87346932392ed18ed2cf7e985b3e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832681, "uuid": "d863dd8f-c2dd-4d3a-9138-11e652c2dd58", "comment": "Malware payload (RedLineStealer)", "value": "847edfef952377bf06ebf7eefff5e026f14befcbdb197002bd19f79eb15175a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832681, "uuid": "8c8b01d3-9747-4320-9dfc-9120c9b23747", "comment": "Malware payload (RedLineStealer)", "value": "6d5b3371fd9275978e68886e76a979c8683a2335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832681, "uuid": "897768dc-f9e9-4ee6-9121-e3b1a2582f32", "comment": "Malware payload (RedLineStealer)", "value": "57f87a6daf3f2cccd0d5895e30503479a854ef1a7056069b80edb77c47f91b25eae6c025ec4de083ef79d07a830d7bae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832681, "uuid": "4d0fb5de-e863-4194-a9c3-a68b4be8605d", "value": "T18926126322644119D0E68C37A927BEFCB1FA9F3B4F4158FB76DA5DC52A120D0E322953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832681, "uuid": "50e0f176-e913-4c5e-be0b-6884b4fcbf9b", "value": "908bea7ee71339f1c35ba419da3ba679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832681, "uuid": "5714bf3d-59ab-4c85-b231-80015b9f9a7a", "value": "98304:lLawtn6xIw2dL1FlzHuTdVDtV3zcJJZfinA9I:fN6xIwK3lITQJJZKnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636832681, "uuid": "89818d49-de6f-4859-9557-5410033cad12", "value": 4772352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636832681, "uuid": "f468dd16-1f28-47e8-8df4-44241980a22d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832681, "uuid": "e617604e-9048-4a4d-a37e-9cb20729eff7", "value": "Genshin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75d689d-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831236, "uuid": "cc0e8e7c-cec7-41da-861a-a0ad041933e5", "comment": "Malware payload (RaccoonStealer)", "value": "4a9ee96ddb90f509a2aed7fecfbbbd64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831236, "uuid": "2b3074ec-5f5c-4c74-941f-66e37379ef28", "comment": "Malware payload (RaccoonStealer)", "value": "84b846f09b2656ce312b7d8bbd02ab6a53cde3fc3d8817879b191c4cf1a5525c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831236, "uuid": "a290c49b-01b2-43df-bbe2-7aed868a494d", "comment": "Malware payload (RaccoonStealer)", "value": "4584a59da8eb5d59e16396fdcc8351ff91184159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831236, "uuid": "3881fd17-9370-4af5-846c-cee1de1a0228", "comment": "Malware payload (RaccoonStealer)", "value": "b5fcb1829a58ee9237c2d7c16e36d8d7e625701acfd79963808cfa3c22db9f476f0c9b7485d7e5668c83d56953a8173d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831236, "uuid": "a7b2cf1e-b55d-48c3-a0b3-8b448ffa8887", "value": "T13B748D00B6A0C035F5B616F849769369B53F7DE1AB7490CF22E42AEE4A346E0ED30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831236, "uuid": "9aff9324-de53-4a77-b881-0f999a6a4bcf", "value": "17d363df494bcb38053d0872594e66c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831236, "uuid": "142c5836-87d9-4081-8b29-85db18adf580", "value": "6144:hsrEKLZCfgNCHHlUTGlBnIQEfYSNvP2/NSp6YwJ:hDqyjHHyTGlBnIQEfYSNESp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831236, "uuid": "c5570a2c-c643-45a3-b5ea-034562bd8d03", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831236, "uuid": "b1280e96-dfb4-46f4-b339-20c16b02e4b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831236, "uuid": "cb8f5d91-9daf-4eda-a4d9-369a209d48bb", "value": "4a9ee96ddb90f509a2aed7fecfbbbd64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb2d73d-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831270, "uuid": "90d58561-08bd-4946-be14-f0a8c42367a7", "comment": "Malware payload (RaccoonStealer)", "value": "05a9797bd132c8728a7076303c34d3bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831270, "uuid": "ac152783-f3ee-48cc-b046-b0931b66d1c0", "comment": "Malware payload (RaccoonStealer)", "value": "86b870116bb099e653d83b6c9aaf742e77f65c0677dfa71908377b9300a6507d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831270, "uuid": "9e9633f9-d7b1-4795-82be-f0a52a08bc27", "comment": "Malware payload (RaccoonStealer)", "value": "865570e7399eddfe2e6f58962fb33464aa10d46b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831270, "uuid": "6ddb02fd-e8ec-4d28-8f7b-d108db2d68ed", "comment": "Malware payload (RaccoonStealer)", "value": "da6a7e928c4bc2f28f022a7864c4d858d10890e8e54fb6084df26caf1471052562046b42b022bae867a6b83d71827c98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831270, "uuid": "8713237d-2025-46c6-ac77-0a575207d118", "value": "T1F6C4D000A6A0C035F5F716F8497592A9B93F7E91AB3490CF12D52AEE9734AE0EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831270, "uuid": "85827ff9-b85e-4547-9810-8ecd6c42265b", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831270, "uuid": "b02fa06a-3310-4338-9508-44695c709935", "value": "12288:LygzbbnnwKCBC2WDW1Qkso6DRVK12rDrd1mp/8GMHw:hHUBmksr62k84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831270, "uuid": "b39d6abc-9411-41aa-a2e9-45e483452a28", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831270, "uuid": "be7cd397-78af-4cd3-8bc2-97fa5909d41f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831270, "uuid": "bf6f05c5-cb3c-457c-ba62-109bd9458369", "value": "05a9797bd132c8728a7076303c34d3bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cacc45b-44c2-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1636836076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836076, "uuid": "3297b6df-3f5e-4b1d-8885-10a08585936c", "comment": "Malware payload (AsyncRAT)", "value": "4aa4dfd6b9b3ba9a2961b4a8f40d6b1b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836076, "uuid": "ebacb87e-ed1b-43e2-b0ba-919e3ffd99fb", "comment": "Malware payload (AsyncRAT)", "value": "86fe486e3f2591d8c631a2d25ccdc147a1e003eb5c39c11bf33b9e44d570102c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836076, "uuid": "0a4006f1-7cd4-4b7a-af3b-f3df8deb2f99", "comment": "Malware payload (AsyncRAT)", "value": "58af61c783085bcb776a275d58dede78f276dc9b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836076, "uuid": "4f2f4081-ca96-44bd-b472-9294695bde4a", "comment": "Malware payload (AsyncRAT)", "value": "a058cf7d41c98d7edef8303e7022ba49bd006c19fee655d64340fb608e6b91a1325139733d9442549da4a908c1305a37", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836076, "uuid": "e22508b9-95d7-4c78-bcd7-4f618471a1a6", "value": "T1AAF4740C7605053BFD1CA930A48D2B4466411FBF2A42E665FB6631C3EB373DB5E278A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836076, "uuid": "ec80dc60-3e78-4b60-a0c3-7a7cf3605f6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836076, "uuid": "033b777d-1423-47c2-b437-628ba6029474", "value": "6144:s4F0RLtSwckgkS//RlL2yNVyXNVwT3QlPJ0DNy2Ou:JF0RLtSwnM/XdNVeIT3UuDNy21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636836076, "uuid": "a3fac54d-3e4a-42bc-b742-4cbf5dc9e794", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636836076, "uuid": "b7c996be-4c13-481d-84ea-cffaae478ce1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836076, "uuid": "b7d86609-ea8c-43bc-aa5c-2989875db980", "value": "4aa4dfd6b9b3ba9a2961b4a8f40d6b1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60fc117f-4429-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636770505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636770505, "uuid": "2243e962-fa9c-44d6-a14f-adac52c82c46", "comment": "Malware payload (RedLineStealer)", "value": "cb4804b273c7aa139507dce67b808bf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636770505, "uuid": "df82cc28-dda5-4d8c-96a7-508539a1547a", "comment": "Malware payload (RedLineStealer)", "value": "8746b2d00388bd71bd806386fbe09052853c2dd9bc098132746eedbb30112c1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636770505, "uuid": "f7211e98-dc49-482e-a997-a45113f238f5", "comment": "Malware payload (RedLineStealer)", "value": "8223fd906383d479298343d9438e1435aac7140b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636770505, "uuid": "b584cbaa-58e3-4b3c-98f2-88260a43a1bf", "comment": "Malware payload (RedLineStealer)", "value": "ddb30debbb04a9948147388ef702c02ad0ec8953b22465b8c75b66025b988fde3596198d832e35e4a3b321b3bf1c7e2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636770505, "uuid": "14f3bbb0-3ebd-42f3-919f-a9ef74d73c97", "value": "T1B4C5234AFF85A837C92EC7B196438701F339D56297B64B83795C06340FB9385AC8DE98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636770505, "uuid": "a3553f40-8b8f-488e-b318-f132560860d7", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636770505, "uuid": "d4216b3c-6d38-4796-a37f-2f996177b8a4", "value": "49152:Kh45FF2Co61QzI/p+1ityjeEtDYQ5NOYJv/P5KwyFanVlStWYYOu4:fLhCcSAMDYQ5NCtanV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636770505, "uuid": "aafb2ae9-2928-4598-b1c2-de45f42e9f95", "value": 2680320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636770505, "uuid": "cb3c529e-41aa-4c78-9df8-464602c788dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636770505, "uuid": "9770fba9-cc24-4cbe-8b1b-bf2ed339e7ba", "value": "cb4804b273c7aa139507dce67b808bf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76578e5-44bc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636833893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833893, "uuid": "428b4818-ba6d-46c4-bf02-dd54268161b2", "comment": "Malware payload", "value": "8319bf09a48f2b8adeaa22ecac73996d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833893, "uuid": "7d3f34bf-ce27-4928-a778-a99667a2bac6", "comment": "Malware payload", "value": "87b08adafd2246067a02148e96965a0e1d754d5f43805007b7a9210ad4aa937f", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833893, "uuid": "fe0ead35-3a46-47aa-8ad2-ef20eeaef9aa", "comment": "Malware payload", "value": "13df638d75427b37ff7f049cfa4f38fe82a8e7e7", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833893, "uuid": "604fee46-065d-47f3-b5a0-7e19f595352c", "comment": "Malware payload", "value": "12bae734393eb16a11c0a20e876840c915ecd7eec78ad9b82eb756ecb0fab1bc9b9c12ee936a0b2e2cbd4ca1eb32dc4a", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833893, "uuid": "fee62e27-161d-45f1-9564-e06befd71b73", "value": "T17D04BE617A44C80AD56906350DE2C6EA6B33FC069EA6C70B3165F37F7E77B90C94224B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833893, "uuid": "2440d4eb-0b4a-4fe0-841c-fc49f3aead10", "value": "3072:ArxEtjPOtioVjDGUU1qfDlaGGx+cL2QnA6buAJbD4DiOpEkOHfehcZHQIawhlujD:6xEtjPOtioVjDGUU1qfDlavx+W2QnAwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833893, "uuid": "0ae0ee8f-7f0f-4aad-befc-35ea1dda372a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833893, "uuid": "f7299d72-082a-4a50-bae8-d3181287c9a3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833893, "uuid": "e6b98443-b4a0-4a22-8304-7d5782ed5d44", "value": "Pago_Confirmacion.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c502039-44b5-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636830546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830546, "uuid": "82dd7071-8561-40a5-b070-4f69069f8e00", "comment": "Malware payload (RedLineStealer)", "value": "975a9bca336900be1c816a516787deac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830546, "uuid": "c213c1d1-d2b0-41b9-95c5-e32f383ad66d", "comment": "Malware payload (RedLineStealer)", "value": "8814614df44496c1fedda481b646d666a99b3ddd34353e04cb5a0f374ad93e25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830546, "uuid": "0a39aeba-7616-4422-b454-c1e1878c0152", "comment": "Malware payload (RedLineStealer)", "value": "3a2bbdb7a8b3f18e9fd1490151ca8d45f80544ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830546, "uuid": "494531f9-0cdb-4711-a936-95780e854f4b", "comment": "Malware payload (RedLineStealer)", "value": "b7f55667e03659f085a76cd5bd42d4aacc2cb85bcb51f456d8a6453377039b54e66f8d160166ca2efbce1a41a3593991", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830546, "uuid": "00eaa866-e3bd-486f-9f0b-50e73e51a906", "value": "T1F56533BB3F24D5E9C14399F948467A98D32137D8AE94710BBEDB8695C42D4A7CC3C0AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830546, "uuid": "d7739783-14b4-4be5-a12a-eaceca93bc08", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830546, "uuid": "a14e5c50-ecbd-4279-9a91-bfd94c378a00", "value": "24576:Nso9RH/mf9cEQTHHlHXY3pHsCRXp1ex3YsHQFyO1iKsujdwo7ky9Dzlh891Qjh4e:6oLH/mf9sTHHl3Y3yCRXnc3rH2Td93lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636830546, "uuid": "5fbdca2c-f89d-4756-854e-39251577131b", "value": 1505792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636830546, "uuid": "5334c85d-d2eb-4f85-8cb9-bb8f56e1b040", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830546, "uuid": "e462750f-dc4d-4ce4-b2cd-0cf75a314d05", "value": "LeezeyCore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae40895-4423-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636767810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636767810, "uuid": "9911021d-b880-4764-a814-620ab51b903c", "comment": "Malware payload (RedLineStealer)", "value": "280d8ac98717328877666b10a47bd686", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636767810, "uuid": "e912ccb2-41c7-446f-a126-baed3bc9c9e5", "comment": "Malware payload (RedLineStealer)", "value": "88d819e97e573477222ae60022206e9d16fabeaa10385296f403adcb2edf1bac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636767810, "uuid": "9fb59b09-8071-4fa6-a3ed-d741bd0f457b", "comment": "Malware payload (RedLineStealer)", "value": "8e02e4700f050797ba5529599d18cdada7e82198", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636767810, "uuid": "cfb80ce0-7841-438a-bcec-d0540d3c7372", "comment": "Malware payload (RedLineStealer)", "value": "82bf91ef5e799a3a7063c22f0856ba18f6f3e8f0dc7ccb18da51bfdbb119a124647e2404244a6dd7b79c2e721dfad069", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636767810, "uuid": "cd75cb28-38aa-4ba4-89e2-0e4dc7fde618", "value": "T1E465337E6BA93E6CC44255F883333791F851E1BDEFD4D62A3AE7110624480BAB84E6D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636767810, "uuid": "65e61b7c-6cc3-4519-94e7-a1830c5c9b5d", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636767810, "uuid": "05c1294f-9da7-4e00-ac79-35a56a114e0b", "value": "24576:lZwLRvhLjiWae3L82YBPtsy1rOn5KDkVWAF8usOQkEaHNYK3E7oy3NVzLcY:ElhLj36BV3yn6kPyNa6U6NVcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636767810, "uuid": "07c48b45-13eb-433b-8f61-e1e76a99d5b1", "value": 1409024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636767810, "uuid": "7b7f3c49-7c6a-4942-9903-c331bfa37642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636767810, "uuid": "b829dbf4-7ae7-4879-80a6-5885d4a79b91", "value": "280d8ac98717328877666b10a47bd686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba77106f-44ad-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636827349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827349, "uuid": "92e952de-74d2-41c5-8732-c1e841acca0b", "comment": "Malware payload (RedLineStealer)", "value": "3188cdb32536cfb6ad2dba943b4ffab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827349, "uuid": "79f9a01e-e962-442c-b5d6-aa678b275d36", "comment": "Malware payload (RedLineStealer)", "value": "8a3962b436960d310647b1b6b2dc6e970b456e36b534ecba21ee1e7b2ef94f0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827349, "uuid": "8aabb2ae-9593-4c3e-8670-b63e25d1bcd7", "comment": "Malware payload (RedLineStealer)", "value": "02ddc07dfd30ce4d33f47a4ed24008cffe3423f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827349, "uuid": "cb5f8c6c-b559-4394-9b07-d107529831ec", "comment": "Malware payload (RedLineStealer)", "value": "9d9a6448e8153e713ca0b5827c0f09e81a8f0f88da058143e8db584d90ac526efca65bd27da1251e8e3581b6f17360f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827349, "uuid": "88b34d37-71ca-46de-97a3-7d65c6b00ffe", "value": "T1BDD5120CA944CFCCEBD18E77878BE61452A51F50DB2BDFCC669033DA1E35491AB12AD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827349, "uuid": "cb5bea55-af73-432b-9922-006240c335eb", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827349, "uuid": "ceb7a8f6-5d81-4793-9095-d68e5e33a6fa", "value": "49152:Pb4efrjNOmh0oVOK/zwDcCqfXhYCtt7cJi2V32Ay3PvoJFna:j4ejjBGqDLCqCCci2V2333oJFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636827349, "uuid": "aa11a936-4444-425e-a313-2e224f1e4fa4", "value": 2946634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636827349, "uuid": "d97a9479-397c-4c55-9eb9-7c1fa5aee2f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827349, "uuid": "39081756-c5c0-4d45-82be-cb142f124950", "value": "GenshinHack v1.34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943b0daf-44c0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636835445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636835445, "uuid": "00fd9f07-9fed-4ae3-8621-6c4e0e2836e1", "comment": "Malware payload (RedLineStealer)", "value": "7e1661bdc5e64cc1bcf62ce29b48f0b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636835445, "uuid": "81df2509-e8aa-4b33-97a5-1527bf7a720e", "comment": "Malware payload (RedLineStealer)", "value": "8a76fd10a479dbf5bb5d60f6ef949641d2ef4f1262a6d9dd273cf93b7be934b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636835445, "uuid": "05fab860-f80f-4d90-8946-f571f40f9865", "comment": "Malware payload (RedLineStealer)", "value": "0aaeb9da7af2d8917254a1d02bbb45b23ca56ded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636835445, "uuid": "fe62fef2-965d-42ef-a21a-a4268a7f6c36", "comment": "Malware payload (RedLineStealer)", "value": "62a0ce1beae638193ad92b8c6883fcc26bb47139bd3889820cd0fc9e0765cd7446172112a145dcfc1b604cf711148825", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636835445, "uuid": "68c5cff4-5b69-4ab4-acc9-f35b7bc0ab6f", "value": "T18916332290D03869E2CB6A7D9D0BDAF78556C7F564E86C66734A028B9FFF0A33055138", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636835445, "uuid": "63281021-653e-453d-9864-32f74e507100", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636835445, "uuid": "2b15503a-43ac-4603-a658-6cfd710c714b", "value": "98304:1FVySWe/aWDDOkHPtwsLw1Dl7JGY3K8ujThIOMsEXvsx6bCFFAn:1LySWePDDOkvXLw7cWejThIOMjXv9OK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636835445, "uuid": "4164b98c-2206-49b7-b786-80f7d1337cfb", "value": 4399104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636835445, "uuid": "b9e71619-473b-41ca-8e35-968f22db9077", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636835445, "uuid": "66449c85-ffcc-41a9-b1fe-9ee57e1af332", "value": "ValhallaDsp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2606c0ef-4470-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636800900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800900, "uuid": "e46d819b-e70f-455a-8d9f-4fc4bd002ab5", "comment": "Malware payload (Formbook)", "value": "1ad9efcddab819d24cca2f9323395f9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800900, "uuid": "77b003cd-a8bc-4c8e-9051-187fb75ac94a", "comment": "Malware payload (Formbook)", "value": "8b249a16ea50d01651cf9c1f01c97deea48293f1b28735450d62bd0413b93653", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800900, "uuid": "a74d7e7b-5306-4693-8700-5c4ae6fb052a", "comment": "Malware payload (Formbook)", "value": "1ffcdd188cb66666cdac14bb8d8b48902bd666e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800900, "uuid": "81dc024a-3f2f-4db8-bb79-86d198bba2e0", "comment": "Malware payload (Formbook)", "value": "98d45afc71c84e2765e01bc8de4fc489ba86819d66049a53c80ec02313f4fec367ca4762cb2372d59c637d52fa502d58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800900, "uuid": "bab9e2ca-b7fe-411d-8956-fa047f557ff0", "value": "T13F74126533F85B63D8BECFF46870629183F1612B7072E7682D85A6EF1875BC0CA41A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800900, "uuid": "b2d4eb1f-a8a8-4c0a-8781-38287de87265", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800900, "uuid": "0bd79103-f054-4693-8123-190783cdffcd", "value": "6144:5G2GXtmd4j44cJ5egkiQ7YHoXdQCD5xRevdZ1hJCnYBphh:5GHXb8vZmD5xRejEEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636800900, "uuid": "a116c77e-ccf0-4ec2-88bd-5b1c9ac971b1", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636800900, "uuid": "3133a3b4-54db-4fdd-94e9-3c7e4d0db40b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800900, "uuid": "d3f7383d-04b0-45a1-87c7-97672c65adec", "value": "1ad9efcddab819d24cca2f9323395f9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3fff62-444b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mekotio)", "timestamp": 1636785315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636785315, "uuid": "c33d020c-cabd-46e2-b359-a98dd1d55d03", "comment": "Malware payload (Mekotio)", "value": "e8019347a91d6165537f6241516e1260", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636785315, "uuid": "85a40b3a-78d8-47f3-8c2f-271f38b3b1cb", "comment": "Malware payload (Mekotio)", "value": "8cd34e606b347f418fc20d6d100a98c74ee6cdccbf94537436bc2794e8aff2a7", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636785315, "uuid": "e3a6c869-7817-4009-8a57-195ae2f11250", "comment": "Malware payload (Mekotio)", "value": "14452b86fd43e981350aebc5e5760563b53e8b68", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636785315, "uuid": "fa12a311-7c5e-4ca7-841d-1ee6fc6b5023", "comment": "Malware payload (Mekotio)", "value": "7d4b05feddecc315354ff12cc19238dafc1fd4098dce4939d2766be18dc7543e52c609d8894097a8112a878d27c369ba", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636785315, "uuid": "e2ab5462-074e-4fa0-9076-529ec2e14b85", "value": "T1553633277AFF5611EED4E7BD1AC0FC1E05D9A4A162C27B80F6A04FBAB705D05EB19081", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636785315, "uuid": "dd20665c-3bb9-42dd-9f81-f37f4d185f81", "value": "f6988829722dbf9487ad06d111563af1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636785315, "uuid": "9fc0538e-58a4-41a0-a0c6-07f166dd66ff", "value": "98304:vKnKtSkXldocnYn2OumT78+SysFB56V4BF1hT/bCEg7gvk3BeFZX92BtQIHa:isSkXranqmdV65pn/uEg0vWBELa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636785315, "uuid": "614a65c8-3ab0-41c2-9881-fd87620a2413", "value": 5281280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636785315, "uuid": "daf5167b-9694-4a22-8c36-cb918390626b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636785315, "uuid": "770a218d-1e39-4b3c-9670-18d473c30fe9", "value": "#PackedThemida #BankerMekotio_n1.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdd7fdc-44ba-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636832854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832854, "uuid": "e1491992-668b-40a0-9633-e4b52ca7c788", "comment": "Malware payload (RedLineStealer)", "value": "e15ab1216d8617f2b76fd2f86adf8e54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832854, "uuid": "00700777-e0e1-4987-85fa-151df0db6cfc", "comment": "Malware payload (RedLineStealer)", "value": "8d5a44287fea225aaf7aec78fa9591560d448e8813e6c70315496889a8e78fc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832854, "uuid": "b5974910-1401-4e28-a962-f13838a12b3c", "comment": "Malware payload (RedLineStealer)", "value": "15a98ecba2aeb23d21bc9d963c4285162dd8c371", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832854, "uuid": "af068cf6-9e35-4d57-8dae-387a92167bf2", "comment": "Malware payload (RedLineStealer)", "value": "5abaa9d8c8d86e80fbef9953c12817559d508456d2601f475d2914e93ae4aa817ebc6f45fce3ee5781d20e0ddfc0fb9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832854, "uuid": "625c4dc4-9f59-455e-a6da-5e58bd0e2ec0", "value": "T11C65333342A0B65ED2DE7378371ADBD462C5BB7CCAD56324684B1F412496878EE084EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832854, "uuid": "2f46d5ba-c7cf-4036-8cd7-0bf9af6d862e", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832854, "uuid": "575f4158-d2f8-4048-a61f-ea6f0cb0a0df", "value": "24576:g3I7f093ZCgREMdQ0GpMY0bnAxfv0DiJQA2XOkf/EieeqtTBkEaHNYK3W7oy3NV5:gaf09cguMdQjsnAxGS52XOkUWqt9Nakh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636832854, "uuid": "23670ac8-b028-4181-9ca1-720834dcf360", "value": 1410048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636832854, "uuid": "9a31ca00-5126-4327-881f-ead8428864f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832854, "uuid": "e4e70e06-b921-4d3f-a9a7-21d28f85be52", "value": "DualHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374837e0-44ad-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636827128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827128, "uuid": "2a5ac8f0-ae6b-4ca6-8cb8-50a48b25c7cb", "comment": "Malware payload", "value": "270bbca0c28564c989fdcaf821fd7d7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827128, "uuid": "702da2c5-03a9-469b-8a71-dfda44adaea1", "comment": "Malware payload", "value": "8dc5d35e7f0a75f8a864ce2a569ac1cc3825521bcd269e5bc2ee7e6ce40c3fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827128, "uuid": "eb92ae1c-d58a-498a-9c72-309d9994cc53", "comment": "Malware payload", "value": "0020553b43e595fc68b6f724adc02a6bc851a7e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827128, "uuid": "db135887-0e51-45da-810d-8df9ce51e5dd", "comment": "Malware payload", "value": "1f8739914abe2ba512a4a8890f0f50b553c177a56d04f6389eebd48715a0a99d40c64bccdd0572636ebd882731a226eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827128, "uuid": "523d005b-382a-4fa8-851c-a8432e374ff1", "value": "T168D623A3C76BC424CE7A25F3B1C743C5A87753A9AD0B82AF07D029D05ED14A707A1B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827128, "uuid": "dae0930f-03d7-40ff-93bd-9552c2ddd44a", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827128, "uuid": "6b6e5292-f9b1-472d-8629-2e75ee88016d", "value": "393216:dvgtiv+2jW8DFPucUpXbRSgQTOtHhhBWMrHoU03vpIap3:tIc1a8DVuhXFSguOSrhIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636827128, "uuid": "e9e403f0-b0e7-4b85-88ac-70da79ee747a", "value": 13416110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636827128, "uuid": "de104e1c-1a1e-41f9-994f-19cbf40b8105", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827128, "uuid": "79f7faa8-214b-4b69-9b51-97dcb53e9a19", "value": "Remix v1.4 Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d466ee9a-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831257, "uuid": "29ddcc34-ce25-45f5-93d1-7d77e1d14a3a", "comment": "Malware payload (RaccoonStealer)", "value": "672bb8e0f32231714c6e2e52250eb1d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831257, "uuid": "f2744a64-b111-49eb-b33c-388c9de3da5d", "comment": "Malware payload (RaccoonStealer)", "value": "8f34321cad9e1f7e2d41ea9ca04699aef59ba9c768ecef60ce2bf54bf13826bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831257, "uuid": "4d8b5ab4-31af-4d26-a655-055f2070c472", "comment": "Malware payload (RaccoonStealer)", "value": "15754eb4f207824f498c3d33769213af8f5b83a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831257, "uuid": "8b7b3921-d631-422a-9db5-e9874a900db5", "comment": "Malware payload (RaccoonStealer)", "value": "8cfdf40b0de38ca80a3c63b30fc642a4db26556aa8cfa23c64a2928a031c77079e757b576bfd7b9973bf035ad63318f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831257, "uuid": "0b3522a2-c8c0-4d84-9d65-83ae0490564e", "value": "T12CD4D000A6A1C035F0B652F8597A9269B93F7EE1A73881CF12C52AEE56747E0FD70707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831257, "uuid": "c4636a71-289b-4e05-847d-0af1b01643b6", "value": "17d363df494bcb38053d0872594e66c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831257, "uuid": "6e0a6077-7f4e-4ea9-b507-40162e3632fb", "value": "12288:5GJ2LWzSiTJbs8DBPsr/kLY4svkUmKm1+0ZlXckIcPPyRp7:5GJ2eSi1ssCr/7FVPSls5VRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831257, "uuid": "ce29eaae-3835-4502-93c8-4f6a5329c3dc", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831257, "uuid": "e8650647-b518-40b2-ae1a-463964123e50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831257, "uuid": "ed06d950-1baa-4ea9-b9da-bfe6bb88d6e1", "value": "672bb8e0f32231714c6e2e52250eb1d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37d0f2b-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831283, "uuid": "7bb662ba-7343-4278-8130-e9a4aa363b2d", "comment": "Malware payload (RaccoonStealer)", "value": "6639ccae8dba333bc0fefa489181e0de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831283, "uuid": "61851f22-6476-40b2-86ac-69d510096d0a", "comment": "Malware payload (RaccoonStealer)", "value": "92cde3e38c7522bc1c3e01ebeaa60b5fd37f7766ca5064d571afa933312b460b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831283, "uuid": "0b186a29-c9ca-4d87-a97b-b776a9b3f31d", "comment": "Malware payload (RaccoonStealer)", "value": "7d3b599fdf653a432f340619c2f9292d89e8979e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831283, "uuid": "b4a0ba6f-e889-4f71-bd75-2bf8a7707810", "comment": "Malware payload (RaccoonStealer)", "value": "2dd44583403c92798c378de1739907bc5aca20bddf284237ecfce2f3444e29a1a7f283105a17cfafb42ab412b10438ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831283, "uuid": "fc509fa3-20b9-4ce0-950b-493622fbb6c5", "value": "T1B5C4E10077E1D034F1B726B9497692A9B82E7DA1AB3554CF22C53BEA97746E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831283, "uuid": "833badfd-1733-4d3a-817a-6a5836f29526", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831283, "uuid": "1855a99f-6b2d-4ec9-881a-d1c9182d9e97", "value": "12288:quQuL6yvKBXu7AfO72ngFjvHCaKowC2kKamVmrVQsi:quQGtwuWOFjJKowC2iQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831283, "uuid": "78331bce-1193-4eeb-bc33-9132f787d456", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831283, "uuid": "6377bbc6-144b-4992-aea1-5d83ba6b5fe6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831283, "uuid": "4aa91bcc-68c4-4e01-a74c-42e2d5d2280a", "value": "6639ccae8dba333bc0fefa489181e0de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6444f1-44db-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636847167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636847167, "uuid": "3c5593ea-c0db-491f-8662-fc8ef51fdff4", "comment": "Malware payload (RaccoonStealer)", "value": "d5bcb713701ff4284dfc09017147b6b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636847167, "uuid": "eabd6d14-f699-4afc-9af0-9dbe2dde925c", "comment": "Malware payload (RaccoonStealer)", "value": "9598ecb2f430ae57baec3e652df255e48ab6fbc4cb680f567a5ba3832cae7e56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636847167, "uuid": "347a8dd3-e56d-4c6d-a2cc-f7a6b5967dbe", "comment": "Malware payload (RaccoonStealer)", "value": "1f9d66acffa03cd2706305095afc3642eca76466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636847167, "uuid": "1ae81254-24a6-4e0c-8756-e1465e2027ff", "comment": "Malware payload (RaccoonStealer)", "value": "b248217a66c101d32dc3796b98aeea064d35cec40faadf935dd971e843afbb3ba5a95497b2b39e280fea5e75dfca2914", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636847167, "uuid": "dee35b98-edc5-44a7-9369-1675da525cb1", "value": "T112C4D00077A1C035F1B766F889799369B53F7DE2A72554CF22C52AEA5634AE0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636847167, "uuid": "babc3723-f0a4-4b2d-82c5-8cbb21df769d", "value": "6d58d46cb4da553c2a028fd56457c4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636847167, "uuid": "c39e8f17-3db6-4b31-b38e-44ed780d7ad7", "value": "12288:s6JUWIZZONIQ6uOMUP8Q/WcncpnPtgcUr+IEQvo7uHNnSA:d36g6oU5uccZSv+WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636847167, "uuid": "dabbbfba-8c1f-42e7-9a52-c24c783b7735", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636847167, "uuid": "ddb12dfb-d4a3-4e6a-8de3-1fe7e7993450", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636847167, "uuid": "9f323f4b-3d7c-4e1d-8050-fe9d9f96f172", "value": "d5bcb713701ff4284dfc09017147b6b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06d2ca9-44b9-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636832566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832566, "uuid": "f3cc85f2-3457-4752-a8b6-42a02c272412", "comment": "Malware payload (RedLineStealer)", "value": "3258b541f77c963e494758fb8337864d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832566, "uuid": "d864ed47-4218-4a04-80e5-4973a67aea27", "comment": "Malware payload (RedLineStealer)", "value": "97107899060e98d844d7b4eb4c3b91c0792b9186173725c75c30bc6bdf32d73d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832566, "uuid": "40986282-0e6f-44c8-9086-e6a2f2f92e29", "comment": "Malware payload (RedLineStealer)", "value": "34d679978174ed37da9ef0ab94dbee8d424b4112", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832566, "uuid": "7ebab1d7-63f9-41ce-9f65-211b53fd9def", "comment": "Malware payload (RedLineStealer)", "value": "ad1523fa0c9b5fd64eb3cc5ee458c1f5fe806788483b95da045ed97d49137b4701eacffaf52e4dc47175890e8ee53f8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832566, "uuid": "6f740fa7-435f-4c29-a121-55dd2e124445", "value": "T1FBC5333A9E1AD021F80D94302C95ED779C15AD8675B4B30988D9FC47B8BEBD8A874C3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832566, "uuid": "a9ec602a-bef1-4182-a589-eabed9e6e0c0", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832566, "uuid": "b12ccdb0-b5be-4e8d-8c98-a82b7460b385", "value": "49152:mRdTccfIrgf3e3K2v39Gast5yxhFpsiL5+oZf/x1MX+/DLZnQYMH0sz1:odTccfIrgG3Zv31mM7smQoZHYX+/DmY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636832566, "uuid": "be551161-9934-4dcf-8c36-48093f1fdd44", "value": 2702833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636832566, "uuid": "c67b8943-3985-4d12-8563-203ce82f3f11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832566, "uuid": "85be1db4-7d2a-42e4-8e83-9a32f75c810d", "value": "FBC v1.6.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ff75fe-44bc-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636833674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833674, "uuid": "5a707822-b392-4d96-b1b8-eb3f08a2343e", "comment": "Malware payload (RaccoonStealer)", "value": "feb16a76541d2240ab40d3f16bcfa80d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833674, "uuid": "cb1181b9-81aa-4d92-abc3-fafff181d674", "comment": "Malware payload (RaccoonStealer)", "value": "976b30ed3b9f1a8f02bac54aac1876534fd55ee277ca288c972774f20051f055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833674, "uuid": "e5cfb682-0efe-4c49-a66f-f75a8bb6959d", "comment": "Malware payload (RaccoonStealer)", "value": "2223c6a3d529f23d0b17d47a67f471302775cfd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833674, "uuid": "1a8db2e2-4493-4c99-b30c-4a03c82b3ca0", "comment": "Malware payload (RaccoonStealer)", "value": "64d6d86cbab9d09a292aa77d6f009029447b28013da04607d1a82ccec6496a079d0ce5dffbc070f0da25534b48a6b3d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833674, "uuid": "5de0aa2d-fb8c-433b-b30b-c54cc1450f42", "value": "T14FC4E014B7E0D035F0F716F84EB592A8B92E7DA1AB3590CF52D42AEA4634AD0ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833674, "uuid": "7abde902-14f4-4e29-ae51-9d890970fbd0", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833674, "uuid": "cb6293f9-7310-4407-8172-8444385ba512", "value": "12288:rfxGCz2cEaxAydesporlxn5i84V2uDqy1mXwvr0a:Hz7EKkdi8S28v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833674, "uuid": "719e82ec-b9ea-4e87-ba67-10222a65e4d8", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833674, "uuid": "37acc2cd-b129-4c97-93f3-137b3fecb728", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833674, "uuid": "665721e6-7bee-4d26-aec5-bff187d71c0b", "value": "feb16a76541d2240ab40d3f16bcfa80d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb9dcaa-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1636831323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831323, "uuid": "118f6183-2baf-4c34-8e5d-6cbc6b2e20f1", "comment": "Malware payload (NanoCore)", "value": "afd271f845f0f41481ff4c7506e410a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831323, "uuid": "7ff7a6db-9bfb-4428-ac24-8d478c0404bf", "comment": "Malware payload (NanoCore)", "value": "97a2f39a58fc953d4681d338d6971bda36dde00bbe0f06be7c673cf1b4a2a480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831323, "uuid": "6163474b-16a4-4c8e-abb6-f060b32763aa", "comment": "Malware payload (NanoCore)", "value": "9b2c03cdf79ebc3f23cac7b8071a03593dc26950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831323, "uuid": "effc5e99-f259-4793-885a-d07d2540586a", "comment": "Malware payload (NanoCore)", "value": "a462a7182a2f964914a6e14bd45bd131475dee5e389ff0343c4632537e0d9789e85c5f93be281b13eba40074a0df2044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831323, "uuid": "06f40879-447d-4aa2-8e83-110dda2ceeaa", "value": "T1CE859F857900E0FED82B8ABF98651C1057637CFE4666910B705B71EA0B7F2C35E2AC67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831323, "uuid": "695aa492-21d5-4850-848c-e9f139f5e7af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831323, "uuid": "218b909b-ba56-4e71-90c5-bb58d1cefda4", "value": "12288:sOmD5PIzp4UvXmpXrkKdxtrexFCmnfYYTTEfrlHEm+eGlx9h++WStP/xS2UumuXp:Nm1PIzrvmp7kKdLaxcmxWrYkuk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831323, "uuid": "594acb2f-eee3-4a35-8fd3-2321317aba9b", "value": 1802240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831323, "uuid": "a6417353-7b05-486b-bb8c-50095268ffba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831323, "uuid": "11174c39-7a5c-4fd2-b21f-06f15fdc7b43", "value": "afd271f845f0f41481ff4c7506e410a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfa9539-446c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636799142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799142, "uuid": "a4ede667-c0fe-45c7-a205-0112109a2b23", "comment": "Malware payload (AgentTesla)", "value": "9f975608144196a305dd3ec9dd266788", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799142, "uuid": "0aab9a9b-6f26-4a1f-97fb-dd14a853a364", "comment": "Malware payload (AgentTesla)", "value": "9be6709c82570161551d21334f1489a7b41f09805d5c44c46352c7a4974143dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799142, "uuid": "5fe429d0-0c78-4364-9d6f-cf5af4c44c10", "comment": "Malware payload (AgentTesla)", "value": "a6aa663dbb2ce710322b6003d50196444484e5ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636799142, "uuid": "bef55b32-d71a-45d9-9601-9d3a160557d7", "comment": "Malware payload (AgentTesla)", "value": "4718210b7912273ab911736c7f16311449e7cb6e8055626dfe7a1bcf47dd2773f26d4004becbe6a179a6bf5bc2c4ebf4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799142, "uuid": "490b81f3-0f25-48b7-becc-90d72fb88886", "value": "T163B4E102B6C1C8B2D53319325A396B116D3D7D202F35CA6FA3E87D6DDA351816638BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799142, "uuid": "f7806288-e9ae-4719-8c62-83e0220be9a6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799142, "uuid": "3332efb3-41ad-4315-a05b-ee859f8e1601", "value": "12288:OQnk3GDYKGcblwtX+t4Y8jxiWuPAMAHzWR:iAOcZwXYMqAMyiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636799142, "uuid": "ca8ff0cb-65dc-4c1e-9472-c3be464026d3", "value": 494272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636799142, "uuid": "d0274f6c-cf61-4fe6-8e0e-4456284e1964", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636799142, "uuid": "759fcd5a-b22e-42cf-b360-c033240b106d", "value": "Documentation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98eecbcb-449d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636820420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820420, "uuid": "ca3dbd2f-b545-4ecb-a092-db3de7ea8e97", "comment": "Malware payload (Mirai)", "value": "8343e05d17ea8910d164f0a6354c0493", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820420, "uuid": "38633c13-3aa4-45ec-a4af-26f3e66b3ad6", "comment": "Malware payload (Mirai)", "value": "9e1d3a67779576747d92cde11a5f7c017130a9d06919a2248c86444ec5fa5479", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820420, "uuid": "7df149fd-9bba-432d-b90f-0799e389ca35", "comment": "Malware payload (Mirai)", "value": "ce13d833423267ccf26479e16a3cfb1764da000c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820420, "uuid": "ffeb9faa-6898-4634-b58d-575a5967d716", "comment": "Malware payload (Mirai)", "value": "78c61fe2f54a6c68ab59e203c70713d45e06840bd14980a1a7a35f04cf48156761f59b7f60d3e9a189651ce28e86b8bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820420, "uuid": "c91962a4-5196-43b1-b8fe-47435db2657e", "value": "T11464E08AED41AF25F8C516B9FA1F034973B38BACE3DB7111E62487143ADE64B4B35184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820420, "uuid": "f4926d11-595d-4f70-9b79-4c1667515b78", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncPBa77oNsKqqfPqOJ:78QpZsKCaiPBa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636820420, "uuid": "8ffeae4d-f88f-4ddd-901f-26b42a9d0e76", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636820420, "uuid": "a9b5cf9b-2a40-4b74-9997-531e1bdefc63", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820420, "uuid": "906372e0-d765-4b39-b10f-e55a74359b6a", "value": "8343e05d17ea8910d164f0a6354c0493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9321e2-44b1-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636829016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829016, "uuid": "d4e62ea2-bdf8-4607-9658-372b7095e0ee", "comment": "Malware payload (RaccoonStealer)", "value": "6966182dd20351152ea815d31e735067", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829016, "uuid": "30987245-33d2-4de0-b1a8-6eec63b56754", "comment": "Malware payload (RaccoonStealer)", "value": "9f1829d274764862ecbac58a299f20376c4f5e7c725de68bc94ea768724906f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829016, "uuid": "cfbcc3e9-3ff8-4821-a204-3e3a8bf2ca3b", "comment": "Malware payload (RaccoonStealer)", "value": "69a2df785f37d2d7d2d9a5f9120c679870ff3872", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829016, "uuid": "690c5d99-7c1f-49db-975e-3b2fb0420a97", "comment": "Malware payload (RaccoonStealer)", "value": "98f52e6d9b9728e764f19f19c1387fda3bd8060b24f99c4935795cd718acfb0281ac7199b5ca676a07819bdcd4e35fa4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829016, "uuid": "990cb93e-d1a2-4c9e-9cb7-80b87d78360b", "value": "T15235F107730B000BE428BBF69FB73B251754F6AA49318717D6E1762E506F2F93AA1712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829016, "uuid": "f3ef7e7e-f983-4129-94fe-da819e6d67e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829016, "uuid": "4c56221e-e052-40a9-93dc-731f8dc24568", "value": "24576:JAonVXGyMHv70mq0PgSErFqQSWjVtVYZ:SonVp7OgSErFqQtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636829016, "uuid": "3924a423-ddfe-414a-8589-30b9e3933dec", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636829016, "uuid": "335737ac-c98e-4409-9d60-14a48384fa53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829016, "uuid": "d2fd8691-1dae-47a3-9b24-966af73c936e", "value": "6966182dd20351152ea815d31e735067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a2a954-449d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636820252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820252, "uuid": "915e4504-66fb-4297-ab4f-f3108877323a", "comment": "Malware payload (AgentTesla)", "value": "e0d0f69523666930260d57f7a5484038", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820252, "uuid": "a735410e-27e6-4786-b7a9-0c02a508ab10", "comment": "Malware payload (AgentTesla)", "value": "a09e152684ccf38a110b62c9ca78cae4b107bfc4ab50647973120d14f721bac3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820252, "uuid": "49c67068-1477-452d-bb3a-8ad5d9b2f6a4", "comment": "Malware payload (AgentTesla)", "value": "9ba26d75bc1c6e51e8ef242cc6a16050c0cf480b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820252, "uuid": "bc07b8fa-5508-4235-a60f-c9ff460b0ad3", "comment": "Malware payload (AgentTesla)", "value": "6aa9ff6153a6baa5654a99cccb8e2e1df19a54d7e4e72fbba6d7b876e648e8aa4c1eb1761bef377d4c3b5bc6fa871518", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820252, "uuid": "464eb744-ed2f-4fe1-a128-2517db0a0e51", "value": "T14A741200E438D725DFFD5B76E4A214888379D58146A1DEAE88D4E0FB7C57B8292D338B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820252, "uuid": "228245c3-bc32-4ac3-93af-e83cf2d887b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820252, "uuid": "ea780128-c33e-4998-8af4-b3511be4948e", "value": "6144:DntrvFl1KNCQ1COR/cbDEb3ggK3XPAPhNkbGEhPwUJAv1T:JrvF2lR/qQT0nPAPhmXDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636820252, "uuid": "71a3c3ab-64f1-4df0-9e5e-98aabecf07a4", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636820252, "uuid": "a658ae3f-683b-41cf-b364-836892f5978c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820252, "uuid": "fb3cf341-35a5-4f88-bb56-ca7f3b7adebf", "value": "e0d0f69523666930260d57f7a5484038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fc5359-44ad-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636827370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827370, "uuid": "a4f317e9-ac24-45a2-a9c2-7da01abed4ee", "comment": "Malware payload (RedLineStealer)", "value": "9a96b1503575c3f7197c63cfe218af98", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827370, "uuid": "eefaff88-aca5-49b5-bc26-bfc7b6c1eb7e", "comment": "Malware payload (RedLineStealer)", "value": "a0b3e767f69fa35a2c2c280cc6ede993d6af464bb261352ea371ee9e0aa60d9a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827370, "uuid": "c9142c44-59c2-40d0-b096-e921108edb7d", "comment": "Malware payload (RedLineStealer)", "value": "430d29c3247d754e836a773d0071a5fea704888f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827370, "uuid": "d1b2a952-1c5c-4d4d-b229-e4571cd13a1e", "comment": "Malware payload (RedLineStealer)", "value": "bef275f873be3c5162f89ef92ba5b3daaf306b834d075c6241706f4e72e00274f3cc2788ad645c4ecfb5e97fd0d92d4c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827370, "uuid": "4a387448-88aa-4029-a83c-7c751fc4a534", "value": "T17A553340C2DDEECAE76D247978189E0FB0AB8BF1CE5475943649F0A4869C073B19E4BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827370, "uuid": "b55876e8-fdae-4941-8254-d7b2c0ac2bb7", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827370, "uuid": "3a92467c-1082-4918-b310-ef9f85d269f2", "value": "24576:Rb9sPDn6y4rIrAJl9v7wgFI8//l0nlsqJHOaxjwuuBFOGzXqDUkEaHNYK3KLMyy:RhoDn6FsrAJb8d8/Onlt17uvOSdNaI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636827370, "uuid": "7e9a62ed-5979-4eab-b414-0b2eea221ab0", "value": 1400832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636827370, "uuid": "fc96ce52-e782-489f-b710-93d17cdb2a7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827370, "uuid": "5b6c39a4-08d4-44c4-873e-31dff6f1f7c8", "value": "SenseHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed38a478-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636831299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831299, "uuid": "271b213b-ff44-4232-9e62-c1fb02d324e3", "comment": "Malware payload (RedLineStealer)", "value": "c57ddeddea6ed928ee6c20a5f2b6634d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831299, "uuid": "8355aaca-e731-4760-8a3b-793d793e4e61", "comment": "Malware payload (RedLineStealer)", "value": "a34e6f1c5a93095db3831ff92eb98b1a6e5451eef64126cdbabe98a1c957fe94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831299, "uuid": "9a11a3d5-8aee-4af7-bb61-276377d39c9d", "comment": "Malware payload (RedLineStealer)", "value": "acb3dac6b23e1f986ee1b659d8677bbe722f2e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831299, "uuid": "388ff55c-5ab4-46b5-8052-a40b6867107f", "comment": "Malware payload (RedLineStealer)", "value": "b7683a9bca4b24d8d984b862c5f895b3b3ef41da0a9917da826aac468ab20316e3a5cb244c3ce58c57d23b3c7520edff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831299, "uuid": "a18ef956-9542-4e57-aa4e-e82aafa4c4b3", "value": "T1A0648E00B7A0C439F4F616F849B693A9B93E7DA1A73590CF22D576EA96346D0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831299, "uuid": "e7822532-38cc-4c4e-a27e-926adf57fe26", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831299, "uuid": "65d1a730-6fa7-4563-9c7c-069a955e11b2", "value": "3072:Ls0pydlykR8YYW5LWqPT7tM2fLFoEbAXqetZwNV0epG6FDRRUZxRVTMO5r6rw9bB:LKLt7O2fh1AzCNV04G6FDzUTTM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831299, "uuid": "12b3df8a-8142-44f9-8eaf-779ab23db8cc", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831299, "uuid": "b92c31cc-00c2-47e4-9ea8-2a3995a6ea65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831299, "uuid": "6500c4f4-4117-49e1-ab2c-a22d92c02d76", "value": "c57ddeddea6ed928ee6c20a5f2b6634d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59799044-44b2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636829333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829333, "uuid": "672a1987-3eaa-4eb6-96bb-e4041e10d070", "comment": "Malware payload (RedLineStealer)", "value": "7186ace185636ae6370b741b93ca8d0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829333, "uuid": "2caf2d24-9c4a-4642-9aa4-ed28d40fbd3d", "comment": "Malware payload (RedLineStealer)", "value": "a3d16c6ae1302f54732d0abfcbf0eaece47378a72a35e570ee68bd479bc7c851", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829333, "uuid": "7430ca2d-f145-445e-9e87-e1b853ca0780", "comment": "Malware payload (RedLineStealer)", "value": "e022fd39851beda080a814c096d294ece89aeff6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829333, "uuid": "5f16936c-2504-40e1-93ec-1d82d2f099bf", "comment": "Malware payload (RedLineStealer)", "value": "d37e171678831004d898df39ca35c1d0d06c3d691fc6152a7d265ef2ff6e704439c72eb623bef2232afef720cfe2bdce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829333, "uuid": "5da36465-2bbd-424e-98ed-efa3830c4790", "value": "T1B76533383F82670DC14BB3B84330330A109A6EF786552EA5A9694502D71E4F7EF94FA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829333, "uuid": "2c7bcabf-7884-4f49-b88a-0903150f9baf", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829333, "uuid": "d0c970b3-a3f8-4533-b9e9-dbba8a4ded48", "value": "24576:gmhPlCGPgNSZlz4JspDumopQohoqaZ/oQkEaHNYK3g1ZOeQqg:9PlBg9J8SmopQoaqaZRNaAPQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636829333, "uuid": "27a33b88-981e-4603-83e0-e3bc411c4906", "value": 1424896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636829333, "uuid": "f78c7c8b-38ea-43ae-b2c9-803721cf64a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829333, "uuid": "cce95ee1-a786-4898-8e69-37610af12eb1", "value": "7186ace185636ae6370b741b93ca8d0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50fa2eb-44c6-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636838050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838050, "uuid": "162f9fbf-07dc-4189-bd47-d4804c6f6835", "comment": "Malware payload (Mirai)", "value": "6437593ed80401f357c48efd44ad98e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838050, "uuid": "181a416f-1d52-4ea6-9521-336eaaf1b464", "comment": "Malware payload (Mirai)", "value": "a74de057ce4b9fa831061d8e64ebc367a7d360ce1a16541b4c90f4b0f286db09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838050, "uuid": "113d244c-723d-45b9-901c-aedc12d5efb2", "comment": "Malware payload (Mirai)", "value": "f9ae4ce50cb6e39a726c524d309bc56efc9940aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636838050, "uuid": "7ca22855-c1ad-4c44-9ed3-15346f185822", "comment": "Malware payload (Mirai)", "value": "5ca53e7db986906e0c7d1cda66af712ea920fdd0ec2bedb5632e7b8a9dfc16265c50ad553ea243817b994374a77d3ac4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636838050, "uuid": "a7e8fbd0-dd0a-47a4-81c9-686e1f00e664", "value": "T1F6F2E038A7D87A7447309B39ED641185A3CA45FCC5EBA7A168280BF1034C64B2BF164A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636838050, "uuid": "8cb3e2e0-bed1-42df-bac9-8ceaee9de217", "value": "768:O8kxiD+j+d+PlFIp1A51QtcmYVKf9g90kOx99Y1SSB/h+T79dMqY2EbHs3Uozm:OKD+j+d+PlFI01QtcmYbGnfY1SWQ9y+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636838050, "uuid": "3bae14bc-ed95-4868-ace3-f2a7a6164276", "value": 36972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636838050, "uuid": "f0bd4bff-0018-45f8-b913-1dda8a8b37e5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636838050, "uuid": "f731f224-203e-4283-8bdd-5ee4081167ce", "value": "6437593ed80401f357c48efd44ad98e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e651af-4466-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636796605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796605, "uuid": "c8aeca0d-eebd-4204-a6c3-790e13db3417", "comment": "Malware payload (AgentTesla)", "value": "02e562ad90c4f2bac2aa2fa839b3c19c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796605, "uuid": "864b0ed1-af98-43d3-9a6d-939f3b9816c1", "comment": "Malware payload (AgentTesla)", "value": "a7b2026b1133589f336f366db1d2e37a06144ff0600877ef20d81eeab077a448", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796605, "uuid": "d6c72981-a033-486f-8163-228f0e1816c8", "comment": "Malware payload (AgentTesla)", "value": "45ddd6bfb6ef984d3b6ae1f73b76c57c1cc2f716", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796605, "uuid": "bbb8e923-384d-4c45-869c-2c477b069361", "comment": "Malware payload (AgentTesla)", "value": "ffcc4e737827ba068c3d5038fef5603748426afea65a44413bfba985d0c91566587d9a09983cbc93b6a80a6cb50d1967", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796605, "uuid": "a715cdb3-b45c-4239-a7d5-7c7c458ec1c6", "value": "T1EBC4126836B4AC17DB7DDFB31C83251157B0BA6BA922D20B3E8615EAE15EF520503F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796605, "uuid": "85be2160-4859-4741-bae8-7299edd3034d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796605, "uuid": "89d252fa-4c74-4c04-b5b8-6ff91050f58f", "value": "12288:6No2iNYvKrfWpWbwhD+zpbcgkz4jJgHyD2Ser:D1SvKVbw5+zZc4Noya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796605, "uuid": "28b5f775-719a-48fc-b5ff-b80b7ce12b30", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796605, "uuid": "f4a852bc-b0f6-4501-bba2-32ec3c46ee9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796605, "uuid": "027a2a81-42a9-4084-a5f7-aff8484de310", "value": "DHL Delivery documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9cda7a-4454-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636788937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788937, "uuid": "8bfc8910-88c6-4a9f-9106-6c8ae0f9741c", "comment": "Malware payload (Smoke Loader)", "value": "d985b4cfdceecc3c0fe4f3e4fda4e416", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788937, "uuid": "39b442d2-7850-49f5-93fa-7f195da7215b", "comment": "Malware payload (Smoke Loader)", "value": "a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788937, "uuid": "a680a197-e0ff-4078-b688-dd4ba8582617", "comment": "Malware payload (Smoke Loader)", "value": "f3c14a4d87569e54faaf0eac73ec1aafa2621dfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788937, "uuid": "075c2c5b-ef35-4d3b-9dfd-44c53850431c", "comment": "Malware payload (Smoke Loader)", "value": "e2a30f40fbcd42708a83b26e38e0843fe16cd7ca634eeb297941f99e881be5bfaea33f48880170558f129b47dadb477c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788937, "uuid": "e4bc85bb-6d03-4c24-b72a-e9ff9b630ffb", "value": "T1A4F39D207BF2C876F5A2A630147586A11B7AFCF33574594A3754222F1EB3BD08AB6353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788937, "uuid": "017eacf7-e98c-4ac2-b6df-e69743201a41", "value": "620327c357b4e134c44aeeb41890b58a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788937, "uuid": "197348f1-cb41-4024-9f52-c7165f46059e", "value": "3072:X7UuBgLClgxDRXr8FszykHszuubqbgLt0ODpZa9uD6Vdyhkd:2LClgxDVwq4r4gRVwVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636788937, "uuid": "4106aabd-5183-4f0c-a1ef-44615fa15829", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636788937, "uuid": "31380551-0d7b-4b8b-b55d-9013216a07fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788937, "uuid": "2b07120c-a4b4-4629-8ad9-d47c713ca651", "value": "d985b4cfdceecc3c0fe4f3e4fda4e416.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd29db1-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831303, "uuid": "18a8c11d-ec79-4bcf-9d3d-0e252e24fb37", "comment": "Malware payload (RaccoonStealer)", "value": "78f185f09c5e814104fbf049904a6971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831303, "uuid": "a9b8f7df-5dfc-40d2-94c6-06cb9b715a24", "comment": "Malware payload (RaccoonStealer)", "value": "a921f59feebc9aea286874e8f499dbcbfafe1cfee244e44ec7dc2b431d1b39d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831303, "uuid": "78e32cf8-f4b0-4eeb-a406-3e4b8fd6dab1", "comment": "Malware payload (RaccoonStealer)", "value": "a2c506c3ed3c18048f2d7f5dea7d9f16ed46a29b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831303, "uuid": "9fa59469-4c7e-4ea8-9031-643e721c8981", "comment": "Malware payload (RaccoonStealer)", "value": "012338c0e4c73b53821df8703e2ba1bb84371384ba2866db96efd46a15b3288f6d3cd2b09deea55fa336c594a9408d16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831303, "uuid": "a3bd0a0e-b296-4d99-87e4-c4750e642b02", "value": "T1BDC4D100A7E1C035F5B326F949B592A9A53FBD91AB3490CF62D42AFE56346E0EC30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831303, "uuid": "fd81ded0-48f8-4a4b-a342-33247e1c0cca", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831303, "uuid": "a5a5e3fc-3096-46b6-8957-eccf186705a3", "value": "6144:9tXBDcN61uDxBjEozZMbmObo3qKgG80KC0wWahDw2lrZyrmy93kgqv4Qqn:ZwkpgM7oDKC0KU2lrZyrmy9Uv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831303, "uuid": "ef794614-c557-4c35-89f5-b43ce88ddd1a", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831303, "uuid": "f262cbc9-8b80-4ae7-a460-829f35ee37ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831303, "uuid": "332645c9-d9f3-41dc-9b22-8347102a5277", "value": "78f185f09c5e814104fbf049904a6971.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21318c96-4423-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1636767821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636767821, "uuid": "666a6aac-e6d2-40ce-a3fe-a1b0eebda111", "comment": "Malware payload (ArkeiStealer)", "value": "1790eae1cc50666ee6239bdd13123039", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636767821, "uuid": "9b62ecbc-fe12-472c-823e-e6911c3842a1", "comment": "Malware payload (ArkeiStealer)", "value": "ac50621ee130a988dc1ddc97ca8b1193249ce9a027648f482ef1b0f9cf7b2e88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636767821, "uuid": "193be2ee-f1c5-4b35-a37f-d00fdb1ebdcf", "comment": "Malware payload (ArkeiStealer)", "value": "df2526522ba6a3d4e76773b7cb09299ef1b18a67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636767821, "uuid": "aabd20ec-7c6b-49c1-9335-b579e78459fd", "comment": "Malware payload (ArkeiStealer)", "value": "a30f0225229a7d3d1ac0614f509fe3d5f4fbcb90bddcbef40ff1714e8789a9b37792006ade033664bed62f4c6bdf65c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636767821, "uuid": "d791b489-8f3d-4d56-8fff-ee5e93c3ea08", "value": "T1E26533702791CC5FF14E27BDAA2B76798B713084C360F377A3A9561E38EF6958819027", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636767821, "uuid": "41dd7c14-f7d4-49ac-a3ac-7af3e11c0b8f", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636767821, "uuid": "57fec115-6bb2-4863-aae7-8b5a190b0782", "value": "24576:VDsEmMJDeGBUBReuWuMf5CWfzCMuK0kMbJDIRRFJbk9JJ+/y9kEaHNYK3OGkP9Qr:6MJySpLf9i9XJ/NaHcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636767821, "uuid": "90b7c6be-6188-4bcd-a369-bc7472fa667b", "value": 1452032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636767821, "uuid": "8f5ffeb0-688d-439f-a3e1-4fcae7fffd71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636767821, "uuid": "afe99cce-7526-4e4c-90d7-13b0f658ccf6", "value": "1790eae1cc50666ee6239bdd13123039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4313851-4490-11ec-843c-42010a9c0014", "comment": "Malware payload (Troldesh)", "timestamp": 1636814963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636814963, "uuid": "0e74fac8-8084-4187-ac1b-1c2901bef0bf", "comment": "Malware payload (Troldesh)", "value": "536f24111b28ff9febcdaef4ceb47adb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636814963, "uuid": "217a5c2e-5e63-466f-b1da-cf0387315421", "comment": "Malware payload (Troldesh)", "value": "ae771418cdcba682dd1beafa62d6a6a2505b74748bbb61ed4b666332cafa3527", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636814963, "uuid": "f9aa9e9b-1e37-4230-981a-32a07924b4cf", "comment": "Malware payload (Troldesh)", "value": "a6620c1b338dbb84dea74b60d4bd9474166e452c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636814963, "uuid": "00320ed3-d4f1-4549-b3b9-add0e2e4f1a5", "comment": "Malware payload (Troldesh)", "value": "62a43436b692b902037cdd3eaf43d4b322eca3a63ccc2dba8cfb8b8f161fecf56ff5eae85184963cc986b7af957841db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Troldesh", "colour": "#255919", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636814963, "uuid": "afb78884-d002-4af5-b09e-09dcba40d957", "value": "T199128457AD5726E07E768566AF6FC14813A5070306BDC060B32EE8C15F5CA6702F8AFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636814963, "uuid": "82e99110-1f59-45fd-aa9f-6d972981c31b", "value": "192:6S9WMunMYHCUGSSEHn9Tr8ZJSt+u9JaXw/EwMettECxLozGC0:VIpH9U/Sya2itECxL2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636814963, "uuid": "355c29e5-19a8-4ab1-8f95-be4f7829c7a3", "value": 9385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636814963, "uuid": "8a1c71d3-3cbb-4894-8bf9-760901d83e36", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636814963, "uuid": "081bcf7a-257f-478b-89ae-aed51ca97c1c", "value": "\u0437\u0430\u043a\u0430\u0437\u0435.2019-0807.docx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1f7965-4465-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636796350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796350, "uuid": "5d8c3c06-44a3-461d-a575-42d6bd1caa8c", "comment": "Malware payload (Loki)", "value": "77e3cab6aea3ab9d21f615f00571c949", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796350, "uuid": "e1cbff92-a34e-41d2-af67-9f198dd1a6a6", "comment": "Malware payload (Loki)", "value": "af6080eb192c732f995fb809ddea9e15ac7d3b3408c1f6e2c7e42cf35db94daf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796350, "uuid": "3cc2915f-e5e6-4166-badd-16d3102d9794", "comment": "Malware payload (Loki)", "value": "23c989d592ee66c863a5eaceae420a9a803982be", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796350, "uuid": "51cac1e5-b0c0-46e4-a9d0-7b34eddef077", "comment": "Malware payload (Loki)", "value": "5d8e8a70dd5acc982f5e2bc03149445d9b1132d1da27ddbd7b82296fa624a733462020c7909fa3d22c53c0af9d247074", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796350, "uuid": "ccd5b5b2-9bf1-469c-a608-c798d85033ee", "value": "T153820DADD45706988F89BBB82B0B1F85158C766DF785A6333638973527E2C7B402383D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796350, "uuid": "8d5c9c1b-be38-4814-b79f-02d43d9fac81", "value": "384:5nc7BXkYDDbrjBciOsLR1gNzHIKEsjmTaQth1O:5mdkyciOwgNztjiaKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796350, "uuid": "f98e6bfa-0343-41ea-a200-9981fbe96a46", "value": 17689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796350, "uuid": "4ec07da3-39c1-4b1d-80bf-374125e84732", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796350, "uuid": "c9b69c4e-8dcd-43ee-99ed-5b226258d614", "value": "list.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475d8726-44c3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636836604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836604, "uuid": "1282c732-80ab-44e4-a61a-b9a568a9417f", "comment": "Malware payload (Mirai)", "value": "5b081c2d77d3229952e2996899e2b9b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836604, "uuid": "6dd57fed-eba3-4cdf-8e72-48271a50ba20", "comment": "Malware payload (Mirai)", "value": "b10f700e7c6fcd33fcfd7511cf0a0e3a45ede17bff13aa821a7abb960112e9cd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836604, "uuid": "bccd0939-86d8-43d9-b8ff-e713c7311a7c", "comment": "Malware payload (Mirai)", "value": "a91a763e6bacc5c5b539352669d003aff5658405", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636836604, "uuid": "14786ee8-837b-44a8-881c-7892bded7f53", "comment": "Malware payload (Mirai)", "value": "c67e29a4feec3fc49f56031142236af7f10ff454b6d5a252bf079ec3a793aa50dc18a9d0e4a4cb48a1c049b31fba58d0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836604, "uuid": "609c13ee-a07d-40ad-a92a-0123e25de666", "value": "T14D5302D28DC4982543735D785C9C0EFD1B150FB7E492EE9268B84A1A84E39CA3DF004F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836604, "uuid": "7bf7734a-81b2-4586-9237-812912715d6a", "value": "1536:aTOicyNz5xUbq9xX6RkjBugHg95Lc7fOhx68R4TLH:zwxxwaj/c5Lc7fOH6i4nH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636836604, "uuid": "78a24c89-d6cc-487e-b651-a83b32b51dc2", "value": 64528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636836604, "uuid": "55341e9c-767f-4654-9680-912e0ea6e6b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636836604, "uuid": "769a9e77-3c87-4659-9e71-540ddf9526e0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e232608e-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831281, "uuid": "f4bf72b8-d641-4c5d-b671-a8b6038ef763", "comment": "Malware payload (RaccoonStealer)", "value": "af65544517587aa92863c1c88f587e0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831281, "uuid": "711cb9f0-836e-440a-9e5d-b8eb0cf3a263", "comment": "Malware payload (RaccoonStealer)", "value": "b2cfcca54559fe12152b31db92c3344cbf9024df4f9ba0bf4bd1790c3963a779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831281, "uuid": "35c64a81-5a8c-46c1-b441-5494b731a9cc", "comment": "Malware payload (RaccoonStealer)", "value": "fa5813486fc38cedc1d7706eef79ee4f30892c94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831281, "uuid": "4447cdef-6aca-4824-b011-66d4533fa505", "comment": "Malware payload (RaccoonStealer)", "value": "3ad784e1ebef6c67da1a5d63abcc541ac111d6b0dcc516a37e63c6d0e6c8a57afc86de54695c1929e85962a74f525eb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831281, "uuid": "772f19af-4059-4f80-b8f0-7c74f7bae01d", "value": "T199D4C010AB50C039F6F712F85A7A93A8B52E7AE15B1450CBA3D51BED47356E0ED3032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831281, "uuid": "b8309457-d26f-41b0-b7c3-42666e59fa6e", "value": "19b6735c8aa7c4762763f185c4bec636", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831281, "uuid": "b56bf280-4fa0-4fa0-b427-f5d0553ce329", "value": "12288:Bni79NSzDq9dp5BD0sxYM/DQROc4XuzeFHyu5lfdsmimop:Bi7Kqvp510sxY2QRO7Su5wmim0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831281, "uuid": "a9e2f179-21e9-4a55-bc48-261afa32fa39", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831281, "uuid": "6e6804f0-d02f-4c57-bace-6936ba806e23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831281, "uuid": "d9f0ed68-44d8-434e-b4a2-d0397601055e", "value": "af65544517587aa92863c1c88f587e0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0003ea8-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831250, "uuid": "5f5a2ddd-d274-48f0-81fc-fc867f4400ed", "comment": "Malware payload (RaccoonStealer)", "value": "add3360cb1f3e0f0e923d4efbe1cd533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831250, "uuid": "107d1949-b017-4966-9e22-b8cf0373d928", "comment": "Malware payload (RaccoonStealer)", "value": "b34e8aa6bc42993186969f1477590c585d6eee163fde696854cb4e462fbbb7a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831250, "uuid": "cc82e221-447a-4eab-b3cf-fbd363311892", "comment": "Malware payload (RaccoonStealer)", "value": "b08cc116457e031c81b84df6187c9aa687456994", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831250, "uuid": "f964fd9b-4b59-4f8a-84b1-88baaebb67fb", "comment": "Malware payload (RaccoonStealer)", "value": "a0544452d54774ca44ad039aa02519f7c2d562b9daabb27d9d46c4f0ea0d4568e8468d23779990e077f3b3cf061025d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831250, "uuid": "03f7a573-af1c-4a67-b3e6-879821604ba3", "value": "T157D4D000A6A1C035F1B652F859B5D369B93F7EE1BB6450CF12C02AEA4B74AE0ED31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831250, "uuid": "19321903-9363-4f08-8254-d39e2eab1310", "value": "17d363df494bcb38053d0872594e66c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831250, "uuid": "071a882d-264a-43f4-98ad-405ade5afdee", "value": "12288:AsIjtJct6KOI1Hvb8oCXoYx2l2RDImWZSjhW:AT/6u7wlSUIjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831250, "uuid": "97921c1c-a32d-4579-931c-f63447b5af2f", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831250, "uuid": "3fc4951f-3ca3-487b-89ee-17125f25ca71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831250, "uuid": "38998ebb-c427-4609-bf50-66c80ecf9cf2", "value": "add3360cb1f3e0f0e923d4efbe1cd533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031bd7eb-446b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636798694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798694, "uuid": "db95d44c-7d17-47c7-be45-83bd6c0f427f", "comment": "Malware payload (Gafgyt)", "value": "79cb753c7b2c6c798f442423befd7068", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798694, "uuid": "24ed7e15-8259-4c1d-9583-0dd166f53e5c", "comment": "Malware payload (Gafgyt)", "value": "b39a00ef329d98f9403e6a013e8b7e71d6c709d22c5466c6b19b8ba8e53557fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798694, "uuid": "2f4b25a7-649a-439e-8ea1-3b83d63538a8", "comment": "Malware payload (Gafgyt)", "value": "234cad34c4e52952e3636e6e3af84fc28ac5cd98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798694, "uuid": "615cf74d-2db7-402b-8308-100ffb37982c", "comment": "Malware payload (Gafgyt)", "value": "aed65281c1134dd84abcc4775827f7d6d4f508a8f14e237f6feca04db912b23672a70b63054da1bbab446bb92ed13215", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798694, "uuid": "3c53a3d5-4b3c-427a-baad-2de0e5488641", "value": "T177F3966E7E21ABBEE16886310BF36F70C39521D337919382E16CD6585EB124D1C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798694, "uuid": "459a8817-7c3a-41aa-885d-00694a8dcc67", "value": "3072:rk5yydFPWx5ODiK5hVDrrhmvtOqx13LWRWq:Y7FOCuK5hVXrhmvtOqx13LWRWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636798694, "uuid": "6bd9f299-049f-47d7-a6ae-7286661cd5fa", "value": 158557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636798694, "uuid": "7fde9fa4-fcd4-49be-bf13-0d8fffdef0e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798694, "uuid": "b4c227e6-7892-460b-80c6-23afc529a127", "value": "79cb753c7b2c6c798f442423befd7068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cb32e5-4470-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636800906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800906, "uuid": "ba5ca01e-32db-4433-ac54-e2587a869cc2", "comment": "Malware payload (Formbook)", "value": "412241a9318ff1dac966423d98e42ca6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800906, "uuid": "77ff025e-2541-475b-99db-c1da0c582f92", "comment": "Malware payload (Formbook)", "value": "b4c8ee0de2b2db7adf56e9cbe744b5737b6efe3c3b851bfab64b1690dca0d5ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800906, "uuid": "bc198bb9-b4fb-41f0-a9f0-e2f00e1110c0", "comment": "Malware payload (Formbook)", "value": "e7fda7653b5c15a23118e836abe0a2d90196d14c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800906, "uuid": "792b8edf-2c2b-4145-8251-3685011a33aa", "comment": "Malware payload (Formbook)", "value": "4ca703e7d5321c0ee1e36d4e443042a51d718ce52638d473739e03b6e276ca66f0758e72c3e6f85ad2f56fb77ea9817e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800906, "uuid": "bc0fe251-1119-44d0-a957-9a24b1784b0b", "value": "T1AEA4F27E7A59CE02D135463AC8EE946043FCBC0A7976C76D6FD8238F6D5234018B06BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800906, "uuid": "3eb1b164-c6ee-4a88-b1d0-647ddc71107d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800906, "uuid": "4110f37e-c6ca-4962-8137-0001805ac45d", "value": "12288:9NYjCOetD008R6QtyAnzLZTdhWgn7X2pI:b+C1C0Y6MLtf/AI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636800906, "uuid": "0583d89f-a87e-4358-91a4-9eeac250ccfd", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636800906, "uuid": "724b160f-79d5-4106-ba6e-781bf49d1f49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800906, "uuid": "0399d9be-c461-4f8c-acdb-543337716947", "value": "412241a9318ff1dac966423d98e42ca6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa0826e-446b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636798707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798707, "uuid": "9cffc8c9-411b-405c-967a-9e20b6928d6b", "comment": "Malware payload (Gafgyt)", "value": "a4067b1a6c8e733de892dbc486da618d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798707, "uuid": "7f091a1f-36c5-4e44-9c08-b36efd98cce5", "comment": "Malware payload (Gafgyt)", "value": "b7d1f5d4d419afee6c3cabe7fded01ee64a47329ada9fc00d345efdc3cd3bda5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798707, "uuid": "70fc471d-fc08-4857-8008-a9a0434c1b9c", "comment": "Malware payload (Gafgyt)", "value": "370b2e68389f12d4557ef0c71004c982445f59e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798707, "uuid": "62ea78ea-0986-4f82-a75b-b2e4cc2717dd", "comment": "Malware payload (Gafgyt)", "value": "a1baaae46b26439ebb6edb622f5adb6c9e733d5f8743b370ecd6a567780b0e09411a22ce325e36be12c3d6640d8cbd0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798707, "uuid": "af50297b-71b7-4726-984c-d6da16fa3b18", "value": "T1ACD32945FC444767C2D327BAE78E038D77355BB857C73311A938AEB02BC1B992D2A5A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798707, "uuid": "c38dd975-0b1b-4520-b6a6-fbf2126aef47", "value": "3072:hR7Bjbc4P0VmgZ5hSJ/jdRPm63QQAhP5+XD6q:FPjgZ5hSJ/jDm63QQAhP5+XD6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636798707, "uuid": "6861426e-6610-4ef1-8f3a-adb1412813e1", "value": 132186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636798707, "uuid": "0c108223-a4d8-4bac-8592-d31a81967d0d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798707, "uuid": "b071cfb9-05c4-426f-beae-2e9c2a460520", "value": "a4067b1a6c8e733de892dbc486da618d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa0d695-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831295, "uuid": "35964c94-e5a3-4cf8-9a09-7be1540d328d", "comment": "Malware payload (RaccoonStealer)", "value": "9b20270a5eec3641bf6b23e0f02cd0c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831295, "uuid": "6ae3d30b-c2ec-4637-84b2-0b0028c6a136", "comment": "Malware payload (RaccoonStealer)", "value": "b94b96eb7b544695666e1a4c743c5f948aa69e2a5e93bf65b62199e01a276834", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831295, "uuid": "d6ce6c51-01ac-4669-9b49-a4043fd7df3e", "comment": "Malware payload (RaccoonStealer)", "value": "588348b7ece68602b732fae2c3cfe0aef8ac4516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831295, "uuid": "2b56b813-9e10-44aa-93ac-ce3c29e624c3", "comment": "Malware payload (RaccoonStealer)", "value": "33f2025f9b5491f915677950e9a6bbf935c30f9ee170d929253f818b727ac06054e875223b74ea881424941839d2376f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831295, "uuid": "04ce5e7a-826c-4f09-b839-dc3775eb4d1a", "value": "T1F3C4E100B6A0C035F0B756F449B592A9B93F7DE1AB3590CF62D43AEA5634AE0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831295, "uuid": "de81c875-8d6e-4847-9a3e-b1d27207f26d", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831295, "uuid": "3037eb9d-653e-4fcd-a759-6d5626a20dda", "value": "12288:NPy+ZBCWWl5we9hfy6WN/hd32lrVinmyBUv4s:8+ZBCvl9W2SU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831295, "uuid": "895bceec-ac66-4bcf-910d-d4afd2b16fd3", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831295, "uuid": "664547c7-325d-445b-88cb-56e04ffe8807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831295, "uuid": "0968b08e-84a4-4dd9-9c35-b70efcd59e8d", "value": "9b20270a5eec3641bf6b23e0f02cd0c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00eb7383-44b7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636831332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831332, "uuid": "7803adf7-66de-4ea6-a7ec-d22c69f07a38", "comment": "Malware payload (RedLineStealer)", "value": "7ac20345ed8615a12a8ac4f1e79f2cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831332, "uuid": "db5b3a36-493a-4662-9cb5-a16c33d2a93f", "comment": "Malware payload (RedLineStealer)", "value": "baa9766b5d610d55b57bdbf3025be5a2d77fb109878b8ae54538d248067b8052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831332, "uuid": "f798bfdc-7dfd-44ad-9d53-2fbfa45b8b71", "comment": "Malware payload (RedLineStealer)", "value": "ca5690864a204245746a9a0fbd5471fe39857c64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831332, "uuid": "61190f9d-eff0-4dfd-8daa-5588b3c0a88e", "comment": "Malware payload (RedLineStealer)", "value": "e1cd4157da33ba1ab3afa7b815325a21d6677c82bb175ea7c2d88d189ea259e45ca16af6932fd7c4549d5bad6ebe3dad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831332, "uuid": "58739f97-a482-4a51-9f69-301b94395571", "value": "T1DCF3128AC3681DC3F9282AB5554327B0DD1D8056F6B2F65C238119F49791BB6FC3E9C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831332, "uuid": "9e70ee18-4c1d-41df-807a-3edb8415ed77", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831332, "uuid": "ab5ab6d2-72ff-46dd-ac68-66bcf59e0879", "value": "3072:d0mllKADklPzzeXh/pImXbIU0qxmQMcQkAokWfBSMdGfXeK6RZ:d0mlkADklbm9dL0bQMcghMdGfLMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831332, "uuid": "dd857fcd-3481-4535-bb62-136059c6b54c", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831332, "uuid": "4464a5cd-e047-4417-a57d-f022f89cd0da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831332, "uuid": "7027052a-c3d7-4e32-9c26-991288925c96", "value": "7ac20345ed8615a12a8ac4f1e79f2cb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e56fb0-44ac-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636826774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826774, "uuid": "9b5eaeb5-9b01-4e44-b339-471bbc20b168", "comment": "Malware payload (RedLineStealer)", "value": "d00b69f2065226b8ea59c341ec08fa21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826774, "uuid": "8250d6ca-0c79-46b2-a6fe-48a0fde736ac", "comment": "Malware payload (RedLineStealer)", "value": "bacbcfb421611b561d70543f99b77f0d4218689bd66c8160221feba6abc4b58f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826774, "uuid": "de9fcd15-f9d0-43b2-8d22-bc836d446466", "comment": "Malware payload (RedLineStealer)", "value": "72ab6576b607c80243c8d720affa7c8475b1e95d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826774, "uuid": "e9bc5253-89cb-4f3f-849c-7002dd20524f", "comment": "Malware payload (RedLineStealer)", "value": "b98fd701ae9d7f3e8ffc3acd669967fada4236d1fdfc82f390a3c2ca7beb65bb69b5ff9d8ec12a6de83051fe415c2949", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826774, "uuid": "d4df3bbe-034c-4fd9-b1fe-e9b4e872da76", "value": "T108462377A6280049E0E9CD3A4937BDE031FB4F5ACB81F83878E6B9C625355E1E702657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826774, "uuid": "807d4f1c-42d3-4596-b8e4-258201a5dd06", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826774, "uuid": "dc6eb8cc-4d3c-4730-b2ff-af0efa1a66c7", "value": "98304:iuu7zIFNlKMUyej/psJXvEsLXg57Oa1l4XoyNaVk+s8LUBA08UwMtNJ:i93GNlKMQF89c57Oa1lwoyNW8Bya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636826774, "uuid": "ba72a28d-4777-45d1-b095-91b4cc1754e1", "value": 5671616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636826774, "uuid": "7310dbe4-01cf-4137-ab43-84eb03594109", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826774, "uuid": "a3e14953-cf3a-4867-ba93-043c39e10d68", "value": "Software.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdae159b-44c5-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1636837689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636837689, "uuid": "eb889f75-4c55-49f0-81ef-0e834692ec30", "comment": "Malware payload (Mirai)", "value": "c131795a546cbf950fe004177bfb7a9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636837689, "uuid": "711deb32-1d05-40bc-a449-f7d625343554", "comment": "Malware payload (Mirai)", "value": "bce175c4444ef19f1108cad0cdcf7318032904b746cc2624ee05794a5e92ceb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636837689, "uuid": "2ccf57f3-fbe4-4806-8383-5813f7170adb", "comment": "Malware payload (Mirai)", "value": "53c72be9f717b1afdddc3e438ad915336cc0d9c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636837689, "uuid": "7493f207-fce5-463d-af09-fa3c211efcc9", "comment": "Malware payload (Mirai)", "value": "2d0d7f01fbf4ee760b502e8ff0a788e158c7059724f386708e02cb08c5a66d0e9c4295a951f32abe11b8839f35103fff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636837689, "uuid": "f7ce421e-1462-4a00-819b-51e8109196d0", "value": "T19113F263E0961636E5305222FD18C3CD37D5AA7CE83C732B2D6616E86D921860766BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636837689, "uuid": "51036d4b-1b9a-4d76-8a21-2f563a9687de", "value": "768:Ge8Bl1buGF5UOUv3Nc5wV448hHoc4Q85/FEtvF3EK2R2+9q3UELlr:38Bl1CQ5UHvZ248xYQ85/FEtvtEWjLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636837689, "uuid": "cdd1b276-94d1-4073-a528-921f56c16dec", "value": 42380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636837689, "uuid": "a0d90888-6288-4818-b8a7-56e9fbeff4e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636837689, "uuid": "6e0b6a19-5161-413f-85a2-4691196586d7", "value": "c131795a546cbf950fe004177bfb7a9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e953da58-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636831293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831293, "uuid": "bb7a72f8-a624-41e8-a09a-9770ea9981ac", "comment": "Malware payload (RedLineStealer)", "value": "afdfd33ee10a1b36cf7cec18f90216d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831293, "uuid": "b6b18065-0299-478b-ab44-c893c9d458ba", "comment": "Malware payload (RedLineStealer)", "value": "be2d4d2297c029aade113b2255b0f404c3de2830b307f77c3f7f9e678e988857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831293, "uuid": "56c16efd-4810-4cec-80ad-e9e79893ff17", "comment": "Malware payload (RedLineStealer)", "value": "68bbf39ed4a20bcee68b48c83319d12200393b9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831293, "uuid": "68c42ef0-3216-45a2-b704-181b67f68938", "comment": "Malware payload (RedLineStealer)", "value": "94c6827461f6e1362d6fad9fa5230bd10c3a2a9f4c4a50a55774a6106644032a4e061480f15c2f3f52435777e2065ced", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831293, "uuid": "09262689-2ed2-4c3c-88c2-bc76322499ac", "value": "T18446331724201E2BDE7C1B33AB3592093A00786B91B4DA4F4F3CBB57FDD59E1199C62A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831293, "uuid": "f671aab7-a22b-4c19-b7b8-bf7cc17c5912", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831293, "uuid": "a908c59a-b449-4a75-9174-9174e6db555d", "value": "98304:y3c0zrX0Bkt/HClTd4QChOK29oRwjN/xYYxWdpPlx3E5lRUxq6U4ETXRxLc:y3vzQOt/ilTd4QTK29HR/xVW3lx0tUA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831293, "uuid": "e81a5d17-513b-4753-b1ea-dfecb3220cd7", "value": 5382248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831293, "uuid": "d0a29ad8-3955-4e9a-a4b4-c1138df4d7d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831293, "uuid": "e856ffab-7d30-448a-bd36-58d0b26d46e0", "value": "BE2D4D2297C029AADE113B2255B0F404C3DE2830B307F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d4c677-44bc-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1636833493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833493, "uuid": "340f1699-b02d-4ac6-b55b-6806ad0caab1", "comment": "Malware payload (Vjw0rm)", "value": "37632480b7758b11c991dd01ec1009db", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833493, "uuid": "890ef798-8439-4ad0-8990-2c59180a858c", "comment": "Malware payload (Vjw0rm)", "value": "bebd2525ca48a108e033a4a66467089cf0e4c3f92754a3af18f10a247d747d74", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833493, "uuid": "7e24c1fc-95c5-4d21-9109-dd7c146f65e7", "comment": "Malware payload (Vjw0rm)", "value": "6c59d8309033cd066df15fc0fddf7f0c122ed31e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833493, "uuid": "ce768d5d-7acc-4912-a8d4-d0270ee8ae20", "comment": "Malware payload (Vjw0rm)", "value": "1d25e89b9c9ecfd420056b420b5718e23cb866563709d50087a7e72a50fa641c639470f5bda711e9d5bbad9d89700187", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833493, "uuid": "f1747e04-2ee6-40ff-ae1c-78689f3604e0", "value": "T108838F019E431CC6F5B5C6A2209810E4DD17A6F4CF6AE4DADE4249CE0EEF24767C7E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833493, "uuid": "c907c8b9-060c-4e93-a4c9-17ca5d4e58ef", "value": "384:gPnPI1gYzbBg55m/eguLS7X/g/W/W/w//a/t3Q/QSfm6wUgn:Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833493, "uuid": "1c9cc16e-4f3a-4fc3-ab3d-1e32bd8440a8", "value": 83988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833493, "uuid": "2310c3fb-72eb-4cdf-89dc-6c84505f6033", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833493, "uuid": "5b9bf215-c3e2-412d-a377-6be086b12518", "value": "837362354_Payment_Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83e2a50-44d6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636845062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636845062, "uuid": "c0d059fe-387f-4c8a-8d96-8f3801f217bd", "comment": "Malware payload (RaccoonStealer)", "value": "9e7a44184e9635049586b846f124b8c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636845062, "uuid": "20ee3b92-dade-4ddd-a861-1c1d39f40cc7", "comment": "Malware payload (RaccoonStealer)", "value": "bec0b668154a19902c4c39606a18bf0aaf93d52f4922e77dd15d44ddf359d20a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636845062, "uuid": "79a9b8a9-9510-43a4-bce5-a1055e26cfd9", "comment": "Malware payload (RaccoonStealer)", "value": "a1521b32b4f003ae1a59f082dea6eb2f496841ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636845062, "uuid": "a5d3a83d-2dc6-4051-bc1e-8c9f679e7807", "comment": "Malware payload (RaccoonStealer)", "value": "35fa1632f15958c75eaab09a5e480b7e0a847c298824d3ade5381e83ea669114994c13ab867cdeb03c8315587b8f2d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636845062, "uuid": "89ad7e52-067c-47c9-9537-93b7b15eeef2", "value": "T1E7C4D000B7A0C035F5B767F98D7592A8AA2F7D91A73454CF22D92AEE4634AD0EC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636845062, "uuid": "1baf4285-95fd-46fe-9029-f4ba452e88ff", "value": "6d58d46cb4da553c2a028fd56457c4dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636845062, "uuid": "4546bf89-03e5-4fac-934b-e56feda55bd3", "value": "12288:g2VARxkULr7avSqs329XBqDcEd2fgUKqS+67foC7H2XIOj:g2xUL/avSqs3yXBqDRN1qS+RXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636845062, "uuid": "e6775e4e-6d40-42da-933b-ba2dca1d6655", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636845062, "uuid": "58919f84-a494-4c00-9737-6334840e7278", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636845062, "uuid": "4ca451e7-080a-40f7-85f9-1e0f571e50db", "value": "9e7a44184e9635049586b846f124b8c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ea5cf8-444b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mekotio)", "timestamp": 1636785249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636785249, "uuid": "0eb674e9-6624-4e40-85e6-1792a71a41ba", "comment": "Malware payload (Mekotio)", "value": "4f1ce0b2de051bff70ff372dfc8642f2", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636785249, "uuid": "e339be5b-96da-4252-be6d-9acdbe4a4a36", "comment": "Malware payload (Mekotio)", "value": "c2b44ba2996a50269b07c4b9538254e6f4aa11650dfc380cc4d97dc44e43bddf", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636785249, "uuid": "0b7eba97-66e7-4a20-8425-186c22e3277a", "comment": "Malware payload (Mekotio)", "value": "9ffe7a85dde4a8feab514081d8bfcff49901d5c1", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636785249, "uuid": "2a27dd5f-325d-47e3-8d96-1c503cdbbfd9", "comment": "Malware payload (Mekotio)", "value": "5cac04fe8e85e398bd6056dee6d6010e7cd2caf119ed24ea9ff9e45c7414903c3464db06e3a4f33a96e0539222ad4b72", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636785249, "uuid": "4291ae0b-14d7-443b-b2d8-a15a60499409", "value": "T1203633E53EF2CC9AF95A733E9AD13534C82838C48C99DF122DD346AD1A5F47359E0A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636785249, "uuid": "a1f686e9-7627-423e-9979-ab68dcd9cf31", "value": "9e5fd72b2604a9a1c15ba81c18c21ae2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636785249, "uuid": "63d0b46a-3a67-46a4-813a-dd154f324877", "value": "98304:z/i/hkD+bLi5/HXeLk2JXecVkRTgbr/VB4b3MLk7VCPQIzOpuZwHv1:z6/h/aVuhJ7sMdxzOpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636785249, "uuid": "cf4af06e-ef1c-4e7e-a7e4-742c04ba9c15", "value": 5287424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636785249, "uuid": "deb9ee90-fbbd-4f9f-8f18-e5d596d1111d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636785249, "uuid": "bd78c6eb-7670-45e6-8536-1ae318158925", "value": "#TrojanBanker #Mekotio.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca606852-44cd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636841119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841119, "uuid": "775525c9-9d87-4171-82bb-75a90550ef2e", "comment": "Malware payload", "value": "99f1fefeff6997e012561b14a018863b", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841119, "uuid": "a952f006-406f-48cb-b229-70b18591cebc", "comment": "Malware payload", "value": "c4a4d1ba86df47e489c46c2c500847fcc896d434e7f20264f256c68e869ce02b", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841119, "uuid": "845949fb-ded5-42cf-9acd-74b4b7283317", "comment": "Malware payload", "value": "7f70fe69a3c83d9269a767f36b3de59f72787862", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841119, "uuid": "52535b03-444f-4281-969d-540d06d00700", "comment": "Malware payload", "value": "57cae3db844b948bba3312fc92e2bd615ebe6440cea25f323b7c20b59946947c7f41ba6a0ce251585bbfe3c83b3d0ac6", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841119, "uuid": "c428bee9-f4a7-48c7-a557-8075847df2ee", "value": "T1E521CA2E2445DB5409619286F3B1B101E66C890328A5325971FEC5CF8F3CC28D8C8BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841119, "uuid": "33631beb-6ff6-4793-88c4-cde747d182fc", "value": "24:8kwgOvc0OJ6JEV/pnJZ2LC3WAlFL+rDxNJEL79orrWhdH9a:ygL0HJwRnXqCG+ulNJiqrrGds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636841119, "uuid": "d36e00de-701f-466e-868a-30ba4dde3631", "value": 1185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636841119, "uuid": "da9f66eb-71a7-4e8c-80b5-66ebb6f62716", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841119, "uuid": "3c2b0858-4d73-4067-a600-6c2b744272c8", "value": "6mPM1cfP.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7153096-4486-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1636810646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810646, "uuid": "2233fa40-c3b2-4192-b28a-94cae66e013b", "comment": "Malware payload (STRRAT)", "value": "dbef0280383b9fd612ce88a46a3de965", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810646, "uuid": "15863110-fd48-432f-ba76-40da8791e28d", "comment": "Malware payload (STRRAT)", "value": "c7ed1cec47b5f8d575e739d4c77d86a6222a64539e5870229fc4488bb0b50b05", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810646, "uuid": "1a533f79-c0c3-4e21-a9fa-d04aa8116bb1", "comment": "Malware payload (STRRAT)", "value": "1b0915d4473e88ab2aa30ca07601620bd0e4d872", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810646, "uuid": "0f9f00cf-56f4-4702-8256-2171d35f08a9", "comment": "Malware payload (STRRAT)", "value": "717c94da52ad0994b909845bdc74cf274f4d49244d0021a6525323a3c31dca624a3210a8d722b17857e4fb7d390c3d27", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810646, "uuid": "2bffd467-b5cd-40e9-84da-8c6f38e38a49", "value": "T12393CF2BB87BC078F2031833526995236A0D9698E54DA11B36FD045AFE30D6E9F176CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810646, "uuid": "e3e226cf-02d1-4d5b-944d-f67d699309a7", "value": "1536:7g/B1AnMP1r9Qz1+jkGc//nGSIPseuJ08pLUuj/T713he5/oHGvkvxlpIHr+E:7gcnMP15QsjQG5Pzu+89Uu7Ta5/Rv5L1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636810646, "uuid": "9c3a495e-287a-4083-86df-b01826c9ed85", "value": 94788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636810646, "uuid": "bd72925e-5d24-4eea-8244-9790a04c7a91", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810646, "uuid": "942f9cff-74f2-4ea2-9a82-21f404d06030", "value": "itfvuiuifr.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb884f18-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1636831216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831216, "uuid": "d1e53cb5-7c06-40d9-bf79-c07491540ebb", "comment": "Malware payload (RemoteManipulator)", "value": "1b1fa26f715ff688887f8d1c8b766707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831216, "uuid": "14ddf6f9-9356-4955-ad72-cd2eff52af8b", "comment": "Malware payload (RemoteManipulator)", "value": "c94fa0a47554ecb45552a5e3121d9bebefa8c01384dc0781c5167c4870afa6c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831216, "uuid": "b9dbd188-25c6-4edf-bd00-bbcd1ef2d4f3", "comment": "Malware payload (RemoteManipulator)", "value": "6d09249c329c41671edd8ff6a7bf7c5db60fbc9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831216, "uuid": "ac8affaa-3f2c-4841-972c-76ac3b39c363", "comment": "Malware payload (RemoteManipulator)", "value": "c49f122435b18b72d9009bbf72b0c968f9d0411e1f2ece71ecb03dfdde29faecbbed1deea1040f18b06e9058e41dbcf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831216, "uuid": "96c5a434-f5fe-4e3d-ba88-f43f270a91a6", "value": "T112C6335AA77491F0DA5E3FF69D192E71173EEB121002FACE9CC1A6428B74B10FE05627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831216, "uuid": "43d53536-b23c-48c2-9e13-b09374408eca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831216, "uuid": "6e11c1c6-271f-4e1e-af51-43908f9fba06", "value": "196608:CDtZuwK57ybJu9STD686fRmhR/WXli503kItXzOpT8cWtzmmUJAq6:CDtAwK5quZ865m3/ili503kItDM8rSJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831216, "uuid": "fd339715-3b91-49a4-9fd7-964de730538b", "value": 12502016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831216, "uuid": "f79398ec-0381-4957-ae92-f5fc5b11e2e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831216, "uuid": "f4e11f13-268e-47e0-ab72-99410f95f6ba", "value": "C94FA0A47554ECB45552A5E3121D9BEBEFA8C01384DC0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e84380-449d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636820197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820197, "uuid": "7c6cfcaf-3d9b-4887-a6ee-22f632231561", "comment": "Malware payload (AgentTesla)", "value": "cee8018b41d3adc34739f9d34070c73b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820197, "uuid": "8d3bd474-a2d5-471d-b453-4c1df34a326f", "comment": "Malware payload (AgentTesla)", "value": "c9c32c42c44146b3a77fd2b317610b1ddda01e711b09d5edcd10675ba68edc01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820197, "uuid": "0a88e060-061a-4709-9432-c8869a103a99", "comment": "Malware payload (AgentTesla)", "value": "bb6ab2b73fc2aa633819aa13dd3279ce3e5a30fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636820197, "uuid": "0197d391-3c9b-4d3b-821d-b5b86b3b4dbe", "comment": "Malware payload (AgentTesla)", "value": "1840d5cd1d4bdb1b1f1dee0e50af357a5e65b6f3a4d435842d10b9a740a7054c4b6dbd09e4abcd1f748a0703bc70eb05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820197, "uuid": "2117a1a5-79f9-4470-ab06-5b5d7d60e4a6", "value": "T117B4E101B6C188B2D53319325A396B256D3D7C206F35CA6FF3E4696EDE311C1A229B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820197, "uuid": "08bee666-9036-44d3-ad3f-5063f7825eda", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820197, "uuid": "6657bb5b-c0a4-4035-993b-c1c641c6b092", "value": "12288:JQnk3GDYKGcblwtX+t4Y8ALICzOKAtbBBBGp:DAOcZwXYHOJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636820197, "uuid": "72473ab2-8e3e-4a08-8d4a-6960fee14a6c", "value": 494296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636820197, "uuid": "5f9835e7-4a7a-4426-a44f-17dd91549461", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636820197, "uuid": "92b94cd7-d889-4b46-8c60-055686fd016a", "value": "Documentation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1fc478-44cf-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636842062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636842062, "uuid": "f3bf278b-52ea-4674-88d8-1c787dfcf708", "comment": "Malware payload (RaccoonStealer)", "value": "f98af687061258cf9b8e12a1722070b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636842062, "uuid": "3d0a776b-7680-4a7c-9950-dc0d17f72e57", "comment": "Malware payload (RaccoonStealer)", "value": "cab23f63a0cd63cd22fab73efb4c31044c7cb72617a1154a7c47bfa867196c57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636842062, "uuid": "09cf8728-77f0-461e-8acc-ed4581b559be", "comment": "Malware payload (RaccoonStealer)", "value": "656c9c0ab75a3f8b961aba5804ab32e4ddd1449f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636842062, "uuid": "546fbf23-2fe7-49e7-8f15-0207c86416df", "comment": "Malware payload (RaccoonStealer)", "value": "7884211dd6d9836384196edbe2b9ee0d0a3aaac9adab7f6608509c59fee4b5c2a8c289331ba57733a826815ec0d54a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636842062, "uuid": "cb73f087-06db-4bcf-ad7d-d22c08f79d70", "value": "T1C4C4D000A7F1C035F5F766B94DB69268B52E7EA1A73490CF22D57AE95A346E0EC30313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636842062, "uuid": "a709a3c4-0938-4e84-91ff-7b15ea9e4ad8", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636842062, "uuid": "38402dac-8891-43df-ac57-964551da899f", "value": "12288:L2JwYOCed6ILJymCGEEMqvgGJQrZfPkfoav8MOY2uDqy1mXwvr0:iBOwIVxcsQFf/w8Y28v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636842062, "uuid": "8e480772-d8fd-4beb-b958-85a578447b06", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636842062, "uuid": "270885cd-f1fa-4a99-b16e-87ce517ad718", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636842062, "uuid": "6ebda9b8-854c-4a4f-a59c-c563a8cec18a", "value": "f98af687061258cf9b8e12a1722070b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecace4d1-4423-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636768162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768162, "uuid": "95840749-7585-43b6-951b-6174b03f7505", "comment": "Malware payload (RedLineStealer)", "value": "cfc59bc8b478578358711bbc68506c3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768162, "uuid": "482b8a7d-45e2-4ad0-8e0d-2b2a6628d2b7", "comment": "Malware payload (RedLineStealer)", "value": "cbeafcb1b8e209794f255e1f689a636a22e2e4fc9017a9cfb839ac02e99c378e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768162, "uuid": "1702f003-295f-4f00-a57e-ce1719a25788", "comment": "Malware payload (RedLineStealer)", "value": "0a3c41ded9a3cfff213108589808622c571134ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636768162, "uuid": "1effba88-cc5c-4978-a791-a5d38cc68485", "comment": "Malware payload (RedLineStealer)", "value": "1a9d754ed143e3192c5d55120a1b1034ba599264af6a2196d473800ad5f7dfadddb4febdd702b90d346393bf904250a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768162, "uuid": "c19f5d79-0624-4e71-9a86-e7dad4c0d81d", "value": "T1F555333E1FC05550D24CDBF865925A1272FF91B620F40235585A8E0F4B29D62EE2FEBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768162, "uuid": "c0114318-e7f0-465f-92a8-115276d9ccfb", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768162, "uuid": "da38ec4d-2d10-4dbc-b269-937952400b75", "value": "24576:m5FUa4NA3uQr8vsDIfeROi/oTjIQPOCkEaHNYK3D1ZOeQqu:mHUsr8vaROCuIQPRNaBPQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636768162, "uuid": "eda9ad86-807a-4d68-bd8e-9e25886688ad", "value": 1392640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636768162, "uuid": "d129fcf5-cb0a-4d6a-a8d5-9ed14b1aea92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636768162, "uuid": "50971c35-bbd1-4734-a104-35cf7db095b1", "value": "cfc59bc8b478578358711bbc68506c3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6eca13-44bc-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1636833871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833871, "uuid": "5925bf87-9485-49e2-bea0-e50676f548a5", "comment": "Malware payload (RemcosRAT)", "value": "f60f15e87d0c5441ad66c41aee1d0b77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833871, "uuid": "bf812f73-d12f-4798-9b25-e582bc02db4c", "comment": "Malware payload (RemcosRAT)", "value": "cc387181593d803a367fcf95d0ed8ca7929d0c5b383c4d960f5a44d4cadb2c4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833871, "uuid": "5a3473ec-5ad3-44d3-b598-214f9da6b051", "comment": "Malware payload (RemcosRAT)", "value": "f7354494749e0f0a48b34142aaece31170d93155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833871, "uuid": "6ef3382f-4a64-4bef-8c42-150e90ba98ff", "comment": "Malware payload (RemcosRAT)", "value": "7870f3d45ab4e08adc2f1de8291c1bbcff21b3b21280420a1629dce16b51ad272c6cf5059eebed6bc53d966ef7058a82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833871, "uuid": "acd5808e-e8cf-4d50-9694-ae13d7ef11c7", "value": "T139057C22AAECA47AD17F05796D4B53B654253E04391498B637FE3A0CCF35B412D2A2CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833871, "uuid": "e7bc9633-6028-470c-997c-abf6c7138c6e", "value": "771d05838293a8356c469b98086d5fef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833871, "uuid": "ff7e61b0-5fc5-4f38-8d8d-97f9f705820b", "value": "12288:uBI5fjs/RGn87z7htHHqdmKRcdbmfdRa1P2AI5mlQ45DgyYLaSU3dyBL7Uo2jfnd:Bwq9NofGKsPArG9hFEvOcld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833871, "uuid": "7a2e7c20-dc30-4861-b2f6-eec19fd1b198", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833871, "uuid": "f384b509-3079-4467-bf43-e9491c27fe98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833871, "uuid": "10c09df3-c9f2-4991-9a0e-a95f974be82f", "value": "New fax document from xero Scanner_0028275363838_373663635_8636337365_39838393938487_8e77388373739.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318f4b4b-447c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636806073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636806073, "uuid": "15c6af16-218d-48b1-b725-03d5104e241a", "comment": "Malware payload (RedLineStealer)", "value": "9ab835eddcba87e825f2bba6551d731f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636806073, "uuid": "f3b3f2a8-a481-44e4-9807-9d25b642e256", "comment": "Malware payload (RedLineStealer)", "value": "cd3c3976d4df1484942e9bb438351566f586a31f6623b558417690dbac274c85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636806073, "uuid": "7462b22b-0ad6-4399-9269-375f9e0819b2", "comment": "Malware payload (RedLineStealer)", "value": "89b372db51b1ee32ea9705056730104533399af5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636806073, "uuid": "74e34bdc-38b9-4623-b141-9992ab7707be", "comment": "Malware payload (RedLineStealer)", "value": "dcad41e1d4f4fe7d7dae3f166681b01982632620383bb13d521731436f1895d3777e3c7c2ac37305b5b6be886af2c989", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636806073, "uuid": "565e45db-2810-410d-832e-016b6c9bb642", "value": "T143A34C5877CCD905E6FE0F7468F0125843F0E0A36816EB5F1DC558E90E6BB819B62BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636806073, "uuid": "e8e40553-775b-4c50-905c-0da83cb19914", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636806073, "uuid": "7e242205-5fa0-4dce-a12f-1ce6b334e91a", "value": "3072:1Zk6sgbLjlp5q8uKIbPICk7HkvPV2IJvQe3d:UQbLjlp5q8u3QPKugd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636806073, "uuid": "3b0b7ed2-2c1d-48ba-9fd5-fcd1820ed938", "value": 106736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636806073, "uuid": "5c3601af-0423-4a35-93e0-66c43b425a33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636806073, "uuid": "3c236cfb-95e9-4b11-9184-201e557dd441", "value": "9ab835eddcba87e825f2bba6551d731f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c684f8-4476-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636803418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636803418, "uuid": "95b0982a-02a7-4c93-a80d-db3d8fcbc196", "comment": "Malware payload (AgentTesla)", "value": "3d72404b706a9b80569f02e8c97b0202", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636803418, "uuid": "08d97973-e538-4725-ba6e-88e45654571b", "comment": "Malware payload (AgentTesla)", "value": "ce8a9bf908ce35bf0c034c61416109a44f015eabf058b12485450cd40af95fc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636803418, "uuid": "a3936522-1b28-4963-80f5-49c6bf125919", "comment": "Malware payload (AgentTesla)", "value": "7bc87a5056e3a428195b0a2091b9dd0815862074", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636803418, "uuid": "98795ca9-68ed-49ef-ade0-e233f3e49a9a", "comment": "Malware payload (AgentTesla)", "value": "48fa483ccd0ffb76f9d51059691286134db559fa1ab49493590c2f426173226db140a4bdcd2fe4a063a4f91211b9cbfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636803418, "uuid": "8bdf36a6-ff28-4658-abee-eb068addb613", "value": "T1D464134656CEAEE7C9434D301973A76FD77D848C5040AA1B87B82FBF2A946C34D39362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636803418, "uuid": "05c10636-ec9c-428e-8d5c-c38a2c85ac35", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636803418, "uuid": "c9371f01-6371-43b8-b3f4-ff078370a3a2", "value": "6144:rGi7eGiIXcUxYZTvxsm6FW0I0gEwU37UPwOsb8DryA7U10yzkS:vXpxYZzxn6A9EZCsgqAMV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636803418, "uuid": "04e732d0-07e4-440b-b5d8-503a09847db1", "value": 314388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636803418, "uuid": "dd38556f-754c-431b-a64a-6a19ea27c7b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636803418, "uuid": "2adf892a-1ab1-4146-96f1-708d06e6c862", "value": "3d72404b706a9b80569f02e8c97b0202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865a70b9-44a8-11ec-843c-42010a9c0014", "comment": "Malware payload (Amadey)", "timestamp": 1636825114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636825114, "uuid": "dc05ef98-9f84-4d86-a012-0aef81310ad8", "comment": "Malware payload (Amadey)", "value": "0ccaba8f07f43baba600ee09864dd488", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636825114, "uuid": "0e1db8ac-f0ed-43af-8553-179d2bb34422", "comment": "Malware payload (Amadey)", "value": "cf878de150bbfc29baab8635e159bb2733e63f1dbd954374258a55ee73982f0a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636825114, "uuid": "a43b3755-b870-466e-93c8-b81c265a9757", "comment": "Malware payload (Amadey)", "value": "fc6205c186b040cd6b2c30e1c4f161ec2eea2a47", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636825114, "uuid": "9c3ff4f4-3de8-44ab-b3fc-b9ea51e7184c", "comment": "Malware payload (Amadey)", "value": "1b98971723bf7899e1fdff241c812aec6c2f8573b044ab07462e893e72cfa7838774d5cf4de4176b7f907383bd46d2b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636825114, "uuid": "d84204ac-82f8-4680-a353-21d8f67aea3a", "value": "T16FA633C654A11C08E7660272AE5D9E8146F4B43F02FD336D6FFBE0404E1C974BBA5BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636825114, "uuid": "e9134493-5a74-4997-8b3c-94c115ae517d", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636825114, "uuid": "c94ab41a-49d3-41dc-9663-51ef72e8d66e", "value": "196608:J9nddqv9h1EAPp8puO1a/xvwZXvI9ncSDCHqo0oUPR8xYwr:JIDNPCuO1uxvwxvI9nFDCHD0NPR8xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636825114, "uuid": "f812219b-4f4c-4b10-b11b-34898a641b26", "value": 9500004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636825114, "uuid": "75611d0c-2517-4cdd-955a-c1f7462c134c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636825114, "uuid": "cdb595bf-fa98-4d61-be79-1d7a7e1268f7", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb232e89-444b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mekotio)", "timestamp": 1636785339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636785339, "uuid": "efa36021-8397-456d-b338-18fe48978c73", "comment": "Malware payload (Mekotio)", "value": "4151656534a6c6273f6630677f04e15b", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636785339, "uuid": "8bca233e-fab0-480a-a592-ef8ad9374c3a", "comment": "Malware payload (Mekotio)", "value": "cfa20a3a8248d963ab012b69d808648beeba7627bfac7f73d070637233954590", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636785339, "uuid": "5cf4d17a-0406-4ed6-8b6f-3015ca0bd096", "comment": "Malware payload (Mekotio)", "value": "54370c788fa466004c2e1af49ebb0eb20d1235cd", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636785339, "uuid": "ba81fb1f-d3b2-4f4f-8ac9-9eee5cc0ad1f", "comment": "Malware payload (Mekotio)", "value": "ea9119abd2721b2da14e457d586e4611832ef71ca311e9ed34082cad2c4d4eac0132641d155f40b051f66ad88269b539", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636785339, "uuid": "4df84935-3066-4460-a52f-5435b3de017c", "value": "T1FC36331F6167295CF5ACAF7936011A2568F490F37BE45B0C05439F2DFE0CB29ABB6806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636785339, "uuid": "e1540433-d22e-42c3-976a-0413899c25c9", "value": "07dfab11c89d0fa9c9adf0b5138254a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636785339, "uuid": "46f15745-95a8-4c36-a05f-5219cac703d4", "value": "98304:0W/CV24vva4aJ0Z5Lh5vVWE3ylYrJ30e4fSo69bxtHI+O:0aCRAJ0LLh3WEdrl0fSo69vHNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636785339, "uuid": "811394fd-1af1-405d-a15c-22fb43482641", "value": 5280768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636785339, "uuid": "5c3d0950-d5bf-4bae-9dcc-ac993dd8578c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636785339, "uuid": "ceea12ea-407b-4559-ba0b-f76822d76cdf", "value": "#PackedThemida #BankerMekotio_n2.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de495821-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831274, "uuid": "286e51ed-7d47-4787-bfad-c18e8a9ff3b5", "comment": "Malware payload (RaccoonStealer)", "value": "42554fa49a7c6336025c73fe30011624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831274, "uuid": "4f372996-7e84-4e2a-8ac6-65a9e90723a7", "comment": "Malware payload (RaccoonStealer)", "value": "d0366bbec7419a0ba11bceade615b2bfb23a568e6cb0b7c33a903e4f679c03fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831274, "uuid": "a30e153d-b55e-4b24-af4c-e8e364daede1", "comment": "Malware payload (RaccoonStealer)", "value": "1177f9f3fd641b66e5b252f8676b5c954c7745fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831274, "uuid": "88de216a-56c4-45af-b6bc-f14b8c58ea26", "comment": "Malware payload (RaccoonStealer)", "value": "3495aa46710b4f3b6e5b8734dee197fb2cade7c40ea3674ace3abb0bd265a032afca25498c2ef97331d6832914f6a8d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831274, "uuid": "b5f02b58-ae97-47fb-ba2d-27c8ab98eb61", "value": "T1C5C4E100A7B0C035F5B726F949B59268B53E7DA1AB3590CF62D476EE9634AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831274, "uuid": "72ac74aa-f9f6-477e-a2d8-82e8f7a1398d", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831274, "uuid": "31ec10b6-a1fb-49e1-bd47-e23ed469cb7e", "value": "12288:Fjef8oUM2aFoH0FgUPZEwS3gHXqVE85uSAdZvV277JGgmJXkzsvmviD:0f8oD2zkgQ64Xzq6d2ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831274, "uuid": "eeec37ea-f8da-4763-aee5-de3bc3bb111a", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831274, "uuid": "4fbb4ea2-7b8a-4394-ba76-7677e75f294b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831274, "uuid": "2315a14d-2f09-4357-8c16-886072c447aa", "value": "42554fa49a7c6336025c73fe30011624.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52547ed5-4453-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636788519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788519, "uuid": "fec892d0-724b-4c73-a901-9b85910c6447", "comment": "Malware payload (RaccoonStealer)", "value": "677f81f901919e20eb1d4dc42a89408b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788519, "uuid": "4ac658c6-3467-44e0-86c5-c34ec23e00b3", "comment": "Malware payload (RaccoonStealer)", "value": "d08a707ce3fc1cf0234aaa42d8720b92ddc8c68b878a3ab38cb76bb0a410d23c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788519, "uuid": "8f0dabac-c23a-4839-be2b-aebc414a04b1", "comment": "Malware payload (RaccoonStealer)", "value": "924034e1042d23cf6d207fb65aadb6080ac1e51c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788519, "uuid": "fd53edfe-c877-4a20-8c14-ab1e2de4d916", "comment": "Malware payload (RaccoonStealer)", "value": "ece5b1777483c56fea2910eb71dc37554344a5055b15d9be38974e7e8308c2a1ed3690ce8fe42bc82b4a3328b9d547fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788519, "uuid": "42121502-1f10-40fc-8899-8f38773641ec", "value": "T1DA5507C3E75B3429FB2321F651BB3A77303508916B89A6E30D739847F490AE656B1D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788519, "uuid": "776287d1-dd42-4bb8-8448-d4b344fe2869", "value": "641e0b8d4845d5673b6d9b3d409d6a12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788519, "uuid": "6ab9759b-ffed-4040-936a-24afb20e7198", "value": "24576:XQkYzWDv1s1Em24sNK4CpWLopdSU+NtrWFROuaSDTf857PIXBAaOKvxYuVIu29KN:6aS8h/aOYtIx9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636788519, "uuid": "a3f68632-e170-40a4-96d6-b2dd2a83d880", "value": 1341520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636788519, "uuid": "9ae44ad5-c14d-468d-9424-b9de18f3989a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788519, "uuid": "f4bfe5ea-7b35-4abd-9eaa-5d612bbc5bd4", "value": "677f81f901919e20eb1d4dc42a89408b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411390ef-4453-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1636788490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788490, "uuid": "ce3ef408-b3d5-4320-9acf-652ebcb716c2", "comment": "Malware payload (Smoke Loader)", "value": "5ba6b06273d0c0a67ca4ee8d1635a785", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788490, "uuid": "7e3fb13a-0403-4bcd-9f7c-cc5baf6694cd", "comment": "Malware payload (Smoke Loader)", "value": "d0c16ac2ad12e7bdd032c7cc33fd6360bd2052985807100872cb67c3aaf7faec", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788490, "uuid": "8b15d5bd-f68a-4bb5-b13d-62282b51a7c1", "comment": "Malware payload (Smoke Loader)", "value": "2cd5204ee4f1202ec48797b3110490d1cf5891d5", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636788490, "uuid": "40f264f8-30d1-4348-a635-05f6e59479df", "comment": "Malware payload (Smoke Loader)", "value": "4b5cadc2a159fad18e65ece6cc61248951973daa013714a029401487440c4ad641aa427a211159f65856ba9db21cdb5d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788490, "uuid": "7862511a-2e03-4552-b035-3bf3a440cd38", "value": "T1A9F3AD9077E1B836E1E62A32E4B48EB11B36FD322570554F3B57562E1E732D08AB2713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788490, "uuid": "913ba9ae-96dc-4545-84f9-917585e8fadd", "value": "b1eb985407d404811ad25dcff76a8017", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788490, "uuid": "99b96fae-a8f3-4495-a62d-b5d4ef7ea77e", "value": "3072:M72eMgsom0Fggxb1EnRNjBmwIXaRMpZa9uD6Vdyhkk:tAsom0FggV1Fa6wVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636788490, "uuid": "6e6aaa50-cddc-4b63-af60-36eb4873137e", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636788490, "uuid": "d23d7045-2a1f-4aea-9820-f58ec0408d3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636788490, "uuid": "726af1ca-d122-4908-80dd-a7253793c3cb", "value": "5ba6b06273d0c0a67ca4ee8d1635a785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95044dc7-4473-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636802375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636802375, "uuid": "90846477-74e6-4ce3-ad15-c8448b370299", "comment": "Malware payload", "value": "48b0a9eff9c4934c0b0b8875b8867ac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636802375, "uuid": "ae0ef726-9b03-4ad1-a3a2-49d8d19d2db9", "comment": "Malware payload", "value": "d0c624cc9097fec7a90c4e893f84b2a35c54100acf2f16ac0aa026c8fcde9814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636802375, "uuid": "563c66dd-53ca-4072-ab8b-cd7c7f7b1535", "comment": "Malware payload", "value": "8f90200031a93f1da51a981cb16c2e390158123e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636802375, "uuid": "fe1f888b-60d3-4c5c-93fc-cd742435d866", "comment": "Malware payload", "value": "fa1c3f427d058ac4df0fb1c9e85837184895423b723d591f95d630f1f65275df91273a431639be75b7d0f077d313ebb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636802375, "uuid": "3177e9c5-2fcc-46cd-997c-d44a347e334a", "value": "T1B3D4EBC8331331BEC616C471AF7CDD7BA6E83466432A81D25463319DAD5CF87AA0D8AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636802375, "uuid": "3406feb1-1667-4309-bb98-1d871d1a1615", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636802375, "uuid": "131954df-d68a-4008-85c9-e506ec21056f", "value": "12288:funRF3uJfaGjcgAHRkcx6vrl8xGmIc9z4Mg60yeVowYT6:ffyGjRAHSth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636802375, "uuid": "92d2714d-6884-4819-bd4d-61ed90fb75ab", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636802375, "uuid": "962de43b-3f6f-425c-a09d-e1cd9b566073", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636802375, "uuid": "6482b613-1083-4422-a642-808ceaed8578", "value": "SecuriteInfo.com.Adware.WizzMonetize.1.27938.1766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888f8700-4465-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636796341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796341, "uuid": "69e2c9b0-f727-4ad2-8278-f44817612f2c", "comment": "Malware payload (Formbook)", "value": "05bb0a04de5e7c2318c6ee79371961e3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796341, "uuid": "a507e18e-5063-4432-9001-fb6b943e900a", "comment": "Malware payload (Formbook)", "value": "d0eacf0ab2c715a78988ffe0c243109c9998c3076ed609718bf743ae1bfd9820", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796341, "uuid": "a026a711-ff2c-4e66-a638-337d71dbe151", "comment": "Malware payload (Formbook)", "value": "bb1fd94268d8a899ecd439160424d688eccacd44", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796341, "uuid": "984e87f2-53a2-4bab-bc73-45f2caffb5f9", "comment": "Malware payload (Formbook)", "value": "4a11455ea29ba40a5aa7959c63b13208a7f08d7ce1ae1c4e82274bd49be9b4e6adbacb4c4e97a992a72087ec7c357b4f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796341, "uuid": "1d2db00e-ff6e-4cc5-9af1-9b812871c5f5", "value": "T134341207366912E5E9E2DF7D086794B41B00EDC22A518DE102D57E7AE43BFBB8263713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796341, "uuid": "8b39adff-7ad7-4eef-8db3-5b5805b5d87e", "value": "3072:nSYh0kCcStglwVBHohoH0iLOZm385JM8YQfFXj/3F3DB5kchITfE+f+lUK/wY2RY:SYGEAIhqOZP5JMkFXj9A0Mct/wY2RWt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796341, "uuid": "c008d0bf-91f3-4773-8d54-ff2dbd5ebee6", "value": 233416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796341, "uuid": "c8754986-2ee5-414c-83e4-4f23ef57f90a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796341, "uuid": "7efca92a-71f3-49e0-a1de-27e81e3552b4", "value": "New Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e07657-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636831320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831320, "uuid": "8c54e56e-1408-44c4-80c1-d7349d430bef", "comment": "Malware payload (RedLineStealer)", "value": "af4a20f0322e3ac49d014f9dad3c37b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831320, "uuid": "8077abec-1446-4d11-8a5d-33746f6cd364", "comment": "Malware payload (RedLineStealer)", "value": "d249b3f40f9477ed5927d59dbe3985d1de2a89ce0eaf808508611a021e959363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831320, "uuid": "faa9e7fc-6d08-4e2f-97ed-497dbb283423", "comment": "Malware payload (RedLineStealer)", "value": "cc4de6dde2ea0f2c0cb25cc1cc2cca9669798ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831320, "uuid": "4fae7ab5-2317-4ecd-88f4-8b57dbc45c13", "comment": "Malware payload (RedLineStealer)", "value": "e0aa2f153600f3753357ca2c9d5463037eeda048c0fc8699d2a30bd2a7d166ae8a36242a73b1969d91434e1cbdf869f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831320, "uuid": "f58b0d18-624b-4c6f-b295-f4f8a667f646", "value": "T1BE749D4CB3599A35EBAC4535D8F20050E3F1EFD6A00BD72AB8C034ED19A1BD9F952786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831320, "uuid": "a0f7df09-9fee-4d28-b743-f98154e4998e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831320, "uuid": "d82c10a4-24c1-4d5c-9e30-99431f6a38c6", "value": "3072:fzjzlHiIprjqMFBl4FBnLEbFlJx1nOfEuYIVdGS1bAYtgUBBBBBjBpBB4LkvMvBF:rPlHqgL31n3UBBBBBjBpBBwdBBBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831320, "uuid": "4b51b37f-8e5d-482a-93d7-281018614246", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831320, "uuid": "8c7c96d9-cf97-4423-8b68-952bf347ad79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831320, "uuid": "b1f1fdf1-a197-44b4-8333-46882b3e1251", "value": "af4a20f0322e3ac49d014f9dad3c37b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f53a124-446b-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1636798768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798768, "uuid": "0d062e31-0f28-4c76-8da7-5d2043c6f93f", "comment": "Malware payload (CobaltStrike)", "value": "bcd31277f852e79b57dbd2b81ae53e7a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798768, "uuid": "4d775247-2c6c-48de-84a4-10d45ae0ea8a", "comment": "Malware payload (CobaltStrike)", "value": "d3f1d658545c3726233e696e3cea4d66d9a515d60f551ea01abfda00552e17da", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798768, "uuid": "385e04f6-1400-4d70-8c2e-795539606319", "comment": "Malware payload (CobaltStrike)", "value": "de6f13b81a5a3461efa3e4b4fcdcb0401466a264", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798768, "uuid": "8094996d-0c60-4eb5-9de1-3789d9948820", "comment": "Malware payload (CobaltStrike)", "value": "8797709bc86593381f7de6858c8fe6f99a3a95cd5cf032eff6ec39e68e80ee88e9a7da27bd7ba914b368cad33f592b2b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798768, "uuid": "2ee1edeb-6c31-4005-acaa-20d005d0f34a", "value": "T160152A47E37341FCC96BC57487A6A732A930785841397E294F85EB222FA1F30953EB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798768, "uuid": "bc04708c-c7ee-40ea-a0bc-b62b923c9934", "value": "a525d4d88000481b8302e8fc27bd5884", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798768, "uuid": "bff83c89-5701-4777-9e2c-7df7e90d228a", "value": "24576:QeLSjjINcWnd5VUWPFEeXr3yAHqTmtxeQ:Q1jINcWdzaxyxeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636798768, "uuid": "00371af6-ed9c-4c7a-b7ac-3a8c14397fdc", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636798768, "uuid": "2ac93674-5975-4751-88e6-879a79cfbbc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798768, "uuid": "29d0f7c6-00c5-4102-be64-5dc5d4ca31f7", "value": "asdfasdf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694f622d-44b4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636830219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830219, "uuid": "8aa7f7d5-1b2a-4ee9-b279-e81fcb17d64a", "comment": "Malware payload (RedLineStealer)", "value": "263b7ea516b0c860b4f282890d8595bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830219, "uuid": "3faa2e9f-2b17-4391-90b0-2f3c60b2775f", "comment": "Malware payload (RedLineStealer)", "value": "d3f77ae659c38c08c8c39fde6c8e5900817e2032b5b8e96de98811b00889b486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830219, "uuid": "c5fe1b85-7bf1-4e80-be19-4904a506b11d", "comment": "Malware payload (RedLineStealer)", "value": "6c45dfc932762baf633901eb29205913f20c0045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830219, "uuid": "98bbc74e-b6fc-4da8-ba06-9a2a9464f20a", "comment": "Malware payload (RedLineStealer)", "value": "e9ed10fe4a3be27560add56f6adb38901f83c0bd4ce6f2390acfc40915ebf5eb05c0752ac169964a098aa04748e198c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830219, "uuid": "93d51967-5627-4c11-a08a-2d81ddb1018f", "value": "T1FB74F1032D4CFA18E4557F7343DB4AD557A36DD16E32C98D2F49AE091A21B822EB3339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830219, "uuid": "d3efd763-123c-45b9-bc0d-8bee62946976", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830219, "uuid": "92a07463-d2ac-4606-9d29-fb587a74ab89", "value": "6144:QSzjPI1Ave+tqtUFU/kWS+iVJLrfxpU7y:ZPIObqtUFU8qiLfom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636830219, "uuid": "fd3b8964-aacd-47ae-8484-c3d83e1137e4", "value": 355736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636830219, "uuid": "da470b8b-7f8d-472e-b611-7a1d764b5e41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830219, "uuid": "2860e820-99f3-48c5-9d6f-c9714ba24feb", "value": "EuphoriaH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5598cf13-4466-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1636796685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796685, "uuid": "703b8998-23b8-4c97-9dd8-194c4ec6c4f1", "comment": "Malware payload (Loki)", "value": "2d5ed76bd161abde94ea29dd3d8cd561", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796685, "uuid": "74452b23-9f30-4a55-a07a-c9894ac9a0b5", "comment": "Malware payload (Loki)", "value": "d4aeb056d406660c713cb9007022ecb92b12a205c084ab96f7cae4dfc76c5716", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796685, "uuid": "edb511ea-568b-452a-b277-77c221f4314f", "comment": "Malware payload (Loki)", "value": "d2248f5fee62cccc4a1fab3734083d2445523c06", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796685, "uuid": "391bc036-f1e9-4f19-bef6-2c265002fe32", "comment": "Malware payload (Loki)", "value": "91b7fa2f4019d2099f2f07d46ee37fe4f308258f0daf89219b99e1599e24c8d61fba2ae987064d4e254ee8a6dcd53cf5", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796685, "uuid": "60758ea6-c459-406f-9e56-41f56f916e04", "value": "T16A41AC7B2E46A286036B6A7BFD37F18ECD41F87EA88CD0419121F8D4346893195F6639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796685, "uuid": "90f59c00-b919-4ef6-8046-c865733d0015", "value": "48:T0FxOlwzAG2RxTEA74Ae5uRYYlAgGUBm4dmkA:29VJnAe5uBlP/RdmkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796685, "uuid": "e763d831-f673-48cb-bdce-0d291c491fa4", "value": 1952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796685, "uuid": "218d5e39-97f5-4fa3-83fa-119a49817b3a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796685, "uuid": "1e1c70fb-314a-4488-8255-756cd600b33c", "value": "documentos de env\u00edo_83291.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1198a3a-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831306, "uuid": "25d8063e-2587-47ae-9657-644c8d729ccb", "comment": "Malware payload (RaccoonStealer)", "value": "ee45056503a95c6fe8992f739225a3db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831306, "uuid": "c521c8e2-46a2-4ec0-a5a5-bc9068686c97", "comment": "Malware payload (RaccoonStealer)", "value": "d5151ae2398b510107975a3744e0a4321d53d09eca55c9f64aeaca226d5fcce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831306, "uuid": "c988bf74-2d1e-4963-97c0-1d96fa77c518", "comment": "Malware payload (RaccoonStealer)", "value": "a2450dd669389c43ca3c88afc5738ffaa6918d03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831306, "uuid": "fcf5da08-13ef-42dc-8f4c-5922c38b9c06", "comment": "Malware payload (RaccoonStealer)", "value": "4bc6847bb59426a9b8eda028c42407c8a4387016134b3f0ebd9705706e16dcc36bed67d2e4492138ce527795ce941af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831306, "uuid": "fde14fc7-a1f5-4a51-854e-064537c6b54d", "value": "T144C4E010B7B0C039F4B756F8497692A8A53F7EA1AB3494CF22C526EA57346E0EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831306, "uuid": "c195bbe5-826a-46d8-93db-06bf290be63b", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831306, "uuid": "95b7d0cc-deac-41c7-9f20-140e3d2919b0", "value": "12288:+hWZOalh9gLGr8qvd27F9ig+rFf+Nn+pFTEEd2wu+YEmpiULul:zOaj9g28dF98F+n2dEEd2cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831306, "uuid": "3a88e1d7-0be4-4a84-97d4-27636b961e61", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831306, "uuid": "2cc81e79-dac9-496d-8605-4173974919ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831306, "uuid": "cede5697-1493-4920-8cfc-aeb1d294ee66", "value": "ee45056503a95c6fe8992f739225a3db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8820b14-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831264, "uuid": "69ca8d2d-c511-4bb2-aab6-e8bd4cb2fa04", "comment": "Malware payload (RaccoonStealer)", "value": "afdebbe310efbf8ebc01012495dba839", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831264, "uuid": "a9477bb3-a90f-4bcf-a909-61840e867bcc", "comment": "Malware payload (RaccoonStealer)", "value": "d5c05cd26342688768185f72a797e379fccea0ced4b49af77770a632f0601166", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831264, "uuid": "9cf5da39-0c8d-49c9-bb87-4f7dd1e58ba5", "comment": "Malware payload (RaccoonStealer)", "value": "4107fbed949f1c820da21072f94ead291052e572", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831264, "uuid": "6cd3fe69-7a33-470e-ba75-2f34e29b0493", "comment": "Malware payload (RaccoonStealer)", "value": "c13aa0291942041a4c1ae18fd3a1a0fadb3e1ef9d22f779490d3453117292300b73bbfab4e32d527338ff87d2a778e54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831264, "uuid": "96594336-5eda-427d-901c-982d840ad0ab", "value": "T1EE648E00BBA0C435F5B726F845B69369B92F7DA1AB3590CF22D536EA96346D0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831264, "uuid": "e173fecd-e7ee-47f1-bc9a-c670189aa9c5", "value": "055231e986715e3ad0fc64abd72cd41a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831264, "uuid": "81e83ca9-2a3b-45e7-9365-3f686ba7ca0f", "value": "6144:M7Jff60L0eZAlJT2kn1qu6LV0cGiMDz2RTqZDi:M9f6F2ud2kn1qu6LV0cGiMeTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831264, "uuid": "dd205502-a869-4099-83e9-d581dc22acae", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831264, "uuid": "7c82e58c-a299-4e0d-bb3e-3f5c20d344f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831264, "uuid": "4057864d-0f61-423e-a88f-65cae371ddcc", "value": "afdebbe310efbf8ebc01012495dba839.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc6dd60-44d3-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1636843564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636843564, "uuid": "8b422ebb-c5cc-499e-b361-5faaf5a5cdb0", "comment": "Malware payload (GCleaner)", "value": "24766cc32519b05db878cf9108faeec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636843564, "uuid": "3e390e3e-403f-4aee-8b5b-8dabd98117ca", "comment": "Malware payload (GCleaner)", "value": "d7cdfb895940efd584c78b7e56f9ed720491234df489ee9eb9aa98c24714d530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636843564, "uuid": "d4f29330-450e-471f-aa53-19331b60d8a7", "comment": "Malware payload (GCleaner)", "value": "c553780cb609ec91212bcdd25d25dde9c8ef5016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636843564, "uuid": "6c295d37-0957-49ea-a30a-2c43fb5ddeb3", "comment": "Malware payload (GCleaner)", "value": "3332d51b40ee893a61a112b48e8e746adff76e39dff671f51f8feca624885a44cba6c974a429011b0f15553965716a76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636843564, "uuid": "2eda1637-f0fc-4bbf-9284-4b47786f1e10", "value": "T154043A386391B436E4F30435A4ED97F494687A3067948CEBB7854F2E0B79AC2D634B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636843564, "uuid": "a415262f-23cf-4d5f-a9fa-acc863292223", "value": "2c02c1999142edb52caad79376c81ce6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636843564, "uuid": "f27d0c7f-60db-4c40-986c-f5ecb69d24b3", "value": "3072:2ltChp7mxic8WjwEu70OOGbV3gqNH+HI/yyvcOGkXtTLvAGLi8MxtBb5bBhGu/hl:PfvQ479V3r0cyyvcOGkXtTLY18wHtbBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636843564, "uuid": "5f199d73-99d3-45e6-9fff-459e4ab17528", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636843564, "uuid": "40629be8-efae-4af8-b0c2-760005a8e526", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636843564, "uuid": "293957a6-a7e0-4471-ab3f-758c8b1a7821", "value": "24766cc32519b05db878cf9108faeec4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46ac5b1-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831311, "uuid": "cc5a4e19-1fbd-4abf-8311-042b3e9c38d0", "comment": "Malware payload (RaccoonStealer)", "value": "f90cf9b8f9aecbaca751312d94c3a084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831311, "uuid": "a09e7aae-3a5d-44c1-b2de-42c11685444f", "comment": "Malware payload (RaccoonStealer)", "value": "d895d7793b22c9d6fc66a55e71ad757362b22a21992524ef5683f016ddf684b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831311, "uuid": "16df3bb2-76d0-4c46-9755-a718512c67da", "comment": "Malware payload (RaccoonStealer)", "value": "d6923b3ede795995fd5b35f1c07cf46fc3151d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831311, "uuid": "c8d2ff07-4b96-42fa-9c51-a439ba9f5210", "comment": "Malware payload (RaccoonStealer)", "value": "34e6501f9d0305cba09ead8da71d0cfc40c8954ba9c1575fdb56d6f17cc13dfa5a536b492ff9ce7b21420b005d597eec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831311, "uuid": "4a0e3672-fdab-4c80-8043-6228e89ba18d", "value": "T128C4E100B7B0C035F1F767F54A799268A53E7DA1AB3490CF62D52AE996346E0DC30367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831311, "uuid": "202475cf-9fcf-400b-a8c9-70aa4a09906a", "value": "ed1b1d17b38d0dd027b889df8df37758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831311, "uuid": "c0750fdf-bcb9-4329-a217-bfb514e468b2", "value": "12288:tbILSDq7rtjwzWZzTzLd02XjUAqmBKa60H:t8wqHtjUWFTzu2oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831311, "uuid": "9073c4bd-69ef-4b53-a82b-bc0ce9be42ac", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831311, "uuid": "c84d5549-b707-4fd2-81b4-d8645878f57e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831311, "uuid": "0115701e-8e6b-4567-823d-a1a9e9935275", "value": "f90cf9b8f9aecbaca751312d94c3a084.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a20a1b-44b2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636829320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829320, "uuid": "c6e5ec0c-40de-4642-bf27-cfaee498d2e4", "comment": "Malware payload (RedLineStealer)", "value": "f781a93e4bbeb163e5ff499d3a0f56af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829320, "uuid": "1b167d54-c5e1-48ac-aeaf-a1ee8b28e4aa", "comment": "Malware payload (RedLineStealer)", "value": "d8ce2e5613b91a46eb15835e6d2aac47a715e2ab55a97163bdf2ed8ac350f7a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829320, "uuid": "36d40aa5-bd43-42ef-b3e1-564dfe56c5bf", "comment": "Malware payload (RedLineStealer)", "value": "46065192bd7c6188b2a98271dab3608ca3abece8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829320, "uuid": "f678ecf9-8f76-416f-8120-b481492dfa2d", "comment": "Malware payload (RedLineStealer)", "value": "b1b5878475c83210baa0e1061267a7285378c678bfe429250be7f41d6a692c28f2eeff255c43655138ce152b76666dfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829320, "uuid": "ae01ae96-bd79-418f-8d38-47f3fc7a6fae", "value": "T1FC65334863D1F94CC893EF39EE2AAF84E6BC506C74F5E5661B1E4CD6263805992C24CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829320, "uuid": "2b09a6c8-839e-4367-8e74-e0a9b69bcc5a", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829320, "uuid": "f9403bb4-b3ef-45bb-b04f-4240d15e95b1", "value": "24576:+ALHXulD7DZxCgY4P4ULf1ydCV+qzuvaXxVV9VD+EmJ4I7skEaHNYK3q7oy3NVzO:fut7VzPfLf9c+uCXxVVj+5J4msNaYU62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636829320, "uuid": "493856f0-a5c9-4ebc-9e5a-6e7d0f24f0d9", "value": 1496576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636829320, "uuid": "41b1c8d2-ce33-4059-9b9e-5a4cc68f3d96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829320, "uuid": "274e49b3-6e25-4300-8d48-871777d723b6", "value": "f781a93e4bbeb163e5ff499d3a0f56af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b9ce4e-44bc-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636833783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833783, "uuid": "b835acdd-6733-4129-9db2-20686e46e9f6", "comment": "Malware payload (RedLineStealer)", "value": "bc696a3c1ae7b216b926386c6542808c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833783, "uuid": "f5ad0ac2-339f-4d7c-b3a5-ac20ec8d5a67", "comment": "Malware payload (RedLineStealer)", "value": "dbc5448b9ef5bb12f64c4507828cd8cf49b34129024920a8eb9a1c4f175e9d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833783, "uuid": "68c6b19d-40b5-45ee-b8aa-dd5cf02af72e", "comment": "Malware payload (RedLineStealer)", "value": "ef21a7da66b83e8161b5af492e186af302ab3e16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833783, "uuid": "99ef7080-5288-41ee-9e2e-2eb008174214", "comment": "Malware payload (RedLineStealer)", "value": "2583925939a3f589eea3ec90c31f704cf62236f4e6ec2ac775a4b8ac3c6517190f218d6af5b87b6f7ecbebda2c4ae329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833783, "uuid": "763e7584-142b-4ccb-a7d7-c182c6a59aa8", "value": "T1B36533F18F0CE85CC89722F4E5D96D51F189B38010DC612A9EAD6D65FD8E427E22B239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833783, "uuid": "33c3542b-4e07-4432-b256-8681fd6e4703", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833783, "uuid": "146f8a32-0ac2-4207-ac8d-58e7cde84f8b", "value": "24576:qZILqVhO0TJd0tdSjeETrhTqcv9jVEsv03Q7uC8pnkEaHNYK3YVMrMmN:kILqVhNSNETL9jSaCQipnNaqVYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833783, "uuid": "b9a0e974-3638-430c-b109-551a1582653d", "value": 1419776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833783, "uuid": "20d22561-fe79-418e-a0cf-a3f493648a67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833783, "uuid": "3400ccde-958c-4b71-b4f1-0d72d1cd548b", "value": "fortnite hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb37207d-446a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636798681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798681, "uuid": "396420ca-ef40-4d8a-ac0f-169db1f41308", "comment": "Malware payload (Gafgyt)", "value": "1cfa618363405924f396e1246af38e41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798681, "uuid": "8ea9fa59-8e1f-4c7b-8b96-dac65f7277b3", "comment": "Malware payload (Gafgyt)", "value": "dd6fcfa7b661356864dbf4923999e74589040f6133d35d2e2f2541147b956666", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798681, "uuid": "f474e8e4-da07-42f8-92aa-97de49de4f9e", "comment": "Malware payload (Gafgyt)", "value": "16fd90e9fb008e2d666389be68f9bba9818e53ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798681, "uuid": "ddfc42a3-be76-4ed5-8cee-1f66e6a9f91e", "comment": "Malware payload (Gafgyt)", "value": "c61c7ecdff1e66222d7aabbe50ea20953288256dad28f95c3c1392f5ec0b7f9af936eb73568227f497fec13a7310a619", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798681, "uuid": "e0e1ca99-9703-4773-b981-a781e4e883a7", "value": "T1E0C31A53F800DFA6F40AE67204D34B25B631BBB20F536622B25739679E761E53827F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798681, "uuid": "98c27579-8061-4ce6-8b38-e88051222f20", "value": "3072:Y7oizQ+0HzMN8jyM8XciyeU1J3OHoZmmh0qDrtaflZq:Y7ocryzMN8jyFye0J3woZmmh0qDrtafO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636798681, "uuid": "1427b098-7382-4dc3-a040-6c2abdd8e015", "value": 120034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636798681, "uuid": "633eecc6-4a66-4f9c-8a74-cb8cf6807c8e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798681, "uuid": "347d1e7a-60c5-42bd-961d-21754ffd2ebb", "value": "1cfa618363405924f396e1246af38e41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2f6c43-4486-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636810656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810656, "uuid": "677c0e80-053e-4e37-9c20-a0915b59f56a", "comment": "Malware payload", "value": "994fbaa06ab08da261208f9aa29a9e09", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810656, "uuid": "4b65ee3d-24ee-4243-a9bb-c396e4b7ad74", "comment": "Malware payload", "value": "e0114319386e0d1bdda645e5974446f2d3bcc2263cae98899b5e8f5c08845ad9", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810656, "uuid": "f4d07840-c48a-4397-b802-925b8d4e9006", "comment": "Malware payload", "value": "95951de03acb206945b0bc83a0803a1740d94123", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636810656, "uuid": "cc2e00f0-3237-428c-8ab4-663f53f352e9", "comment": "Malware payload", "value": "65ba93fc9b061488f6d9acc2305acef39f2c5541f0be6163d8dcf02e90e43b0d5be33a947b77bbb1267c42ba76b0cfa3", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810656, "uuid": "940db6f9-2578-464d-a1cb-502a982414e6", "value": "T127C4BE8A37590DE9DCEB407DE9A3E301EA6930A183F484D713ACA5FA4F13791543DA72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810656, "uuid": "45a44125-16b7-42a4-884a-ec0039ba08ee", "value": "6144:kGr7Yna6SnW7+z9Dp2m3HUjMH4y6gFxKIiq8ch9/H5WeSYnwxammoP00s579/ckB:F2gn48pfGWYgbnga57ZcwDLPWtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636810656, "uuid": "9e10d1a1-d285-4afc-94bd-8f11c400eb88", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636810656, "uuid": "775c9e52-bfc0-4e18-9f67-bb9c7defeb38", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636810656, "uuid": "4cf70bbc-6281-432c-be10-239951b1fd61", "value": "documents-600.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdee760-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831243, "uuid": "87606146-3c69-44cc-92b4-49c59dab4858", "comment": "Malware payload (RaccoonStealer)", "value": "d3a484aeb5e17989b842aa8597d2115e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831243, "uuid": "61258ec0-f36a-4f59-b18c-11af09359e78", "comment": "Malware payload (RaccoonStealer)", "value": "e253810ad83994358a6000190a641dc5ca130554d8c639b5df95538680dea1ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831243, "uuid": "663efd1d-fc3b-4cf4-aaca-c2c0ed7b789e", "comment": "Malware payload (RaccoonStealer)", "value": "7025d2d2d55f42cbe56bb08e77b2af06ae0acb71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831243, "uuid": "b4024d33-f57c-439a-b037-ca5fd6f72025", "comment": "Malware payload (RaccoonStealer)", "value": "c18ac8535c585de23ce809df6fc0316da82d00933bc62f1f59bb8fa4af9f525f1c31866a04696ae058f7954bbe7483e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831243, "uuid": "239dcb7f-4c8a-4ad1-a9c1-fc160d72d909", "value": "T145748D00B6A1C035F6B256F949769368B53F7DE1AB6590CF22C82BEE4A346D0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831243, "uuid": "fcb5d93c-2149-44d3-8794-d73ba1839598", "value": "17d363df494bcb38053d0872594e66c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831243, "uuid": "e762a91d-6dbc-4e89-a4cc-0e8e8fc62c70", "value": "6144:mHEAez1tYwCK1sq/QulFOcQEQ8k376/esxGSmD:9AAMwC1OQulFOcQEQ8kvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831243, "uuid": "b7a0f959-2cfd-4999-ba95-620d493e7c2c", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831243, "uuid": "0811d300-2fca-4cca-8536-ff8d5fb51311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831243, "uuid": "3ad4e5ab-c10d-432d-9745-23351b994740", "value": "d3a484aeb5e17989b842aa8597d2115e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb20a24-446a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636798685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798685, "uuid": "31419ae7-0cc6-4550-8f83-98fe19e06dfd", "comment": "Malware payload (Gafgyt)", "value": "1786a9a6434fbf89fe59a736b518a258", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798685, "uuid": "1d348678-5dbf-4add-8fca-f5da7b804e37", "comment": "Malware payload (Gafgyt)", "value": "e34fe9df091b5ae644f76ae1823a3892b937134b19806ff8c9bb6f6071434e1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798685, "uuid": "5ddb43dd-0bbe-4a09-ad44-78da44dbe01a", "comment": "Malware payload (Gafgyt)", "value": "85ae3706f342739770ca73f0bc7b950c68d2bc7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798685, "uuid": "f476f611-61f6-4288-a1be-6f7e9b3b2b6e", "comment": "Malware payload (Gafgyt)", "value": "57eff883020332b020bc11e385360753d7e1695e62285e23e57d59252e6ce419403e905630218fe21b4f3c8c19ccf4d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798685, "uuid": "b03ac235-c615-4942-aad3-a04691bdb74c", "value": "T103A33A9AE747C6B3C8430BB6024FA6664921F5BB092E9B4EF31D6CB0AF224D53515FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798685, "uuid": "288e7afd-93d4-420b-89cd-c9dec18ecee9", "value": "3072:VhlqNpP1GVjjWHKmiqTCr3L7nwuG5h9EDmgG0OzUmgfmfo:Vz+pP1GVjjWHRixLwuG5h9KmgG0OzUmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636798685, "uuid": "fd736f38-3d18-4d69-ac36-3f0d2275bf02", "value": 106738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636798685, "uuid": "fac57b22-61c8-4607-bf48-f9efa0313a79", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798685, "uuid": "94085575-7752-4ccc-bb8e-f15834af9f85", "value": "1786a9a6434fbf89fe59a736b518a258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a13e58-44bc-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1636833494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833494, "uuid": "817f9f0d-fcb1-4005-bdd7-ed4ca54cd030", "comment": "Malware payload (Vjw0rm)", "value": "700a4f8e72def7a2b5fe5a67431928cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833494, "uuid": "f563f9af-2a40-4b93-b5f3-244f51f0037c", "comment": "Malware payload (Vjw0rm)", "value": "e3b94526da641e87e5f65a02571f55e8cd84b36578a01bed84cf033c5851dd19", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833494, "uuid": "8df35a3f-1caf-44c7-b847-a77d2fb41515", "comment": "Malware payload (Vjw0rm)", "value": "722a166d6e6c6badb4d31a5ef071d6fe3cfb6ac8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833494, "uuid": "63f300b4-156b-4f90-b219-e7f393928505", "comment": "Malware payload (Vjw0rm)", "value": "58f4b754ddfb432223f6d49d28bec19ad014fae18468da2db2c07ae4bb4dc659ffb1c5800be431e98df7517c91622db8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833494, "uuid": "06121228-be54-41e8-8786-4b120bc75206", "value": "T16283D6419F421C87B6B8D69350AD0025CE5CE2F8CF6AA49AD341F9CC0EEF2476793E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833494, "uuid": "95bd7b81-b5a3-425d-8aac-d8a5627d9fc6", "value": "384:wPnPI1gYzbBg55m/eguLS7X/g/W/W/w//a/t3Q/QSfm6wUgv:fG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833494, "uuid": "8bb9bd6c-adc6-41a9-86a0-d5f42f082831", "value": 83988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833494, "uuid": "d2cbd8fb-2af7-45d4-ab86-0a63e01bc180", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833494, "uuid": "0ea8c58f-d607-40a5-8a69-3a2371e46bb5", "value": "93388363_Payment_Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40597812-44ac-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1636826714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826714, "uuid": "c33e3824-9f00-4d82-b864-46141d23bdd6", "comment": "Malware payload (AZORult)", "value": "a3cc781be4a0cc75f14ce69b59f8c99f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826714, "uuid": "ec501cc5-ce93-4eb0-a70f-3bce220c2ac7", "comment": "Malware payload (AZORult)", "value": "e4649c5b452d75aa2cdfdb8bffed9dd6c558d3cb1225c877bf570abb7b106221", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826714, "uuid": "9c9c0c0a-b161-4f3f-aa8e-1188c8f0af64", "comment": "Malware payload (AZORult)", "value": "9c13ea485984c9e75196c4d0bd871b1b7dc72017", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636826714, "uuid": "93bb5426-827e-4bc1-86ab-2b12ba9bc81a", "comment": "Malware payload (AZORult)", "value": "d0616648b9f3f5844e735c1daf6a52673cba269ca860a8b89f639cd2dede0b414834cb931aa0c5e706f42c74edd57962", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826714, "uuid": "0b64c4e2-352c-46fe-b943-d1180f63dd8f", "value": "T1282501152CBB0163E01649B04FA185FA2B7EFC2375655D0FE784FD4814A3A4AA8E277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826714, "uuid": "f35b6d5f-87fc-4878-b96c-1f5c2cea6369", "value": "38bbd7b6af738c50eec8bb509ccc9556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826714, "uuid": "1d70e787-98ed-4d38-ab2b-e9e28a1ca0be", "value": "24576:FgPhv3voosHbE01/LrSxgIvEoTJ4mS/Xr5XrHS:SvoDbX9k4oTJ4mSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636826714, "uuid": "5204da9f-b901-4c75-8571-23d69601e832", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636826714, "uuid": "83857e8c-9214-4739-bbb5-55f61f0e4c49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636826714, "uuid": "cd3d6b50-b2b8-448f-9837-a0ec80dc88c9", "value": "a3cc781be4a0cc75f14ce69b59f8c99f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06ee4d0-446a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1636798663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798663, "uuid": "5ab24db8-c6a3-48c3-945c-d9fa201cb08d", "comment": "Malware payload (Gafgyt)", "value": "6d87a3af220b440d99af44aa2071b66d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798663, "uuid": "907e28b1-ada6-4497-b909-1d8bff0fe01a", "comment": "Malware payload (Gafgyt)", "value": "e6a50ce2285fd383744594ad2ff763438210ad7f9c3d35e1ff630135774ec02b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798663, "uuid": "38f23e9e-1b84-4da8-a1bc-415f9ce0e5ce", "comment": "Malware payload (Gafgyt)", "value": "a34b1f9d5eac1b853335dacf1c28e108bef88e4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636798663, "uuid": "d9b187b7-75f5-49b8-8688-38ca19695fbb", "comment": "Malware payload (Gafgyt)", "value": "fef0294965459df879dd723d55c2d4046041c373ee9f885968e79a63086ab42f1c2ed88303a42e34bdf31dcef180199d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798663, "uuid": "367fc335-8aa7-45ca-8107-25a8f92a794e", "value": "T1D1C34C17B71C0B83C4D789B22DAB3BF18B6DB6B1129721C1A90AEF804773A751523F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798663, "uuid": "621ef875-d9a5-478a-9d31-891aa4732b51", "value": "3072:OwYKBQZmnrzDA5hxy+BDmmh0qDrugflJq:OwDBQQnrPA5hxfDmmh0qDrugflJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636798663, "uuid": "79de1e43-f1ca-4ca8-9353-edb09b64e850", "value": 119074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636798663, "uuid": "688561a1-11ce-464e-b008-bea703e34514", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636798663, "uuid": "90da9766-48a1-4d66-b030-232b0568904d", "value": "6d87a3af220b440d99af44aa2071b66d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40ae39e-44cd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636841162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841162, "uuid": "898b51f0-c583-4759-bb66-3c775f426f68", "comment": "Malware payload", "value": "abbd913fabcce80fe6c14f8103800378", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841162, "uuid": "ea39ca6e-e366-4f3f-bfb2-e1d7d5ebd0e5", "comment": "Malware payload", "value": "e7cabf681ce8989913c4c78c8f539a791c852e0e637f359d2a399b91dc676506", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841162, "uuid": "ed49490b-2977-45fc-bad4-3f80684d3a49", "comment": "Malware payload", "value": "bbfd5bd99597e246fe61dc8fa4cbaa99c1808b1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636841162, "uuid": "94bb4580-414b-48db-913f-47d6b332d627", "comment": "Malware payload", "value": "290c832ec00a60b89bbafbf0ecee406c85017549939c14ea4245a407b80d83ff7f72c239be265118a999d66839079c39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841162, "uuid": "d9458620-9aff-493f-888f-60b992a06ee9", "value": "T1F5E4400D7604053FFD2CA93194892B4427411FBE2A42E665FB6631C3EB373DB5E278A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841162, "uuid": "cc0bca82-326d-4f2f-9629-93f69fa1ddac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841162, "uuid": "80f91ba2-99fa-41a8-b335-630951206e6b", "value": "6144:6NnLK7WYbaY0T1Rpg+CDSx9iLbmjrjmI/HIv/yDu:6NnLK7WY+d1LdC6smjnD/Ivq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636841162, "uuid": "c96a661d-6849-405e-8081-056368a35b32", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636841162, "uuid": "ae5496eb-9a5c-43ca-9af3-aeeeeb2c32b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636841162, "uuid": "d24d227d-2e54-4d2d-acca-927940ba6937", "value": "abbd913fabcce80fe6c14f8103800378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d8ff5a-44b9-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636832382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832382, "uuid": "1ac9aa91-e2eb-4d0d-9de8-a6b219613514", "comment": "Malware payload (RedLineStealer)", "value": "760d5a8b6a2a43b3038bf05519f8d2f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832382, "uuid": "a634af7f-e5b4-4c24-ae75-4a3ea2289bb4", "comment": "Malware payload (RedLineStealer)", "value": "e7d90e82ce6b6d2233f2afd0cbd1d7256497d5c4020b903d40a25b153dc9cfb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832382, "uuid": "10eef745-faa8-4cf3-8427-88733c552946", "comment": "Malware payload (RedLineStealer)", "value": "2945040e3eae0dea14a7e407347f11843ed79dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832382, "uuid": "85118223-c941-4cfd-bec6-75a0587d9509", "comment": "Malware payload (RedLineStealer)", "value": "3655e523ddc918785be4ef7c1be3b4946f76c2b61d88a235347c84b2bd55fc086c504fda9702a40d867695b5143cedfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832382, "uuid": "2329de4c-112a-4e0f-8359-6086e368a0d2", "value": "T1AD7533F2B188E98ED906DBF8BDF7AE16CF40B7ECDDB47080121215989784C56F91A439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832382, "uuid": "1ca4f1c6-37fc-4688-b8ca-035db318142e", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832382, "uuid": "0fa89967-0716-4d03-8281-ddb5a2983144", "value": "24576:+myM/P8uSBmdEaM/1pFEPd4Qd5oXBbYqWXvUIeXqHmKKkEaHNYK3oGkP9Qx:+mUuSBm10p+dXo5YqW/UIcCmKKNaJcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636832382, "uuid": "73d98b85-575a-411f-883c-1c578db3e517", "value": 1626624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636832382, "uuid": "9ad65f84-23ce-42cd-b5e7-ea932740d488", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832382, "uuid": "24597a8b-3dd9-4319-b841-28a6c417798b", "value": "Gl_hackV2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e4f37d-44b9-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636832260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832260, "uuid": "9e39344f-434c-4ff8-abc2-3efa3aa1ffca", "comment": "Malware payload (RedLineStealer)", "value": "89ba3a26828c25d05dc1d712dca0ad11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832260, "uuid": "0a9a19ff-835c-4aed-b927-54169468dc2a", "comment": "Malware payload (RedLineStealer)", "value": "ebd2638b8cb8c64f869779415eb8f6cb28da23a42f3301f55f5a40b931581634", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832260, "uuid": "f1d35484-779a-4a1d-9e4e-863ce8e9feeb", "comment": "Malware payload (RedLineStealer)", "value": "be925ca9f4434734fb26711c4e50b1d8e6baba6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636832260, "uuid": "66585812-f149-40ea-8287-78068ff0f3a4", "comment": "Malware payload (RedLineStealer)", "value": "4b7e639da66527379d9fccbe0bdb9639c22c15f55e3b4d3a4102b8b3e29123fe9177aa1528c2f8977dff5a103e98d011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832260, "uuid": "d322108b-e411-4bda-ad0d-b3bb0c791d75", "value": "T1186533FDC941DE3EC5AAA3F6B6265C1E6279491ACFC9E39CE3058F13B215037E5004A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832260, "uuid": "2179feb8-0bbf-44d1-a506-1933a885eabb", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832260, "uuid": "0a3c9bc6-9097-459e-8328-8a5296fe1f70", "value": "24576:2JhbiAsw0EFIOkKpH+8gI644p9Nz5vCRfp/Esom9NeVGeqlPmN4c8aHHcckEaHN1:26A0eIOJpHtOLp9x5vIfp/Om9New3Gb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636832260, "uuid": "cf82df79-8a29-4f30-9d19-b0969a5b1f3d", "value": 1521152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636832260, "uuid": "5a5f8af5-77b3-4645-a673-914b99e9c256", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636832260, "uuid": "59c534ef-58d6-460f-a70d-2d5fffd61d6a", "value": "Unicore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5151ea-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1636831219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831219, "uuid": "09dceb7e-4b7d-4fbe-8ac7-d96f6e6f59fb", "comment": "Malware payload (RemoteManipulator)", "value": "8cef8ed60cceea50160020196c19662b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831219, "uuid": "2271fd33-8963-45f4-85a4-39780f83a1d4", "comment": "Malware payload (RemoteManipulator)", "value": "ec833e37264c772de689338f22b307bc864390e62d1cd1d7a8bb6d9bd3da8883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831219, "uuid": "3d141a9b-30f3-426a-a0d1-b3971eb48f68", "comment": "Malware payload (RemoteManipulator)", "value": "445c65823d058235adc8f16e13ef52c7dd3092cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831219, "uuid": "6e682a82-38b2-44ad-b6c4-214e11ebaf8a", "comment": "Malware payload (RemoteManipulator)", "value": "f2d7a50c24db75a9146b70b56a713524a2ff8adcdb41421a5bc42fd4369b9d0b69173324d2eee175c24bbf5dedf98a04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831219, "uuid": "cd12e5aa-7997-4a44-8951-f34b6ee202f7", "value": "T110463301F04BEC72C57225335A6BA621D93AFE202E22D69F77D41E799D72110E718EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831219, "uuid": "294c7f6c-a8c6-4fb6-b899-f61af005e3ac", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831219, "uuid": "c28fb8ab-2667-4dcb-988f-6e1edc644d9d", "value": "98304:+vEAC/X9eafEr+SAN4OxBRPdqaBZQEi8En7a8KxEZ53CraN0qu0oMr46tfObbk:+sj/d8aSu4aBRP8UI82exEZ533uTifOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831219, "uuid": "80c3ed64-0dbf-4d6c-bade-02b09e3b3461", "value": 5517088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831219, "uuid": "9728cbce-ddde-4071-bbed-6594765e250e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831219, "uuid": "6d3df04b-4833-423b-90c3-6cc73ae12fad", "value": "EC833E37264C772DE689338F22B307BC864390E62D1CD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002a5fc1-44bc-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1636833478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833478, "uuid": "fcab484a-b327-4c8b-bfd8-2ccf08de8a53", "comment": "Malware payload (AsyncRAT)", "value": "116016144f6b7252b2e0e9e3105f1500", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833478, "uuid": "76c78668-41be-4256-9197-ca83e40c91fc", "comment": "Malware payload (AsyncRAT)", "value": "ee01f7666617dc4509a2f2fb71d7f95f25dad05c8d73d4104aaea213cfc8b92a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833478, "uuid": "a47d6b14-d3ba-4753-bb9f-00c5eba8b6d7", "comment": "Malware payload (AsyncRAT)", "value": "a28e7ba7c633bb8269789a511fafdcb13fab9570", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833478, "uuid": "a0dea4a9-ea2e-4fd3-848a-bea0dc430cc3", "comment": "Malware payload (AsyncRAT)", "value": "4e04506b56176a66813be52a97adabe505189373a23947aa3b80bc9b4a936818e6f5d01f66169fcd47bbd76ee5a41b68", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833478, "uuid": "c20332e4-9e65-4a01-9327-ee56ffc43963", "value": "T16E01AC4FD9EBA6E31BF37903E1A39E28CC102062E7E6C224B12643CC4B20D952D8D06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833478, "uuid": "4073e75d-cf35-47a8-9446-a36304d75c1f", "value": "12:NCV35K+ZbCm9rIqYlNwvYFM0fMW7CBbzdmMQO3R7bh7GZtjxKtEEGUtWoHsan:cV35sm9EaoM0fMWkd2XKEExsan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833478, "uuid": "bfcbe2ac-72d1-4c77-ba1d-e05f0731e3dc", "value": 662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833478, "uuid": "32d7f8d6-05c9-4561-9c20-59b67cfee5e6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833478, "uuid": "b9014584-6f27-428f-a4af-65a47781a1f7", "value": "XatLtbzy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f135659e-44bc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636833883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833883, "uuid": "09ca4883-3ddd-4b83-bc32-4e9112f1f43f", "comment": "Malware payload", "value": "2051874c7e07efce49b2f04d09d9ef3f", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833883, "uuid": "931cbd4a-d9a0-4bce-af9d-4f3dc9911048", "comment": "Malware payload", "value": "ef46033bd20dc2c05f66e9bd2e533c9d41419350443b90891e7596d9e56a6365", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833883, "uuid": "0e507942-748f-48ed-b1c5-c6ba23ba5b9d", "comment": "Malware payload", "value": "11ee7464448eef9bc48501076262517b044be575", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636833883, "uuid": "72ffeb36-a5b7-45a5-a985-ab2f2dd5d704", "comment": "Malware payload", "value": "7bf2499a0b58d9bd500fe5cf750910ed56457b67b25529196186bfd1ca89a5d37947382de974840c9252cced44e2a0c0", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833883, "uuid": "2821c80c-048c-4318-84c9-a58e95c2a899", "value": "T14404CF517A84C80AD55906361DE2C6EA7B33FC42AE76C3073154F3BFAE77790C90265A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833883, "uuid": "bfae5797-7791-4176-b2ed-abed0e42328b", "value": "3072:crxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAvbuAJbD4DiOpEkOHfehcZHQIawhlujE:mxEtjPOtioVjDGUU1qfDlavx+W2QnAVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636833883, "uuid": "5fdd4a3c-5b95-485d-8007-f6b6ba262cd2", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636833883, "uuid": "c6cc4dcf-1d21-4062-aaa3-5392be51780a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636833883, "uuid": "5d3c7f0d-98cf-4041-a248-d5c35efe7971", "value": "Confirmacion, Pago Fecha.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9e5332-44b4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1636830065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830065, "uuid": "5d3d4124-676f-44a6-94fa-096b7d679478", "comment": "Malware payload", "value": "a3928d74150ca56e9eb7b0109039c0ed", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830065, "uuid": "4a639e61-c436-443f-a8ca-d6dbe38e700f", "comment": "Malware payload", "value": "ef822c9b85879ae70fd66d39ebe4ec133cbb83ae4424350c729424580839b19b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830065, "uuid": "b9d7a83b-8adb-4431-be9e-2a5050625aad", "comment": "Malware payload", "value": "0da3af9293df75aa3de4eb9e948400ad5a8bbd6c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830065, "uuid": "b407ef99-8349-4572-8b4a-83a50ebf3174", "comment": "Malware payload", "value": "e8d81e4e7c32ee85d79993e61662095e96df9cb0047167dbf71386ac062e876dacf2d60a6f93c130aac0b56665965671", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830065, "uuid": "e7054039-3143-43d8-963d-df47960b31ac", "value": "T1CAA5334976970709C59C25BA808B13780BE11FDDF273CCEFA7AD129A5832BD9A1D078C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830065, "uuid": "a48e676f-685f-4fb7-992a-f0898a34334e", "value": "49152:GtbtwTXo6p41L7S9jep7IStTyU2oRpSEax:4So6W7ujm7IaTyUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636830065, "uuid": "96a374d7-8dd5-4738-99b2-72444eb671b5", "value": 2072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636830065, "uuid": "490e79ee-0842-4dab-a442-dbe8a140cbc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830065, "uuid": "9a422eec-0ad8-47c6-8eae-c9341c8b57a0", "value": "use it if directx error.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ffd884-44b3-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1636829839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829839, "uuid": "3fc8a517-b7f3-49ac-9736-9f78ad83cc23", "comment": "Malware payload (DCRat)", "value": "e2b1b315921b100a562396ad39aa4537", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829839, "uuid": "05cdf092-163b-4c97-9d68-2f577e1eb804", "comment": "Malware payload (DCRat)", "value": "f071709c71c19d16da4a7d460f1559542e02954d0e714410d1c615b67ce22379", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829839, "uuid": "e88e9015-239f-48f4-bbac-bd2bda524bba", "comment": "Malware payload (DCRat)", "value": "99033700fe2306e7982e2c6194d676aa88697586", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829839, "uuid": "dbf3ae6a-7be5-44a4-9416-b4daacb164f0", "comment": "Malware payload (DCRat)", "value": "18641b9cd08b433ba13f37a741a71528ec464dceec443647ddb61fd30a5dc2e9d6a0fe43b7c3ba3eb1f32ae836048472", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829839, "uuid": "87f86f8f-4161-43e5-8608-999d3a9da860", "value": "T193B53322267235DFD7BDCBF70AE687A6A14B3B55AC3181BD32490C5B0D3A1C0E6B1C81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829839, "uuid": "1bafcada-d8f6-49e7-9c75-0e34b680f541", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829839, "uuid": "6202d183-05e8-4170-b1d3-2b27d3a6904a", "value": "49152:5nae17mbshfdy8VuV1wc8wCAS+kam5ZhlSjRSDMofGazSsHWy:5naexVTc8wCum5ZhGRSDMQ/zSsHWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636829839, "uuid": "1e0bbd27-c64b-4076-aa1d-a3bf679febd3", "value": 2268672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636829839, "uuid": "25367917-95d8-4e58-9a2a-3a45ba8f9aee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829839, "uuid": "b13ab18d-ccc9-4986-90d3-313761200c8e", "value": "e2b1b315921b100a562396ad39aa4537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7d6c60-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831241, "uuid": "21ddaa65-13d8-4d17-a811-ad79a5dac79f", "comment": "Malware payload (RaccoonStealer)", "value": "1ef6554c01f8775dbcba688239d7d54b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831241, "uuid": "307a561c-ab25-47c3-9681-bdc63a6a7e4d", "comment": "Malware payload (RaccoonStealer)", "value": "f3437e96520f1bbe5ffc6e027915d40a7d86a94e94466d63e0f86a0bb18224e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831241, "uuid": "85fa9083-6214-4021-8fdb-44b74229f953", "comment": "Malware payload (RaccoonStealer)", "value": "589518a2183da2f9a5a71f2dfa1ebafd3176522c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831241, "uuid": "81d442bb-fe31-48d5-8a06-37e7eb2ed4e9", "comment": "Malware payload (RaccoonStealer)", "value": "b90d4842dca27f65f78c85fe7fc01c684bf16c7ba2c74932181a922508fe619bbf0b302668e44e3b40987c3c128a97b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831241, "uuid": "f25bf05e-a211-4df8-adab-a32759a1aed6", "value": "T13ED4DF00B6A1C035F1B662F909B9936CB53F7EE1AB6850CF63D526EA46346E1EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831241, "uuid": "cda54336-1d2e-432c-b375-1b162143cda5", "value": "17d363df494bcb38053d0872594e66c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831241, "uuid": "abd42c69-8730-4b76-8d1f-295d478c7bf0", "value": "12288:1BscsT+2dMVqN2V/S/KePvmXobnilpnl4dfIKsAkcyMa:1BwTGVqogRPvmanktlEQbc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831241, "uuid": "a228c8dc-1e53-43d4-bfb8-dd44a5d8e2fb", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831241, "uuid": "b266e067-aee1-4ab2-8a3e-eeef2169220f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831241, "uuid": "80e11299-21c9-4478-b05f-b5f1287341c8", "value": "1ef6554c01f8775dbcba688239d7d54b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41200fda-44b3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636829722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829722, "uuid": "a972cd25-e290-409e-9f59-fb5fb197a8b4", "comment": "Malware payload (RedLineStealer)", "value": "9e48083c8dbcfeba4f8cef6fa16adcc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829722, "uuid": "327754f8-b907-45b3-bc86-4e68f29a1956", "comment": "Malware payload (RedLineStealer)", "value": "f3580c945b60d9f9b43c886f0f86244308c4ec859b6b3e005e5ebc2315ff0f0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829722, "uuid": "284bdd2b-b362-44cd-9745-12ff36e7beee", "comment": "Malware payload (RedLineStealer)", "value": "3ee49b2013da7c65e8925e699100711d0cca6bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636829722, "uuid": "21b4c390-8fad-402f-b793-9764f519a14d", "comment": "Malware payload (RedLineStealer)", "value": "bc86b6ad0294fb84287e1cebbd4397748f3002e08673a91c60e3272c3b6323de8cac872f75fb22d9a517d8701e751a63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829722, "uuid": "a5495f7a-bcc2-4cca-891d-76a1999f5095", "value": "T197D4315B21C3FE54CEA8D67B87AFD9248B2210D3531347CB57BA87C08615C2DEEE52A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829722, "uuid": "76082bf7-e94a-44d1-b4d6-e7d527f97339", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829722, "uuid": "bf20ee51-244d-45b6-a754-a8893b64cf87", "value": "6144:JwKFz5ttLwPjBAWWFKxZ//FpE0zeUiYP4yP7mVqz8MBe2VzM+KIak:JwKFz5tdEUFKxZHnbRihw6JMB9VMiak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636829722, "uuid": "5a2ae675-d37c-4c91-9ad7-b4f47568a834", "value": 604568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636829722, "uuid": "ca445169-2fe5-4bd2-9b3f-ccfb9c491190", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636829722, "uuid": "2af9b294-4e23-4609-9977-0a642071b070", "value": "GENSHIN IMPACT HACK FOR PC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108d8ede-4455-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1636789268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789268, "uuid": "08ef336a-ec75-42b4-a8eb-106f3222124b", "comment": "Malware payload (SnakeKeylogger)", "value": "52bfacfadaab66022df4e76f03e1add5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789268, "uuid": "ec8683a6-7d2d-4d1e-94e4-445ccce8ad17", "comment": "Malware payload (SnakeKeylogger)", "value": "f4edeab344f7191212f56330be9228495f1d3bd6ee6fa80b1fbdc6533c3cc240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789268, "uuid": "34559d31-88fd-4aea-af66-ffe025e781f1", "comment": "Malware payload (SnakeKeylogger)", "value": "532b489a41e468d32b7c41b1a0d550ba269730f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636789268, "uuid": "bb98023c-f59d-4343-b796-b8a0b2f06456", "comment": "Malware payload (SnakeKeylogger)", "value": "6c483653d34e8b7d1b3e7c725abe7f728f541199bf21cf098b856834ff584c94891cf87fc44d600b7d48b947d84cd0f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789268, "uuid": "a9f0a562-e9d9-4405-a7c2-8d32782306c0", "value": "T146E4320E6A04056BED1CA530C58D2B0427511EBF3A42EFA5BB4A31C3EB373D5586F9B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789268, "uuid": "ae8dd1d0-6198-449d-9efd-9a57b311070c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789268, "uuid": "608df6fb-bfbc-412e-9b1c-cd403bedd0de", "value": "6144:6ogY55TYufHVBGCCjVvkBK4fG2QmCvm4NpqYAOFwML/nIhlin68ysu:6ogGTv1BGCj+Xnm4NpqQuc6w61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636789268, "uuid": "4878b8e0-e19c-4544-a799-b7db836c9edc", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636789268, "uuid": "11f42319-4c23-48af-9f25-e8174d9fa4fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636789268, "uuid": "fb79b39a-9af8-409d-b7e9-b3daeda1e79d", "value": "Request_ISO_003820_1006517_001pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d533f9dd-44b5-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636830829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830829, "uuid": "d276b36b-a066-4596-9ee8-59be8bb8f492", "comment": "Malware payload (RedLineStealer)", "value": "d02ac5e541394722c43314a987bd6f04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830829, "uuid": "32e3a461-b901-4302-b228-143c782fe2cc", "comment": "Malware payload (RedLineStealer)", "value": "f5faced81151871dd7ecd897e8c41dccf60eeadc7598563baeba61c66a743e4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830829, "uuid": "b32e31b8-8c42-4bd6-8147-6c113d9ebcda", "comment": "Malware payload (RedLineStealer)", "value": "13a483479fad44f1d8e2a22132551cc92c01fbbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636830829, "uuid": "024c59d4-cf94-4611-b9d1-4480a6b62a8b", "comment": "Malware payload (RedLineStealer)", "value": "cedf9f6b13aa935936258ab538fcf9677044bd99ff5269447a788c0c406b23b93f43224187043cd874aa4f9a1485d93e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830829, "uuid": "df0f3add-7f66-4dbc-9ae5-6b69278f705e", "value": "T192642033197CF7189051FE3397CBBE7507E61ED95A7249AE1B099A015B10B42EE23738", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830829, "uuid": "127a85ba-73a9-4ea5-b74a-f30cab5eab8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830829, "uuid": "9b52330c-b12c-4b28-a446-1b695bfb3fe4", "value": "6144:Hvp+U1syFyeP9UdS8GtQw1HpsGJ57/2ln8Zn7Cgk:HvR2gbUdSZtl1HprJ57/2ln8Zn7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636830829, "uuid": "1a38a66e-cb10-40e5-b259-6f555fca724b", "value": 332696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636830829, "uuid": "352d2b03-e287-4887-acd8-27d430e6ba3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636830829, "uuid": "af7fa54f-fa5a-4f19-8328-4e2d3796980e", "value": "tradecheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6d8965-44ad-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636827139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827139, "uuid": "8338b92f-38f9-414f-b27c-2f10849d36d2", "comment": "Malware payload (RedLineStealer)", "value": "63688214415c58db43cebb979e528b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827139, "uuid": "a67a5b57-0ff1-4ea2-ac4d-cb0b3acb011a", "comment": "Malware payload (RedLineStealer)", "value": "fbc01c6283f8cdc91c6a6a2588460cf32c29c17bbc041d8e9b069800d9b1387a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827139, "uuid": "c20e5b04-befd-4c6b-b1b1-a03c54762258", "comment": "Malware payload (RedLineStealer)", "value": "3652635bbb5b717676674e8da52d8db141a50832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636827139, "uuid": "358c7f0c-1e72-4d31-87c6-870fa75256a4", "comment": "Malware payload (RedLineStealer)", "value": "400ab32d0d32bc3259cd6382eadcc1f477d5e6640b80cad6b1c88ea495efcfbde8a3b2ea5282f8e9d72f64ec50c03d30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827139, "uuid": "23e5a67c-6f20-44ff-af21-9f596de2e65c", "value": "T10355338F2D414BF1C90E7EB1D9C6DE09C83166615DF3ACA4B44E74ACBF8517885E20E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827139, "uuid": "2349829c-8cf3-43fc-82d0-a709021ef4bf", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827139, "uuid": "36ee351c-1aad-4be7-998d-ba568456414d", "value": "24576:MCZHWnZYknEuoZ2UZZ7OlZXg7TvGOPdnQA8wzsz7/RM5ARRe3GeIdHA:TWZYI0ZpKo/vxpQA8wQso+4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636827139, "uuid": "91dda063-e7e0-4a93-981e-014d49007f82", "value": 1323008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636827139, "uuid": "143e4a22-5f09-4255-ad62-5305589af883", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636827139, "uuid": "a2ff4159-a724-41a1-b16a-39113c9a11c1", "value": "Covid 21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b48191a-4466-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1636796641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796641, "uuid": "e5c57506-2a28-4640-b334-906a14f09c11", "comment": "Malware payload (AgentTesla)", "value": "850ee7e4151b6be49c19b2d59d2bd5a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796641, "uuid": "631744ed-4891-4cbb-9890-c400a48deb7d", "comment": "Malware payload (AgentTesla)", "value": "fbda1992ca24a0d646d5da7eb4ff254ef758961c55d89dabc69d36e0c9f3ac9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796641, "uuid": "bf706737-19bf-423c-ab0c-6c401269c4bc", "comment": "Malware payload (AgentTesla)", "value": "e75b24be59261cdbaf0974089c8bc444de586d25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636796641, "uuid": "7556d498-d08a-4418-9347-232a39f57e26", "comment": "Malware payload (AgentTesla)", "value": "c57fb0e743e1ff5ca032b2ca4d87ee41ea9ad397f9ba877b1bc0f6052afec31aa355f91682eaead678d454316afd5524", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796641, "uuid": "f67221bc-f5b6-4624-ab6c-be51fb93caa0", "value": "T11EB4124476A44E24EBBDCEB21D63110047B99C7EAE64E22F1DE7F299327EB840152F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796641, "uuid": "e75d1204-8d32-4b2a-97e5-90d95ab2f4e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796641, "uuid": "da7331c5-9e74-4715-a89a-db995b9a6ad2", "value": "6144:lOgCGB2GhNay3Zy8IJ2JyARZ00d4EgNWrqe6NAEubAU5uWSG6B7RjgIQKdfYG0eJ:/B2iNN3ZymjDdmuEDW23sQfeFy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636796641, "uuid": "fd1e9c55-ce52-4c69-86b0-e03a55f94a89", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636796641, "uuid": "19b6fd8f-0960-4142-b280-b1d555e652a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636796641, "uuid": "ce78f679-d4bd-46dd-a929-910469e8e6e8", "value": "DHL_119040 documento de recibo de la compra,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d3bc12-44b6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1636831238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831238, "uuid": "113ac8eb-c40e-48ec-8e3d-1454073d9dca", "comment": "Malware payload (RaccoonStealer)", "value": "2901ef7ac9e8cc28cee1ddfb22462160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831238, "uuid": "2b2ac15e-a6a9-43af-933f-9d0f44fd7ca8", "comment": "Malware payload (RaccoonStealer)", "value": "fdd4f5811b2ddef82ef643bbad923e615838947ecd447a4ad08b13f675b05c40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831238, "uuid": "854f1990-d0d2-4fa0-b4ac-fc86b37f0446", "comment": "Malware payload (RaccoonStealer)", "value": "c41dd4c5407c0fd50971d0e4a2db37c1e80fe8ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636831238, "uuid": "4d0dec7d-84d4-4997-abf9-21b2e3e627c0", "comment": "Malware payload (RaccoonStealer)", "value": "9b50904b06c60fdf88902d19a6eaeafcdec7d666f77a106c88eda4a061fbb5cca638187b7114ffeada960d14efe8969f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831238, "uuid": "142de02e-d4e9-4173-98aa-375faa5748db", "value": "T162D4D100A7A1C035F1B666F959B99368B53FBEE16B2580DF23C426DA4674AE0FD30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831238, "uuid": "edbc97cc-b020-4f73-953f-1a8f81dbf104", "value": "ea99ca467492cc4d133feba5a83ca2ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831238, "uuid": "1a67816a-eb03-48a5-b1c9-059bd89a07e4", "value": "12288:8ndipBnzJDDAxShthmfJUSQSgOK7Lht+eIBdXWLTNvN:8wBNDk4UfJzVRKPhUjkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636831238, "uuid": "c3895d35-2af3-4ab3-91e4-c9a24bc52b47", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636831238, "uuid": "7fbc1ab4-271d-4ebf-a7f3-659cab571587", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636831238, "uuid": "06d3576e-0b30-44f0-b2a3-00a0c966ba27", "value": "2901ef7ac9e8cc28cee1ddfb22462160.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b016df-446e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1636800166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800166, "uuid": "5ccc0372-56b5-4262-98ec-390698be3ef2", "comment": "Malware payload (Formbook)", "value": "27d3f668c643e4fb0cb9d925ff18c1a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800166, "uuid": "1d651b27-8927-4574-ad3b-127307855427", "comment": "Malware payload (Formbook)", "value": "fe6892b3bb68851fab4ed732d6855f9c6ec6aa7d870bbcd309f52c3d54fc9fd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800166, "uuid": "36a5b7fc-a70e-4a93-ac48-c2c08fc49c01", "comment": "Malware payload (Formbook)", "value": "418afbb589e03b81235938241b102cd568969d9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636800166, "uuid": "6e7b2047-f021-4bbe-9c0f-cd6aeee876a6", "comment": "Malware payload (Formbook)", "value": "6fb194d2cf6448df740c4b166fffd46acd375ca5f4cc6ef0bb2a5f8d66469dfe7f289820a17db54b9e74aeae6ad1f398", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800166, "uuid": "340c60fc-8395-4b6d-81f7-82be4a41b0df", "value": "T125D4D09AB545C950D5290A36CCCB88E40767BE66FD11E62F38C9736F6A333E3281518F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800166, "uuid": "ee9749fe-eb87-4089-9ee0-55c19370526f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800166, "uuid": "68f6a09c-707a-4c54-85fa-fce6a118236c", "value": "12288:/FnZXRkLt1ljnYQvJ3eKmzrsgbqOFDRggxTYJ/bZb7Lt1e7oKXnz61QIb:VZitzjYQBEQg+OFdggKXtoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636800166, "uuid": "b5c15860-bb7f-40de-a1b5-cb13c5002c12", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636800166, "uuid": "e69ea8fc-d277-4a6e-a0e2-20bd3a14964b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636800166, "uuid": "df31be88-90ca-4a0f-8d73-0ba8a54875a0", "value": "27d3f668c643e4fb0cb9d925ff18c1a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a806206a-44b0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1636828606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1636828606, "uuid": "445f28e0-6b4e-4e8e-8914-04feecc41f37", "comment": "Malware payload (RedLineStealer)", "value": "2d39a43e700974dfc66e9af20c3a0422", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1636828606, "uuid": "5e9dc53c-a51b-470a-98e2-2523ebb986b6", "comment": "Malware payload (RedLineStealer)", "value": "ff90826cab0586e3c4c4787b1a079164a367efa90904ae481ca5861120429bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1636828606, "uuid": "1cf2d55f-ad5d-489d-b19c-cb530732d5f3", "comment": "Malware payload (RedLineStealer)", "value": "fa3acd80d09ac951f6ee830fa6b0b3330e061e3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1636828606, "uuid": "71c7ed6e-e435-49d0-9ead-852653d6c26f", "comment": "Malware payload (RedLineStealer)", "value": "ea41ff31f01595ec909259c3cb157b937c1796aa12a1efc803c1713dbc7e9093619b65eb90ca42b7fd42c6ad38e566ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1636828606, "uuid": "a78ba4b0-64ff-4fe1-b39a-31f96e4c93e7", "value": "T167C53343725FAC6EE11105B4DC2EC2269215DCBEA037995F3A7EBA453CE7381824DEC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1636828606, "uuid": "31d54188-180e-4acf-8728-a17ce40b7e46", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1636828606, "uuid": "fe794965-6087-44bb-af65-f53a1bef2063", "value": "49152:vRZML2mfKTtHHZz1LgWrAvcYw3USrjVAOG5oDNb9qIg6VyHh/c:JC1KRB1/AcDE8VAOTxbkv60B/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1636828606, "uuid": "a571b953-7a6c-4905-ab48-b3d993839975", "value": 2697867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1636828606, "uuid": "70821d7e-88ef-4fbb-ad7a-87b1a602839e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1636828606, "uuid": "5b6c6b02-5153-4c21-b741-b9aa016459a2", "value": "Genshin Impact v 2.1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }